vania-janet/multiturn-rag-retrieval-data huggingface dataset:
If the origin host is set up to handle CORS requests, and this request has the Origin header, then it should respond back to the Edge with a CORS header of Access-Control-Allow-Origin and the associated value. The overall response, including that header and value, is cached in the CDN. Any subsequent request for the object at the same URI path is served from the cache and includes the Access-Control-Allow-Origin header value that was originally received from the origin.





 Multiple CORS origin support 

In some cases, you can allow a list of specific origins (not all) to access your CDN contents, and need CDN to serve different Access-Control-Allow-Origin response headers for different origins (not wildcard * for any origins). However, CDN caches the headers along with contents, so it might serve the cached Access-Control-Allow-Origin header to the request, which might not match.

You can leverage the [Cache Key query optimization](https://cloud.ibm.com/docs/CDN?topic=CDN-about-content-delivery-networks-cdn-cache-key-optimization) to add different parameters in the URLs for different origins. This way, the content and headers are cached differently.

For example, suppose you've set the CDN cdn.example.com to serve contents for the two origins (abc.com and 123.com), and want to add different parameters for each origin; for example, https://cdn.example.com/test.json?domain=abc.com and https://cdn.example.com/test.json?domain=123.com. CDN would return different Access-Control-Allow-Origin headers that are served by your back-end server:

Request from abc.com origin returns access-control-allow-origin: https://abc.com:

 curl -H "Origin: https://abc.com" -H "Referer: https://abc.com/" -i https://cdn.example.com/test.json?domain=abc.com
HTTP/2 200
access-control-allow-origin: https://abc.com
this should fail (not a valid regional endpoint)
$ ibmcloud kp region-set not-a-region

FAILED





 Example 3 

Unset (remove) the regional endpoint.

 remove the regional endpoint
$ ibmcloud kp region-set -u

OK







 Required parameters 



* -i, --instance-id

The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.







 Optional parameters 



* REGION

Specify a regional endpoint. This parameter is optional and if not specified, you are prompted to select a regional endpoint from a list.
* -u, --unset

Unset (remove) the regional endpoiont.









 kp registrations 

Registrations are associations between root keys and other cloud resources, such as Cloud Object Storage (COS) buckets or Cloud Databases deployments.

For example, in Key Protect you create a root key, which is used by COS to protect data at rest.

The relationship between other cloud resources and Key Protect is called a registration.

Do not delete a root key if there are resources, such as COS buckets and objects, that rely on the root key. Deleting the root key means you cannot recover those resources. This is known as "crypto shredding" and there is no recovery from this action.

ibmcloud kp registrations
-i, --instance-id INSTANCE_ID
[-r, --key-ring KEY_RING_ID]
[-c, --crn-query CRN_PATTERN]
[-k, --key-id KEY_ID_OR_ALIAS]
[-o, --output OUTPUT]



 Examples 

These are examples of kp registrations.

Registration examples show numerous Cloud Resource Names (CRNs). CRNs follow this format:

crn:version:cname:ctype:service-name:location:scope:service-instance:resource-type:resource
If set to 1, query strings are removed from a URL when computing the token’s HMAC algorithm. Default value is 0.
* tokenDelimiter - Specifies a single character to separate the individual token fields.
* aclDelimiter - Specifies a single character to separate access control list (ACL) fields.
* hmacAlgorithm - Specifies the algorithm to use for the token’s hash-based message authentication code (HMAC) field.
* transitionKey - The token transition key, which specifies an even number of hex digits for the token transition key. An entry can be up to 64 characters in length.



* Returns - An object of type SoftLayer_Container_Network_CdnMarketplace_Configuration_Behavior_TokenAuth.



--------------------





 deleteTokenAuth 

Delete an existing Token Authentication behavior for an existing domain mapping and returns the updated behavior.



* Parameters:



* uniqueId - (Required) The unique ID of the mapping to which this origin path belongs.
* path - (Required) Token Authentication Path to be deleted.



* Return - A status message if the deletion was successful; otherwise, an exception is thrown.



--------------------
Any services that were bound to the package are also removed, so after you update other parameters you must [bind services](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-services) to your package again.



 Updating parameters for all actions in a package 

ibmcloud fn package update cloud-object-storage
--param bucket <bucket-name>
--param endpoint <bucket-endpoint>





 Updating parameters to a specific action 

ibmcloud fn action update cloud-object-storage/object-write
--param bucket <bucket-name>
--param endpoint <bucket_endpoint>

You can also bind parameters to actions by using Parameters in the console. To add parameters in the console, navigate to the [Actions page](https://cloud.ibm.com/functions/actions) and click one of your actions. Then, click Parameters > Add Parameter. You must add parameters in <key> and <value> pairs.

After you have updated the package or action to include the bucket and endpoint parameters, you must [rebind the service](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-pkg_obstoragepkg_obstorage_sc_bind) with service bind command.









 Writing an object to a bucket 

You can use the object-write action to write an object to an IBM Cloud Object Storage bucket. You can use this action from the console or the CLI.

To write an object, you must specify the bucket-name, object-name, body, and endpoint.

If you [bound your bucket and endpoint parameters](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-pkg_obstoragepkg_obstorage_param_bind) to the cloud-object-storage package or to the object-write action, you do not need to specify them during invocation.



 Writing an object to a bucket with the console 



1.
Example host name and IP address mappings

 Deployed virtual server instance and services Hostname IP address 

 Access host access.example.com 172.10.1.4 
 Basic management services basic.service.example.com 172.11.1.4 
 Critical management services critical.service.example.com 172.11.1.5 
 Power VS shared file system power.service.mgmt.example.com 10.10.10.4 
 Example virtual server instance host for SAP HANA DB db.mgmt.prd.example.com 10.10.10.5 
 Example SAP HANA DB host db.prd.example.com 10.10.20.5 
 Example virtual server instance host for SAP NetWeaver app1.mgmt.prd.example.com 10.10.10.6 
 Example SAP NetWeaver application server host app1.prd.example.com 10.10.20.6 



8. Each Unix OS user has a UID and GUID. These IDs are used to specify file system ownership and become a part of file system metadata. In the management scenarios, where file system is backed up on one host and restored on another, both hosts must use the same UID and GUID for the same users. For the best experience, make sure that you use central user management for SAP users. In the example deployment, LDAP client setup was used on the virtual server instances that are running on Power® Systems Virtual Server.
9. You need an overview about the ports that must be opened for communication between SAP workloads that run on IBM Power Systems Virtual Servers (such as SAP NetWeaver or SAP HANA), in VPC (such as SAP Web Dispatcher, SAP Solution Manager) and outside of the environment (such as clients in public internet or in on-premises environment).
10. Determine the size parameters for each SAP workload that you plan to deploy. The most important parameters are memory size (especially for SAP HANA) and the number of SAPs. Most of the other configurations can be derived from these two key metrics.
The tags can later be used to query the resources in the IBM Cloud console.
* Select a resource group.
* Select a location. The location determines where the workspace actions are run.
* Provide a description (optional) of the Schematics workspace.
* Click Next and then click Create. The Schematics workspace is created with the name that you specified.









 Step 2: Updating SMC parameters 



1. Go to the IBM Cloud Workspaces page and select the Workspace name that you created. The Schematics -> Workspaces page opens on the Jobs tab that shows the job log.
2. Go to the Schematic Workspace Settings tab, and in the variable section, click "burger icons" to enter the required values and update default parameters.

Parameters unique to your account and your deployment:



 Name Description Type Default 

 lone_vpc_name Name of an existing Lone Symphony VPC, lone_vpc_name and lone_vpc_region must be in same order. If no value is given, then need to add existing_lone_vpc manually with SMC transit_gateway. Note: lone_vpc_name supports a maximum of 3 existing_lone_vpc_name. For more information, see [VPC](https://cloud.ibm.com/docs/vpc). list(string) null 
 lone_vpc_region Name of the IBM Cloud region where the existing Lone Symphony VPC, lone_vpc_name and lone_vpc_region must be in same order (Examples: us-east, us-south, etcand so on). Note: lone_vpc_region support maximum of 3 existing_lone_vpc_region. For more information, see [Region and data center locations for resource deployment](https://cloud.ibm.com/docs/overview?topic=overview-locations). list(string) null 
 ssh_key_name Your IBM Cloud SSH key name such as "smc-ssh-key" that is created in a specific region in IBM Cloud. Mark it as sensitive to hide the SSH key in the IBM Cloud console.
The first time that MFA is enabled, it is set to use email by default. You can change the setting to use SMS, but you cannot configure both at the same time.



 With the GUI 

You can configure the MFA email channel through the GUI.



1. Navigate to the Cloud Directory > Multifactor authentication tab of the App ID dashboard.
2. In the Enable Multifactor authentication box, on the Settings tab, toggle MFA to Enabled. Acknowledge that you understand that MFA is charged as an [advanced security event](https://cloud.ibm.com/docs/appid?topic=appid-pricing). By default, Email is selected as the Authentication method.
3. In the Email channel tab, review the Email template. You can choose to send the template with the provided wording or write your own message. Be sure to use the correct HTML tagging. In the GUI, you can add parameters and insert images. To change the [language](https://cloud.ibm.com/docs/appid?topic=appid-cd-typescd-languages) of the message, you can use [the APIs](https://us-south.appid.cloud.ibm.com/swagger-ui//Management%20API%20-%20Config/mgmt.updateLocalization) to set the language. However, you are responsible for the content and conversion of the message. Check out the following table to see the list of tables that you can use in this message and all the other messages that you can send. If a user does not supply the information that is pulled by the parameter, it appears blank.



Table 1. MFA message parameters

 Parameter Description 

 %{display.logo} Displays the image that you configured for your Login Widget. 
 %{user.displayName} Displays the screen name a user chose to use when interacting with the app. 
 %{user.email} Displays the user's registered email address. 
 %{user.username} Displays the user's specified username when the authentication method is set to username and password.
Lists the keys in the Key Protect instance with the key name or alias exactly matching the characters in the string "TEST" without quotation marks.

 list keys with identifiers exactly matching TEST
$ ibmcloud kp keys -l exact:TEST

Retrieving keys...
OK
Key ID Key Name
636e9f3a-feaf-4033-8603-687754dc7e51 TEST





 Example 9 

Lists the keys in the Key Protect instance and sort the keys based on their id and the date the key was created starting with the newest (the hyphen, '-', indicates sort by descending order).

 sort keys by id and descending creationDate
$ ibmcloud kp keys -b id,-creationDate

Retrieving keys...
OK
Key ID Key Name
ef2cc155-fe56-492c-845c-4d1f0688c7ba my-last-key
2f1cb135-fa16-40dc-815c-4d1f0ee8c7ba my-first-key







 Required parameters 



* -i, --instance-id

The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.







 Optional parameters 



* -b, --sort-by

Sort the keys based on the parameters. The default property for sorting results is "id." '-' before the parameter indicates sort by descending order. The supported sort parameters at this time are



* id
* state
* extractable
* imported
* creationDate
* lastUpdateDate
* lastRotateDate
* deletionDate
* expirationDate



* -c, --crn

Include the cloud resource name (CRN) in the output.
* -f, --key-filter

Filter the keys based on the parameters. The supported key filtering parameters are



* creationDate
* deletionDate
You can choose other parameters according to your company's security policy; however, make sure to use identical parameters on IBM VPN gateway and ASAv.



* Encryption algorithm - Set to aes-256 for this example.
* Integrity algorithm - Set to sha256 for this example.
* Diffie-Hellman group - IPsec uses the Diffie-Hellman algorithm to generate the initial encryption key between the peers. In this example, it is set to group 19.
* Pseudo-Random Function (PRF) - IKEv2 requires a separate method that is used as the algorithm to derive keying material and hashing operations that are required for the IKEv2 tunnel encryption. This is referred to as the pseudo-random function and is set to sha256.
* SA Lifetime - Set the lifetime of the security associations (after which time a reconnection occurs) to 86400 seconds.



crypto ikev2 policy 100
encryption aes-256
integrity sha256
group 19
prf sha256
lifetime seconds 86400
crypto ikev2 enable outside

Create an IPsec profile for the virtual tunnel interface (VTI). The profile references the IPsec proposal, and the VTI references the profile. Make sure IBM VPN gateway and ASAv use identical IPsec proposal and IPsec profile parameters.

crypto ipsec ikev2 ipsec-proposal ibm-ipsec-proposal
protocol esp encryption aes-256
protocol esp integrity sha-256
crypto ipsec profile ibm-ipsec-profile
set ikev2 ipsec-proposal ibm-ipsec-proposal
set pfs group19
set security-association lifetime kilobytes unlimited
set security-association lifetime seconds 3600
responder-only

Create the tunnel group to IBM primary tunnel. The peer address 169.59.210.199 is the small public IP of the IBM route-based VPN gateway, and the pre-shared key should be same as the IBM route-based VPN gateway.
Why does a connection via WebSocket close after 60 seconds? 

Virtual Private Cloud

Classic infrastructure

  What’s happening 

Your Ingress service exposes an app that uses a WebSocket. However, the connection between a client and your WebSocket app closes when no traffic is sent between them for 60 seconds.

  Why it’s happening 

The connection to your WebSocket app might drop after 60 seconds of inactivity for one of the following reasons:



*  Your Internet connection has a proxy or firewall that doesn't tolerate long connections.
*  A timeout in the ALB to the WebSocket app terminates the connection.



  How to fix it 

To prevent the connection from closing after 60 seconds of inactivity:



1.  If you connect to your WebSocket app through a proxy or firewall, make sure the proxy or firewall isn't configured to automatically terminate long connections.
2.  To keep the connection alive, you can increase the value of the timeout or set up a heartbeat in your app.



*  Change the timeout: Increase the value of the proxy-read-timeout in your ALB configuration. For example, to change the timeout from 60s to a larger value like 300s, add this [annotation](https://cloud.ibm.com/docs/containers?topic=containers-comm-ingress-annotationscustom-connect-read-timeouts) to your Ingress resource file: nginx.ingress.kubernetes.io/proxy-read-timeout: 300. The timeout is changed for all public ALBs in your cluster.
*  Set up a heartbeat: If you don't want to change the ALB's default read timeout value, set up a heartbeat in your WebSocket app. When you set up a heartbeat protocol by using a framework like [WAMP](https://wamp-proto.org/), the app's upstream server periodically sends a ping message on a timed interval and the client responds with a pong message. Set the heartbeat interval to 58 seconds or less so that the ping/pong traffic keeps the connection open before the 60-second timeout is enforced.
This is corrected in the LA release.
3. Some Beta events include array data. If the array is too large, the event isn't be recorded. For LA, these events display an array element count rather than the actual data.



* Each time you open a console for a virtual server instance or bare metal server, two API calls are issued: the first one generates a console access token, the second one uses the generated token to open the console websocket.

This API call generates two Activity Tracker events: is.instance.console-access-token.create and is.instance.console.read, or is.bare-metal-server.console-access-token.create and is.bare-metal-server.console.read.

You cannot use request id to correlate console Activity Tracker events as each call generates a unique request id. Instead, you can use initiator id to correlate console events that are generated from API calls that are issued by the same user.
* You can find the detailed information and fields that are included in the requestData and responseData for Bare Metal Servers for VPC AT events in the [API documentation](https://cloud.ibm.com/apidocs/vpc/latest).
For more information, see [Resizing a virtual server instance](https://cloud.ibm.com/docs/vpc?topic=vpc-resizing-an-instance&interface=api).

This feature is now generally available. See the [VPC API change log](https://cloud.ibm.com/docs/vpc?topic=vpc-api-change-log30-march-2021).







 22 February 2021 



 For all version dates 

Block storage snapshots. Accounts that have been granted special approval to preview this feature can now create and use [snapshots](https://cloud.ibm.com/docs/vpc?topic=vpc-snapshots-vpc-about) and explore the new [snapshots API methods](https://cloud.ibm.com/apidocs/vpc-betalist-snapshots).

This feature is now generally available. See the [VPC API change log](https://cloud.ibm.com/docs/vpc?topic=vpc-api-change-log18-may-2021).

Virtual server instance console. Accounts that have been granted special approval to preview this feature can now access instances by connecting to a VNC or serial console. Learn about [accessing virtual server instances by using VNC or serial consoles](https://cloud.ibm.com/docs/vpc?topic=vpc-vsi_is_connecting_console&interface=api), and explore the new instance console API methods:



* [Create a console access token for an instance](https://cloud.ibm.com/apidocs/vpc-betacreate-instance-console-access-token)
* [Retrieve the console WebSocket for an instance](https://cloud.ibm.com/apidocs/vpc-betaget-instance-console)



This feature is now generally available. See the [VPC API change log](https://cloud.ibm.com/docs/vpc?topic=vpc-api-change-log30-march-2021).
No, WebSocket is not supported by Akamai's Edge servers.
* With multiple file purges, what's the difference between a favorite group and an unfavorite group?

A favorite is a permanent group, which means that it will never be deleted unless you change it to an unfavorite group. An unfavorite group is a temporary group. This type of group is automatically deleted after 15 days of inactivity.

Favorite groups names must be unique. Unfavorite groups do not have this limitation.
* In what status is a CDN allowed to perform multiple file purges?

Multiple file purges are allowed in the following states:



* Running
* Running - HTTP only
* CNAME configuration required
* Stopped



* Is IBM CDN compliant with Payment Card Industry Data Security Standard (PCI DSS)?

Yes, IBM CDN is PCI DSS 3.2.1 compliant through our partner Akamai's certification. For more information, see the Akamai [Attestation of Compliance](https://www.akamai.com/uk/en/multimedia/documents/infosec/pci-dss-3.2-attestation-of-compliance.pdf).
* How to get the client IP address?

Akamai Edge servers add the True-Client-IP and X-Forwarded-For headers in the requests to the origin. Then, in your backend origin server, you can get the client IP address from the value of the True-Client-IP, or extract the first IP in the chain of X-Forwarded-For.
* FAQs for CDN with ICOS



 Can I use ICOS private endpoints for CDN? 

No. The CDN edge servers can only access the ICOS public endpoints, so objects in the ICOS buckets should provide public access.





 Will traffic sent from ICOS to CDN be charged? 

Yes. The CDN and ICOS don't have a way of measuring each other's traffic, so both traffic from ICOS and CDN are charged.





 How does the CDN edge server retrieve content from the ICOS objects?
ibmcloud is instance-console INSTANCE [--vnc] [-q, --quiet]



 Command options 



* INSTANCE: ID or name of the instance.
* --vnc: Get the WebSocket URI for the VNC console and open the IBM Cloud web VNC console in the browser for the instance.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is instance-create 

Create a virtual server instance.
For more information, see [SSML validation](https://cloud.ibm.com/docs/text-to-speech?topic=text-to-speech-ssmlssml-errors).

IBM SPR format now specified with ibm instead of spr
: The use of spr is deprecated as an argument to the format option of the GET /v1/pronunciation method and for use with the alphabet attribute of an SSML <phoneme> element. To use IBM SPR notation, use the ibm argument instead of spr in all cases.

New support for audio/mulaw audio format
: The list of supported audio formats now includes audio/mulaw;rate={rate}. Like audio/basic, this format provides single-channel audio that is encoded by using 8-bit u-law (or mu-law) data that is sampled at 8 kHz. For more information, see [Using audio formats](https://cloud.ibm.com/docs/text-to-speech?topic=text-to-speech-audio-formats).

New supported features identified when listing voices
: The GET /v1/voices and GET /v1/voices/{voice} methods now return a supported_features object as part of their output for each voice. The object describes whether the voice supports customization and the SSML <voice_transformation> element. For more information, see [Languages and voices](https://cloud.ibm.com/docs/text-to-speech?topic=text-to-speech-voices).





 23 June 2016 

New WebSocket interface for speech synthesis
: The service now offers a WebSocket interface for synthesizing text to speech. The interface offers the same features as the /v1/synthesize method of the HTTP interface. It accepts plain text or text that is marked up with SSML. In addition, it also supports use of the SSML <mark> element to identify the time in the audio at which it finishes synthesizing all text that precedes the mark.