vania-janet/multiturn-rag-retrieval-data huggingface dataset:
__ow_user String The namespace_ID that identifies the Cloud Functions-authenticated subject. 
 __ow_body String The request body entity, as a base64 encoded string when content is a binary file, or plain string otherwise. 
 __ow_query String The query parameters from the request as an unparsed string. 



A request cannot override any of the named __ow_ parameters. Doing so, results in a failed request with status equal to 400 Bad Request.

The __ow_user is only present when the web action is [annotated to require authentication](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-annotationsannotations-specific-to-web-actions) and allows a web action to implement its own authorization policy. The __ow_query is available only when a web action elects to handle the ["raw" HTTP request](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-actions_webactions_web_raw_enable). The __ow_query is a string that contains the query parameters that are parsed from the URI (separated by &). The __ow_body property is present in either raw HTTP requests, or when the HTTP request entity is not a JSON object or form data. Otherwise, web actions receive query and body parameters as first class properties in the action argument. Body parameters take precedence over query parameters, which in turn take precedence over action and package parameters.





 HTTPS Endpoint support 

Supported SSL protocols: TLS 1.2, TLS 1.3 ([draft version 18](https://datatracker.ietf.org/doc/html/draft-ietf-tls-tls13-18))





 Altering the response content of web action 

You can alter the response content of a web action to return different content types by using [Content extensions](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-actions_webactions_web_extra).

Before you begin
ibmcloud tg cc $gateway --name vpc-connection --network-id $vpcCRN --network-type vpc

To create a classic connection named classic-conn.

ibmcloud tg cc $gateway --name classic-conn --network-account-id 67123579566843320188712647902101 --network-type classic

To approve a connection from another account as the network owner, run the following command:

ibmcloud tg connection-approve|ca GATEWAY_ID CONNECTION_ID [-h, --help]

To reject a connection from another account as the network owner, run the following command:

ibmcloud tg connection-reject|cr GATEWAY_ID CONNECTION_ID [-h, --help]

For more information about available commands and options, see [Connections](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-transit-gateway-cliconnections) in the Transit Gateway commmand reference.







 Adding a cross-account connection with the API 

To add a cross-account connection, perform the following steps:



1. Request a connection to communicate between other accounts.
2. Perform actions on a requested connection. This must be completed.



For classic cross-account connections, be sure that the network-account-id is set to the account you are requesting to communicate with. For VPC cross-account connections, be sure that the network-id is set to the account that you are requesting to communicate with.



 Request cross-account connection 

The original account must request a connection to communicate with the other account.



 Request 

To request a cross-account connection, set the following parameters:



Table 1. Path parameters for adding a cross-account connection

 Path parameters Details 

 transit_gateway_id <br>Required <br>string The transit gateway identifier 





Table 2. Query parameters for adding a cross-account connection

 Query parameters Details 

 version <br>Required <br>string Requests the version of the API as of a date in the format YYYY-MM-DD.
Status codes

 Code Description 

 200 Function invocation accepted, the Function will be executed delayed. 
 202 Function invocation accepted, the Function will be executed asynchronously. 
 299 The Function exceeded the specified or maximum runtime limit and was aborted. 



As a developer of a Function, you can generate any arbitrary HTTP status code, even the ones listed previously. Therefore, a response header indicates that the status code was generated by the Function code.

Code Engine Functions adds the following response headers to the Function invocation response.



Table 2. Status codes

 Code Description 

 x-faas-actionstatus The HTTP status code set by the Function program logic. 
 x-faas-activation-id The unique ID to identify the Function invocation. 
 x-faas-result A success message or short error message that is returned by the Runtime container. 
 x-faas-errormessage A long error message with additional details. 
 x-faas-prewarmed A message that indicates whether the invocation was cold or if the Function ran in an existing (pre-warmed container. Possible values are false or true. 







 Function data input/output characteristics 

To run your Function in Code Engine, your code must implement a runtime contract with the following characteristics.



* Must be callable from a public web app endpoint, so that it can be embedded with web pages and then invoked from any Code Engine Eventing source, a Web Browser, or any other HTTPS capable client.
* Must implement a main procedure as entry point. The main procedure can receive input parameters in form of a JSON formatted data structure and can return output parameters, also in form of a JSON formatted data structure.
* Can receive an optional sub path, so that the Function can implement different flavors, based on the specified path. The Function's main procedure receives the path as a __ce_path input parameter.
* Can receive optional query parameters, which can be used to configure the Function at runtime. The Function's main procedure receives the parameters as key-value pairs within the JSON formatted input data structure.
* Can receive request headers, so that client code can specify accepted encodings.
2. Set Email verification to Enabled.
3. Set Allow users to sign in to your app without first verifying their email address to Yes. When set to yes, users are able to interact with your application after they sign up, but before they verify their email address. The default setting is no.
4. Customize the content of your message. You can add parameters and insert images by using the UI. To change the [language](https://cloud.ibm.com/docs/appid?topic=appid-cd-typescd-languages) of the message, you can use [the APIs](https://us-south.appid.cloud.ibm.com/swagger-ui//Management%20API%20-%20Config/mgmt.updateLocalization) to set the language. However, you are responsible for the content and conversion of the message. Check out the following table to see the different parameters that you can use in your message. If a user does not supply the information that is pulled by the parameter, it appears blank.



Table 2. Parameters that you can use in messages that are related to verification

 Parameter Description 

 %{linkExpiration.hours} Displays the number of hours the link is valid. 
 %{linkExpiration.minutes} Displays the number of minutes the link is valid. 
 %{verify.code} Displays a one-time verification URL. 
 %{verify.link} Displays the action URL that you specified in settings. 



You can also use the message parameters that are listed in the [Welcome message](https://cloud.ibm.com/docs/appid?topic=appid-cd-typescd-messages-welcome) section.
5. Define an expiration time for the action URL. The URL expiration is the amount of time, in minutes, that a user must complete the action before the verification link expires. This setting also affects the amount of time that your reset password link is valid.
6. Enter a URL for the page that you want to display after a user verifies their email in the Thank you page URL box.
2. Click the Check Host Profile Compliance icon.

On the Objects tab, the compliance status is updated as Compliant, Unknown or Non-compliant. A non-compliant status indicates a discovered and specific inconsistency between the profile and the new host.







 Reviewing compliance failures and remediation 



1. To see more detail on compliance failures, select the Host Profile from the Objects tab that is used in the compliance check.
2. In order to see specific detail on which parameters differ between the host that failed compliance and the Host Profile, click the Monitor tab and select the Compliance view.
3. Expand the object hierarchy and select the failing host.
4. The differing parameters are displayed in the Compliance window, under the hierarchy.
5. Review the parameters and understand why the new host can vary from the reference host. For parameters where the compliance isn't acceptable, remediate before moving the new host from maintenance mode. For example, where configuration drift is caused by system administrator action.







 Related links 



* [VMware HCX solution architecture](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-hcx-archi-introhcx-archi-intro)
* [IBM Cloud for VMware Solutions Demos](https://www.ibm.com/demos/collection/IBM-Cloud-for-VMware-Solutions/) (demonstrations)
The Load Balancer, knowing which Invokers are available, chooses one of them to invoke the action that you requested.





 6. Please form a line: Kafka 

The controller and the Invoker solely communicate through messages that are buffered and persisted by Kafka. Kafka lifts the burden of buffering in memory, which risks an OutOfMemoryException, from both the controller and the Invoker, while also making sure that messages are not lost if a system crashes.

To get the action invoked, the controller publishes a message to Kafka, a high-throughput, distributed, publish-subscribe messaging system. The message contains the action to invoke and the parameters to pass to that action (in this case none). This message is addressed to the Invoker.

After Kafka confirms that the message is received, it responds to the HTTP request with an Activation ID. You can use this ID to get access to the results of this specific invocation. This model is an asynchronous invocation model, where the HTTP request terminates once the system accepts the request to invoke an action. A synchronous model (called blocking invocation) is available, but not covered here.





 7. Invoking the code: Invoker 

The Invoker is the heart of Cloud Functions because the Invoker implements the action. To run actions in an isolated and safe way, Docker is used to set up a self-encapsulated environment (called a container) for each action that is invoked. After the container is created, the code is injected and then run with the parameters that were passed to it. When the results are returned, the container is destroyed. Performance optimizations can be done at this stage to reduce maintenance requirements, and make low response times possible.

In this case, with a Node.js based action at hand, the Invoker starts a Node.js container. Then, it injects the code from myAction, runs it with no parameters, extracts the result, saves the logs, and destroys the Node.js container.





 8. Storing the results: CouchDB again
"resource_plan_id": "<service-id>"
"point_in_time_recovery_time":"<TIMESTAMP>",
"point_in_time_recovery_deployment_id":"<DEPLOYMENT_ID>"
}'

The parameters name, target, resource_group, and resource_plan_id are all required. The target is the region where you want the new deployment to be located, which can be a different region from the source deployment. Cross-region restores are supported, except for restoring a eu-de back up to another region.

For PITR, use the point_in_time_recovery_time and point_in_time_recovery_deployment_id parameters. The point_in_time_recovery_deployment_id is the source deployment's ID and point_in_time_recovery_time is the timestamp in UTC you want to restore to. If you want to restore to the latest available point-in-time use "point_in_time_recovery_time":" ".

If you need to adjust resources or use a Key Protect key, add the optional parameters key_protect_key, members_disk_allocation_mb, members_memory_allocation_mb, and/or members_cpu_allocation_count, and their values to the body of the request.







 Verifying PITR 

In order to verify the correct recovery time, you must check the database logs. Checking the database logs requires the [Logging Integration](https://cloud.ibm.com/docs/databases-for-enterprisedb?topic=cloud-databases-logging) to be set up on your deployment.

When you perform a recovery, your data is restored from the most recent incremental backup and any outstanding transactions from the WAL log are used to catch your database up to the time you recovered to. After the recovery is finished, and the transactions are run, the logs display a message. You can check that your logs have the message,

LOG: last completed transaction was at log time 2019-09-03 19:40:48.997696+00

There are two scenarios where recovery does not show up in the logs.



1.
When a Cisco ASAv VPN receives a connection request from VPN for VPC, it uses IKE Phase 1 parameters to establish a secure connection and authenticate to VPN for VPC. Then, if the security policy permits the connection, the Cisco ASAv establishes the tunnel using IPsec Phase 2 parameters and applies the IPsec security policy. Key management, authentication, and security services are negotiated dynamically through the IKE protocol.

To support these functions, the following general configuration steps must be performed on the Cisco ASAv VPN:



* Make sure the public IP address for Cisco ASAv is configured directly on the ASAv. Use crypto isakmp identity address to ensure the Cisco ASAv uses the public IP address of the interface as its identity.

This global setting applies to all connections on the Cisco device, so if you need to maintain multiple connections, set crypto isakmp identity auto instead, to ensure that the Cisco device automatically determines the identity by connection type.
* Define the Phase 1 parameters that the Cisco ASAv VPN requires to authenticate VPN for VPC and establish a secure connection.
* Define the Phase 2 parameters that the Cisco ASAv VPN requires to create a VPN tunnel with VPN for VPC.



Create an IKE version 2 proposal object. IKEv2 proposal objects contain the parameters that are required for creating IKEv2 proposals when you define remote access and site-to-site VPN policies. IKE is a key management protocol that facilitates the management of IPsec-based communications. It is used to authenticate IPsec peers, negotiate and distribute IPsec encryption keys, and automatically establish IPsec SAs.

In this block, the following parameters are set as an example. You can choose other parameters according to your company's security policy; however, make sure to use identical parameters on IBM VPN gateway and ASAv.



* Encryption algorithm - Set to aes-256 for this example.
* Integrity algorithm - Set to sha256 for this example.
* Diffie-Hellman group - IPsec uses the Diffie-Hellman algorithm to generate the initial encryption key between the peers. In this example, it is set to group 19.
For example, if you want to create a trigger with alarm feed, then you must run a command similar to the following example:

ibmcloud fn trigger create triggerCron --feed /whisk.system/alarms/alarm --param cron “0,1,2,3,4,5”

In this case, the KEY and VALUE pair that follows --param are consumed by feed and are treated as feed parameters. By using the new options, you can differentiate between trigger parameters and feed parameters. The following command creates a trigger called triggerCron with cron feed parameters of 0,1,2,3,4,5 and a trigger parameter of KEY msg and VALUE of Hello World!.

ibmcloud fn trigger create triggerCron --feed /whisk.system/alarms/alarm --feed-param cron “0,1,2,3,4,5” --trigger-param msg “Hello World!”

The original --param option is not deprecated so you can continue to use it as you have previously. You simply now have the ability to separate your trigger and feed parameters by using the new options. However, please do not mix --param or --param-file options with either --trigger-param or --feed-param options. These options are considered two different ways of setting trigger parameters and must not be used together.







 ibmcloud fn trigger delete 

Delete a trigger.

ibmcloud fn trigger delete TRIGGER_NAME



 Example 

ibmcloud fn trigger delete mytrigger







 ibmcloud fn trigger fire 

Test a trigger by firing it, rather than waiting for it to be triggered automatically.

ibmcloud fn trigger fire TRIGGER_NAME [--param KEY VALUE] [--param-file FILE]



 Command options 

TRIGGER_NAME
: The name of the trigger. This value is required.

--paramKEYVALUE, -pKEYVALUE
: Parameter VALUES in the KEYVALUE format. This flag is optional.

--param-fileFILE, -PFILE
If you modify your non-service credential parameters, running an [package update](https://cloud.ibm.com/docs/openwhisk?topic=cloud-functions-cli-plugin-functions-clicli_pkg_update) command with new parameters removes any parameters that currently exist, but are not specified in the package update command. For example, if you run package update -p key1 new-value -p key2 new-value but omit any other parameters that were set, those parameters no longer exist after the package is updated. Any services that were bound to the package are also removed, so after you update other parameters you must [bind services to your package](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-services) again.
2. Verify that the parameters were bound to the package.

ibmcloud fn package get MyApp parameters

Example output

ok: got package MyApp, displaying field parameters

[
{
"key": "name",
"value": "World"
}
]
3. Verify that the parameters were inherited by the package.

ibmcloud fn package get MyApp/MyAction parameters

Example output

ok: got package MyApp/MyAction, displaying field parameters

[
{
"key": "name",
"value": "World"
}
]







 Sharing packages of actions 

After the actions and feeds that comprise a package are debugged and tested, the package can be shared with all Cloud Functions users. Sharing the package makes it possible for the users to bind the package, invoke actions in the package, and author Cloud Functions rules and sequence actions. Actions and feeds within a shared package are public. If the package is private, then all its contents are also private.



1. Run the [ibmcloud fn package update](https://cloud.ibm.com/docs/openwhisk?topic=cloud-functions-cli-plugin-functions-clicli_pkg_update) command to share the package with all users.
IKEv2 proposal objects contain the parameters that are required for creating IKEv2 proposals when you define remote access and site-to-site VPN policies. IKE is a key management protocol that facilitates the management of IPsec-based communications. It is used to authenticate IPsec peers, negotiate and distribute IPsec encryption keys, and automatically establish IPsec security associations (SAs).

In this block, the following parameters are set as an example. You can choose other parameters according to your company's security policy; however, make sure to use identical parameters on the IBM VPN gateway and ASAv.



* Encryption algorithm - Set to aes-256 for this example.
* Integrity algorithm - Set to sha256 for this example.
* Diffie-Hellman group - IPsec uses the Diffie-Hellman algorithm to generate the initial encryption key between the peers. In this example, it is set to group 19.
* Pseudo-Random Function (PRF) - IKEv2 requires a separate method that is used as the algorithm to derive keying material and hashing operations that are required for the IKEv2 tunnel encryption. This is referred to as the pseudo-random function and is set to sha256.
* SA Lifetime - Set the lifetime of the security associations (after which time a reconnection occurs) to 36000 seconds.



crypto ikev2 policy 100
encryption aes-256
integrity sha256
group 19
prf sha256
lifetime seconds 36000
crypto ikev2 enable outside

Create an IPsec policy for the connection. The IKEv2 supports multiple encryptions and authentication types, and multiple integrity algorithms for a single policy. The ASAv orders the settings from the "most secure" to the "least secure" and negotiates with the peer using that order.

 Create IPsec policy, IKEv2 support multiple proposals
crypto ipsec ikev2 ipsec-proposal ibm-vpc-proposal
protocol esp encryption aes-256
protocol esp integrity sha-256

Create the group policy and tunnel group. The peer address and pre-shared key are configured in this step.

 Create VPN default group policy
Typically your onsite networking team will specify the configuration to match agreed corporate standards and provide you with the necessary IP address of the data center VPN gateway, and the subnet address ranges that can be accessed.

Before commencing setup of the VPN, the IP addresses of the VPN gateways and IP network subnet ranges must be determined and available for the data center VPN configuration and for the secure private network enclosure in the IBM Cloud. These are illustrated in the following figure, where the APP zone in the secure enclosure will be connected via the IPSec tunnel to systems in the ‘DC IP Subnet’ in the client data center.

Zoom

![IPSec tunnel](https://cloud.ibm.com/docs-content/v1/content/01ccb31b85637ed5f03008c920c9596354caaf98/virtual-router-appliance/includes/solution-tutorials/includes/solution-tutorials/images/solution36-configuring-IPSEC-VPN/vpn-addresses.png)

IPSec tunnel

The following parameters must be agreed and documented between the IBM Cloud user configuring the VPN and the networking team for the client data center. In this example the Remote and Local tunnel IP addresses are set to 192.168.10.1 and 192.168.10.2. Any arbitrary subnet may be used with agreement of the on-site networking team.



List of parameters to review to configure the VPN

 Item Description 

 Name given to the IKE group for the connection. 
 Agreed IKE encryption standard to be used between IBM Cloud and the client data center, typically aes256. 
 Agreed IKE hash between IBM Cloud and client data center, typically sha1. 
 IKE lifetime from client data center, typically 3600. 
 Name given to ESP group for the connection. 
 Agreed ESP encryption standard between IBM Cloud and client data center, typically aes256. 
 Agreed ESP hash between IBM Cloud and client data center, typically sha1. 
 ESP lifetime from client data center, typically 1800. 
 Internet facing public IP address of the VPN gateway at the client data centre.
to int32 Required End time. Set as UNIX timestamp in seconds or milliseconds. 
 size int32 Optional Number of log lines to include in the export. 
 hosts string Optional Comma-separated list of hosts. 
 apps string Optional Comma-separated list of applications. 
 levels string Optional Comma-separated list of log levels. 
 tags string Optional Comma-separated list of tags. 
 query string Optional Search query. For more information, see [Search Logs](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-view_logsview_logs_step6). 
 prefer string Optional Defines the log lines that you want to export. Valid values are head, first log lines, and tail, last log lines. If not specified, defaults to tail. 
 email string Optional Specifies the email with the downloadable link of your export. By default, the log lines are streamed. 
 emailSubject string Optional Use to set the subject of the email. <br>Use %20 to represent a space. For example, a sample value is Export%20logs. 



When you include a query or a subject to an email, use %20 to represent a space.

For example, you can define a set of parameters to include information:

ENDPOINT/v1/export?to=START_TIME&from=END_TIME&hosts=LIST_OF_HOSTS<=vels=LIST_OF_LEVELS&size=N&query=(SEARCH_QUERY)" -u $TOKEN:





 Exporting logs 

Complete the following steps to export logs programmatically:



 Step 1. Get a service key 

[Get a service key](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-service_keys).





 Step 2. Identify the data to pass through the export parameters 

To verify that the query that you use in the export returns the set of logs that you are looking for, define the search query through the logging web UI. Refine the query until you can only see the logs that you want to export. Then, map the data to the query parameters.