vania-janet/multiturn-rag-retrieval-data huggingface dataset:
The requirement to update user account credentials applies only to the following offerings: VMware vSphere, VMware vCenter Server, VMware Regulated Workloads, and Cyber Recovery.

IBM Cloud for VMware Solutions communicates with the IBM Cloud infrastructure through SoftLayer API calls. To access the SoftLayer API securely, you must link the credentials of your IBM Cloud infrastructure account to your IBM Cloud account. After your first order, you can update the user account credentials on the Settings page.



 Before you begin 



* You can link only one IBM Cloud infrastructure account to one IBM Cloud user account.
* The IBM Cloud infrastructure account that you're using must meet certain requirements. For more information, see [The IBM Cloud infrastructure account](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-signing_required_accountssigning_required_accounts-infra).
* If the API key for your IBM Cloud infrastructure account changes, you must update the key on the Settings page in the IBM Cloud for VMware Solutions console.

It is your responsibility to ensure that the API key that is saved on the Settings page is correct and up-to-date. Otherwise, operations that require API key validation might fail.







 Procedure to update user account credentials 



1. In the IBM Cloud for VMware Solutions console, click Settings from the left navigation pane.
2. If you have both an IBM Cloud infrastructure account and an IBM Cloud account that are linked, click Retrieve credentials to complete the credentials automatically, and then skip to Step 4.
3. In the following situations, review the information the IBM Cloud infrastructure credentials area for the steps that you need to take:



* If you have both an IBM Cloud infrastructure account and an IBM Cloud account that are not linked, you must link them. Follow the instructions in [Upgrading your account](https://cloud.ibm.com/docs/account?topic=account-upgrading-account), then click Retrieve credentials to complete the credentials automatically.
Enable multi-factor authentication (MFA) in your IBM Cloud account for all users.





 Define the network strategy 

In IBM Log Analysis, you can use the logging agent to collect and forward logs to your IBM Log Analysis instance. After you provision an instance of IBM® Log Analysis, you must configure a logging agent for each log source that you want to monitor.

You can configure the logging agent to connect to the logging instance through the public network or through the private network.



* By default, the agent connects through the public network.
* To connect over a private network, you must have access to classic infrastructure and [enable virtual routing and forwarding (VRF)](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint) and connectivity to service endpoints for your account.



The type of network defines the level of isolation and security that is configured to move workloads between cloud-based resources in your account.

Some factors that you must consider when you must decide which network to choose are:



* Corporate requirements on how services and applications can access cloud-based services in your account
* Security on production workloads
* Industry compliance regulations



If you require no access to Internet to connect to IBM Cloud services and isolated connectivity for workloads in your account, connect the logging agent over the private network.

Consider the following information when you work with private endpoints:



* Private endpoints are not accessible from the public internet.
* All traffic is routed to the IBM Cloud private network.
* Services like IBM Log Analysis are no longer served on an internet routable IP address.



Consider the following limitations:



* Ingestion endpoints of type syslog-tcp (syslog-a) and syslog-udp (syslog-u) are not currently supported on the Cloud Service Endpoint (CSE) network.
* The logging web UI is not currently supported on the CSE network.



If you have an additional firewall set up, or you have customized the firewall settings in your IBM Cloud infrastructure, you must allow outgoing network traffic to the IBM Log Analysis service on TCP port 443 and TCP port 80 in your firewall.
* Usage aggregated towards (AG)Solutions:(BU)Support



Account group Solutions reports

Query: https://enterprise.cloud.ibm.com/v1/resource-usage-reports?account_group_id=group-solutions&month=2019-06

This query returns two reports:



* Usage aggregated towards (AG)Solutions:(BU)Operations
* Usage aggregated towards (AG)Solutions:(BU)Support



Account group Solutions children reports

Query: https://enterprise.cloud.ibm.com/v1/resource-usage-reports?account_group_id=group-solutions&month=2019-06&children=true

This query returns four reports:



* Usage aggregated towards (AG)AI-Services:(BU)Operations
* Usage aggregated towards (AG)AI-Services:(BU)Support
* Usage aggregated towards (AG)Data-Services:(BU)Operations
* Usage aggregated towards (AG)Data-Services:(BU)Support



Account group Data-Services reports

Query: https://enterprise.cloud.ibm.com/v1/resource-usage-reports?account_group_id=group-data-services&month=2019-06

This query returns two reports:



* Usage aggregated towards (AG)Data-Services:(BU)Operations
* Usage aggregated towards (AG)Data-Services:(BU)Support



Account group Data-Services children reports

Query: https://enterprise.cloud.ibm.com/v1/resource-usage-reports?account_group_id=group-data-services&month=2019-06&children=true

This query returns two reports:



* Usage aggregated towards (A)Data-Services-Operations:(BU)Operations
* Usage aggregated towards (A)Data-Services-Support:(BU)Support



Account Data-Services-Operations report

Query: https://enterprise.cloud.ibm.com/v1/resource-usage-reports?account_id=account-data-services-operations&month=2019-06

This query returns one report: Usage aggregated towards (A)Data-Services-Operations:(BU)Operations
While this reduces the number of accounts you need, it can also become problematic because each account is subject to [quotas and service limits](https://cloud.ibm.com/docs/vpc?topic=vpc-quotas) for VPC.





 Satellite reference architecture 

For the Satellite reference architecture, we still have a test and production account. We then create one new resource group for each deployment as shown in the following diagram.

Zoom

![Using two accounts with multiple resource groups for Satellite reference architecture](https://cloud.ibm.com/docs-content/v1/content/9ac5c38b41e0aa1cb4ccc6cc7f547751ec805221/framework-financial-services/satellite/images/resource-organization/satellite-accounts-two-with-multiple-resource-groups-beta2.drawio.svg)

Figure 6. Using two accounts with multiple resource groups for Satellite reference architecture







 Managing scalability with an enterprise 



 Rationale for using an enterprise 

Unless you have a limited number of deployments and accounts, it is highly recommended that you use an [enterprise](https://cloud.ibm.com/docs/account?topic=account-what-is-enterprise). Large enterprises that allow an account structure, cross account networking, resource deployment, and billing to develop organically run the risk of encountering governance, scaling, security, and accounting issues. See [Enterprise account architecture](https://cloud.ibm.com/docs/enterprise-account-architecture?topic=enterprise-account-architecture-about) for recommendations on how to address these concerns across accounts so that a robust, compliant, and scalable solution can be achieved.





 Organizing your enterprise 

Within an enterprise, you can create multiple accounts and account groups. With this structure, you can easily manage many accounts and many deployments.



 VPC reference architecture 

The following diagram shows a single enterprise with one account group that contains separate accounts for each deployment of the VPC reference architecture.

Zoom

!
Managing logs for EU-supported resources 

Across every industry, organizations require tighter controls and visibility into where their data is stored and processed in the IBM Cloud®. To manage logs that are generated in your EU-supported account by using the IBM Log Analysis service, consider the following information:



1. You must provision IBM Log Analysis instances in the EU-DE (Frankfurt) location.
2. [You must enable your account to be EU-supported](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-manage_eu_logsmanage_eu_logs_step1), so support is handled by team members in the European Union.
3. To manage logs that are generated by EU-Supported IBM Cloud services by using the IBM Log Analysis service, you must provision 1 logging instance in the EU-DE (Frankfurt) location. Then, you must enable this logging instance to collect service platform logs.



* To manage logs from IBM Cloud services, you must provision services in the Frankfurt location.



4. To manage logs from Kubernetes clusters and VSIs that run in IBM Cloud or outside the IBM Cloud, you must configure the logging agent to forward logs to instances in Frankfurt.
5. You must restrict access to users to see and manage logs from logging instances in Frankfurt.
6. You must ensure that you archive to an EU-Supported IBM Cloud Object Storage (COS) bucket.





 Step 1. Set on the EU-Supported flag in your account 

You must enable your account to be EU-Supported so that logging instances in Frankfurt are supported by EU members.

Consider the following information when you turn on the EU-supported flag in your account:



* Support is handled by team members in the European Union (EU).
* In the event that your issue requires non-EU expert assistance, it will be reviewed and approval given prior to any non-EU intervention.
* You can filter and identify the IBM Cloud Catalog services that are EU-Supported.







 Step 2. Provision IBM Log Analysis instances in Frankfurt 

You can provision IBM Log Analysis instances in multiple [locations](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-regions).
* the JRE type, as the heap-related options for the JVM vary according to the JRE's supported options.



* The [Liberty features supported in IBM Cloud](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-liberty_features).



* Two-phase commit global database transactions are unsupported in IBM Cloud and therefore disabled by setting -Dcom.ibm.tx.jta.disable2PC=true.



* The IBM Cloud environment.

The JVM options are configured to provide optimization in an IBM Cloud environment and to aide diagnostics of memory-related error conditions.



* Fast failure and recovery of an app is configured by disabling JVM dumps options and killing of the processes when an app's memory is exhausted.
* Virtualization tuning (IBM JRE only).
* Routing of information on the app's available memory resources at the time of failure to the Loggregator.
* If an app is configured to enable JVM memory dumps, the killing of Java processes is disabled, and JVM memory dumps are routed to a common app "dumps" directory. These dumps can then be viewed from the IBM Cloud dashboard or the IBM Cloud CLI.





The following is an example default JVM configuration that is generated by the buildpack for an app that is deployed with a 512M Memory Limit:

-Xtune:virtualized
-Xmx384M
-Xdump:none
-Xdump:heap:defaults:file=../../../../../dumps/heapdump.%Y%m%d.%H%M%S.%pid.%seq.phd
-Xdump:java:defaults:file=../../../../../dumps/javacore.%Y%m%d.%H%M%S.%pid.%seq.txt
-n, --name NAME (required)
: Name of target account. This option is exclusive with --id.

--parent-account-group ACCOUNT_GROUP_NAME (required)
: Name of parent account group. This option is exclusive with --parent-account-group-id and --parent-enterprise.

--parent-account-group-id ACCOUNT_GROUP_ID (required)
: ID of parent account group. This option is exclusive with --parent-account-group and --parent-enterprise.

--parent-enterprise (required)
: Set enterprise as the parent. This option is exclusive with --parent-account-group and --parent-account-group-id.







 ibmcloud enterprise account-show 

Display details of an account.

ibmcloud enterprise account-show (-n, --name NAME | --id ID)



 Command options 

--id ID (required)
: ID of the account. This option is exclusive with -n, --name.

-n, --name NAME (required)
: Name of the account. This option is exclusive with --id.







 ibmcloud enterprise accounts 

List accounts.

ibmcloud enterprise accounts [--parent-account-group ACCOUNT_GROUP_NAME | --parent-account-group-id ACCOUNT_GROUP_ID] [--recursive]



 Command options 

--parent-account-group ACCOUNT_GROUP_NAME (optional)
: Name of the parent account group. This option is exclusive with --parent-account-group-id.

--parent-account-group-id ACCOUNT_GROUP_ID (optional)
: ID of the parent account group. This option is exclusive with --parent-account-group.

--recursive (optional)
: Show descendant accounts.







 ibmcloud enterprise account-import 

Import a stand-alone account.

ibmcloud enterprise account-import (--account-id ID) [--parent-account-group ACCOUNT_GROUP_NAME | --parent-account-group-id ACCOUNT_GROUP_ID]



 Command options
* You must also have a billable account.



To enable your IBM Cloud account to use virtual routing and forwarding (VRF) and service endpoints, see [Enabling VRF and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint).





 Considerations for private network connections 



* Private domain names aren't used by the container-registry CLI plug-in. If you push an image on the private domain name, and then use the CLI on a public connection to run the ibmcloud cr images command, the image is listed with all the other images that have the same public domain name.
* If you have private IBM Cloud Kubernetes Service clusters, you aren't required to change anything. IBM Cloud Kubernetes Service already modifies the connection, which is referenced by the public domain name, to use a private connection. This behavior is unchanged.



* If you use IBM Cloud Kubernetes Service, you can optionally reference your images from private clusters by using the private registry domain name. However, you must create more imagePullSecrets for the extra domain names, see [Understanding how to authorize your cluster to pull images from a registry](https://cloud.ibm.com/docs/openshift?topic=openshift-registrycluster_registry_auth).



* Pull traffic is not charged for image pulls that use private connections.
* If you use [image signing](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_trustedcontent) and want to use the private domain names, you must re-sign any images that you already have because the domain name forms part of the signed artifact.







 Pushing and pulling images 

Private connections are available so that you can push and pull images. You use the same icr.io domain name, with the prefix private., see [Regions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_regions).

You can't use private connections for image management operations by using the IBM Cloud Container Registry CLI.
You can't manage worker nodes for your cluster, and you receive an error message similar to one of the following examples.

Unable to connect to the IBM Cloud account. Ensure that you have a paid account.

can't authenticate the infrastructure user: Time-based One Time Password authentication is required to log in with this user.

 Why it’s happening 

Your IBM Cloud account uses its own automatically linked infrastructure through a Pay-as-you-Go account.

However, the account administrator enabled the time-based one-time passcode (TOTP) option so that users are prompted for a time-based one-time passcode (TOTP) at login. This type of [multifactor authentication (MFA)](https://cloud.ibm.com/docs/account?topic=account-typesaccount-based) is account-based, and affects all access to the account. TOTP MFA also affects the access that IBM Cloud Kubernetes Service requires to make calls to IBM Cloud infrastructure. If TOTP is enabled for the account, you can't create and manage clusters and worker nodes in IBM Cloud Kubernetes Service.

 How to fix it 

The IBM Cloud account owner or an account administrator must take one of the following actions.



* Disable TOTP for the account, and continue to use the automatically linked infrastructure credentials for IBM Cloud Kubernetes Service.
* Continue to use TOTP, but create an infrastructure API key that IBM Cloud Kubernetes Service can use to make direct calls to the IBM Cloud infrastructure API.





 Disabling TOTP MFA for the account 



1. Log in to the [IBM Cloud console](https://cloud.ibm.com/). From the menu bar, select Manage > Access (IAM).
2. Click the Settings page.
3. Under Multifactor authentication, click Edit.
4. Select None, and click Update.







 Using TOTP MFA to create an infrastructure API key for IBM Cloud Kubernetes Service 



1. From the [IBM Cloud](https://cloud.ibm.com/) console, select Manage > Access (IAM) > Users and click the name of the account owner.
For more information, see [Centrally managing billing and usage with enterprises](https://cloud.ibm.com/docs/billing-usage?topic=billing-usage-enterprise).
* Can I remove my account from an enterprise?

After you import your account into an enterprise, you can't remove it.
* Can I move an account within an enterprise?

Yes, you can move your account anywhere within an enterprise. For example, you can move your account directly under the enterprise or from one account group to another. For more information, see [Moving accounts within the enterprise](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-enterprise-organize).
* Can I move an account group?

No, it’s not possible to move an account group within the enterprise.
* Can I edit an account name from within the enterprise?

No, you can't edit the name of an account from within your enterprise. To edit the name of an account, go to Manage > Account in the IBM Cloud console, and select Account settings. In the Account section, click the Edit icon ![Edit icon](https://cloud.ibm.com/icons/edit-tagging.svg), enter your new account name, and click Submit.
* Can I invite users to an enterprise?

To invite users to an enterprise, you must have an IBM Cloud Identity and Access Management (IAM) access policy with the Editor or higher role on the User Management service. For more information, see [Inviting users](https://cloud.ibm.com/docs/account?topic=account-iamuserinvinvitations).
* Can my child account have a different subscription currency than my enterprise account?

No, billing and subscriptions are managed at the enterprise level rather than at the child account level. Your child account cannot have a different subscription. For more information about enterprise billing, see [Billing options](https://cloud.ibm.com/docs/billing-usage?topic=billing-usage-enterprise&interface=uienterprise-billing-options).
* Can I change the domain for my enterprise account?

Yes, domains can be updated.
curl -X PATCH "https://enterprise.cloud.ibm.com/v1/account-groups/$ACCOUNT_GROUP_ID" -H "Authorization: Bearer <IAM_Token>" -H 'Content-Type: application/json' -d '{
"primary_contact_iam_id": "enterpriseAccountIamId"
}'

UpdateAccountGroupOptions updateAccountGroupOptions = new UpdateAccountGroupOptions.Builder()
.accountGroupId(accountGroupId)
.name("Updated Example Account Group")
.primaryContactIamId(enterpriseAccountIamId)
.build();

Response<Void> response = service.updateAccountGroup(updateAccountGroupOptions).execute();

response = enterprise_management_service.update_account_group(
account_group_id=account_group_id,
name='Updated Example Account Group',
primary_contact_iam_id=enterprise_account_iam_id,
)

updateAccountGroupOptions := enterpriseManagementService.NewUpdateAccountGroupOptions(
accountGroupID,
)
updateAccountGroupOptions.SetName("Updated Example Account Group")
updateAccountGroupOptions.SetPrimaryContactIamID(enterpriseAccountIamID)

response, err := enterpriseManagementService.UpdateAccountGroup(updateAccountGroupOptions)
if err != nil {
panic(err)
}

const params = {
accountGroupId: accountGroupId,
name: 'Updated Example Account Group',
primaryContactIamId: enterpriseAccountIamId,
};

enterpriseManagementService.updateAccountGroup(params)
.then(res => {
done();
})
.catch(err => {
console.warn(err)
});
Depending on [your account settings](https://cloud.ibm.com/docs/account?topic=account-service-endpoints-overview), you can use public or private endpoints to manage categories programmatically. For information about endpoints per region, see [API endpoints](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-endpointsendpoints_api).





 Authentication 

When you manage categories programmatically, you must use a service key. Authorization to the logging configuration API is enforced by using a service key.

A service key is a unique code that is passed in an API request to identify the calling application or user. The service key is specific to a logging instance. For more information on how to generate a service key, see [Managing service keys](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-service_keys).

Use of the logging configuration REST API is done by adding a valid service key to the HTTP Authorization request header. You must pass the service key as a header parameter (-H) of your requests.

For example, in a cURL request, you must set the content-type header as follows:

-H 'servicekey: <SERVICE_KEY>'





 Body parameters 

The following field is body parameter that you can set in the API request:



 name (string) 

Specifies the name of the category to be created.

The following table indicates when the name parameter is required:



Table 2. Required status per method

 Action Request Field required 

 Create a new category for a given type. POST ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/checkmark-icon.svg) 
 Modify a category UPDATE !
(Optional) Check whether your account is enabled for VRF and service endpoints.

ibmcloud account show

The following CLI output shows the account details of a VRF and service endpoint-enabled account.

Retrieving account John Doe's Account of john.doe@email.com...
OK

Account ID: d154dfbd0bc2edefthyufffc9b5ca318
Currently Targeted Account: true
Linked Softlayer Account: 1008967
VRF Enabled: true
Service Endpoint Enabled: true

For more information about enabling VRF and service endpoints in your account, see [Enabling VRF and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint).
4. Create a private Secrets Manager service instance by running the following command.

ibmcloud resource service-instance-create <instance_name> secrets-manager lite <region> -p '{"allowed_network": "<connectivity-option>"}'



Table 1. Variable descriptions

 Variable Description 

 region The region abbreviation, such as us-south that represents the geographic area where you want your Secrets Manager to be handled and processed. For a complete list of supported regions, see [Regions and endpoints](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-endpoints). 
 connectivity-option The network connectivity option that you want to allow for your instance.<br><br>To allow access to the instance over both public and private service endpoints, use public-and-private. To limit API requests to the instance to take place only through a private network, use private-only. Keep in mind that the Secrets Manager service UI is not accessible for private-only instances. 



5. (Optional) Verify that that the service instance was created successfully.

ibmcloud resource service-instance <instance_name>

Provisioning a Secrets Manager instance can take 5 - 15 minutes to complete.







 Viewing your endpoint URLs 

The service endpoint URLs are different for private and public network connections.