vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Adding a Keystore, connecting to a Database and enrolling an Application 

After you have completed configuring the Data Security Broker Manager, the next steps is to connect to a database, add a keystore and enroll an application to perform the data encryption.



1.  Refer to the [Add a Database in Data Security Broker Manager](https://cloud.ibm.com/docs/security-broker?topic=security-broker-sb_add_db) section to add a database in the Data Security Broker Manager.
2.  Refer to the [Add a Keystore in Data Security Broker Manager](https://cloud.ibm.com/docs/security-broker?topic=security-broker-sb_add_keystore) section to connect to a keystore in the Data Security Broker Manager.
3.  Refer to the [Enrolling an Application in Data Security Broker Manager](https://cloud.ibm.com/docs/security-broker?topic=security-broker-sb_enroll_app) section to enroll an application in the Data Security Broker Manager.
* All products in the same family, Cloud Pak for Data, Cloud Pak for Automation, Cloud Pak for Security
* All terms in the same category, carburetor, piston, valves



For more information, see [Creating a facet by creating a dictionary](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-facetsfacetdict).

To add a facet by identifying a pattern, complete the following steps:



1. On the Improve and customize page, click Customize display, and then click Facets.
2. Click New facet > By identifying a pattern.
3. On the Create facet from a new pattern page, choose how you want to select documents. You can allow Discovery to select 10 random documents for you or you can select up to 20 documents yourself.

If you select the documents yourself, follow these guidelines:



* Choose documents that contain mentions of the pattern in every different format that you want the model to be able to recognize later.
* If you want the model to understand ways that a term is used that don't fit the pattern, include a document that uses the term in the wrong way so you can intentionally omit its selection.

For example, the pattern you want to add might capture mentions of clothing. In documents that mention a top to refer to a shirt, you would select top as a clothing mention. But, you might also want to include a document that mentions the top 3 fashion trends and purposely not select top when the term is used in this context. The omission teaches the model that top doesn't fit the pattern when the term is used to mean the best.
* Include documents that have a maximum of 5,000 characters. Any document that exceeds the limit is truncated to 5,000 characters.



4. Click Next.
5. Select example words or phrases that fit the pattern that you want to define.

For example, if you want to define a date pattern, start highlighting date mentions in each document. If you make a mistake, hover over the selection and click the x to delete it.

Be sure to select every mention of the pattern.
export MQSERVER="CLOUD.ADMIN.SVRCONN/TCP/<HOSTNAME>(<PORT>)"
* On Windows:

set MQSAMP_USER_ID=alice
set MQSERVER=CLOUD.ADMIN.SVRCONN/TCP/<HOSTNAME>(<PORT>)
* <HOSTNAME> - this is 'hostname' in the file connection_info.txt(refer to Appendix#1)
* <PORT> - this is 'listenerPort' in the file connection_info.txt(refer to Appendix#1)



3. Create the following environment variables in bob's command shell.



* On Linux/Mac:

export MQSAMP_USER_ID=bob
export MQSERVER="CLOUD.ADMIN.SVRCONN/TCP/<HOSTNAME>(<PORT>)"
* On Windows:

set MQSAMP_USER_ID=bob
set MQSERVER=CLOUD.ADMIN.SVRCONN/TCP/<HOSTNAME>(<PORT>)
* <HOSTNAME> - this is 'hostname' in the file connection_info.txt(refer to Appendix#1)
* <PORT> - this is 'listenerPort' in the file connection_info.txt(refer to Appendix#1)



4. From alice's command shell, run the sample program to send a message to the target queue.

amqsputc DEV.QUEUE.1 <your Queue manager name>



1. Enter the application API key for alice when prompted for a password(this is your 'apiKey' value in the file "applicationApiKeyalice.json)
2. Type the text of the message, then press Enter key twice to send only a single message.



Pressing the Enter key twice will exit the sample application.

!
Add the IBM Cloud Kubernetes Service cluster that you want to back up with PX-Backup. You can select any cluster in your account, including the cluster where you installed PX-Backup.

Before you begin:



* [Log in to the PX-Backup console](https://cloud.ibm.com/docs/containers?topic=containers-storage_portworx_backuppx-backup-ui).
* [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)



The kubeconfig in clusters with PX-Backup expires after 24 hours. To prevent your cluster's kubeconfig file from expiring, set the context with your cluster using the --admin option. ibmcloud ks cluster config --cluster <cluster_name> --admin

Adding a cluster:



1. In the PX-Backup console, click Backups.
2. Click Add Cluster.
3. Enter the name of the cluster that you want to back up.
4. In the CLI, get the kubeconfig file output for your cluster. Make sure that you have set the context to your cluster with the --admin option to prevent the kubeconfig from expiring.

kubectl config view --flatten --minify
5. Copy the entire kubeconfig CLI output and paste it into the Kubeconfig field in the PX-Backup console.
6. Select Others as your Kubernetes Service.
7. If the cluster that you want to add to the PX-Backup service does not have Portworx installed in it, [you must install Stork onto the cluster](https://cloud.ibm.com/docs/containers?topic=containers-storage_portworx_backuppx-backup-stork).
The vSRX node is not started. Start the vSRX VM and retry the operation.





 Error 1119 

The vSRX node's VM is running but the node is not accessible via telnet. Exit from all console (telnet) sessions and retry the operation.





 Error 1120 

The vSRX node does not have a valid license. Remove any evaluation licenses and apply a valid license. Then retry the operation. Refer to [Known limitations for IBM Cloud Juniper vSRX](https://cloud.ibm.com/docs/vsrx?topic=vsrx-known-limitations-for-ibm-cloud-juniper-vsrx) for more information on identifying and removing the evaluation license.





 Error 1121 

License operations against vSRX v15.1 are not supported. Upgrade to a newer version of the vSRX.





 Error 1122 

An error occurred in the readiness check, try again or contact support.





 Error 1123 

The vSRX console has an active session in edit mode. Exit the console session and retry.





 Error 1124 

The gateway experienced a precheck setup failure due to a Juniper incompatibility change in version 18.4. Specify a vlan-id for each interface configured with vlan-tagging. Refer to [Correcting error 1124](https://cloud.ibm.com/docs/vsrx?topic=vsrx-correcting-readiness-errorscorrecting-1124) for more information.





 Error 1125 

The gateway experienced a precheck setup failure due to a Juniper incompatibility change in the version 18.4 syslog settings. Refer to [Correcting error 1125](https://cloud.ibm.com/docs/vsrx?topic=vsrx-correcting-readiness-errorscorrecting-1125) for more information.





 Error 1126 

The gateway control link is down. Ensure vnet0 and vnet1 are configured on the Ubuntu host and retry.





 Error 1127 

The Ubuntu host is missing an ethernet interface in bond0.
If you do not have an account:



1. Click the Sign up button.
2. After you create a free trial account, upgrade it to a Pay-As-You-Go type by going to Manage > Billing and Usage > Billing in the IBM Cloud console, and clicking Add Credit Card.
3. Ensure that the user has both Administrator and Manager roles for the Kubernetes cluster that they will link to their blockchain service instance. See these steps on [how to assign Kubernetes access roles](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-v2-deploy-iks-icibp-v2-deploy-iks-k8x-access-roles) for more information.





When you plan to use the service instance in the context of a broader organization-wide solution, it is recommended that the participating organizations use a functional email address to create their network. In this case, access to the network does not depend on any single individual's availability.



* If you plan to use an existing Kubernetes cluster on IBM Cloud, ensure the version of Kubernetes it is running is between v1.24 - v1.26. For more information about how to determine what version of Kubernetes your cluster is running and how to upgrade the version, see [Updating the Kubernetes version of your cluster](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-v2-deploy-iks-icibp-v2-deploy-iks-updating-kubernetes).
* If you plan to use a Hardware Security Module (HSM) to generate and store the private key for your peer and ordering nodes, you can configure the HSM before you deploy the platform. Along with deploying the HSM device itself, in order for the blockchain components to access the HSM partition, you also need to publish an HSM client image to a container registry. If you decide to publish an HSM client image to a container registry, you can enable HSM support for the platform by providing the image URL when you link the service to your cluster.
For more information on what roles are enabled and what actions each access role allows for each service, see the documentation for that service.
* Custom roles for a service can be created on the IAM Roles page by the account owner or a user assigned the administrator role on the role management service.

You can review the available roles and associated actions for a particular service by going to the [Roles](https://cloud.ibm.com/iam/roles) page, and selecting the service that you want to learn more about. This is the same page where you can create a custom role in the console.





 Platform management roles 

With platform management roles, users can be assigned varying levels of permission for performing platform actions within the account and on a service. For example, platform management roles that are assigned for catalog resources enable users to complete actions such as creating, deleting, editing, and viewing service instances. And, the platform management roles that are assigned for account management services enable users to complete actions such as inviting and removing users, working with resource groups, and viewing billing information. For more information about the account management services, see [Assigning access to account management services](https://cloud.ibm.com/docs/account?topic=account-account-services).

Select all roles that apply when you create a policy. Each role allows separate actions to be completed and doesn't inherit the actions of the lesser roles.

The following table provides examples for some of the platform management actions that users can take within the context of catalog resources and resource groups. See the documentation for each catalog product to understand how the roles apply to users within the context of the service that is being used.



Table 1. Example platform management roles and actions for services in an account
The first row of the table describes separate options that you can choose from when creating a policy, and the first column describes the selected roles for the policy. The remaining cells map to the selected role from the first column, and to the selected policy from the first row.

 One or all IAM-enabled services Selected service in a resource group Resource group access 

 Viewer role View instances, aliases, bindings, and credentials View only specified instances in the resource group View resource group
* UI
* CLI
* API
* Terraform







 Managing access for IBM Cloud Direct Link 

Access to the Direct Link service instance for users in your account is controlled by IBM Cloud® Identity and Access Management (IAM). Every user that accesses the Direct Link service in your account must be assigned an access policy with an IAM role. Review the following roles, actions, and more to help determine the best way to assign access to Direct Link.

IBM Cloud® Direct Link enables connectivity between customer on-premises resources to IBM Cloud resources that are hosted in classic and Virtual Private Cloud (VPC) infrastructures.

The access policy that you assign users in your account determines what actions a user can perform within the context of the service or specific instance that you select. The allowable actions are customized and defined by the direct link as operations that are allowed to be performed on the service. Each action is mapped to an IAM platform or service role that you can assign to a user.

If a specific role and its actions don't fit the use case that you're looking to address, you can [create a custom role](https://cloud.ibm.com/docs/account?topic=account-custom-rolescustom-access-roles) and pick the actions to include.

IAM access policies enable access to be granted at different levels. Some of the options include the following:



* Access across the instance of the Direct Link service in your account
* Access to an individual service instance in your account
* Access to a specific resource within an instance



Review the following table that outlines what types of tasks each role allows for when you're working with the Direct Link service. Platform management roles enable users to perform tasks on service resources at the platform level, for example, assign user access to the service, and create or delete instances.

Direct Link does not have service-access roles, which enable users access to Direct Link and the ability to call the Direct Link API. For information about the exact actions that are mapped to each role, see [Direct Link](https://cloud.ibm.com/docs/account?topic=account-iam-service-roles-actionsdirect-link).



Table 1.
For information on the default security group, refer to [Updating the default security group](https://cloud.ibm.com/docs/vpc-on-classic-network?topic=vpc-on-classic-network-updating-the-default-security-group).





 service_manager_service_failure 

Message: None

For further instructions to fix this problem, refer to the [API documentation](https://cloud.ibm.com/apidocs/vpc-on-classic). If this problem persists, [contact support](https://cloud.ibm.com/docs/vpc-on-classic?topic=vpc-on-classic-getting-help-and-support).





 subnet_conflict 

Message: CIDR conflicts with existing Subnet in VPC.

Run the GET /subnets API to retrieve all subnets in VPC. Check the value of ipv4_cidr_block to make sure that the CIDR you have provided is not in use by other subnets.

If using the CLI, you can run ibmcloud is subnets and look at "Subnet CIDR" value for conflicts.

Refer to the [API documentation](https://cloud.ibm.com/apidocs/vpc-on-classic) for additional help. If this problem persists, [contact support](https://cloud.ibm.com/docs/vpc-on-classic?topic=vpc-on-classic-getting-help-and-support).





 subnet_not_empty 

Message: Cannot delete the subnet until it is empty. Delete any resources in the subnet and retry.

There was a request to delete a subnet, but the subnet still has resources in it. Subnets may have instances, VPNs, load balancers, or public gateways in them. You must delete your resources in the subnet before you can delete the subnet.

In some situations, this error can occur even when the console shows 0 VSIs and 0 load balancers. Deletion is asynchronous, and it may take a few minutes for the internal status to change.
Several options are available, but this tutorial follows the steps to [copy an image pull secret](https://cloud.ibm.com/docs/containers?topic=containers-registrycopy_imagePullSecret) to the test namespace. Rather than copying all the icr.io secrets, you can copy the us.icr.io secret because your image is in that local registry. The following command copies the default-us-icr-io secret to the test namespace, giving it the name test-us-icr-io:

kubectl get secret default-us-icr-io -o yaml | sed 's/default/test/g' | kubectl -n test create -f -
5. Two options are available to [use the image pull secret](https://cloud.ibm.com/docs/containers?topic=containers-registryuse_imagePullSecret). This tutorial uses the option to refer to the image pull secret in the deployment .yaml file by populating the spec.imagePullSecrets field. The following snippet shows the required lines in context; you must add the final two lines:

spec:
containers:
- name: hello-world
image: us.icr.io/<my_namespace>/hello-world:1
imagePullPolicy: Always
imagePullSecrets:
- name: test-us-icr-io
6. Delete your deployment and reapply the configuration:



1. Delete your deployment by running the following command:

kubectl delete -f hello-world.yaml
2. Reapply the configuration by running the following command:

kubectl apply -f hello-world.yaml



This time the command succeeds, and you can access your container by using a curl command or a web browser.
Configure DNS 



 Journey Map 

![Architecture](https://cloud.ibm.com/docs-content/v1/content/b7b9235ce6abd45b66931867c388cf107d38e15b/cloud-native-journey/kubernetes-on-vpc/images/dns/journey-map.png)





 Overview 

Application pods in your IKS Cluster uses CoreDNS as its DNS provider. If CoreDNS is unable to resolve a DNS request, it forwards the the request to the IBM Cloud Private DNS. In some circumstances, you may choose to customize the DNS settings, such as needing to integrate with a private on-prem DNS for accessing on-prem resources. In this section of the journey, we will review some of these scenarios.

The process which loads images from a container registry is configured to use the IBM Cloud DNS Server and does not use CoreDNS. If you will be using a private on-prem container registry, be sure to refer to the section below to configure the IBM Cloud DNS Server.

![Architecture](https://cloud.ibm.com/docs-content/v1/content/b7b9235ce6abd45b66931867c388cf107d38e15b/cloud-native-journey/kubernetes-on-vpc/images/dns/dns1.png)





 On-Prem Private DNS 

If your IBM Cloud Account is connected to your on-prem network and if your application will be referencing private on-prem hostnames, you will need to configure CoreDNS. As shown in the figure below, the CoreDNS configuration is extended so if any queries for the private acme.com domain are received, CoreDNS will forward the request to an on-prem private DNS Server.
For more information about setting up the custom script, see [Example custom scripts for DevSecOps](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-cra-cli-plugindevsecops-custom-script-examples).

FAILED
Error executing docker build cmd for stage-0: exit status 1
...
COPY file-to-copy.js file-to-copy.js:
------
failed to compute cache key: "/file-to-copy.js" not found: not found

By default, the Code Risk Analyzer bom-generate command builds the Dockerfiles from the context of the location of the Dockerfile itself. If you want to build the Dockerfiles from the context of the root project directory, use the cra-docker-build-context parameter to allow the Code Risk Analyzer to build the Dockerfiles from this context.







 Removing stored Code Risk Analyzer data 

The Code Risk Analyzer plug-in does not store any client data in its databases. However, earlier versions of Code Risk Analyzer Tekton tasks securely stored the results of vulnerability scans in its database.

To request the removal of any client data that might be stored in the Code Risk Analyzer, contact [IBM Support](https://cloud.ibm.com/unifiedsupport/supportcenter).





 FAQs 

Get answers to frequently asked questions about using the Code Risk Analyzer CLI.



 How can I determine why the CLI failed? 

Before you call the Code Risk Analyzer CLI, set the IBMCLOUD_TRACE environment variable to true to turn on the debug log.

export IBMCLOUD_TRACE=true

Observe the API calls and the responses that are shown in the log to determine the exact reason for failure.





 How can I debug a BOM command that fails to pull a base image from a private registry. 

Make sure that you are authenticated with the registry where the base image resides by using the ibmcloud cr login command or the docker login command.
Configure IBM Key Protect and IBM Cloud Hyper Protect Crypto Services (HPCS) 

In this section, you can find details on how to configure IBM Key Protect and IBM Cloud Hyper Protect Crypto Services (HPCS) and add it as a keystore in Data Security Broker Manager.

Refer to the [Configuring and adding IBM Key Protect as a Keystore in Data Security Broker Manager](https://cloud.ibm.com/docs/security-broker?topic=security-broker-sb_ibm_keyprotect). section to configure IBM Key Protect and add it as a Keystore in Data Security Broker Manager.

Refer to the [Configuring and adding HPCS as a Keystore in Data Security Broker Manager](https://cloud.ibm.com/docs/security-broker?topic=security-broker-sb_hpcs) section to configure IBM Key Protect and add it as a Keystore in Data Security Broker Manager.
Managing IAM access for Netezza Performance Server 

Identity and Access Management (IAM) enables you to securely authenticate users for platform services and control access to resources consistently across the IBM Cloud platform. For example, with only a single login to IBM Cloud® with your IBMid, you have access to any of your service consoles and their applications without having to log in to each of them separately.

Access to the IBM® Netezza® Performance Server for IBM Cloud Pak® for Data as a Service service instances for users in your account is controlled by IBM Cloud® (IAM). Every user that accesses the Netezza Performance Server service in your account must be assigned an access policy with an IAM role. Review the following roles, actions, and more to help determine the best way to assign access to Netezza Performance Server.



  Roles and actions 

The access policy that you assign users in your account determines what actions a user can perform within the context of the service or specific instance that you select. The allowable actions are customized and defined by Netezza Performance Server as operations that are allowed to be performed on the service. Each action is mapped to an IAM platform that you can assign to a user.

If a specific role and its actions don't fit the use case that you're looking to address, you can [create a custom role](https://cloud.ibm.com/docs/account?topic=account-custom-rolescustom-access-roles) and pick the actions to include.

IAM access policies enable access to be granted at different levels.



Table 1. The table outlines what types of tasks each role allows for when you're working with the Netezza Performance Server service.

 Role                        Connect  User Management  Scaling  Backup and Restore  Monitoring  DR 

 IAM Platform Administrator  Y        Y                Y        Y                   Y           Y  
 IAM Platform Operator       Y        Y                Y        Y                   Y           Y  
 IAM Platform Editor         Y        Y                Y        Y                   Y           Y  
 IAM Platform Viewer         Y        N                N        N                   N           N  



Netezza Performance Server does not use IAM Service roles.

For information about the steps to assign IAM access, see [Managing access to resources](https://cloud.ibm.com/docs/account?topic=account-assign-access-resources).