vania-janet/multiturn-rag-retrieval-data huggingface dataset:
After the OS reload completes for the first node in the cluster, it is critical that the second node be left unpowered until the OS reload to upgrade that node is submitted and running. Powering the node on prior to the OS reload causes the cluster to run with mismatched vSRX versions, potentially leading to a “split-brain” scenario where each node tries to claim primary ownership. This generally results in an outage. After the OS reload of the first node, the gateway transitions to “Upgrade Active” status.
5. Standalone environment only:[Import the vSRX configuration](https://cloud.ibm.com/docs/vsrx?topic=vsrx-importing-exporting-vsrx-configurationimport-the-whole-vsrx-configuration) and migrate the settings to the new architecture if necessary.





 vSRX configuration migration considerations 

For a High Availability environment, the upgrade restores the previous vSRX configuration. No further steps are needed.

For a Standalone environment, the upgrade does not restore the previous configuration, so you should export and import your configuration. Refer to [Importing and exporting a vSRX configuration](https://cloud.ibm.com/docs/vsrx?topic=vsrx-importing-exporting-vsrx-configuration) for more information.

Additionally, when migrating from an older version, such as 15.1, your interface mappings might have changed. This requires some modifications to the vSRX configuration after the import. Refer to [Migrating 1G vSRX standalone configurations](https://cloud.ibm.com/docs/vsrx?topic=vsrx-migrating-configmigrating-1g-standalone) for more information.
* Why does cluster creation using dedicated hosts fail sometimes with the error status of dedicated host is failed?

In some regions, dedicated hosts have a limitation on the number of virtual server instances that can be placed on them at one time. You can try to provision the cluster with a smaller number of virtual server instances to overcome this.



Power Systems Virtual Servers



* What is IBM Power Systems Virtual Server?

IBM Power Systems Virtual Server is a hosted infrastructure offering that allows you to quickly integrate with the Internet for on-demand provisioning. This offering provides a secure and scalable server virtualization environment that is built upon the advanced RAS features and leading performance of the Power Systems™ platform. The IBM Power Systems Virtual Servers are located in IBM data centers and distinct from the IBM Cloud servers with separate networks and direct-attached storage.
* What versions of AIX, IBM i, and Linux are supported?

The supported AIX, IBM i, and Linux® operating system versions depend on the IBM Power Systems hardware that you select for the Power Systems Virtual Server: S922 (9009-22A), E980 (9080-M9S) . To view a list of the supported AIX, IBM i, and Linux operating system technology levels, see the following system software maps:

AIX - Power Systems Virtual Server supports AIX 7.1, or later. When viewing the system software maps, refer to the AIX 7.1, AIX 7.2, and AIX 7.3 information. If you use an unsupported version, it is subject to outages during planned maintenance windows with no advanced notification given.



* [S922 (9009-22A) AIX software map](https://www-01.ibm.com/support/docview.wss?uid=ssm1platformaix9009-22A-vios-only)





* [E980 (9080-M9S) AIX software map](http://www-01.ibm.com/support/docview.wss?uid=ssm1platformaix9080-M9S-vios-only)
Managing access 

API Connect V10 Reserved uses IBM Cloud Identity and Access Management (IAM) to securely authenticate users and control access to service instances on the IBM Cloud platform.

API Connect V5 does not support IAM roles and actions. You can still use the IAM site to obtain an IBM Cloud API key, which is needed for generating a token for use when [Calling APIs provided by API Connect](https://cloud.ibm.com/docs/apiconnect?topic=apiconnect-call_apim_apis).



 Identity and Access Management roles and actions 

Access to Reserved instances for users in your account is controlled by IBM Cloud Identity and Access Management (IAM).

Every user in your account that accesses a Reserved instance must be assigned an access policy with an IAM user role defined. The policy determines what actions a user can perform within the context of the associated Reserved isntance. The allowable actions are customized and defined by the IBM Cloud service as operations that can be performed on the service. The actions are then mapped to IAM user roles.

Policies enable access to be granted at different levels. Options include the following access levels:



* Access across all Reserved instances in your account
* Access to an individual Reserved instance in your account
* Access to a Reserved instance contained in a specific resource group



After you define the scope of the access policy, you assign a role. The role determines the user's level of access. The following tables outline what actions each role allows within the API Connect V10 Reserved instance.

Table 1 details actions that are mapped to platform management roles, and which API Connect role corresponds to each platform role. Platform management roles enable users to perform tasks on service resources at the platform level; for example: assign user access for the service, create or delete instances, and bind instances to applications.



Table 1. IAM user roles and actions

 IAM Platform role Maps to API Connect role Summary of allowed actions 

 Viewer Viewer View (but not edit) APIs, members, settings, and organizations. 
 Operator Community Manager View data and settings. Edit Products and APIs. Manage Consumer organizations, apps, subscriptions, and analytics. 
 Editor API Administrator View data and settings.
If you specify the no-wait option, the project reclamation restore begins and does not wait. Use the reclamation get command to check the project reclamation status. This value is optional. The default value is false.

--quiet, -q
: Specify this option to reduce the output of the command. This value is optional. The default value is false.

--wait, -w
: Restore the project reclamation and wait for the project reclamation to be restored. If you specify the --wait option, the project reclamation restore waits for a maximum time in seconds, as set by the --wait-timeout option, for the project reclamation to be restored. If the project reclamation is not restored within the specified --wait-timeout period, the project reclamation restore fails. This value is optional. The default value is true.

--wait-timeout, --wto
: The length of time in seconds to wait for the project reclamation to be restored. This value is required if the --wait option is specified. This value is ignored if the --no-wait option is specified. The default value is 600.





 Example 

This example restores the myproject project that is in soft deleted status to an active state. Use the reclamation list command to display a list of all projects that are in soft deleted status.

ibmcloud ce reclamation restore --name myproject





 Example output 

Restoring project 'myproject'...
OK









 Registry commands 

A container registry, or registry, is a service that stores container images. For example, IBM Cloud Container Registry and Docker Hub are container registries. A container registry can be public or private. A container registry that is public does not require credentials to access. In contrast, accessing a private registry does require credentials.

You must be within the context of a [project](https://cloud.ibm.com/docs/cli?topic=cli-clicli-project) before you use registry commands.
If you specify the no-wait option, the project reclamation restore begins and does not wait. Use the reclamation get command to check the project reclamation status. This value is optional. The default value is false.

--quiet, -q
: Specify this option to reduce the output of the command. This value is optional. The default value is false.

--wait, -w
: Restore the project reclamation and wait for the project reclamation to be restored. If you specify the --wait option, the project reclamation restore waits for a maximum time in seconds, as set by the --wait-timeout option, for the project reclamation to be restored. If the project reclamation is not restored within the specified --wait-timeout period, the project reclamation restore fails. This value is optional. The default value is true.

--wait-timeout, --wto
: The length of time in seconds to wait for the project reclamation to be restored. This value is required if the --wait option is specified. This value is ignored if the --no-wait option is specified. The default value is 600.





 Example 

This example restores the myproject project that is in soft deleted status to an active state. Use the reclamation list command to display a list of all projects that are in soft deleted status.

ibmcloud ce reclamation restore --name myproject





 Example output 

Restoring project 'myproject'...
OK









 Registry commands 

A container registry, or registry, is a service that stores container images. For example, IBM Cloud Container Registry and Docker Hub are container registries. A container registry can be public or private. A container registry that is public does not require credentials to access. In contrast, accessing a private registry does require credentials.

You must be within the context of a [project](https://cloud.ibm.com/docs/codeengine?topic=codeengine-clicli-project) before you use registry commands.
Why can't Schematics find your resource group? 

  What’s happening 

When you run an IBM Cloud Schematics plan or apply action, the resource group that you try to retrieve by using the ibm_resource_group data source cannot be found. Following error message are received.

Error retrieving resource group <resource-group>: ResourceGroupDoesnotExist: Given resource Group : "<resource-group>" doesn't exist

  Why it’s happening 

You do not have the wanted permissions in Cloud Identity and Access Management to view the resource group. If you specified an API key in your Terraform template or in Schematics, this API key does not have the wanted permissions in IAM to view the resource group.

  How to fix it 

Make sure that the Viewer permission on the resource group is assigned to you or the API key that you use. For more information, see [Adding resources to a resource group](https://cloud.ibm.com/docs/account?topic=account-rgsadd_to_rgs).
Click here for details on [Site to Site VPN](https://cloud.ibm.com/docs/mas-ms?topic=mas-ms-supportsite-to-site-vpn)
5. Does MAS-Dedicated allow connection to the database?

Answer: Yes, but there are restrictions and guildelines. Please refer to [Database Support](https://cloud.ibm.com/docs/mas-ms?topic=mas-ms-supportdatabase-support)
6. Can customers access Manage log files?

Answer: Logs files can be accessed from [IBM COS](https://cloud.ibm.com/docs/mas-ms?topic=mas-ms-supportaccess-cos-buckets) (Cloud Object Storage) bucket(s) provided to individual customers for each environment.
7. Can we use the HTTP and HTTPS end points to post to applications in the Cloud?

Answer: Yes, HTTPS only.
8. Can customers execute sql scripts that manipulate data?

Answer: This is not allowed in production environments. If customer needs data correction, it is recommended to perform this from the front end or use automation scripts, to ensure data integrity.
9. How does Single Sign On (SSO) setup work?

Answer: Customers can request [SSO setup](https://cloud.ibm.com/docs/mas-ms?topic=mas-ms-supportsaml-sso-config) work via [IBM Case ticket](https://www.ibm.com/mysupport)
10. Can customers run dbconfig for NON_PROD and PROD?

Answer: For NON-PROD, yes, using [API calls](https://cloud.ibm.com/docs/mas-ms?topic=mas-ms-supportadmin-util-api-calls).
11. Can customers use Manage (Maximo) MXLoader?

Answer: Technically, IBM does not support MXLoader, but customers can use MXLoader outside of the IBM hosted SRE environment and connect to their database via the MIF (Maximo Integration Framework).
Run the following command to generate the OAuth token:

ibmcloud iam oauth-tokens

Zoom

![OAuth token](https://cloud.ibm.com/docs-content/v1/content/57ab3ec034294d8a6de510b97bec3035d4654761/security-broker/images/oauth_token.svg)

OAuth token

The Admin users that are added to Data Security Broker Manager must use the tokens generated in the same IBM Cloud® account, where the Super Admin user resides. Data Security Broker Manager does not support cross account access, considering the security risks involved.
3. Open the Data Security Broker Manager console which has already been configured in a browser window. For example, [https://150.238.243.117](https://150.238.243.117).
4. Copy the OAuth token without any space or additional characters and paste it in the Enter token text box as shown below in the Login page and click Sign In to login to the Data Security Broker Manager:

Zoom

![Login to Data Security Broker Manager](https://cloud.ibm.com/docs-content/v1/content/57ab3ec034294d8a6de510b97bec3035d4654761/security-broker/images/sb_login.svg)

Login to Data Security Broker Manager
5. Once you have logged into the Data Security Broker Manager, the next step is add a database, connect to a keystore, and enroll an application to proceed with the data encryption. Refer to the [Data Protection Services Overview](https://cloud.ibm.com/docs/security-broker?topic=security-broker-sb_encrypt_progress) section to proceed with the data protection services.
Why didn't my IBMid login complete? 

If you log in to IBM Cloud and the authentication of your IBMid doesn't complete, there might be a problem with the service.

  What’s happening 

When you log in to IBM Cloud, authenticating with IBMid doesn't complete.

  Why it’s happening 

There might be a problem with the IBMid authentication service.

  How to fix it 

Make sure you can log in to [IBM](https://login.ibm.com/authsvc/mtfim/sps/authsvc?PolicyId=urn:ibm:security:authentication:asf:basicldapuser).

If you can, it is an application problem and you can try logging in to the console again later. If you can't log in to that page, contact the [IBMid help desk](https://www.ibm.com/ibmid/myibm/help/us/helpdesk.html).
Within the Public Subnet, the [SAP router](https://support.sap.com/en/tools/connectivity-tools/saprouter.html) and the jump host provide secure connections to the virtual server instances. The SAP router is a software application that provides a remote connection between the customer's network and SAP. The SAP Router and jump host are within a single security group with rules for inbound and outbound traffic between the private subnets in the zone. SAP routers are used with traditional SAP products and analytics solutions and offerings that are acquired from Sybase. For a comprehensive list of which SAP Business Analytics products benefits from SAP router connections, see [SAP Note 1478974](https://launchpad.support.sap.com//notes/1478974).

A jump host is used to access, manage, and administer SAP virtual server instances from the same customer ZONE directly from their premises. These SAP virtual server instances can be in a separate security zone but must be on same IBM Cloud region. The customer connection to the jump host follows the same rules as the direct connection from customer premises to the virtual server instance SAP instances. The connection uses the CFN IP and security group 1 firewall rules from a designated public subnet. This architecture uses two defined security groups; this arrangement is the simplest method for separating the public and private subnets. You can add more security groups if you require more isolation.





 Virtual server instances on SAP NetWeaver 7.x APAB stack, JAVA stack, and dual stack (ABAP+JAVA) architectural design on IBM Cloud® VPC on Unix 



 Standard system 

In a standard system, all main instances run on a single virtual server instance within a private subnet. For more information, see [About virtual server instances for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-about-advanced-virtual-servers). The virtual server instance has these components:

Zoom

![Figure 2.
You can create a custom image from a boot volume that is attached to a virtual server instance. Then, you can use the custom image to provision new virtual server instances. For more information, see [About creating an image from a volume](https://cloud.ibm.com/docs/vpc?topic=vpc-image-from-volume-vpc).





 What is the virtual server instance identifier and SMBIOS system-uuid? 

The virtual server instance is automatically assigned an instance identifier (ID), which includes the SMBIOS system-uuid as a portion of the ID, when the instance is created. IDs are immutable, globally unique, and never reused, so the ID uniquely identifies a particular instantiation of a virtual server instance across all of IBM Cloud. The ID, including the SMBIOS system-uuid portion, is static and persists for the lifecycle of the virtual server instance until that virtual server instance is deleted.

For more information, including how to retrieve this information from within your virtual server, see [Retrieving the virtual server instance identifier](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-virtual-server-instancesretrieve-VSI-instance-identifer) section in Managing virtual server instances.





 Can I access metadata about my virtual server instances? 

Yes, if your account is granted special approval, you can access the instance metadata service to get information about your VPC compute resources. The metadata service is a REST API that you invoke by using a well-known URI to retrieve instance-specific information from the metadata server. For more information, see For more information, see [About Instance Metadata for VPC (Beta)](https://cloud.ibm.com/docs/vpc?topic=vpc-imd-about).





 Can I use the same operating system image for more than one account? 

Yes, when you create a custom image for IBM Cloud VPC, you can import those images into a private catalog for use among multiple accounts. A private catalog provides a way for you to manage access to products for multiple accounts, if those accounts are within the same enterprise.
When you create a multizone VPC cluster with the private cloud service endpoint only, a private Ingress controller is created by default. The Ingress controller assigns privately accessible routes for your apps and listens on the private host network interface. Only clients that are connected to your private VPC network can access apps that are exposed by a private route.

The following diagram shows how a Ingress controller directs network traffic from private networks to an app in a multizone, VPC cluster.

Zoom

![Expose an app in a private, multizone, VPC cluster by using a Ingress controller](https://cloud.ibm.com/docs-content/v1/content/bce0f0917a9eea684d1b4b704ac6343a1f65f446/openshift/images/roks_router_vpc_private.png)

Figure 2. Expose an app in a private, multizone, VPC cluster by using a Ingress controller



1. A client that is connected to your private VPC network sends a request to your app by using the app's private route. For example, you might use the Virtual Private Cloud VPN, IBM Cloud Transit Gateway, or IBM Cloud Direct Link to allow requests from an on-premises network, another VPC, or IBM Cloud classic infrastructure to apps that run in your cluster.
2. A DNS service resolves the route subdomain to the VPC load balancer hostname that is assigned to the services for the Ingress controller. In VPC clusters, your Ingress controller services' IP addresses are floating, and are kept behind a VPC-assigned hostname. Note that though the DNS record for the route subdomain is registered in the public DNS system, the DNS resolution servers are reachable from the VPC.
3. The private VPC load balancer resolves the VPC hostname to an available private IP address of a Ingress controller service that was reported as healthy. The VPC load balancer continuously checks the IP addresses of the services that expose the Ingress controller in each zone in your cluster.
4.
The SAP Router and jumphost are within a single security group with rules for inbound and outbound traffic between the private subnets in the zone. SAP routers are used with traditional SAP products and analytics solutions and offerings that are acquired from MS SQL Server database. For a comprehensive list of which SAP Business Analytics products benefits from SAP router connections, see [SAP Note 1478974](https://launchpad.support.sap.com//notes/1478974).

A jumphost is used to access, manage, and administer SAP virtual server instances from the same customer ZONE directly from their premises. These SAP virtual server instances can be in a separate security zone but should be on same IBM Cloud region. The customer connection to the jumphost follows the same rules as the direct connection from customer premises to the virtual server instance SAP instances. The connection uses the CFN IP and security group 1 firewall rules from a designated public subnet. In this architecture, there are two security groups defined; this arrangement is the simplest method for separating the public and private subnets. You can add more security groups if you require more isolation.





 Virtual server instances on SAP NetWeaver 7.x APAB stack, JAVA stack, and dual stack (ABAP+JAVA) stack on Windows Servers with MS SQL Server DB 



 Standard system 

In a standard system, all main instances run on a single virtual server instance within a private subnet. For more information, see [about virtual servers for VPC](https://cloud.ibm.com/docs/vpc-on-classic-vsi?topic=vpc-on-classic-vsi-virtual-private-cloud). The virtual server instance has these components:

Zoom

![Figure 2. Standard installation](https://cloud.ibm.com/docs-content/v1/content/f89cc64b006ca59b35404693959c83d5747fee3e/sap/images/refarch-sap-mssql-std-only.svg)

Figure 2. SAP NetWeaver 7.x MS SQL Server standard installation with AAS
Understanding OpenShift Data Foundation 

Virtual Private Cloud

Classic infrastructure

Satellite

[OpenShift Data Foundation](https://www.redhat.com/en/technologies/cloud-computing/openshift-data-foundation) is a highly available storage solution that you can use to manage persistent storage for your containerized apps.

What is OpenShift Data Foundation?
: OpenShift Data Foundation is a highly available storage solution that consists of several open source operators and technologies like [Ceph](https://docs.ceph.com/en/latest/start/intro/), [NooBaa](https://www.noobaa.io/), and [Rook](https://rook.io/). These operators allow you to provision and manage File, Block, and Object storage for your containerized workloads in Red Hat® OpenShift® on IBM Cloud® clusters. Unlike other storage solutions where you might need to configure separate drivers and operators for each type of storage, ODF is a unified solution capable of adapting or scaling to your storage needs. You can also deploy ODF on any OCP cluster.

How does OpenShift Data Foundation work?
: ODF uses storage volumes in multiples of 3 and replicates your app data across these volumes. The underlying storage volumes that you use for ODF depends on your cluster type. - For VPC clusters the storage volumes are dynamically provisioned Block Storage for VPC devices. - For bare metal Classic clusters, the storage volumes are local disks on your bare metal worker nodes. - For Satellite clusters, the storage volumes are either local disks on your worker nodes, or you can dynamically provision disks by using a compatible block storage driver.
: ODF uses these devices to create a virtualized storage layer, where your app data is replicated for high availability. Because ODF abstracts your underlying storage, you can use ODF to create File, Block, or Object storage claims from the same underlying raw block storage.

For a full overview of the features and benefits, see [OpenShift Data Foundation](https://www.redhat.com/en/technologies/cloud-computing/openshift-data-foundation).



 Architecture overview