vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* If you want to use a private repository, you must [create a secret](https://cloud.ibm.com/docs/satellite?topic=satellite-satcon-manage-gitopscreate-satconfig-private-secret) on the target cluster that contains a personal access token with at least read access to your private repository.





 Creating a secret for using a private repository 

To connect to private repositories, you must create and apply a git personal access token to your clusters.



1. Create a Github or Gitlab token.



* For Github, [create a personal access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens). When you create the token, grant it repo scope so that it can read from private repositories. You can also create a [machine user](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/managing-deploy-keysmachine-users) and bind your personal access token to the machine user.
* For Gitlab, [create a personal token](https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html) or [create a deploy token](https://docs.gitlab.com/ee/user/project/deploy_tokens/).



2. Encode the token to base64.

printf "TOKEN_FROM_GITHUB_OR_GITLAB" | base64
3. For each cluster that you want to use, log in to the cluster and create a secret named razee-git in the razeedeploy namespace by applying the following YAML file:

apiVersion: v1
data:
token: [BASE64_ENCODED_TOKEN_FROM_GITHUB_OR_GITLAB]
kind: Secret
metadata:
name: razee-git
namespace: razeedeploy
type: Opaque
[_security](https://cloud.ibm.com/apidocs/cloudantgetsecurity) 



The nature of the access that is granted depends on the specific API endpoint. For example, the _design role provides access that allows a user or [API key](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-work-with-your-accountcreating-api-keys) to create, read, modify, or delete design documents. If you grant access this way, the advantage is that you're not required to assign the more widely applicable _reader or _writer roles. This distinction is useful because otherwise the authorized account might read from or write to documents within the database, other than the design documents.

The credentials that you use to log in to the dashboard automatically have the _admin role for all databases you create. Everyone and everything else, including users that you share databases with, and API keys you create, must be given a role explicitly to do corresponding tasks.

The special nobody username applies for anyone or any application that tries to do tasks, but that didn't authenticate with the system. In other words, the nobody username applies to all unauthenticated connection attempts. For example, if an application tries to read data from a database, but didn't identify itself, the task can continue only if the nobody user has the role _reader.

It's possible to grant more powerful roles to an unauthenticated user than to an authenticated user. For example, if the nobody username is intentionally granted _admin, _reader, and _writer roles, but an authenticated user account such as alexone is granted only the _reader role. In this case, it's possible that an unauthenticated user might have a more powerful role than the authenticated alexone user.

It's important to understand that the nobody username is not a way of supplying a default set of permissions. Instead, the nobody username is used to determine permissions for unauthenticated users.



 Determining the role to assign 

First, determine the role or roles to assign to a user account or API key.
* [You can use private network connections to securely route your data in Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes16apr2020_private_network)
* [ibmcloud cr private-only command is available](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes16apr2020_private)



* [3 February 2020](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-3feb2020)



* [Using Container Registry tokens is deprecated](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes3feb2020_tokens)



* [31 January 2020](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-31jan2020)



* [ibmcloud cr image-digests command is available](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes31jan2020_digests)



* [4 December 2019](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-4dec2019)



* [Support for Red Hat signatures is available](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes4dec2019_signatures)



* [25 October 2019](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-25oct2019)



* [IBM Log Analysis platform services logs are available](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes25oct2019_logs)



* [14 October 2019](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-14oct2019)
Therefore, any built-in integrations you add to your assistant will have public endpoints. If you only want to connect to a client application or messaging channel over the private network, then you must build your own custom client application or channel integration.
* Before you can use a search integration or search skill, you must create a Discovery instance with a private network endpoint. The list of Discovery instances that are displayed for you to connect to includes only instances with private network endpoints.









 Related topics 



* [Security architecture](https://www.ibm.com/cloud/architecture/architecture/practices/watson-security-architecture/): Describes the security components that are needed for secure cloud development, deployment, and operations.
* [IBM Cloud compliance programs](https://www.ibm.com/cloud/compliance): Describes how to manage regulatory compliance and internal governance requirements with IBM Cloud services.
* To get information about private endpoints, see [Private endpoints](https://cloud.ibm.com/docs/monitoring?topic=monitoring-endpointsendpoints_ingestion_private).
* To get information about public endpoints, see [Public endpoints](https://cloud.ibm.com/docs/monitoring?topic=monitoring-endpointsendpoints_ingestion_public).







 Access to the web UI through a public endpoint 

To access the IBM Cloud Monitoring web UI, you may need to define a firewall rule in your host. To get information about the web UI endpoints, see [Web UI endpoints](https://cloud.ibm.com/docs/monitoring?topic=monitoring-endpointsendpoints_sysdig).





 Alert Notifications via Webhooks 

To receive alert notifications by using webhooks from the Monitoring service, you may need to define firewall rules for the subnets that are invoking your webhooks. To get information about the subnets, see [Subnets for webhook notifications](https://cloud.ibm.com/docs/monitoring?topic=monitoring-endpointsendpoints_network_alert_subnets).
"description": "Extended description for my secret.",
"downloaded": false,
"id": "40000df-4000-300c-c01028-6ff20000dbd",
"labels": [
"dev",
"us-south"
],
"last_update_date": "2022-01-25T19:22:59Z",
"name": "test-kv-secret",
"secret_data": {
"payload": {
"key1": "value1"
}
},
"secret_type": "kv",
"state": 1,
"state_description": "Active",
"versions": [
{
"created_by": "iam-ServiceId-9ca407-f38d-000e-0b02-ed6b41",
"creation_date": "2022-01-25T19:22:59Z",
"downloaded": false,
"id": "40000df-4000-300c-c01028-6ff20000dbd",
"payload_available": true
}
],
"versions_total": 1
},
"wrap_info": null,
"warnings": null,
"auth": null
}

A request to create key-value secrets in an existing secret group returns the following response:

{
"request_id": "a0766ef6-5bfe-d92d-4894-6d3f40126b25",
"lease_id": "",
"renewable": false,
"lease_duration": 0,
"data": {
"created_by": "iam-ServiceId-9ca24407-f38d-479e-8b02-ed6b4e1b0d31",
"lease_id": "",
"renewable": false,
"lease_duration": 0,
"data": {
"created_by": "iam-ServiceId-c0c7cfa4-b24e-4917-ad74-278f2fee5ba0",
"creation_date": "2021-06-04T02:55:40Z",
"crn": "crn:v1:bluemix:public:secrets-manager:us-south:a/a5ebf2570dcaedf18d7ed78e216c263a:0f4c764e-dc3d-44d1-bd60-a2f7cd91e0c0:secret:ea1907c8-8c8e-6b83-3c20-05f2015b80d8",
"description": "Extended description for my secret.",
"expiration_date": "2030-04-01T09:30:00Z",
"id": "ea1907c8-8c8e-6b83-3c20-05f2015b80d8",
"labels": [
"dev",
"us-south"
],
"last_update_date": "2021-06-04T02:55:40Z",
"name": "test-arbitrary-secret",
"secret_type": "arbitrary",
"state": 1,
"state_description": "Active"
},
"wrap_info": null,
"warnings": null,
"auth": null
}

A request to retrieve the metadata of a kv secret returns the following response:

{
"request_id": "0a0000e-0a0f-edfh-000a-ec2000ab00",
"lease_id": "",
"renewable": false,
"lease_duration": 0,
"id": "0767-064498f3-4df5-4fa5-b2ed-de5a3bfea024",
"href": "https://us-east.iaas.cloud.ibm.com/v1/subnets/0767-064498f3-4df5-4fa5-b2ed-de5a3bfea024",
"crn": "crn:v1:bluemix:public:is:us-east-2:a/be636a7a6e4d4b6296bedf669ce8f757::subnet:0767-064498f3-4df5-4fa5-b2ed-de5a3bfea024",
"name": "lb-subnet"
}
],
"resource_group": {
"id": "42c4f51adc3147b4b4049ad9826c30a1",
"href": "https://resource-controller.cloud.ibm.com/v1/resource_groups/42c4f51adc3147b4b4049ad9826c30a1",
"name": "Default"
},
"resource_type": "load_balancer",
"logging": {
"datapath": {
"active": false
}
},
"profile": {
"href": "https://us-east.iaas.cloud.ibm.com/v1/load_balancer/profiles/dynamic",
"name": "dynamic",
"family": "Application"
},
"security_groups": [
{
"id": "r014-b739c959-fb3c-44cc-9ec5-41c45b4d637e",
To learn how to configure your Secrets Manager instance to use private endpoints, see [Securing your connection to Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-service-connection).



Table 2. Private endpoints for interacting with Secrets Manager by using the native Vault APIs

 Region Endpoint URL 

 Dallas https://{instance_ID}.private.us-south.secrets-manager.appdomain.cloud 
 Frankfurt https://{instance_ID}.private.eu-de.secrets-manager.appdomain.cloud 
 London https://{instance_ID}.private.eu-gb.secrets-manager.appdomain.cloud 
 Osaka https://{instance_ID}.private.jp-osa.secrets-manager.appdomain.cloud 
 Sao Paulo https://{instance_ID}.private.br-sao.secrets-manager.appdomain.cloud 
 Sydney https://{instance_ID}.private.au-syd.secrets-manager.appdomain.cloud 
 Tokyo https://{instance_ID}.private.jp-tok.secrets-manager.appdomain.cloud 
 Toronto https://{instance_ID}.private.ca-tor.secrets-manager.appdomain.cloud 
 Washington DC https://{instance_ID}.private.us-east.secrets-manager.appdomain.cloud 







 Viewing your endpoint URLs 

You can find your service endpoint URLs in the Endpoints page of the Secrets Manager UI. If you need to retrieve your service endpoint URLs programmatically, you can also call the following API to retrieve the values that are specific to your Secrets Manager instance.

curl -X GET
-H "Accept: application/json" -H "Authorization: Bearer {IAM_token}"
"https://{region}.secrets-manager.cloud.ibm.com/api/v1/instances/{url_encoded_instance_CRN}/endpoints"

Replace the variables in the example request according to the following table.



Table 3.
Retrieve the contents of your IAM credential secret.

ibmcloud secrets-manager secret --id $SECRET_ID --output json

The following JSON snippet shows the example response.

{
"metadata": {
"collection_type": "application/vnd.ibm.secrets-manager.secret+json",
"collection_total": 1
},
"resources": [
{
"access_groups":
"AccessGroupId-e7e1a364-c5b9-4027-b4fe-083454499a20"
],
"api_key": "pVTL3W7o1uqIWSE8sSh8ebNhRN4-d1D0W9GcPVgwcLUr",
"created_by": "iam-ServiceId-222b47ab-b08e-4619-b68f-8014a2c3acb8",
"creation_date": "2020-12-15T14:31:42Z",
"crn": "crn:v1:bluemix:public:secrets-manager:us-south:a/a5ebf2570dcaedf18d7ed78e216c263a:f1bc94a6-64aa-4c55-b00f-f6cd70e4b2ce:secret:cb7a2502-8ede-47d6-b5b6-1b7af6b6f563",
"description": "Extended description for my secret.",
"labels":
"storage",
"us-south"
],
"last_update_date": "2020-12-15T14:31:42Z",
"name": "test-iam-credentials",
"secret_group_id": "432b91f1-ff6d-4b47-9f06-82debc236d90",
},
"wrap_info": null,
"warnings": null,
"auth": null
}

A request to retrieve a key-value secret in an existing secret group returns the following response:

{
"request_id": "a0000c-e00-000ef-d000e8-a68e60000",
"lease_id": "",
"renewable": false,
"lease_duration": 0,
"data": {
"created_by": "Id-000000",
"creation_date": "2022-01-26T20:11:29Z",
"crn": "crn:v1:bluemix:public:secrets-manager:eu-gb:a/4b0000a6bbe:5f1a3554-5f59-4164-8bfc-5e0000000cf66:secret:e006e8bc-f497-dc93-4102-9d0000001",
"description": "Extended description for my secret.",
"downloaded": true,
"id": "e00000c-f0000-d0003-00002-9d9cf2000001",
"labels": [],
"last_update_date": "2022-01-26T20:11:29Z",
"name": "test-kv-secret-from-group",
"secret_data": {
"payload": {
"key5": "value5"
}
},
"secret_group_id": "0000ffd-da17-c0000-eb0000-600000002",
"secret_type": "kv",
"state": 1,
"state_description": "Active",
"versions": [
{
"created_by": "Id-0000000",
ID 38ef87e9-3a4d-4d72-8450-86c16b76ae0d
Name my-tpl-1
CRN crn:v1:bluemix:public:is:us-south-1:a/7f75c7b025e54bc5635f754b2f888665::instance-template:38ef87e9-3a4d-4d72-8450-86c16b76ae0d
Resource group Default
Image c5471ef3-15f5-4468-964b-f9b4d3ca8120
VPC dd1c6831-cc4d-4c40-aab2-6b0c17f41424
Zone us-south-1
Profile bx2-2x8
Metadata service Enabled
false

Keys Key IDs
e7d18039-0e0e-4207-8598-de7cca949030

Boot volume Name Capacity Profile IOPS Attachment name Auto delete Tags
my-boot-vol-1 100 general-purpose 0 boot-vol-1 true env:test1,env:dev1

Data volumes ID Name Capacity Profile IOPS Attachment name Auto delete Tags
- my-vol-1 10 general-purpose 0 my-vol-att false env:test1,env:dev1

Primary Network Interface Name Subnet ID Security Groups Allow source IP spoofing Reserved IP Address Reserved IP ID Reserved IP Name Reserved IP Auto Delete
primary 0617-c1f1e468-3283-4f44-9d08-3d57b77817f1 7c2db5ac-19e0-4d83-8226-e6178fedfe56 false - - - -

Created 2022-08-22T09:10:34+05:30

Use the instance template to create an instance and volumes with user tags. See the following example.
If your allowlist is IP-based, you can see which IP addresses are opened when you allow access to the service endpoint URLs by reviewing [this table](https://cloud.ibm.com/docs/containers?topic=containers-firewallmaster_ips).
6. Verify your connection.



* If the public cloud service endpoint is enabled:

curl --insecure <public_service_endpoint_URL>/version

Example command

curl --insecure https://c3.<region>.containers.cloud.ibm.com:31142/version

Example output

{
"major": "1",
"minor": "7+",
"gitVersion": "v1.7.4-2+eb9172c211dc41",
"gitCommit": "eb9172c211dc4108341c0fd5340ee5200f0ec534",
"gitTreeState": "clean",
"buildDate": "2017-11-16T08:13:08Z",
"goVersion": "go1.8.3",
"compiler": "gc",
"platform": "linux/amd64"
}
* If only the private cloud service endpoint is enabled, you must be in your IBM Cloud private network or connect to the private network through a VPN connection to verify your connection to the master. Note: You must [expose the master endpoint through a private load balancer](https://cloud.ibm.com/docs/containers?topic=containers-access_clusteraccess_private_se) so that users can access the master through a VPN or IBM Cloud® Direct Link connection.

curl --insecure <private_service_endpoint_URL>/version

Example command

curl --insecure https://c3-private.<region>.containers.cloud.ibm.com:31142/version

Example output

{
"major": "1",
It can contain only unreserved characters as defined by section 2.3 of [RFC3986](https://datatracker.ietf.org/doc/html/rfc3986). The authentication token for the signature key is passed to a GET /keys request in the HTTP Authorization request header.

This request returns the base64 encoded public key. The following is an example of the response body:

{
"publickey": "<base64 encoded string of public key (ASN.1 DER encoded struct containing integer X and integer Y)>"
}
* POST /sign/:name

This requests the signing service to sign the input data by using the signature key identified by the :name parameter. The :name parameter is appended to the URL that accesses the signing service. It can contain only unreserved characters as defined by section 2.3 of [RFC3986](https://datatracker.ietf.org/doc/html/rfc3986). The authentication token for the signature key is passed to a POST /sign request in the HTTP Authorization request header.

The request body contains the input data to be signed. Requests created by TKE CLI plug-in and Terraform commands also include a parameter that identifies SHA-512 as the hash algorithm to be used when generating the signature. The following is an example of the request body:

{
"hash_algorithm":"sha2-512",
"input":"<base64 encoded string of data to be signed>"
}

This request returns the signature that is generated over the input data using the specified signature key. The following is an example of the response body:

{
"signature": "<base64 encoded string of binary data (ASN.1 DER encoded struct of integers R and S)>"
}







 Configuring the TKE CLI plug-in to use the signing service 

Instead of using signature key files that are stored on your workstation for signing commands, configure the TKE CLI plug-in to use signature keys that are provided by your signing service by completing the following steps:



1.
* UI
* CLI
* API
* Terraform







 VPC considerations when using custom images in a private catalog 

If you plan to share or publish a custom image to other accounts within your enterprise, you need to create a private catalog. A private catalog provides a way for you to manage access to products for multiple accounts while those accounts are within the same enterprise. You can share any existing x86 virtual server custom image with a private catalog, except for an encrypted image.

On the console, you can find custom images in a private catalog by clicking Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/icons/icon_hamburger.svg) > VPC Infrastructure > Compute > Images > Catalog images.

For more information about private catalogs, see the tutorial [Onboarding a virtual server image for VPC](https://cloud.ibm.com/docs/account?topic=account-catalog-vsivpc-tutorial&interface=ui).

Custom images can also be published to the IBM Cloud® catalog and to other (nonenterprise) accounts. This process requires onboarding to the [IBM Cloud® Partner Center](https://cloud.ibm.com/partner-center/sell).



 Prerequisites and limitations 

Before you can import a custom image into a private catalog, the following items must be completed.



* Create a private catalog
* Create and import the custom image into IBM Cloud VPC



Custom images in a private catalog have the following restrictions:



* Must be an x86 image
* Can't be encrypted
* Can't be used with a bare metal profile
* Can exist in only one version of one catalog product offering in one private catalog at a time
* Must be in available status







 Using cross-account image references in a private catalog in the UI 

Instances you provision belong to your account. Images shared to your account through a private catalog might belong to other accounts.
Get a trusted profile by name or ID:

ibmcloud iam trusted-profile NAME|ID [--id | --output FORMAT] [-q, --quiet]



 Command options 

NAME|ID (required)
: Name or ID of the profile.

--id
: Show ID of the profile only.

--output FORMAT
: Specify output format. Only 'JSON' is supported.

-q, --quiet
: Suppress verbose output.





 Examples 

Retrieve trusted profile with name sample-test:

ibmcloud iam trusted-profile sample-test

Retrieve trusted profile with profile ID Profile-cb258cb9-8de3-4ac0-9aec-b2b2d27ac976:

ibmcloud iam trusted-profile Profile-cb258cb9-8de3-4ac0-9aec-b2b2d27ac976







 ibmcloud iam trusted-profiles 

List trusted profiles under current account

ibmcloud iam trusted-profiles [--id | --output FORMAT] [-q, --quiet]



 Command options 

--id
: Show ID of profiles only.

--output FORMAT
: Specify output format. Only 'JSON' is supported.

-q, --quiet
: Suppress verbose output.





 Examples 

List ID of all trusted profiles under current account:

ibmcloud iam trusted-profiles --id







 ibmcloud iam trusted-profile-update 

Update a trusted profile

ibmcloud iam trusted-profile-update NAME|ID [-n, --name NEW_NAME] [-d, --description NEW_DESCRIPTION] [--output FORMAT] [-f, --force] [-q, --quiet]



 Command options 

NAME|ID (required)
: Name or ID of the profile to update.

-n, --name NEW_NAME
: New name of the trusted profile.

-d, --description NEW_DESCRIPTION
: New description of the profile. Providing an empty description will clear the description of the profile.
"fingerprint": "SHA256:RJ+YWs3rupwGFiJuLqY43tvmdeLOUjcIc9cA6IR8n8E",
"id": "dadae729-1d81-4a13-966e-f5d92699f103",
"name": "my-key1",
"resource_type": "key"
}
],
"user_data": "Content-Type: multipart/form-data; boundary=3efa30189c9e0e8ebc24a4decbbf4c2be7b26120c1cdd7cb7bc2ecb0c07cnMIME-Version: 1.0nn--3efa30189c9e0e8ebc24a4decbbf4c2be7b26120c1cdd7cb7bc2ecb0c07cnContent-Type: text/cloud-confignncloud-configndisable_root: falsenchpasswd:n list: |n root:genes1sn expire: falsenusers:n- defaultn- name: rootn lock-passwd: falsen ssh_pwauth: truenn--3efa30189c9e0e8ebc24a4decbbf4c2be7b26120c1cdd7cb7bc2ecb0c07c--"
}
Show more





 Retrieve instance information 

Make a GET "http://169.254.169.254/metadata/v1/instance" call to retrieve detailed information about the instance. To tailor information for specific instance details, such as network interfaces, see [Extra instance metadata endpoints](https://cloud.ibm.com/docs/vpc?topic=vpc-imd-get-metadataimd-additional-inst-metadata).
As long as the new smart contract code addresses the data in a compatible way (by adding new JSON fields and not changing the semantics or type of the existing fields), any subsequent version of the smart contract can run against the data from a prior version.
3. What happens to my peers if I forget to upgrade them to the latest version before updating the smart contract on the channel?

After updating the channel to use the new version of the smart contract, if there are still peers on the channel running the previous version, those peers are no longer able to endorse transactions for the smart contract. Also, you risk not having enough endorsements for transactions to be committed to the ledger, depending on how the smart contract endorsement policy is defined. However, it is possible to install the new version of the smart contract on these peers later and they will again be able to endorse transactions, effectively catching up.
4. What happens when I remove an organization from my private data collection?

The peers in that organization continue to store data in the private data collection until its ledger reaches the block that removes its membership from the collection. After that occurs, the peers will not receive private data in any future transactions, and clients of that organization will no longer be able to query the private data using a smart contract from any peer.









 Private data 

Private data is a feature of Hyperledger Fabric networks at version 1.2 or higher and is used to keep sensitive information private from other organization members on a channel. Data privacy is achieved by using [private data collections](https://hyperledger-fabric.readthedocs.io/en/release-1.4/private-data/private-data.htmlwhat-is-a-private-data-collection). For example, several wholesalers and a set of farmers might be joined to a single channel. If a farmer and a wholesaler want to transact privately, they can create a channel for this purpose. But they can also decide to create a private data collection on the smart contract that governs their business interactions to maintain privacy over sensitive aspects of the sale, such as the price, without having to create a secondary channel.