vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* Although streamBody() is an asynchronous function, we do not want to call await on it, so that it does not block forward progress of the calling fetchAndStream() function. It continues to run asynchronously for as long as it has an outstanding reader.read() or writer.write() operation.
* Backpressure: We await the read operation before calling the write operation. Likewise, we await the write operation before calling the next read operation. Following this pattern propagates backpressure to the origin.
* Completion: We call writer.close() at the end, which signals to the Edge function runtime that we’re done writing this response body. After being called, streamBody() terminates — if this is undesirable, pass its returned promise to FetchEvent.waitUntil(). If your script never calls writer.close(), the body appears truncated to the runtime, though it might continue to function as intended.







 Aggregate and stream multiple requests 

This is similar to our aggregating multiple requests recipe, but this time we’ll start writing our response as soon as we’ve verified that every subrequest succeeded — no need to wait for the actual response bodies.

addEventListener('fetch', event => {
event.respondWith(fetchAndApply(event.request))
})

/
* Make multiple requests,
* aggregate the responses and
* stream it back as a single response.
/
async function fetchAndApply(request) {
const requestInit = {
headers: { "Authorization": "XXXXXX" }
}
const fetches = [
"https://api.coinbase.com/v2/prices/BTC-USD/spot",
"https://api.coinbase.com/v2/prices/ETH-USD/spot",
"https://api.coinbase.com/v2/prices/LTC-USD/spot"
].map(url => fetch(url, requestInit))

// Wait for each fetch() to complete.
The [cross-regional copy](https://cloud.ibm.com/docs/vpc?topic=vpc-backup-service-about&interface=uibackup-service-crc) can be used in disaster recovery scenarios when you need to turn on your virtual server instance and data volumes in a different region. The remote copy can be created automatically as part of a backup plan, or manually later.

With the fast restore feature, you can cache snapshots in a specified zone of your choosing. This way, volumes can be restored from snapshots nearly immediately and the new volumes operate with full IOPS instantly. The fast restore feature can achieve a

recovery time objective(RTO) quicker than restoring from a regular backup snapshot. When you opt for fast restore, your existing regional plan is adjusted, including billing. For more information about the cost of fast restore, see [Pricing](https://www.ibm.com/cloud/vpc/pricing).



 Comparison of backups and snapshots 

Backups are in effect, backup snapshots. In the console, backups appear in the list of Block Storage for VPC snapshots. Backups are identified by how they were created, in this case, by backup policy. These terms are used interchangeably in the Documentation, depending on the context.

The snapshots service is used to create backups, similarities and differences exist between backups and snapshots. Table 1 compares backups to snapshots.



Table 1. Comparison of backups and snapshots

 Feature Backup Snapshot 

 Backs up Block Storage for VPC boot and data volumes. ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/icons/checkmark-icon.svg) !
Load balancer and load balancer monitor for IBM Cloud Provider 1589 1660 Updated Alpine base image to the latest 3.14 version to resolve CVEs. Updated to use Go version 1.16.10. 
 IBM Cloud File Storage for Classic plug-in and monitor 401 402 Updated universal base image (UBI) to the 8.5-204 version to resolve CVEs. Updated to use Go version 1.16.10. 







 Change log for worker node fix pack 3.11.542_1615_openshift, released 6 December 2021 

The following table shows the changes that are in the worker node fix pack patch update 3.11.542_1615_openshift. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 3.11.542_1612_openshift

 Component Previous Current Description 

 [{rhel_short}] 7 Packages 3.10.0-1160.45 3.10.0-1160.49 Updated worker node images and kernel with package updates. Contains fixes for [CVE-2020-36385](https://nvd.nist.gov/vuln/detail/CVE-2020-36385), [CVE-2021-37750](https://nvd.nist.gov/vuln/detail/CVE-2021-37750), [CVE-2021-41617](https://nvd.nist.gov/vuln/detail/CVE-2021-41617), [CVE-2021-20271](https://nvd.nist.gov/vuln/detail/CVE-2021-20271) 







 Change log for worker node fix pack 3.11.542_1612_openshift, released 22 November 2021 

The following table shows the changes that are in the worker node fix pack patch update 3.11.542_1612_openshift. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.
Mirroring 

Mirroring enables messages in one service instance to be copied continually to a second instance, allowing disaster recovery scenarios to be implemented easily. This feature improves resilience because if a service instance becomes unavailable, applications can, without change, reconnect to the second instance and continue their normal operation, by using the same credentials, authorizations, and topic definitions. This feature is provided as a fully managed capability.

This feature is only available for service instances that use the Enterprise plan.

The current features are:



* Mirror topics and consumer groups between two Event Streams service instances.
* SLA of 99.99% availability, consistent with the Event Streams service.
* Monitoring by using IBM Cloud® Monitoring.



The current limitations are:



* Enablement and disablement are by using a support ticket.
* Unidirectional.



Before you start mirroring, consider the following points:



* For seamless switchover, applications are to follow the coding guidelines.
* [Capacity planning](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-mirroringcapacity_planning)



To enable mirroring, see [Mirroring setup guide](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-mirroring_setup).



 Mirroring overview 

Mirroring of selected topics happens between two clusters and is unidirectional, meaning data is mirrored in one direction from a single source cluster to a single target cluster. In this document, the source cluster is named A and the target cluster is named B. These cluster aliases are configurable when mirroring is enabled, so for example, they could be "us-south" and "us-east".

A topic called mytopic from the source cluster (A) appears on the target cluster (B) as mytopic.A indicating it originates from A. This type of topic is called a remote topic because it originates from the remote cluster. In contrast, any topics that are directly created on a cluster by users are called local topics.
* UI
* API







 Synchronizing associated resources 

You can initiate a manual data synchronization request between root keys and the associated cloud resources, such as IBM Cloud Object Storage buckets or Cloud Databases deployments, by using the Hyper Protect Crypto Services key management service API.

When you perform a key lifecycle action on a root key that is associated with other IBM cloud services, those IBM cloud services are notified of the key lifecycle event and are encouraged to respond. However, if the cloud services do not respond to the key lifecycle notification, use the sync API to initiate a renotification of the key lifecycle event to those associated cloud services.

For example, you might delete a root key that has an association with IBM Cloud Object Storage. After you wait for 4 hours for changes to take effect, you notice that you are still able to access the key's resources despite expecting to be blocked from accessing those resources. In this case, you need to call the sync API to renotify IBM Cloud Object Storage of the deleted key lifecycle event, so that IBM Cloud Object Storage can block access to the resources.

The sync API initiates only a request for synchronization. The IBM services that are associated with the key are responsible for managing all related associated resources and ensuring that the key state and key versions are up to date.



 Syncing associated resources with the console 

You can renotify associated resources of your Hyper Protect Crypto Services root key's lifecycle event by using the console.



1. [Log in to the IBM Cloud console](https://cloud.ibm.com/).
2. Go to Menu > Resource list to view a list of your resources.
3. From your IBM Cloud resource list, select your provisioned instance of Hyper Protect Crypto Services.
4. On the KMS keys page, use the Keys table to browse the keys in your service.
5. To renotify the protected resources of a specific root key, click the Actions icon !
* Worker node fix packs 4.8.57_1593_openshift, 4.9.56_1579_openshift, 4.10.52_1558_openshift, 4.11.28_1546_openshift, and 4.12.4_1530_openshift.
* Cluster autoscaler add-on version 1.0.6_955 and 1.0.7_956.
* Block Storage for VPC add-on versions 4.4.17_1829, 5.0.7_1836, and 5.1.2_1828.



* [3 March 2023](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift-relnotesopenshift-mar0323)



* IBM Cloud Object Storage plug-in version 2.2.10.



* [1 March 2023](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift-relnotesopenshift-mar0123)



* CLI version 1.0.498.
* Cloud Image Key Synchronizer add-on version 1.0.0_1362.





* [February 2023](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift-relnotesopenshift-feb23)



* [27 February 2023](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift-relnotesopenshift-feb2723)



* New! Red Hat OpenShift on IBM Cloud 4.12
* Master fix pack and worker node fix pack update
* Worker node fix packs 4.8.57_1590_openshift, 4.9.56_1576_openshift, 4.10.52_1556_openshift, 4.11.28_1543_openshift, and 4.12.4_1528_openshift.
The change in the file structure eliminated complexity that is related to maintaining symbolic links and should have no impact on the apps.



Updated Node.js buildpack v1.17-20150429-1033
: The Node.js buildpack now comes with [IBM SDK for Node.js v0.12.1](https://developer.ibm.com/languages/node-js/articles/download-nodejs-for-ibm-platforms/).



* If your app doesn’t specify a runtime in its package.json file, your app will now start by using v0.12.1, instead of v0.10.x. If you need to use the previous version, specify v0.10.x in your package.json as shown.

"engines": {
"node": "0.10.x"
}
* Known issues with v0.12.1:



* The Suspend feature is broken when you use the Debug Tools feature provided by IBM Cloud Live Sync.
* The mqlight module that is used for the MQ Light service is not supported on v0.12.x



* Various security vulnerabilities were resolved:



* Fixed vulnerabilities in OpenSSL affecting IBM SDK for Node.js. More details are available in the [security bulletin](https://www.ibm.com/blogs/psirt/ibm-security-bulletin-vulnerabilities-in-openssl-affect-ibm-sdk-for-node-js-in-ibm-bluemix-cve-2015-0286-cve-2015-0287-cve-2015-0288-cve-2015-0289-cve-2015-0292-cve-2015-0293-cv/).
* Fixed vulnerability in RC4 Stream Cipher affecting IBM SDK for Node.js.
It is therefore impossible to hide the existence of application channels, and their member organizations, from other members. By contrast, operating without a system channel obscures all channel names and their members from other member organizations.

Increased performance - A system channel consumes a small amount of CPU, networking and storage resources that can be instead utilized for application transactions. The capability to unjoin channels also enables optimizing ordering nodes, by recovering CPU, storage and networking resources from application channels that are no longer needed.

Enhanced channel maintenance - The channel participation APIs are lighter weight, easier to use, and deliver additional features, resulting in reduced code requirements for managing channel policies.



 Systemless orderers details 

This section, for network administrators, describes the details of an ordering service without a system channel. When a system channel is used for creating an ordering service, each ordering node receives a configuration block that is generated prior to creating the orderer container. Each ordering node gets this configuration block to bootstrap it and bring it online. By contrast, when using systemless ordering nodes this process has changed.

With no system channel, an orderer is simply created and started. It does not wait for a genesis block before becoming online. The node will be online immediately and the channel participation APIs are available to use. Once an orderer has joined a channel via a channel participation API request it will be considered either a consenter or follower of the application channel. A consenter has its TLS certificate listed in the consenters field in the channel's configuration block, which authorizes the node to participate in the ordering of transactions. A follower ordering node has joined an application channel, but is not listed in the consenters field and cannot order transactions. Follower nodes can download the ledger to enable data redundancy without additional consenter networking and communication overhead. Note that a follower orderer can always be upgraded to a consenter orderer, and vice versa, by editing the application channel's config block.

Removal of the system channel means that the legacy concept of orderering nodes belonging to a centralized group (the consortium of network organizations) is obsolete. Orderering nodes without a system channel are a much more loosely grouped entity.
* [Virtual Network Functions](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vnf-ha) in combination with a Network Load Balancers to support a high availability and scalability.
* Virtual private endpoint gateways.
* DNS resolution.



A layered architecture will introduce resources and demonstrate connectivity. Each layer will add additional connectivity and resources. The layers are implemented in Terraform. It will be possible to change parameters, like number of zones, by changing a Terraform variable. A layered approach allows the tutorial to introduce small problems and demonstrate a solution in the context of a complete architecture.



 Objectives 



* Understand the concepts behind a VPC based hub and spoke model for managing all VPC to VPC traffic.
* Understand VPC ingress and egress routing.
* Identify and optionally resolve asymmetric routing issues.
* Understand the use of a Network Load Balancer for a highly available and scalable firewall-router.
* Utilize the DNS service routing and forwarding rules to build an architecturally sound name resolution system.







 Before you begin 

This tutorial requires:



* terraform to use Infrastructure as Code to provision resources,
* python to optionally run the pytest commands,
* Implementing a firewall-router will require that you [enable IP spoofing checks](https://cloud.ibm.com/docs/vpc?topic=vpc-ip-spoofing-aboutip-spoofing-enable-check),
* An SSH key to connect to the virtual servers. If you don't have an SSH key, follow [the instructions](https://cloud.ibm.com/docs/vpc?topic=vpc-ssh-keys) for creating a key for VPC.



See the [prerequisites](https://github.com/IBM-Cloud/vpc-transitprerequisites) for a few options including a Dockerfile to easily create the prerequisite environment.

In addition:



* Check for user permissions.
node index.js -s LOGDNA_LOGHOST=logs.us-south.logging.cloud.ibm.com
node index.js

For more information about how to set up monitoring in Hyper Protect Virtual Servers, see [Monitoring logs](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-monitoring).
3. Check for logs of the configuration status from the LogDNA dashboard.

The following actions are traced by the audit log:



* 'Admin Public Key' >>> 'secure-network-admin-key'



secure-network-admin-key.read
secure-network-admin-key.create
secure-network-admin-key.update
secure-network-admin-key.delete



* 'Connection' >>> 'secure-network-connection'



secure-network-connection.add
secure-network-connection.update
secure-network-connection.delete
secure-network-connection.read



* 'Node' >>> 'secure-network-node'



secure-network-node.delete
secure-network-node.create
secure-network-node.update
secure-network-node.read

The following snippet shows an example of an audit log:

{
"action":"<hpvs service name>.secure-network-admin-key.delete",
"initiator":{
"id":token.IBMid,
"name":token.sub,
"typeURI":"service/security/account/user",
"authnId":token.IBMid,
"authnName":token.sub,
"credential":{
"type":"user"
},
"host":{
"address":"9.197.247.35",
"addressType":"IPv4",
"agent":"grpc-go/1.38.0"
}
},
Importing nodes, MSPs, and identities 

The console includes the option to import nodes that were created in another IBM® Blockchain Platform console.

Target audience: This topic is designed for network operators who are responsible for creating, monitoring, and managing the blockchain network.



 Why import components? 

For cases when components have been deployed by one console and need to be operated from other, as well as for cases when certain actions are not possible unless nodes and MSPs and identities are "known" to a console (that is, unless those components have been created in the console or imported into it), the IBM Blockchain Platform allows nodes, identities, and MSPs to be exported from one console and imported into another.

While it is no longer necessary to associate an admin identity when importing a node, there are cases where you will want to import the admin identity associated with a node or MSP.

There are two main reasons to import components:

1. A node will be deployed in one console and operated from another. In these cases, the relevant admin identity must be exported and imported, or a new admin identity for the node must be created. With the exception of upgrading the version of a node, it is possible to perform many of the same administrative actions on an imported node as on a node that was created within a console.
2. A node or MSP simply has to be known by a console so that it can be selected from a drop down list. For example, when creating a channel, it is necessary to choose which ordering service the channel will be hosted on. Similarly, when performing many channel actions, it can be necessary to specify one or more MSPs. In neither case is the person selecting the MSP an admin of the node or the organization. However, they do require the tile representing the node or MSP in their console so it can be selected from the drop down list.

Note that when you import a component, you do not actually import the physical component into your cloud provider. Instead, the console uses the information in the JSON to build a representation of the component that can be operated from the console. Likewise, when you delete an imported node from the console, the node itself, which is still running at the location where it was deployed, is not deleted.
Fixed a bug that may cause node initialization to fail when a new node reuses the name of a deleted node. 
 IBM Cloud File Storage for Classic plug-in and monitor 398 400 Updated to use Go version 1.16.7. Updated universal base image (UBI) to the latest 8.4-208 version to resolve CVEs. 
 IBM Cloud RBAC Operator 945df65 e3cb629 Updated to use Go version 1.16.7. 
 Kubernetes API server auditing configuration N/A N/A Updated to support verbose[Kubernetes API server auditing](https://cloud.ibm.com/docs/openshift?topic=openshift-health-auditaudit-api-server). 
 Load balancer and load balancer monitor for IBM Cloud Provider 1510 1547 Updated image for [CVE-2021-3711](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3711) and [CVE-2021-3712](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3712). 
 OpenShift Container Platform 4.7.23 4.7.30 See the [OpenShift Container Platform release notes](https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.htmlocp-4-7-30). 
 OpenShift Container PlatformControl Plane Operator v4.7.0-20210816 v4.7.0-20210917 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.7.0+20210917).
Kubernetes NodeLocal DNS cache Master 1.15.4 1.15.13 <br><br> * See the [Kubernetes NodeLocal DNS cache release notes](https://github.com/kubernetes/dns/releases/tag/1.15.13)<br> * Now, when you [apply the label to set up node local DNS caching](https://cloud.ibm.com/docs/containers?topic=containers-cluster_dnsdns_cache), the requests are handled immediately and you don't need to reload the worker nodes.<br> * The NodeLocal DNS cache configuration now allows customization of stub domains and upstream DNS servers.<br> * The node-local-dns daemon set is updated to include the prometheus.io/port and prometheus.io/scrape annotations on the pods.<br><br><br> 
 Load balancer and load balancer monitor for IBM Cloud Provider Master 177 208 Updated the version 2.0 network load balancers (NLB) to clean up unnecessary IPVS rules. Improved application logging. Updated image for [CVE-2020-1967](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1967).
* VPC clusters: [Allow traffic requests that are routed to NodePorts on your worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-security-group).



To use a NodePort,



1. In the configuration file for your app, define a [service](https://kubernetes.io/docs/concepts/services-networking/service/) section.

For the Guestbook example, a front-end service section exists in the configuration file. To make the Guestbook app available externally, add the NodePort type and a NodePort in the range 30000 - 32767 to the front-end service section.

Example

apiVersion: v1
kind: Service
metadata:
name: <my-nodeport-service>
labels:
<my-label-key>: <my-label-value>
spec:
selector:
<my-selector-key>: <my-selector-value>
type: NodePort
ports:
- port: <8081>
 nodePort: <31514>



Table 1. Understanding the NodePort service components

 Component Description 

 name Replace <my-nodeport-service> with a name for your NodePort service. Learn more about [securing your personal information](https://cloud.ibm.com/docs/containers?topic=containers-securitypi) when you work with Kubernetes resources. 
 labels Replace <my-label-key> and <my-label-value> with the label that you want to use for your service. 
 selector Replace <my-selector-key> and <my-selector-value> with the key/value pair that you used in the spec.template.metadata.labels section of your deployment YAML. To associate the service with the deployment, the selector must match the deployment labels. 
 port Replace <8081> with the port that your service listens on. 
 nodePort Optional: Replace <31514> with a NodePort in the 30000 - 32767 range. Do not specify a NodePort that is already in use by another service.