vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Run the command:

cocoa locker asset list release:my-app@v1.2.3 --format id --type generic

Example output:

1122211111122222111111111111111111111111111111666661111111111111
2222222222555552222222222222222333333222222222222222222222222222
3333333337777773333333333333333333333333333333344444433333333333

Running the command by using the json format combined with [jq](https://stedolan.github.io/jq/):

cocoa locker asset list release:my-app@v1.2.3 --format json --type generic | jq -r '.[].uri'

Example output:

release:my-app@v1.2.3
docker://us.icr.io/foo/bar:v1.2.3@sha256:0000000011111111222222223333333344444444555555556666666677777777
https://github.ibm.com/foo/bar.gitaaaaaaaabbbbbbbbccccccccddddddddeeeeeeee





 cocoa locker evidence add 

Adds evidence to the evidence locker.

The evidence locker can be specified by using flags. For more information, see [cocoa locker commands](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-clicocoa-locker-commands).

The evidence can be configured by using the following flags:



* --evidence-type-id: a string that identifies the type of the evidence (for example com.ibm.unit_test)
* --evidence-type-version: a string that identifies the evidence details schema (for example 1.0.0, v2, and so on)
persistentVolumeClaim:
claimName: my-pvc

Show more
4. Create the pod in your cluster.

oc apply -f deployment.yaml
5. Verify that the pod is deployed. Note that it might take a few minutes for your app to get into a Running state.

oc get pods

NAME READY STATUS RESTARTS AGE
my-deployment 1/1 Running 0 2m58s
6. Verify that the app can write to your block storage volume by logging in to your pod.

oc exec my-deployment
7. View the contents of the outfile file to confirm that your app can write data to your persistent storage.

cat /

Example output

Fri Jul 16 07:49:39 EDT 2021
Fri Jul 16 07:49:39 EDT 2021
Fri Jul 16 07:49:39 EDT 2021
8. Exit the pod.

exit







 Removing Block Storage for VPC storage from your apps 

If you no longer need your Block Storage for VPC configuration, you can remove your apps, PVCs, PVs, and assignment from your clusters.



1. List your PVCs and note the name of the PVC that you want to remove.

oc get pvc
2. Remove any pods that mount the PVC.



1. List all the pods that currently mount the PVC that you want to delete. If no pods are returned, you do not have any pods that currently use your PVC.

oc get pods --all-namespaces -o=jsonpath='{range .items[]}{"n"}{.metadata.name}{":t"}{range .spec.volumes[]}{.persistentVolumeClaim.claimName}{" "}{end}{end}' | grep "<pvc_name>"

Example output

app ibmc-vpc-block-metro-5iops-tier
2. Remove the pod that uses the PVC.
var IamAuthenticator = require('@ibm-cloud/event-notifications-node-admin-sdk/auth').IamAuthenticator
var EventNotificationsV1 = require('@ibm-cloud/event-notifications-node-admin-sdk/event-notifications/v1')



1. Changes to initializing the SDK



// Replace the below section

var myPushNotifications = new PushNotificationsApiKey(PushNotifications.Region.US_SOUTH, "appGUID","apikey");

myPushNotifications.getAuthToken(function(hastoken,token){
console.log(hastoken, token);
}

// with this

const authenticator = new IamAuthenticator({
apikey: <apikey>, // Event notifications service instance APIKey
});

const eventNotificationsService = EventNotificationsV1.newInstance({
authenticator,
serviceUrl: "https://" + region + ".event-notifications.cloud.ibm.com/event-notifications"
});
Show more



1. Changes to creating notification targets



// Replace the below section

var target = PushMessageBuilder.Target
.deviceIds(["deviceID1", "deviceID2"])
.userIds( ["userID1", "userID2"])
.platforms([Notification.Platform.Apple,
Notification.Platform.Google,
Notification.Platform.WebChrome,
Notification.Platform.WebFirefox,
Notification.Platform.WebSafari,
Notification.Platform.AppExtChrome])
.tagNames(["tag1", "tag2"])
.build();

// with this

const notificationDevicesModel = {
user_ids: ['userID1', 'userID2'],
"name": "",
"options": {
"notifyOnOk": false,
"notifyOnResolve": true,
"resolveOnOk": true,
"channel": "",
"emailRecipients": "",
"url" : "",
"apiKey": "",
"routingKey": "",
"account": "",
"serviceKey": "",
"serviceName": ""
}
}
}
Show more





 Body parameters 



 id (integer) 

ID of an notification channel.





 createdOn (integer) 

Defines the creation time of an notification in milliseconds.

This parameter returns the Unix-timestamp when the notification was created.





 description (string) 

This parameter describes the notification.

The description is available when you view an notification in the notifications section of the monitoring UI, and it is included in notification emails.





 enabled (boolean) 

Defines the status of an notification channel.

Set this parameter to true if the notification channel is enabled to send events and notify when an notification is triggered.

Set to false to disable the notification channel so that it can not send notification events.





 name (string) 

Name of the notification. Must be unique.

The name of a notification channel must be unique and no more than 255 characters.





 modifiedOn (integer) 

Defines when an notification was last modified in milliseconds.

This parameter defines the Unix-timestamp when the notification was last modified.





 Options (json) 

Options are different per type of notification channel.

The following JSON shows the schema model:

"options": {
"notifyOnOk": false,
"notifyOnResolve": true,
"resolveOnOk": true,
"channel": "",
"emailRecipients": "",
"url" : "",
"apiKey": "",
"routingKey": "",
ibmcloud ks cluster addon ls -c <cluster_name_or_ID>

Example output

Name Version Health State Health Status
debug-tool 2.0.0 normal Addon Ready
istio 1.4 - Enabling

The Health State reflects the lifecycle of the add-on components. Each state is described in the following table.



Add-on health states

 Add-on health state Description 

 critical The add-on is not ready to be used for one of the following reasons:<br><br><br><br> * Some or all the add-on components are unhealthy.<br> * The add-on failed to deploy.<br> * The add-on may be at an unsupported version.<br> * Check the Health Status field for more information.<br><br><br> 
 normal The add-on is successfully deployed. Check the status to verify that the add-on is Ready or to see if an update is available. 
 pending Some or all components of the add-on are currently deploying. Wait for the state to become normal before working with your add-on. 
 updating The add-on is updating and is not ready to be used. Check the Health Status field for the version that the add-on is updating to. 
 warning The add-on might not function properly due to cluster limitations. Check the Health Status field for more information. 



The Health Status provides details of what add-on operation is in progress. Each status is described in the following table.



Add-on health statuses

 Status code Add-on health status Description 

 H1500 Addon Ready The add-on is successfully deployed and is healthy. 
 H1501, H1502, H1503 Addon Not Ready Some or all the add-on components are unhealthy. Check whether all add-on component pods are running. For example, for the Istio add-on, check whether the pods in the istio-system and ibm-operators namespaces are in a Running state by running the kubectl get pods -n NAMESPACE command.
Image ID:
Port: <none>
State: Waiting
Reason: PodInitializing
Ready: False
Restart Count: 0
Environment: <none>
Mounts:
/var/jenkins_home from volume (rw)
/var/run/secrets/kubernetes.io/serviceaccount from default-token-cp9f0 (ro)
...
Volumes:
myvol:
Type: PersistentVolumeClaim (a reference to a PersistentVolumeClaim in the same namespace)
ClaimName: mypvc
ReadOnly: false
7. Log in to the pod by using the pod name that you previously noted.

kubectl exec -it <my-pod-123456789> /bin/bash
8. Verify the permissions of your container's mount path. In the example, the mount path is /var/jenkins_home.

ls -ln /var/jenkins_home

Example output

jenkins@mypod-123456789:/$ ls -ln /var/jenkins_home
total 12
-rw-r--r-- 1 1000 1000 102 Mar 9 19:58 copy_reference_file.log
drwxr-xr-x 2 1000 1000 4096 Mar 9 19:58 init.groovy.d
drwxr-xr-x 9 1000 1000 4096 Mar 9 20:16 war

This output shows that the GID and UID from your Dockerfile (in this example, 1000 and 1000) own the mount path inside the container.
* Example usage on GitHub:



$ export GHE_TOKEN='my-git-token'
$ export GHE_ORG='my-github-username'
$ export GHE_REPO='my-github-repo-name'
$ export GIT_COMMIT='1df4adf81a294315a3fb4e211df9ae6cad4895c1'
$ cocoa set-status --state="pending" --targetURL="https://cloud.ibm.com/devops/pipelines/tekton/pipeline-id/runs/run-id/lint/lint?env_id=ibm:yp:us-south" --context="tekton/lint" --description="Tekton linter is running." --git-provider="github"
* Add [liveness and readiness probes](https://cloud.ibm.com/docs/containers?topic=containers-appprobe) to help make sure your webhook container is running and ready to serve requests.
* Set pod [anti-affinity scheduling rules](https://cloud.ibm.com/docs/containers?topic=containers-appaffinity) to prefer that your webhook pods run on different worker nodes and zones when possible. You might use [pod topology](https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/) instead. However, avoid [taints](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) or forced affinity that might restrict where the webhook pods can be scheduled.
* [Set pod priority](https://cloud.ibm.com/docs/containers?topic=containers-pod_priority) to system-cluster-critical for the webhook pods so that other pods can't take resources from your webhook pods.
* Scope your webhook to the appropriate namespace. Avoid webhooks that process resources that run in system-critical namespaces that are set up in your cluster by default, such as kube-system, ibm-system, ibm-operators, calico-system, tigera-operator and openshift- namespaces.
* Review the namespaceSelector option. You can add labels to the certain critical namespaces, such as kube-system, so the webhook is not called for these cases. This setup is called an "opt out" style configuration. Or, you can configure the namespaceSelector option so the webhook is called only for namespaces that have a specific label. This setup is called an "opt in" configuration. Depending on the purpose of the webhook, it might be important that the webhook be called for all namespaces.
I thought that I needed to put my app in a container. Now what's all this stuff about pods? 

A [pod](https://kubernetes.io/docs/concepts/workloads/pods/) is the smallest deployable unit that Kubernetes can manage. You put your container (or a group of containers) into a pod and use the pod configuration file to tell the pod how to run the container and share resources with other pods. All containers that you put into a pod run in a shared context, which means that they share the virtual or physical machine.

What to put in a container
: As you think about your application's components, consider whether they have significantly different resource requirements for things like CPU and memory. Could some components run at a best effort, where going down for a little while to divert resources to other areas is acceptable? Is another component customer-facing, so it's critical for it to stay up? Split them up into separate containers. You can always deploy them to the same pod so that they run together in sync.

What to put in a pod
: The containers for your app don't always have to be in the same pod. In fact, if you have a component that is stateful and difficult to scale, such as a database service, put it in a different pod that you can schedule on a worker node with more resources to handle the workload. If your containers work correctly if they run on different worker nodes, then use multiple pods. If they need to be on the same machine and scale together, group the containers into the same pod.





 So if I can use a pod, why do I need all these different types of objects? 

Creating a pod YAML file is easy. You can write one with just a few lines as follows.

apiVersion: v1
kind: Pod
metadata:
name: nginx
spec:
containers:
- name: nginx
image: nginx
ports:
- containerPort: 80

But you don't want to stop there. If the node that your pod runs on goes down, then your pod goes down with it and isn't rescheduled.
* [Viewing Red Hat OpenShift on IBM Cloud created priority level configurations](https://cloud.ibm.com/docs/openshift?topic=openshift-kubeapi-prioritykube-api-prioritylevelconfig)





[Pod security admission](https://cloud.ibm.com/docs/openshift?topic=openshift-pod-security-admissionpod-security-admission)



* [Understanding security profiles](https://cloud.ibm.com/docs/openshift?topic=openshift-pod-security-admissionpod_security_profiles)
* [What if Pod Security Admission isn't the right choice for me?](https://cloud.ibm.com/docs/openshift?topic=openshift-pod-security-admissionwhat-if-psa)
* [Configuring Pod Security admission namespace labels](https://cloud.ibm.com/docs/openshift?topic=openshift-pod-security-admissionpsa-namespace-labels)
* [Default Pod Security Admission plug-in configuration](https://cloud.ibm.com/docs/openshift?topic=openshift-pod-security-admissionpsa-plugin-config-default)
* [Customizing the Pod Security Admission plug-in configuration](https://cloud.ibm.com/docs/openshift?topic=openshift-pod-security-admissionpsa-plugin-config-custom)
* [Configuring pod security admission](https://cloud.ibm.com/docs/openshift?topic=openshift-pod-security-admissionpod-security-configure)
* [Additional resources](https://cloud.ibm.com/docs/openshift?topic=openshift-pod-security-admissionpod-sec-additional-resources)







 Securing the cluster network 



 Controlling traffic in Classic clusters
"ibmenpushto": "{"fcm_devices": ["9c75975a-37d0-3898-905d-3b5ee0d7c172","C9CACDF5-6EBF-49E1-AD60-E25BA23E954C"],"apns_devices": ["1c75972a-37d0-3898-905d-3b5ee0d7c172","M9CACDF5-1EBF-49E1-AD60-E25BA23E954C"],"chrome_devices": ["2c75972a-37d0-3898-905d-3b5ee0d7c182","N9CACDF5-1EBF-49E1-AD60-E25BA23E994D"],"firefox_devices": ["3c75972a-37d0-3898-905d-3b5ee0d7c182","L9CACDF5-1EBF-49E1-AD60-E25BA23E994E"],"safari_devices": ["1175972a-37d0-3898-905d-3b5ee0d7c1D2","Q9CACDF5-1EBF-49E1-AD60-E25BA23E994N"]}"

Targeting notifications to push user_ids.

"ibmenpushto": "{"user_ids": ["ajay@accts.acmebank.com","ankit@accts.acmebank.com"]}"

Targeting notifications to push tags.

"ibmenpushto": "{"tags": ["salesTeam","TechTeam"]}"

Targeting notifications to platforms.

"ibmenpushto": "{"platforms":["push_android","push_ios"]]}"
For more details see https://docs.gradle.org/7.5.1/release-notes.html

------------------------------------------------------------
Gradle 7.5.1
------------------------------------------------------------

Build time: 2022-08-05 21:17:56 UTC
Revision: d1daa0cbf1a0103000b71484e1dbfe096e095918

Kotlin: 1.6.21
Groovy: 3.0.10
Ant: Apache Ant(TM) version 1.10.11 compiled on July 10 2021
JVM: 11.0.11 (Eclipse OpenJ9 openj9-0.26.0)
OS: Linux 5.15.49-linuxkit amd64

 oc version
Client Version: 4.11.12
Kustomize Version: v4.5.4

 zip
Copyright (c) 1990-2008 Info-ZIP - Type 'zip "-L"' for software license.
This is Zip 3.0 (July 5th 2008), by Info-ZIP.

 unzip
UnZip 6.00 of 20 April 2009, by Debian. Original by Info-ZIP.

 git --version
git version 2.38.1

 curl
The directory Sources/ contains a file that is named main.swift.

The Package.swift must start with a comment that specifies version 4.2 for the Swift tooling:

// swift-tools-version:4.2
import PackageDescription

let package = Package(
name: "Action",
products: [
.executable(
name: "Action",
targets: "Action"]
)
],
dependencies: [
.package(url: "https://github.com/IBM-Swift/SwiftyRequest.git", .upToNextMajor(from: "1.0.0"))
],
targets: [
.target(
name: "Action",
dependencies: "SwiftyRequest"],
path: "."
)
]
)
Show more
2. Create an archive with the contents of the directory.

zip ../action-src.zip -r 
3. Pass the compressed archive to the Docker container over stdin. The stdout is a new compressed archive with the compiled executable file. The Docker container reads the content of the compressed archive from stdin and writes a new archive with the compiled Swift executable file to stdout.

docker run -i openwhisk/action-swift-v4.2 -compile main <action-src.zip >../action-bin.zip

In a Linux based system, you can combine the zip and docker run steps in a single command:

zip - -r * | docker run -i openwhisk/action-swift-v4.2 -compile main >../action-bin.zip

docker run -i openwhisk/action-swift-v4.2 -compile main <action-src.zip >../action-bin.zip

In a Linux-based system, you can combine the zip and docker run steps in a single command:
8.19.2

 jq --version
jq-1.6

 yq --version
yq version 2.4.1

 yq3 --version
yq version 3.4.1

 yq4 --version
yq (https://github.com/mikefarah/yq/) version 4.29.2

 kubectl version --client
WARNING: This version information is deprecated and will be replaced with the output from kubectl version --short. Use --output=yaml|json to get the full version.
Client Version: version.Info{Major:"1", Minor:"24", GitVersion:"v1.24.3", GitCommit:"aef86a93758dc3cb2c658dd9657ab4ad4afc21cb", GitTreeState:"clean", BuildDate:"2022-07-13T14:30:46Z", GoVersion:"go1.18.3", Compiler:"gc", Platform:"linux/amd64"}
Kustomize Version: v4.5.4

 buildctl --version
buildctl github.com/moby/buildkit v0.10.5 bc26045116045516ff2427201abd299043eaf8f7

 helm version --client
Client: &version.Version{SemVer:"v2.17.0", GitCommit:"a690bad98af45b015bd3da1a41f6218b1a451dbe", GitTreeState:"clean"}

 helm3 version --client
version.BuildInfo{Version:"v3.10.1", GitCommit:"9f88ccb6aee40b9a0535fcc7efea6055e1ef72c9", GitTreeState:"clean", GoVersion:"go1.18.7"}
(https://cloud.ibm.com/docs/openshift?topic=openshift-ts-ingress-essefts-ingress-essef)

[Why does the Ingress status show an ESSWS error?](https://cloud.ibm.com/docs/openshift?topic=openshift-ts-ingress-esswsts-ingress-essws)

[Why does the Ingress status show an ESSDNE error?](https://cloud.ibm.com/docs/openshift?topic=openshift-ts-ingress-essdnets-ingress-essdne)





 File Storage 

[Debugging persistent storage failures](https://cloud.ibm.com/docs/openshift?topic=openshift-debug_storagedebug_storage)



* [Checking whether the pod that mounts your storage instance is successfully deployed](https://cloud.ibm.com/docs/openshift?topic=openshift-debug_storagecheck-pod-success-deploy)
* [Restarting your app pod](https://cloud.ibm.com/docs/openshift?topic=openshift-debug_storagets-restart-app-pod)
* [Verifying that the storage driver and plug-in pods show a status of Running](https://cloud.ibm.com/docs/openshift?topic=openshift-debug_storageverify_driver_pod_running_status)
* [Checking whether your PVC is successfully provisioned.](https://cloud.ibm.com/docs/openshift?topic=openshift-debug_storagecheck_pvc_provision)
* [Portworx](https://cloud.ibm.com/docs/openshift?topic=openshift-debug_storagets-portworx-helm)
Support 



  Support channels 

The SDK SHOULD clearly document the proper channels for reporting errors or requesting assistance in using the SDK. These channels SHOULD include GitHub issues, posts to StackOverflow, and other popular developer sites. These channels SHOULD be continuously monitored by the SDK team and responses SHOULD be provided in a timely manner.





  Support expiration 

The SDK SHOULD clearly document the earliest date for expiration of support at the time the SDK released. For "official" SDK releases (major version 1 or later), the expiration of support SHOULD be at least one year from the release date of the SDK.





  Community contributions 

The SDK SHOULD encourage community contributions both in words and in actions (by accepting pull requests from community developers). The process for community contributions SHOULD be clearly described in the CONTRIBUTING doc of the repo.





  Contributors License Agreement 

All contributors to the SDK MUST be required to sign a Contributors License Agreement (CLA) before contributions are accepted.

The SDK SHOULD use the [cla-assistant](https://cla-assistant.io/) integration in its GitHub repo. This is a standard and auditable way to ensure that the CLA is signed by all contributors.
Normal Success 40s public-cr87c198fcf4bd458ca61402bb4c7e945a-alb1-258623678-gvf9n Successfully applied ingress resource.
Warning AnnotationError 2s public-cr87c198fcf4bd458ca61402bb4c7e945a-alb1-258623678-gvf9n Failed to apply ingress.bluemix.net/custom-port annotation. Invalid port 7490. Annotation can't use ports 7481 - 7490
Normal Success 2s public-cr87c198fcf4bd458ca61402bb4c7e945a-alb1-258623678-gvf9n Successfully applied ingress resource.
2. Check the status of your ALB pods.



1. Get the ALB pods that are running in your cluster.

kubectl get pods -n kube-system | grep alb
2. Make sure that all pods are running by checking the STATUS column.
3. If a pod does not have a Running status, you can disable and re-enable the ALB. In the following commands, replace <ALB_ID> with the ID of the pod's ALB. For example, if the pod that is not running has the name public-crb2f60e9735254ac8b20b9c1e38b649a5-alb1-5d6d86fbbc-kxj6z, the ALB ID is public-crb2f60e9735254ac8b20b9c1e38b649a5-alb1.



* Classic clusters:

ibmcloud ks ingress alb disable --alb <ALB_ID> -c <cluster_name_or_ID>

ibmcloud ks ingress alb enable classic --alb <ALB_ID> -c <cluster_name_or_ID>
Jar: m2kassets/built-in/transformers/dockerfilegenerator/java/jar/transformer.yaml
Jboss: m2kassets/built-in/transformers/dockerfilegenerator/java/jboss/transformer.yaml
Knative: m2kassets/built-in/transformers/kubernetes/knative/transformer.yaml
Kubernetes: m2kassets/built-in/transformers/kubernetes/kubernetes/transformer.yaml
KubernetesVersionChanger: m2kassets/built-in/transformers/kubernetes/kubernetesversionchanger/transformer.yaml
Liberty: m2kassets/built-in/transformers/dockerfilegenerator/java/liberty/transformer.yaml
Maven: m2kassets/built-in/transformers/dockerfilegenerator/java/maven/transformer.yaml
Nodejs-Dockerfile: m2kassets/built-in/transformers/dockerfilegenerator/nodejs/transformer.yaml
PHP-Dockerfile: m2kassets/built-in/transformers/dockerfilegenerator/php/transformer.yaml
Parameterizer: m2kassets/built-in/transformers/kubernetes/parameterizer/transformer.yaml
Python-Dockerfile: m2kassets/built-in/transformers/dockerfilegenerator/python/transformer.yaml
ReadMeGenerator: m2kassets/built-in/transformers/readmegenerator/transformer.yaml
Ruby-Dockerfile: m2kassets/built-in/transformers/dockerfilegenerator/ruby/transformer.yaml
Rust-Dockerfile: m2kassets/built-in/transformers/dockerfilegenerator/rust/transformer.yaml
Tekton: m2kassets/built-in/transformers/kubernetes/tekton/transformer.yaml
echo "$REQUIRED_PKG Version is: $PKG_VER. OQSSA requires cmake 3.5 and above."
fi
fi
done
PKG_STATUS=$(yum grouplist Dev* |grep "Development Tools")
if [ "" = "$PKG_STATUS" ]
then
echo "Developement Tools is NOT installed"
fi
echo "Prerequisites verification completed"
Show more
3. Once prerequisite packages are installed and verified, execute script to build and install OQSSA:

bash build-oqssa.sh
4. Run the following command to set the Quantum library path:

export LD_LIBRARY_PATH=$HOME/opt/oqssa/lib:$LD_LIBRARY_PATH







 Configuring the Key Protect SDK with your application 

Once you have the prerequisites installed, follow these steps to configure the [Key Protect SDK](https://github.com/IBM/keyprotect-go-clientusage) with your application:



1. Navigate to the folder where the go client resides by running the following command:

cd $HOME/keyprotect-go-client
2. Set the Kyber algorithm in the initialization of the Key Protect client in your application code. If you do not specify an algorithm, your application will default to using the p384_kyber768 algorithm. Use the following code as an example of algorithm configuration:

qscConfig := kp.ClientQSCConfig{
AlgorithmID: kp.KP_QSC_ALGO_p384_KYBER768,
}
3. Compile the Key Protect SDK by running the following command:

LD_LIBRARY_PATH=$HOME/opt/oqssa/lib PKG_CONFIG_PATH=$HOME/opt/oqssa/lib/pkgconfig go build –-tags quantum









 Using Quantum Safe Key Protect endpoints via CURL 



 Prerequisites