vania-janet/multiturn-rag-retrieval-data huggingface dataset:
To assign a different name to a referenced key, use the format NAME:NEW_NAME=KEY_A. For example, to add an environment variable named myKey for a single key key1 in a configmap that is named configmapName, use the value configmapName:myKey=key1.



This value is optional.

--env-from-configmap-rm, --env-cm-rm
: Remove environment variable references to full configmaps by using the configmap name. To remove individual key references to configmaps, use the --env-rm option. This value is optional.

--env-sec, --env-from-secret
: Set environment variables from the key-value pairs that are stored in a secret by using one of the following ways:



* To add environment variables for all keys in a secret that is named secretName, use the value secretName. You can modify the environment variable names by specifying a prefix when referencing the secret. To specify a prefix, use the value PREFIX=SECRET_NAME. Each resulting environment variable has the format <PREFIX><NAME_OF_KEY_IN_SECRET>. For example, to set the prefix for all variable names of keys in secret secretName to CUSTOM_, use the value CUSTOM_=secretName. If the secret secretName contains KEY_A, the environment variable name is CUSTOM_KEY_A.
* To add environment variables for individual keys, use the format NAME:KEY_A,KEY_B. For example, to add an environment variable for a single key key1 in a secret that is named secretName, use the value secretName:key1. To assign a different name to a referenced key, use the format NAME:NEW_NAME=KEY_A. For example, to add an environment variable named myKey for a single key key1 in a secret that is named secretName, use the value secretName:myKey=key1.



This value is optional.

--env-from-secret-rm, --env-sec-rm
: Remove environment variable references to full secrets by using the secret name.
IBM-provided TLS certificates are signed by LetsEncrypt and are fully managed by IBM.

The IBM-provided Ingress subdomain wildcard, .<cluster_name>.<globally_unique_account_HASH>-0000.<region>.containers.appdomain.cloud, is registered by default for your cluster. The IBM-provided TLS certificate is a wildcard certificate and can be used for the wildcard subdomain.

Follow the steps to use the default TLS certificate for the IBM-provided Ingress subdomain.



1. Get the name of the secret where your default TLS certificate is stored. Note that this is the secret name you specify in the spec.tls section of your Ingress resource.

ibmcloud oc cluster get -c <cluster> | grep Ingress

Example output

Ingress Subdomain: mycluster-<hash>-0000.us-south.containers.appdomain.cloud
Ingress Secret: mycluster-<hash>-0000
2. View the secret details and note the CRN value. This is the CRN of the TLS certificate.

ibmcloud oc ingress secret get -c <cluster> --name <secret_name> --namespace default
3. Create a secret for the default TLS certificate in each namespace where your Ingress resources or apps exist. Specify the TLS certificate CRN with the --cert-crn command option.

ibmcloud oc ingress secret create --cluster <cluster_name_or_ID> --cert-crn <CRN> --name <secret_name> --namespace <namespace>

To copy the secret with the ibmcloud oc ingress secret create command, you must have a default [Secrets Manager](https://cloud.ibm.com/docs/openshift?topic=openshift-secrets-mgr) instance registered to your cluster. If you do not have a Secrets Manager instance and your secrets are instead written directly to your cluster, your secrets do not have the required CRN value and you must manually copy them with oc commands.
"id": "091ca93f-5c99-4078-9d7e-4801143030fd",
"labels": [
"test",
"us-south"
],
"last_update_date": "2020-10-09T17:13:47Z",
"name": "new-credential-name",
"secret_type": "IAM_CREDENTIALS",
"state": 1,
"state_description": "Active",
"ttl": 3600
},
"warnings": null
}







 Delete a role 

Use the following commands to delete a role.

Delete a role in the default secret group.

vault delete ibmcloud/SECRET_TYPE/roles/ROLE_ID

Delete a role that is to a secret group.

vault delete ibmcloud/SECRET_TYPE/roles/groups/SECRET_GROUP_ID/ROLE_ID



 Prerequisites 

You need the [Writer service role](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam) to update the metadata of a secret.





 Command options 

SECRET_TYPE
: The type of secret that you want to delete. Currently, iam_credentials is supported.

SECRET_GROUP_ID
: The ID of the secret group that is assigned to the role and its credentials.

ROLE_ID
: The ID that assigned to this secret.





 Examples 

Delete a role that is assigned to the default group.

vault delete ibmcloud/iam_credentials/roles/091ca93f-5c99-4078-9d7e-4801143030fd





 Output 

The command returns the following output:

Success! Data deleted (if it existed) at: ibmcloud/iam_credentials/roles/091ca93f-5c99-4078-9d7e-4801143030fd









 Locks 



 Lock a secret
To store an image pull secret in the Kubernetes service account, use the [following steps](https://cloud.ibm.com/docs/openshift?topic=openshift-registrystore_imagePullSecret).





 Storing the image pull secret in the Kubernetes service account for the selected project 

Every Red Hat OpenShift project has a Kubernetes service account that is named default. Within the project, you can add the image pull secret to this service account to grant access for pods to pull images from your registry. Deployments that don't specify a service account automatically use the default service account for this Red Hat OpenShift project.



1. Check if an image pull secret already exists for your default service account.

oc describe serviceaccount default -n <project_name>

When <none> is displayed in the Image pull secrets entry, no image pull secret exists.
2. Add the image pull secret to your default service account.



* Example command to add the image pull secret when no image pull secret is defined.

oc patch -n <project_name> serviceaccount/default -p '{"imagePullSecrets":[{"name": "<image_pull_secret_name>"}]}'
* Example command to add the image pull secret when an image pull secret is already defined.

oc patch -n <project_name> serviceaccount/default --type='json' -p='[{"op":"add","path":"/imagePullSecrets/-","value":{"name":"<image_pull_secret_name>"}}]'



3. Verify that your image pull secret was added to your default service account.

oc describe serviceaccount default -n <project_name>

Example output

Name: default
Namespace: <namespace_name>
Labels: <none>
Annotations: <none>
Image pull secrets: <image_pull_secret_name>
Mountable secrets: default-token-sh2dx
To assign a different name to a referenced key, use the format NAME:NEW_NAME=KEY_A. For example, to add an environment variable named myKey for a single key key1 in a configmap that is named configmapName, use the value configmapName:myKey=key1.



This value is optional.

--env-from-configmap-rm, --env-cm-rm
: Remove environment variable references to full configmaps by using the configmap name. To remove individual key references to configmaps, use the --env-rm option. This option can be specified multiple times. This value is optional.

--env-sec, --env-from-secret
: Set environment variables from the key-value pairs that are stored in a secret by using one of the following ways:



* To add environment variables for all keys in a secret that is named secretName, use the value secretName. You can modify the environment variable names by specifying a prefix when referencing the secret. To specify a prefix, use the value PREFIX=SECRET_NAME. Each resulting environment variable has the format <PREFIX><NAME_OF_KEY_IN_SECRET>. For example, to set the prefix for all variable names of keys in secret secretName to CUSTOM_, use the value CUSTOM_=secretName. If the secret secretName contains KEY_A, the environment variable name is CUSTOM_KEY_A.
* To add environment variables for individual keys, use the format NAME:KEY_A,KEY_B. For example, to add an environment variable for a single key key1 in a secret that is named secretName, use the value secretName:key1. To assign a different name to a referenced key, use the format NAME:NEW_NAME=KEY_A. For example, to add an environment variable named myKey for a single key key1 in a secret that is named secretName, use the value secretName:myKey=key1.



This value is optional.

--env-from-secret-rm, --env-sec-rm
: Remove environment variable references to full secrets by using the secret name.
Command Options 

-n, --name
: The name of the application. Use a name that is unique within the project.



* The name must begin with a lowercase letter.
* The name must end with a lowercase alphanumeric character.
* The name must be 63 characters or fewer and can contain lowercase letters, numbers, and hyphens (-).



This value is required.

--argument, --arg, -a
: Set arguments for the application. Specify one argument per --argument option; for example, -a argA -a argB. This value overrides the default values that are specified within the container image. This value is optional.

--build-commit, --commit, --bcm, --cm, --revision
: The commit, tag, or branch in the source repository to pull. The build commit option is allowed only if the --build-source option is set. This value is optional.

--build-context-dir, --context-dir, --bcdr, --cdr
: The directory in the repository that contains the buildpacks file or the Dockerfile. The build context directory option is allowed only if the --build-source option is set. This value is optional.

--build-dockerfile, --dockerfile, --bdf, --df
: The path to the Dockerfile. Specify this option only if the name is other than Dockerfile. The build dockerfile option is allowed only if the --build-source option is set. This value is optional. The default value is Dockerfile.

--build-git-repo-secret, --git-repo-secret, --bgrs, --grs, --repo
: The name of the SSH secret, which contains the credentials to access the private repository that contains the source code to build your container image. To create this SSH secret, use the secret create --format SSH command.
* You application is now accessible through the CNAME only: https://<CNAME>. You may need to wait a few minutes for all configuration to complete and for the CNAME to work.







 Step 3: Enable Dynamic Content Acceleration (DCA) 

At that stage, the static content of the application is cached by the CDN but not the dynamic content.

The Dynamic Content Acceleration (DCA) feature will query a test object in about 10KB size on your origin server to determine the optimal routes for real requests. For this purpose, the application has been customized to include [a test object](https://github.com/IBM-Cloud/cdn-with-cda-todolist/blob/master/views/detection-test-object.html) made available at [/test-dca](https://github.com/IBM-Cloud/cdn-with-cda-todolist/blob/master/main.goL11).

To activate DCA:



1. Select the Settings tab in the CDN configuration.
2. Under the Optimization settings section, click Edit and select Dynamic Content Acceleration from the Optimized for drop-down list.
3. Under the Detection path section, specify the path /test-dca as the detection path, and click Test to verify the path is set correctly. This detection path will be used periodically by IBM® Content Delivery Network to determine the fastest path to the origin.
4. Make sure Prefetching and Image compression are both set to On.

Zoom

![Configure DCA](https://cloud.ibm.com/docs-content/v1/content/006fd22ab2811b7d19804c763a00568b3da4c03a/CDN/includes/solution-tutorials/includes/solution-tutorials/images/solution52-cdn-dca/detection_path.png)

Configure DCA
5. Click Save. You have successfully accelerated your application deployed in Kubernetes Service cluster with Dynamic Content Acceleration.
The default value is true.

--no-wait, --nw
: Update the application and do not wait for the application to be ready. If you specify the no-wait option, the application update begins and does not wait. Use the app get command to check the application status. This value is optional. The default value is false.

--output, -o
: Specifies the format of the command output. Valid values are json, yaml, jsonpath=JSONPATH_EXPRESSION, jsonpath-as-json=JSONPATH_EXPRESSION, url, and project-url. Use jsonpath to specify the path to an element of the JSON output. This value is optional.

--port, -p
: The port where the application listens. The format is [NAME:]PORT, where [NAME:] is optional. If [NAME:] is specified, valid values are h2c, or http1. When [NAME:] is not specified or is http1, the port uses HTTP/1.1. When [NAME:] is h2c, the port uses unencrypted HTTP/2. By default, Code Engine assumes apps listen for incoming connections on port 8080. If your application needs to listen on a port other than port 8080, use --port to specify the port. This value is optional.

--quiet, -q
: Specify this option to reduce the output of the command. This value is optional. The default value is false.

--rebuild
: Rebuild image from source. The rebuild option is allowed if your application currently has an associated build. This value is optional. The default value is false.

--registry-secret, --rs
: The name of the registry secret. The registry secret is used to authenticate with a private registry when you download the container image. This value is optional.

--registry-secret-clear, --rsc
: Clear the registry secret. This value is optional. The default value is false.
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.



 Example ingress secret field ls command 

ibmcloud ks ingress secret field ls --cluster a11a11a11a111a1a111a --name my-secret --namespace default







 ibmcloud ks ingress secret field rm 

Virtual Private Cloud

Classic infrastructure

ibmcloud ks ingress secret field rm --cluster CLUSTER --name NAME --namespace NAMESPACE [--field-name NAME]

Minimum required permissions
: Administrator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

--c, --cluster CLUSTER
: Required. The name or ID of the cluster.

--name NAME
: Required. The name of the secret to remove the field from.

--namespace NAMESPACE
: Required. The namespace that the secret is deployed to.

--field-name NAME
: The name of the field to remove. To see a list of fields, run [ibmcloud ks ingress secret field ls](https://cloud.ibm.com/docs/cli?topic=cli-kubernetes-service-clics_ingress_secret_field_ls).



 Example ingress secret field rm command 

ibmcloud ks ingress secret field rm --cluster a11a11a11a111a1a111a --name my-secret --namespace default --field-name test-field-name







 ibmcloud ks ingress secret get 

Virtual Private Cloud

Classic infrastructure

View information about Ingress secrets in your cluster, including secrets stored in IBM Cloud® Secrets Manager.

The previous alias for this command, ibmcloud ks ingress alb cert get, is deprecated. In CLI version 1.0.157 and later, the ibmcloud ks ingress alb cert category is deprecated, and these commands are now listed in the ibmcloud ks ingress secret subcategory.
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.



 Example ingress secret field ls command 

ibmcloud ks ingress secret field ls --cluster a11a11a11a111a1a111a --name my-secret --namespace default







 ibmcloud ks ingress secret field rm 

Virtual Private Cloud

Classic infrastructure

ibmcloud ks ingress secret field rm --cluster CLUSTER --name NAME --namespace NAMESPACE [--field-name NAME]

Minimum required permissions
: Administrator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

--c, --cluster CLUSTER
: Required. The name or ID of the cluster.

--name NAME
: Required. The name of the secret to remove the field from.

--namespace NAMESPACE
: Required. The namespace that the secret is deployed to.

--field-name NAME
: The name of the field to remove. To see a list of fields, run [ibmcloud ks ingress secret field ls](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_ingress_secret_field_ls).



 Example ingress secret field rm command 

ibmcloud ks ingress secret field rm --cluster a11a11a11a111a1a111a --name my-secret --namespace default --field-name test-field-name







 ibmcloud ks ingress secret get 

Virtual Private Cloud

Classic infrastructure

View information about Ingress secrets in your cluster, including secrets stored in IBM Cloud® Secrets Manager.

The previous alias for this command, ibmcloud ks ingress alb cert get, is deprecated. In CLI version 1.0.157 and later, the ibmcloud ks ingress alb cert category is deprecated, and these commands are now listed in the ibmcloud ks ingress secret subcategory.
For each key-value pair in the configmap, a file is added to the specified mount directory where the filename is the key and the contents of the file is the value of the key-value pair. Specify one mount configuration per --mount-configmap option; for example, --mount-configmap /etc/config-a=config-a --mount-configmap /etc/config-b=config-b. This value is optional.

--mount-rm
: Remove the contents of a configmap or secret from the file system of this job run by specifying the directory where the configmap or secret is mounted. Specify one mount directory per --mount-rm option; for example, --mount-rm /etc/configmap-a --mount-rm /etc/secret-b. This value is optional.

--mount-secret, --mount-sec
: Add the contents of a secret to the file system of this job run by providing a mount directory and the name of a secret, with the format MOUNT_DIRECTORY=SECRET_NAME. Each mounted secret must use a unique mount directory. For each key-value pair in the secret, a file is added to the specified mount directory where the filename is the key and the contents of the file is the value of the key-value pair. Specify one mount configuration per --mount-secret option; for example, --mount-secret /etc/secret-a=secret--a --mount-secret /etc/secret-b=secret-b. This value is optional.

-n, --name
: The name of this job run. This value is required if the referenced job does not have a related job configuration. Use a name that is unique within the project.



* The name must begin and end with a lowercase alphanumeric character.
* The name must be 53 characters or fewer and can contain lowercase letters, numbers, and hyphens (-).



This value is optional.

--no-wait, --nw
The following example creates image registry access that is called myregistry to a Container Registry instance that is located at us.icr.io and uses a username of iamapikey and the IAM API key as a password.

ibmcloud ce registry create --name myregistry --server us.icr.io --username iamapikey --password API_KEY





 Example output 

Creating image registry access secret myregistry...

OK







 ibmcloud ce registry delete 

Delete an image registry access secret.

ibmcloud ce registry delete --name NAME [--force] [--ignore-not-found] [--quiet]



 Command Options 

--name, -n
: The name of the image registry access secret. This value is required.

--force, -f
: Force deletion without confirmation. This value is optional. The default value is false.

--ignore-not-found, --inf
: If not found, do not fail. This value is optional. The default value is false.

--quiet, -q
: Specify this option to reduce the output of the command. This value is optional. The default value is false.





 Example 

ibmcloud ce registry delete --name myregistry -f





 Example output 

Deleting image registry access secret myregistry...

OK







 ibmcloud ce registry get 

Display the details of an image registry access secret.

ibmcloud ce registry get --name NAME [--decode] [--output OUTPUT] [--quiet]



 Command Options 

--name, -n
: The name of the image registry access secret. This value is required.

--decode, -d
: Show the Data output as decoded in the details. If this option is not specified, the Data details are base64-encoded. This value is optional. The default value is false.

--output, -o
: Specifies the format of the command output.
The build dockerfile option is allowed only if the --build-source option is set on this app update command, or your application currently has an associated build. This value is optional. The default value is Dockerfile.

--build-git-repo-secret, --git-repo-secret, --bgrs, --grs, --repo
: The name of the SSH secret, which contains the credentials to access the private repository that contains the source code to build your container image. To create this SSH secret, use the secret create --format SSH command. An SSH secret is also used as a Git repository access secret. This option is allowed only if the --build-source option is set to the URL of a Git repository on this application update command, or your application currently has an associated build from a Git repository source. This value is optional.

--build-git-repo-secret-clear, --git-repo-secret-clear, --bgrsc, --grsc
: Clear the SSH secret. This option is allowed if your application currently has an associated build. This value is optional. The default value is false.

--build-size, --size, --bsz, --sz
: The size for the build, which determines the amount of resources used. Valid values are small, medium, large, xlarge. For details, see [Determining the size of the build](https://cloud.ibm.com/docs/codeengine?topic=codeengine-plan-buildbuild-size). The build size option is allowed only if the --build-source option is set on this app update command, or your application currently has an associated build. This value is optional. The default value is medium.

--build-source, --source, --bsrc, --src
: The URL of the Git repository or the path to local source that contains your source code; for example https://github.com/IBM/CodeEngine or ..
[Menu icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/icon_hamburger.svg)> Resource List.
2. From the list of services, select your instance of Secrets Manager.
3. In the Secrets table, click Add.
4. From the list of secret types, select the Key-value tile.
5. Click Next.
6. Add a name and description to easily identify your secret.
7. Select the

secret groupthat you want to assign to the secret.

Don't have a secret group? In the Secret group field, you can click Create to provide a name and a description for a new group. Your secret is added to the new group automatically. For more information about secret groups, check out [Organizing your secrets](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-secret-groups).
8. Optional: Add labels to help you to search for similar secrets in your instance.
9. Optional: Add metadata to your secret or to a specific version of your secret.



1. Upload a file or enter the metadata and the version metadata in JSON format.



10. Click Next.
11. Select a file or enter the secret value that you want to associate with the secret.

You must enter the key-value data as a JSON object. The maximum file size is 512 KB.
12. Click Next.
13. Review the details of your secret.
14. Click Add.







 Creating key-value secrets from the CLI