vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* The CIS domain was created via a CIS partner (for example, a hosting provider) and the provider's DNS failed.



Error 1018 is returned via an HTTP 409 response code.



 Resolution 

Contact Support with the following details:



* Your domain name
* A screenshot of the 1018 error including the RayID mentioned in the error message
* The time and timezone the 1018 error occurred









 Error 1019: Compute server error 

A common cause of error 1019 is when a CIS Edge function script recursively references itself.



 Resolution 

Ensure your CIS Edge function does not access a URL that calls the same Edge function script.







 Error 1020: Access denied 

A common cause of an error 1020 is when a client or browser is blocked by a CIS customer’s firewall rules.



 Resolution 

If you are not the website owner, provide the website owner with a screenshot of the 1020 error message you received.

If you are the website owner:



1. Retrieve a screenshot of the 1020 error from your customer
2. Search the Firewall Events Log within the Overview tab of your Firewall app for the RayID or client IP Address from the visitor’s 1020 error message.
3. Convert the UTC timestamp of the 1020 error to your local timezone when searching in the Firewall Events Log.
4. Assess the cause of the block and either update the Firewall Rule or allow the visitor’s IP address in IP Access Rules.









 Error 1023: Could not find host 

Common causes of an error 1023 are:



* If the owner just signed up for CIS it can take a few minutes for the website's information to be distributed to our global network.
* Something is wrong with the site's configuration. Usually, this happens when accounts have been signed up with a partner organization (for example, a hosting provider) and the provider's DNS fails.



Error 1023 is returned via a HTTP 409 response code.



 Resolution 

Contact Support with the following details:



* Your domain name
* A screenshot of the 1023 error including the RayID mentioned in the error message
* The time and timezone the 1023 error occurred
Select OK to finish the certificate installation to your server.
9. Bind the certificate to your website. Select your website by expanding Sites under your server's name in the menu under Connections in the IIS Manager. Select Bindings under Edit Site from the Actions menu. Select Add from the Site Bindings window and submit the following information.

Type https
IP Address All Unassigned
Port 443
SSL Certificate your_cert_friendly_name
10. Optionally, configure your SSL certificate to use Server Name Indication (SNI) if you have multiple sites using SSL bound to the same IP address. Select the Require Server Name Indication box.
11. Your website is now configured to accept secure connections.









 Revoking an origin certificate 

Delete your CIS origin certificate. This process cannot be undone.
For cross instance redundancy, when the first secondary vCenter Server instance is added to an existing primary or stand-alone vCenter Server instance, that primary instance AD DNS server IP address is used in the secondary vCenter Server instance and in any subsequent secondary vCenter Server instance “secondary DNS” entry for all components that require a DNS server entry.

For example, ESXi, vCenter, and NSX Manager, and also add-on components, such as, HCX, Zerto, and Veeam. The primary site secondary DNS entry is then changed to the first secondary vCenter Server instances AD/DNS IP address.







 NTP services 

This design uses the IBM Cloud infrastructure NTP servers. All deployed components are configured to use these NTP servers. It is critical that all components within the design use the same NTP server is critical for certificates and Active Directory authentication to function correctly.

Zoom

![NTP and DNS services](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/vcsv4radiagrams-ra-servicesinterconnections.svg)

Figure 2. NTP and DNS services





 Certificate authority services 

By default, VMware vSphere® uses TLS certificates that are signed by the VMware certificate authority (VMCA), located on the VMware Platform Services Controller (PSC) appliance. These certificates are not trusted by the user devices or browsers. It is a security best practice to replace user-facing certificates with certificates that are signed by a third-party or enterprise certificate authority (CA). Certificates for machine-to-machine communication can remain as VMCA–signed certificates. However, it is recommended that you follow best practices for your organization, which typically involve the use of an identified enterprise CA.

You can use the Windows AD servers within this design to create certificates that are signed by the local instance. However, you can also choose to configure CA services if needed.





 Related links
All Address Prefixes in the VPC are automatically deleted when the VPC is deleted.







 VPC resource relationships 

Some VPC resources are contained within other VPC resources (as "children"), but other VPC resources are contained at the account level, outside of any specific VPC. All child VPC resources must be deleted before the parent resource can be deleted. For account-level VPC resources, all links to existing resources must be deleted before the account resource can be deleted.

In some cases, deleting a VPC resource removes the link to existing resources automatically. Table 2 and Table 3 describe the expected behavior.



 VPC 

VPCs contain subnets and public gateways. Load balancers, VPN gateways, and instances are provisioned in a subnet. Before a VPC can be deleted, all subnets and public gateways in the VPC must be deleted. In other words, all public gateways, load balancers, VPN gateways, and instances in the VPC must first be deleted.

A VPC also contains address prefixes and security groups, but these resources are deleted automatically when the VPC is deleted.

A VPC must have a default security group and a default network ACL. If you created a VPC without specifying a default security group and network ACL, a default security group and network ACL were created automatically for the VPC. The default security group and default network ACL cannot be deleted. The default network ACL is deleted automatically when the VPC is deleted. All security groups in the VPC are deleted automatically when the VPC is deleted.



Table 2. Requirements for deleting subnets, public gateways, and security groups

 In VPC Can contain Can attach to Has Status? Automatically deleted when VPC is deleted Automatically detaches when deleted 

 Subnet Instances, load balancers, VPN gateways Public gateway, network ACL Yes No Yes 
 Public gateway Subnets, floating IP Yes No No to subnets, Yes to floating IP 
 Security Groups Instances (NIC), VPC as default No Yes No 







 Subnet 

All resources in a subnet must be deleted before the subnet can be deleted.
* [Can I use Cloud Internet Services (CIS) for domain management when I am using custom domain mapping with Code Engine?](https://cloud.ibm.com/docs/codeengine?topic=codeengine-domain-mappingsprepare-use-cis)



* [Configuring custom domain mappings](https://cloud.ibm.com/docs/codeengine?topic=codeengine-domain-mappingscustom-domain)



* [Configuring custom domain mappings from the console](https://cloud.ibm.com/docs/codeengine?topic=codeengine-domain-mappingscustom-domain-ui)
* [Configuring custom domain mappings with the CLI](https://cloud.ibm.com/docs/codeengine?topic=codeengine-domain-mappingscustom-domain-cli)



* [Completing the custom domain configuration with your domain registrar](https://cloud.ibm.com/docs/codeengine?topic=codeengine-domain-mappingscompleting-custom-domain-registrar)



* [How do I obtain the CNAME record for the custom domain mapping?](https://cloud.ibm.com/docs/codeengine?topic=codeengine-domain-mappingscompleting-custom-domain-cname)
* [How can I use Cloud Internet Services (CIS) with custom domain mapping?](https://cloud.ibm.com/docs/codeengine?topic=codeengine-domain-mappingscompleting-custom-domain-cis)



* [Testing your custom domain](https://cloud.ibm.com/docs/codeengine?topic=codeengine-domain-mappingstest-custom-domain)
* [Viewing domain mappings](https://cloud.ibm.com/docs/codeengine?topic=codeengine-domain-mappingsview-domain-mapping)
"txt_record_value": "8dcgan91fW6aK3aIhPAVZRkHpbYEoMcCNPpVh1n4tSA"
}
],
"dns": "manual",
"ordered_on": "2022-09-13T06:21:33Z",
"state": 0,
"state_description": "Pre-activation"
},
"key_algorithm": "RSA2048",
"labels": ],
"last_update_date": "2022-09-13T06:21:33Z",
"locks_total": 0,
"name": "my-public-certificate",
"rotation": {
"auto_rotate": false,
"rotate_keys": false
},
"secret_type": "public_cert",
"state": 0,
"state_description": "Pre-activation",
"versions": ],
"versions_total": 1
}
]
3. Complete the challenges that are marked as pending before they expire by adding the TXT records that are specified in the challenge to your domain in your DNS provider account to verify your ownership of the domain.

If you order a certificate for subdomains, for example, sub1.sub2.domain.com, you need to add the TXT records to your registered domain domain.com.
4. Validate that the TXT records that you added are propagated. Depending on your DNS provider, it can take some time to complete.
5. After the records are propagated, call the Secrets Manager [Invoke an action on a secret](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2update-secret) API to request Let's Encrypt to validate the challenges to your domain and create a public certificate.

curl -X POST
--header "Authorization: Bearer {iam_token}"
* When the route action is translate, the source IP is translated to the VPN server private IP before it is sent out from the VPN server. This means that your VPN client IP is invisible from the destination devices.







 What DNS server IP addresses should I use? 

DNS server IP addresses are optional when you provision a VPN server. You should use 161.26.0.10 and 161.26.0.11 IP addresses if you want to access service endpoints and IaaS endpoints from your client. See [Service endpoints](https://cloud.ibm.com/docs/vpc?topic=vpc-service-endpoints-for-vpccloud-service-endpoints) and [IaaS endpoints](https://cloud.ibm.com/docs/vpc?topic=vpc-service-endpoints-for-vpcinfrastructure-as-a-service-iaas-endpoints) for details.

Use 161.26.0.7 and 161.26.0.8 if you need to resolve private DNS names from your client. See [About DNS Services](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-about-dns-services) for details.





 How do I update the certificate for the VPN server? 

The VPN server is not aware of updates made to a certificate in Secrets Manager. You must re-import the certificate with a different CRN, and then update the VPN server with the new certificate CRN.





 Can I use a customized hostname for the VPN server? 

Yes, you can. You must create a CNAME DNS record and point it to the VPN server hostname in your DNS provider. After that, edit the client profile by replacing direct remote 445df6c234345.us-south.vpn-server.appdomain.cloud with remote your-customized-hostname.com.

445df6c234345.us-south.vpn-server.appdomain.cloud is an example VPN server hostname.
ibmcloud cis firewall-rule-update 31984fea73a15b45779fa0df4ef62f9b 372e67954025e0ba6aaa6d586b9e0b60 --json '{"expression": "ip.src eq 93.184.216.1 and http.request.uri.path "^./wp-login.php$"", "action": "allow", "priority": 100, "paused": false, "description": "do not challenge login from office"}' -i "cis-demo"
<-- </section "id="section-update-a-firewall-rule-examples" "> --><-- </section "id="section-update-a-firewall-rule" "> --><-- <section "id="section-delete-a-Firewall-rule" "> --> ibmcloud cis firewall-rule-delete Delete a specific firewall-rule for a given DNS domain. ibmcloud cis firewall-rule-delete DNS_DOMAIN_ID FIREWALL_RULE_ID -i, --instance INSTANCE] ! ! ! ! ! !
<-- <section "id="section-delete-a-firewall-rule-options" "> --> Command options DNS_DOMAIN_ID: The ID of DNS domain. Required.FIREWALL_RULE_ID: The ID of firewall-rule. Required.-i, --instance: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.<-- </section "id="section-delete-a-firewall-rule-options" "> --><-- <section "id="section-delete-a-firewall-rule-examples" "> --> Examples Delete firewall-rule 372e67954025e0ba6aaa6d586b9e0b60.
Creating type 'TXT' resource record 



 Request 

curl -X POST $DNSSVCS_ENDPOINT/v1/instances/$INSTANCE_ID/dnszones/$DNSZONE_ID/resource_records -H "Authorization: $TOKEN" -d '{
"type": "TXT",
"name": "txt.example.com",
"rdata": {
"txtdata": "txt strings"
}
}'





 Response 

{
"created_on": "2019-08-16 08:15:53.360664 +0000 UTC",
"modified_on": "2019-08-16 08:15:53.360664 +0000 UTC",
"rtype": "TXT",
"ttl": 60,
"name": "txt.example.com",
"id": "TXT:c6221d5f-69d7-4717-9951-4f69b2680fd4",
"rdata": {
"txtdata": "txt strings"
}
}







 Creating type 'MX' resource record 



 Request 

curl -X POST $DNSSVCS_ENDPOINT/v1/instances/$INSTANCE_ID/dnszones/$DNSZONE_ID/resource_records -H "Authorization: $TOKEN" -d '{
"type": "MX",
"name": "mx1.example.com",
"rdata": {
"exchange": "mailserver.example.com",
"preference": 10
}
}'





 Response 

{
"created_on": "2019-08-16 08:21:20.308716 +0000 UTC",
"modified_on": "2019-08-16 08:21:20.308716 +0000 UTC",
"rtype": "MX",
"ttl": 60,
Veeam 

It is possible to decouple your Veeam® instance from your vCenter Server with NSX-V instance for reuse with your vCenter Server with NSX-T instance. Configuration changes are required to the existing Veeam instance:



* Update instance point to the vCenter Server associated with the NSX-T environment
* Update the DNS setting on the Veeam Server, point to the AD/DNS servers.
* Update the default gateway on the Veeam Server, to the HA VIP IP address of the NSX-T Edge, as access public access is required for license activation.
* Update or create a record for the Veeam Server on the AD/DNS Servers that is associated with the new instance.
* Update or create an ID or user on the AD/DNS Servers, which will be used by Veeam to access the vCenter Server instance.



You must open a ticket to ask IBM Support to decouple the Veeam server, management subnet, and any associated iSCSI storage from the vCenter Server with NSX-V instance so that these components are not deleted when the NSX-V instance is cancelled.

If you deploy a new Veeam instance, you must consider backup data and backup configuration to migrate Veeam to the new NSX-T instance.



* Backup data - Backup files will be hosted in the Veeam repository server. For more information, see [Importing Veeam Agent backups](https://helpcenter.veeam.com/docs/agentforwindows/userguide/integration_import.html?ver=50).
* Backup configuration - The backup configuration can be saved to a file. For more information, see [Configuration backup and restore](https://helpcenter.veeam.com/docs/backup/vsphere/vbr_config.html?ver=120).
This part of the digest is <dns>/<namespace>/<repo>, where <dns> is the domain name, <namespace> is the namespace, and <repo> is the repository.
4. For the chart that you want to restore, make a note of the tag, <tag>.
5. Run the following command to restore the chart to your repository, where <dns>/<namespace>/<repo> is the name of the chart that you want to restore and <tag> is the tag.

ibmcloud cr image-restore <dns>/<namespace>/<repo>:<tag>

In your live repository, you can pull the chart by tag.

If you run the ibmcloud cr trash-list command, the digest and any other tags show in the output, but the tag is no longer displayed.









 Deleting a private repository and any associated charts 

You can delete private repositories that are no longer required, and any associated charts, by using the IBM Cloud console.

When you delete a repository, all charts in that repository are deleted. This action can't be undone.

Before you begin, you must back up any charts that you want to keep.

To delete a private repository by using the IBM Cloud console, complete the following steps.



1. Log in to the IBM Cloud console [https://cloud.ibm.com/login](https://cloud.ibm.com/login) with your IBMid.
2. If you have multiple IBM Cloud accounts, select the account and region that you want to use from the account menu.
3. Click the Navigation menu icon, then click Container Registry.
4. Click Repositories. A list of your private repositories is displayed.
5. In the row that contains the private repository that you want to delete, select the checkbox.

Ensure that the correct repository is selected because this action can't be undone.
6. Click Delete Repository.
ibmcloud dns instance-create 

Create a DNS Services instance.

Use ibmcloud target -g RESOURCE_GROUP to set the target resource group before creating DNS Services instance. Use ibmcloud resource groups to view the list of available resource groups.

ibmcloud dns instance-create INSTANCE_NAME PLAN [-g, --resource-group RESOURCE_GROUP] [--output FORMAT]



 Command options 

INSTANCE_NAME
: The name of the DNS Services instance.

PLAN
: The name or ID of a service plan.

-g, --resource-group
: The name or ID of a resource group.

--output
: Specify output format. Currently, json is the only supported format.







 ibmcloud dns instance-update 

Update a DNS Services instance.

ibmcloud dns instance-update INSTANCE [--name NAME] [--plan PLAN] [--output FORMAT]



 Command options 

INSTANCE
: The name or ID of a DNS Services instance.

--name
: The DNS Services instance name.

--plan
: The name or ID of a DNS Services plan. Use ibmcloud dns plans to get available plans.

--output
: Specify output format. Currently, json is the only supported format.







 ibmcloud dns instance-delete 

Delete a DNS Services instance.

ibmcloud dns instance-delete INSTANCE [--force] 



 Command options 

INSTANCE
: The name or ID of a DNS Services instance.

--force
: Delete an instance without prompting for confirmation.







 ibmcloud dns instance 

Show details of a DNS Services instance.

ibmcloud dns instance INSTANCE [--output FORMAT]



 Command options 

INSTANCE
: The name or ID of a DNS Services instance.

--output
: Specify output format, only JSON is supported.







 ibmcloud dns plans 

List all DNS Services instances.

ibmcloud dns plans







 Zones 

Manage DNS zones by using the following zone commands.
ibmcloud cis page-rule-update DNS_DOMAIN_ID PAGE_RULE_ID (--json @JSON_FILE | JSON_STRING) -i, --instance INSTANCE] --output FORMAT]
Deprecated] ibmcloud cis page-rule-update DNS_DOMAIN_ID PAGE_RULE_ID (-s, --json-str JSON_STR | -j, --json-file JSON_FILE) -i, --instance INSTANCE] --output FORMAT] ! !!!!!!
<-- <section "id="section-command-options-page-rule-update" "> --> Command options DNS_DOMAIN_ID: The ID of DNS domain. Required.PAGE_RULE_ID: The ID of page rule. Required.--json value: The JSON file or JSON string used to describe a page rule. Required.
<-- <ul> -->

* The required fields in JSON data are targets, actions:

<-- <ul> -->

* targets:The target URL pattern to evaluate on a request.
* actions:An array of actions to perform if the targets of this rule match the request. Available actions are: disable_security, always_use_https, ssl, browser_cache_ttl, security_level, cache_level, edge_cache_ttl, bypass_cache_on_cookie, browser_check, server_side_exclude, email_obfuscation, automatic_https_rewrites, opportunistic_encryption, ip_geolocation, explicit_cache_control, cache_deception_armor, waf, forwarding_url, image_load_optimization, image_size_optimization, script_load_optimization, host_header_override, resolve_override. And some actions are limited to Enterprise plan: cache_on_cookie, disable_apps, disable_performance, minify, origin_error_page_pass_thru, response_buffering, true_client_ip_header, sort_query_string_for_cache, respect_strong_etag.
DELETE /v1/{crn}/zones/{domain_id}/origin_tls_client_auth/hostnames/certificates/{cert_id} internet-svcs.security.manage internet-svcs.origin-tls-client-auth-hostname-certificates.delete 







 Domain settings 



Table 21. Domain settings

 Action Method IAM ACTION AT ACTION 

 Get CNAME flattening settings. GET /v1/{crn}/zones/{domain_id}/setting/cname_flattening internet-svcs.reliability.read internet-svcs.cname-flattening-setting.read 
 Update CNAME flattening settings. PUT /v1/{crn}/zones/{domain_id}/setting/cname_flattening internet-svcs.reliability.update internet-svcs.cname-flattening-setting.update 
 Get cache level settings. GET /v1/{crn}/zones/{domain_id}/setting/cache_level internet-svcs.performance.read internet-svcs.cache-level-setting.read 
 Update cache level settings. PUT /v1/{crn}/zones/{domain_id}/setting/cache_level internet-svcs.performance.update internet-svcs.cache-level-setting.update 
 Get browser cache TTL settings. GET /v1/{crn}/zones/{domain_id}/setting/browser_cache_ttl internet-svcs.performance.read internet-svcs.browser-cache-ttl-setting.read 
 Update browser cache TTL settings. PUT /v1/{crn}/zones/{domain_id}/setting/browser_cache_ttl internet-svcs.performance.update internet-svcs.browser-cache-ttl-setting.update 
 Get always online (serve stale content) settings. GET /v1/{crn}/zones/{domain_id}/setting/always_online internet-svcs.performance.read internet-svcs.always-online-setting.read 
 Update always online (serve stale content) settings.
Backup Create, Update, Delete Editor to create, update, or delete backup plan 
 ———————— ————————— ———————— 
 Floating IP (unassociated) Create Editor for Floating IP for VPC resources 
 Floating IP (unassociated) Update, Delete Editor for the floating IP 
 Floating IP (unassociated) View, List Viewer for the floating IP 
 ———————— ————————— ———————— 
 Flow logs Create, Delete, List, Operate, Read, Update See [Managing access for flow logs](https://cloud.ibm.com/docs/vpc?topic=vpc-fl-iam) for details. 
 ———————— ————————— ———————— 
 Geography View, List For regions and zones, any account user 
 ———————— ————————— ———————— 
 Images Create Editor for Image Service for VPC resources 
 Images Update, Delete Editor for the image 
 Images View, List Viewer for the image 
 ———————— ————————— ———————— 
 Instances Create Editor for Virtual Server for VPC and Block Storage for VPC resources<br><br>Editor for Floating IP for VPC resources, if a floating IP is to be associated<br><br>Operator for the VPC, subnet, and the security group 
 Instances Update, Delete Editor for the instance 
 Instances View, List Viewer for the instance 
 Instances Post IP Spoofing Operator for instance 
 Instances Create console Operator and Console Administrator for the instance 
 Instance actions Create, Update, Delete Operator for the instance 
 Instance actions View, List Viewer for the instance 
 Instance storage View, List Viewer for the instance 
 Instance storage Update name Editor for the instance 
 Interfaces View, List Viewer for the instance 
 Interface's floating IP View, List Viewer for the instance and the floating IP
coredns 3/3 3 3 69d
2. Edit the default settings for the CoreDNS ConfigMap. Use a Corefile in the data section of the ConfigMap to customize stub domains and upstream DNS servers. For more information, see [the Kubernetes documentation](https://kubernetes.io/docs/tasks/administer-cluster/dns-custom-nameservers/coredns).

The CoreDNS proxy plug-in is deprecated and replaced with the forward plug-in. If you update the CoreDNS ConfigMap, make sure to replace all proxy instances with forward.

kubectl edit configmap -n kube-system coredns

CoreDNS example output

apiVersion: v1
kind: ConfigMap
metadata:
name: coredns
namespace: kube-system
data:
Corefile: 
import <MyCorefile>
.:53 {
errors
health {
lameduck 10s
}
ready
kubernetes cluster.local in-addr.arpa ip6.arpa {
pods insecure
fallthrough in-addr.arpa ip6.arpa
ttl 30
}
prometheus :9153
forward . /etc/resolv.conf
cache 30
loop
reload
loadbalance
}
<MyCorefile>: 
abc.com:53 {
errors
cache 30
loop
forward . 1.2.3.4
}
3. Optional: Add custom Corefiles to the CoreDNS ConfigMap. In the following example, include the import <MyCoreFile> in the data.Corefile section, and fill out the data.<MyCorefile> section with your custom Corefile information. For more information, see [the Corefile import documentation](https://coredns.io/plugins/import/).