vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Check the chart deployment status. When the chart is ready, the STATUS field in the output has a value of DEPLOYED.

helm status vpn
11. After the chart is deployed, verify that the updated settings in the config.yaml file were used.

helm get values vpn
12. Clean up the current test pods.

oc get pods -a -l app=strongswan-test

oc delete pods -l app=strongswan-test
13. Run the tests again.

helm test vpn







 Limiting strongSwan VPN traffic by namespace or worker node 

If you have a single-tenant cluster, or if you have a multi-tenant cluster in which cluster resources are shared among the tenants, you can [limit VPN traffic for each strongSwan deployment to pods in certain namespaces](https://cloud.ibm.com/docs/openshift?topic=openshift-vpnlimit_namespace). If you have a multi-tenant cluster in which cluster resources are dedicated to tenants, you can [limit VPN traffic for each strongSwan deployment to the worker nodes dedicated to each tenant](https://cloud.ibm.com/docs/openshift?topic=openshift-vpnlimit_worker).



 Limiting strongSwan VPN traffic by namespace 

When you have a single-tenant or multi-tenant cluster, you can limit VPN traffic to pods in only certain namespaces.

For example, say that you want pods in only a specific namespace, my-secure-namespace, to send and receive data over the VPN. You don't want pods in other namespaces, such as kube-system, ibm-system, or default, to access your on-premises network. To limit the VPN traffic to only my-secure-namespace, you can create Calico global network policies.

Before you use this solution, review the following considerations and limitations.



* You don't need to deploy the strongSwan Helm chart into the specified namespace. The strongSwan VPN pod and the routes daemon set can be deployed into kube-system or any other namespace.
* UI
* CLI







 Publishing products to specific accounts 

If you don't want your product to be publicly available to all users in the IBM Cloud® catalog but you do want certain accounts to be able to access your product, you can publish your product to specific allowlisted accounts if your product is [approved for publishing](https://cloud.ibm.com/docs/sell?topic=sell-sw-publish&interface=uisw-request-approval).

A different process is used if you want to share your product with users in your own enterprise or account or to enterprises to which you have the Editor role or higher already assigned, and it does not require approval for publishing. For more information, see [Sharing private catalog products](https://cloud.ibm.com/docs/account?topic=account-catalog-share&interface=ui).



 Before you begin 



1. Ensure that your product is [approved to publish](https://cloud.ibm.com/docs/sell?topic=sell-sw-publish&interface=uisw-request-approval).
2. You must be assigned the Administrator role for the Catalog Management account management service in the same account as your product. For more information, see [Assigning users access](https://cloud.ibm.com/docs/account?topic=account-catalog-access).
3. Verify that at least one version of your product is in the ready state.
4. Retrieve the ID of the account that you want to publish to. For more information, see [Can I view my account ID, account type, and account number?](https://cloud.ibm.com/docs/account?topic=account-accountfaqsaccount-details).

If you don't have access to the account, a user that does have access must share the ID with you.







 Publishing products to specific accounts by using the console 

When you publish your product to specific accounts, the accounts are added to a list of IDs that are granted access to your product also known as the allowlist. Any ID that is not included in the allowlist can't access your product.
You must have access to the target service to create an authorization between services. You can grant only the level of access that you have as a user of the target service. For example, if you have viewer access on the target service, you can assign only the viewer role for the authorization.



1. In the IBM Cloud console, click Manage > Access (IAM), and select Authorizations.
2. Click Create.
3. Select a source account.



* If the source service that needs access to the target service is in this account, select This account.
* If the source service that needs access to the target service is in a different account, select Other account. Then, enter the account ID of the source account.



4. Specify whether you want the authorization to be for all instances, only a specific instance in the account, or instances only in a certain resource group.
5. Select a target service and specify whether you want the authorization to be for all instances, only a specific instance in the account, or instances only in a certain resource group.
6. Optional: Select Enable authorization to be delegated to allow the source service to delegate its access to any dependent services. This option is displayed only if the source service has dependent services. By selecting this option, policies are automatically created by the source service for the dependent services.
7. Select a role to assign access to the source service that accesses the target service.
8. Click Authorize.



If you create an authorization between a service in another account and a target service in your current account, you need to have access only to the target resource. For the source account, you need only the account number.





 Creating an authorization by using the CLI 

To authorize a source service access a target service, run the ibmcloud iam authorization-policy-create command.

The following sample uses mock data to create a policy where a specific source service instance of IBM Cloud Object Storage is authorized to access a specific target service instance of IBM Key Protect:

ibmcloud iam authorization-policy-create cloud-object-storage kms Reader --source-service-instance-id 123123 --target-service-instance-id 456456
* Can I use the secondary IP block that came with the server for virtual machines?

No. The secondary IP that is provided with your server is routed to work on the physical server and not on a virtual machine. You need to have Portable IP blocks to connect your virtual machine to the network.
* Do I need static or portable IP addresses for Virtuozzo?



* Static IP address: Use a static IP address if you have only one hardware node (per VLAN or in total)
* Portable IP address:



* Routed to VLAN: Use this method if you have multiple host nodes within the same VLAN. You also use this method to migrate a container to a different hardware node within the same VLAN without changing the IP of the container.
* Secondary on VLAN: This method works, but you don't need a secondary gateway. You lose 3 of the IP addresses due to host ID, gateway, and broadcast.





Costs per IP can change depending on the routing type (Routed to VLAN or Secondary on VLAN). Prices are shown in the portal after you select the server that you are ordering the IP addresses for. Routing can be changed at any time by opening a support ticket.
* Can I migrate a Virtuozzo 3 Container to a Virtuozzo Container 4 hardware node with no downtime?

Linux:

Yes. By default, Virtuozzo Containers for Linux 4 run in compatibility mode. If Virtuozzo Containers is not running in compatibility mode, then you can start it by using the following command on the hardware node through SSH.

/usr/sbin/vzagent_compat_ctl start

Windows (unsupported):

With Virtuozzo Containers 4 Windows, you have downtime during the transition (between 20 seconds up to 5 minutes) because of not having an online option to pass.

If you use Virtuozzo 3.0 for Windows, then you need to upgrade the hardware node to at least Virtuozzo 3.5.1 for Windows.

Virtuozzo Containers 4 for Windows, by default, runs in compatibility mode.
As you work with your Code Engine workloads, refer to the [CLI command reference](https://cloud.ibm.com/docs/codeengine?topic=codeengine-cli) and track CLI version updates with the [CLI change log](https://cloud.ibm.com/docs/codeengine?topic=codeengine-cli_versions). You can also [access the IBM Cloud Shell](https://cloud.ibm.com/docs/codeengine?topic=codeengine-install-clicloud-shell) in your web browser.

If you do not want to use the CLI, you can [work from the console](https://cloud.ibm.com/codeengine/overview).





 Create your first project 

To get started with Code Engine, [create a project](https://cloud.ibm.com/docs/codeengine?topic=codeengine-manage-project) to contain your entities. You can also [set access policies](https://cloud.ibm.com/docs/codeengine?topic=codeengine-iam) for your project.

Need help? Check out [troubleshooting tips for projects](https://cloud.ibm.com/docs/codeengine?topic=codeengine-troubleshoot-project). If you need more help, try [getting support](https://cloud.ibm.com/docs/codeengine?topic=codeengine-get-support).





 Develop your application, job, or function 

Code Engine deploys applications and runs jobs that are bundled into container images. If you do not have a container image, you can build and deploy your code from within Code Engine.

Code Engine runs functions as code bundles. If you do not have a code bundle, you can build and run your function from within Code Engine.

Do you have source code or a container image for your application or job?

I have a container image. Where is your image stored?
The path is appended to the IBM-provided or your custom domain to create a unique route to your app. When you enter this route into a web browser, network traffic is routed to the Ingress controller. The Ingress controller looks up the associated service, and sends network traffic to the service. The service then forwards the traffic to the pods where the app runs. Many apps don't listen on a specific path, but use the root path and a specific port. In this case, define the root path as / and don't specify an individual path for your app.
: For example, to use http://domain/, enter / as the path. For http://domain/app1_path, enter /app1_path as the path.

name
: Replace <app1_service> and <app2_service>, and so on, with the name of the services you created to expose your apps. If your apps are exposed by services in different projects in the cluster, include only app services that are in the same project. You must create one Ingress resource for each project where you have apps that you want to expose.

port
: The port that your service listens to. Use the same port that you defined when you created the Kubernetes service for your app.
2. Create the Ingress resource for your cluster. Ensure that the resource deploys into the same project as the app services that you specified in the resource.

oc apply -f myingressresource.yaml -n <project>
3. Verify that the Ingress resource was created successfully. If messages in the events describe an error in your resource configuration, fix the values in your resource file and reapply the file for the resource.

oc describe ingress myingressresource



Your Ingress resource is created in the same project as your app services, and your apps are registered with the Ingress controller.





 Step 4: Access your app 

In a web browser, enter the URL of the app service to access.

https://<domain>/<app1_path>
Because intermediate CAs are currently not supported by the IBM Blockchain Platform, this field will be blank. 
 keystore Contains the private key that was generated alongside your public key. This key is used to generate signatures by creating a cryptographic hash that can be verified using the public key known to other users. This key is never shared, and you are responsible for securing and managing it. If this key becomes compromised, it can be used to impersonate your identity, making it crucial to keep this key safe. 
 signCerts Contains the public key that was generated alongside your private key. It is also known as a "signing certificate" because it is used to verify signatures generated by other users. 
 Many Fabric components contain additional information inside their MSP folder. For example, a peer, includes the following folders: 
 admincerts Contains the admin certificates for this organization or component. 
 tls Contains the TLS certs that you store for communicating with other network components. 



Note that organization MSPs are stored in browser storage and must be exported to a local file system and secured by the customer.





 Access control lists (ACLs) 

Hyperledger Fabric allows for finer grained control over user access to specified resources through the use of access control lists (ACLs). ACLs allow access to a channel resource to be restricted to an organization and a role within that organization. The available set of ACLs are from the underlying Fabric architecture and are selected during channel creation or update. Note that access control lists are restrictive, rather than additive. If access to a resource is specified to an organization, it means that only that organization will have access to the resource. For example, if the default access to a particular resource is the Readers of all organizations, and that access is changed to the Admin of Org1, then only the Admin of Org1 will have access to the resource. Because access to certain resources is fundamental to the smooth operation of a channel, it is highly recommended to make access control decisions carefully. If you decide to limit access to a resource, make sure that the access to that resource is added, as needed, for each organization.

You can use the blockchain console to select which ACLs to apply to resources on a channel.
For more information, see [Configuring Dynamic Content Acceleration](https://cloud.ibm.com/docs/CDN?topic=CDN-dynamic-content-acceleration).





 Geographical access control 

Geographical access control is a rule-based behavior that enables you set the access-type parameter for a group of users, based on their geographical location. Two types of behaviors are available: ALLOW and DENY.

The access-typeALLOW lets you specifically allow traffic to selected regions, based on the type of region. Allowing traffic for specific regions implicitly blocks traffic for all others. For example, you might choose to allow traffic to selected continents, such as Europe and Oceania, which blocks access for all other continents.

In contrast, the DENY behavior blocks access to your service for the specified group, but allows access for all other, non-specified regions. For example, if you set the geographical access control access-type to DENY for the continents of Europe and Oceania, users on those continents are not able to use your service, whereas users on all other continents can access it.

This feature is accessible from the Advanced rules page of your CDN configuration. For more information, see [Setting advanced rules](https://cloud.ibm.com/docs/CDN?topic=CDN-setting-advanced-rules).





 Host server origin support 

IBM Cloud Content Delivery Network (CDN) can be configured to serve content from a host server origin by providing the origin hostname, protocol, port number, and optionally, the path from which to serve the content. The default path is /. Protocol can be HTTP, HTTPS, or both. Only certain port numbers are supported by Akamai. See the [FAQ](https://cloud.ibm.com/docs/CDN?topic=CDN-faqsare-there-any-restrictions-on-what-port-numbers-are-allowed) for supported port numbers and ranges.





 Hotlink protection 

Hotlink protection is a rules-based behavior that enables you to control whether certain websites are allowed access to content from your CDN. The browser typically includes a Referer header when an HTTP request is made from a link on a web page, and when that link points to a remote asset.
* Access control lists (ACLs). To specify a finer grained control over resources, you can restrict access to a resource to an organization and a role within that organization. For example, setting access to the resource ChaincodeExists to Application/Admins would mean that only the admin of an application would be able to access the ChaincodeExists resource. Users have the option to edit the access control list one at a time or by uploading a JSON containing the list. For more information about Access Control, see [Access Control Lists (ACLs)](https://hyperledger-fabric.readthedocs.io/en/release-2.2/access_control.html) in the Fabric documentation.

If you restrict access to a resource to a particular organization, be aware that only that organization will be able to access the resource. If you want other organizations to be able to access the resource, you will have to add them one by one. As a result, consider your access control decisions carefully. Restricting access to certain resources in certain ways can have a highly negative effect on how your channel functions.







 Updating a channel configuration 

While creating a channel and updating a channel have the same goal, giving users the ability to ensure that the configuration of their channel is as well suited as possible to their use case, the two processes are in fact very different as tasks in the console. Creating a channel is a process undertaken by a single organization. As long as an organization is a member of the consortium of the ordering service, they can create the channel in any way they want. They can give it any name, add any organizations (as long as they are a member of the consortium), assign those organizations permissions, set access control lists, and so on.

The other organizations have the choice of whether to participate in this channel (for example, whether to join peers to it), but it is assumed that the collaborative process of deciding on the channel configuration will happen out of band, before an organization creates the channel.

Updating a channel is different. Rather than an organization acting alone, channel updates follow the collaborative governance procedures that are fundamental to the way the IBM Blockchain Platform functions. This collaborative process involves sending the channel configuration update requests to operator organizations that have an administrative role in the channel.
Create and send push notifications to Chrome web by using Event Notifications 

Create an Event Notifications service, add a push destination for Chrome Push Notifications, and send messages to Chrome web devices.



 What is Event Notifications? 

Event Notifications is an event notification routing service that informs you about critical events that occur in your IBM Cloud account or triggers automated actions by using webhooks. You can filter and route event notifications from IBM Cloud services like Availability Monitoring, to email, SMS, push notifications, and webhooks.





 How do clients use Chrome web Push Notifications? 

The following diagram shows you how clients use Chrome web Push Notifications.

Zoom

![How clients use push notifications](https://cloud.ibm.com/docs-content/v1/content/4c9a07fe500838e5e55e71e73131ef20b44a6c66/event-notifications/images/en-how-send-chrome.svg)

Figure 1. How clients use push notifications





 Objectives 

This tutorial shows you how to send push notifications as follows:



* Create a website with Event Notifications.
* Get Chrome web credentials.
* Download the SDK and complete the notifications setup.
* Configure and send Chrome web Push Notifications to a browser.







 Before you begin 

You must have the following prerequisites in place:



* Download and install any code editor to right website code by using HTML, CSS, and js.
* A Google account to log in to Firebase console to get your Sender ID and Server API Key.
* An IBM Cloud account. If you do not have one, [create an IBM Cloud account](https://cloud.ibm.com/).







 Step 1: Create an Event Notifications service instance 



* Log in to your [IBM Cloud account](https://cloud.ibm.com/).
* In the [IBM Cloud catalog](https://cloud.ibm.com/catalogservices), search Event Notifications > Event Notifications.
* Select a Region from the list of supported regions and select a pricing plan.
To retrieve the Swagger documentation in a JSON format instead, visit the/ibm/api/docs endpoint instead. To access this endpoint via a web browser you must first login to /ibm/api/explorer first and then visit /ibm/api/docs to retrieve the JSON documentation.

To do this via cURL, follow these instructions.



1. Retrieve the cookie from the /ibm/api/explorer endpoint



curl -k https://web-{your-qmgr-hostname}/ibm/api/explorer/ -c cookiejar.txt



2. Then send a request to the /ibm/api/docs endpoint supplying the cookie



curl -k https://web-{your-qmgr-hostname}/ibm/api/docs -b cookiejar.txt > api-docs.json

Congratulations, you have successfully viewed and retrieved the REST API documentation for your IBM MQ on Cloud queue manager.
Two types of case-sensitive AQL identifiers exist:



* Simple identifier

A simple identifier must start with a lowercase (a-z) or uppercase (A-Z) letter or the underscore character (_). Subsequent characters can be lowercase or uppercase letters, the underscore character, or digits (0-9). A simple identifier must be different from any AQL key word.
* Double-quoted identifier

A double-quoted identifier starts and ends with a double quotation mark character ("). You can use any character between the beginning and ending double quotation mark characters. Double-quoted identifiers cannot contain a period (.) character. If a double quotation mark character occurs within name, it must be escaped by prefixing it with the backslash character (\), for example ”.







 Reserved words 

Reserved words are words that have a fixed meaning within the context of the AQL structure, and cannot be redefined. Keywords are reserved words that have special meanings within the language syntax.

The following AQL-reserved keywords cannot be used as identifiers because each has a well-defined purpose within the language:



* all
* allow
* allow_empty
* always
* and
* annotate
* as
* ascending
* ascii
* attribute
* between
* blocks
* both
* by
* called
* case
* cast
* ccsid
* character
* characters
* columns
* consolidate
* content_type
* count
* create
* default
* descending
* detag
* detect
* deterministic
* dictionary
* dictionaries
* document
* element
* else
* empty_fileset
* entries
* exact
* export
* external
* external_name
* extract
* fetch
* file
* first
* flags
* folding
* from
* function
* group
* having
* import