vania-janet/multiturn-rag-retrieval-data huggingface dataset:
If the resource is not found, the state file is updated, and the Terraform execution plan are changed.

To keep your IBM Cloud Schematics state file and the IBM Cloud resources in your account in sync, use IBM Cloud Schematics to provision, or remove your resources.





 What changes can I make to my resources? 

You can choose to add, modify, or remove infrastructure code in your Terraform template through GitHub, or update variable values from the Schematics Workspaces dashboard.





 How can I compare the required state of my cloud resources against the actual state of my resources? 

To create a deviation report and view the changes between the infrastructure and platform services that you specified in your Terraform configuration files. You can use Terraform execution plans. A Terraform execution plan summarizes what actions Schematics needs to take to provision the cloud environment that is described in your Terraform configuration files. These actions can include adding, modifying, or removing IBM Cloud resources.





 What are the deviations that cannot be detected? 



* A Terraform execution plan is based on the [Terraform state file](https://cloud.ibm.com/docs/schematics?topic=schematics-schematics-cli-referencestate-file-cmds) that is created when you run your first Schematics apply action.
* Resources that you provisioned in other Schematics Workspaces by using automation tools such as Ansible, or Chef that are added without Schematics are not considered included in the Terraform execution plan.







 How must I remove resources with IBM Cloud Schematics? 

You can use the IBM Cloud Schematics console or CLI to remove all the resources that you provisioned with Schematics. To stay in synchronize with your Terraform template, make sure to remove the associated infrastructure code from your Terraform template. So that, your resources are not added again when you apply a new version of your Terraform template.





 What happens if I choose to delete my resource directly from the resource dashboard? 

When you manually remove a resource that you provisioned with IBM Cloud Schematics, the state file is not updated automatically and becomes out of sync. When you create next Terraform execution plan, or apply a new template version.
If I select Delete from the Overflow ![Overflow menu](https://cloud.ibm.com/docs-content/v1/content/006fd22ab2811b7d19804c763a00568b3da4c03a/CDN/images/overflow.png) menu, does that delete my account? 

No, if you select 'Delete' from the Overflow ![Overflow menu](https://cloud.ibm.com/docs-content/v1/content/006fd22ab2811b7d19804c763a00568b3da4c03a/CDN/images/overflow.png) menu, only that CDN is deleted. Your account still exists, and you can create additional CDNs.





 Does content caching use push or pull? 

Content caching is done using an origin pull model. Origin Pull is a method by which data is "pulled" by the Edge server from the origin server, as opposed to manually uploading the content onto the Edge server.





 Is there a recommended browser to use for CDN service configuration? 

Yes, Firefox and Chrome are the recommended browsers. It is recommended that you use the latest versions with your IBM Cloud Content Delivery Network.





 What is the purpose of providing a path when creating my CDN? 

If you provide a path while creating your CDN, it allows you to isolate the files that can be served through CDN from a particular origin server.





 My CDN is in an Error State. What do I do now? 

Refer to the [Troubleshooting](https://cloud.ibm.com/docs/CDN?topic=CDN-troubleshoot-cdn-working) or [Getting help and support](https://cloud.ibm.com/docs/CDN?topic=CDN-gettinghelpgettinghelp), or open a case in the [IBM Cloud console](https://cloud.ibm.com/).





 Where do I find the CNAME for my CDN if I didn't provide one?
For more information, see [Using Terraform with Cloud Load Balancer service](https://cloud.ibm.com/docs/terraform?topic=terraform-infrastructure-resourceslbaas).





 Is it possible to add members with secondary IP addresses? 

Members with secondary IP addresses can be added using the API.





 What happens when the load balancer is in Maintenance Pending state? 

The load balancer can go into Maintenance Pending state due to following reasons:



* Horizontal scaling event takes place.
* The load balancer has a firewall that's blocking the management traffic.
* Security patches are being installed.



When the load balancer is in the Maintenance Pending state, the data path is not affected.





 What is a non-system pool? 

A non-system pool is applicable only with public to private load balancers. The public IP addresses of the load balancer appliances are allocated from your public subnet. Select the Allocate from a public subnet in this account option when provisioning a load balancer.





 Does IBM Cloud Load Balancer support UDP? 

The IBM Cloud Load Balancer service does not support UDP. It supports only TCP, HTTP, and HTTPS.





 Is autoscaling supported by IBM Cloud Load Balancer? 

The IBM Cloud Load Balancer service does not support autoscaling at this time.





 How can I monitor my IBM Cloud Load Balancer metrics? 

The IBM Cloud Load Balancer service supports monitoring with IBM Cloud Monitoring. For more information, see [Monitoring metrics using IBM Cloud Monitoring](https://cloud.ibm.com/docs/loadbalancer-service?topic=loadbalancer-service-monitoring-metricsmonitoring-metrics).





 What information do I need to file an IBM Support ticket? 

To file an IBM Support ticket, provide the product name ("IBM Cloud® Load Balancer"), the UUID of your load balancer (if possible) and your IBM Cloud account number. The UUID can be found in the URL after navigating to the overview page of the given load balancer.





 Where can I find pricing information for IBM Cloud Load Balancer?
* [Step 3: Simulate a phased rollout of BookInfo](https://cloud.ibm.com/docs/containers?topic=containers-istio-qsistio-qs-3)
* [Step 4: Monitor BookInfo with IBM Cloud Monitoring](https://cloud.ibm.com/docs/containers?topic=containers-istio-qsistio-qs-4)
* [Step 5: Secure in-cluster traffic by enabling mTLS](https://cloud.ibm.com/docs/containers?topic=containers-istio-qsmtls-qs)



[About the managed Istio add-on](https://cloud.ibm.com/docs/containers?topic=containers-istio-aboutistio-about)



* [What is Istio?](https://cloud.ibm.com/docs/containers?topic=containers-istio-aboutistio_ov_what_is)
* [What is Istio on IBM Cloud Kubernetes Service?](https://cloud.ibm.com/docs/containers?topic=containers-istio-aboutistio_ov_addon)



* [What does this look like in my cluster?](https://cloud.ibm.com/docs/containers?topic=containers-istio-aboutistio-addon-resources)
* [How does the update process work?](https://cloud.ibm.com/docs/containers?topic=containers-istio-aboutistio-addon-update)



* [What comes with the Istio add-on?](https://cloud.ibm.com/docs/containers?topic=containers-istio-aboutistio_ov_components)
* [Limitations](https://cloud.ibm.com/docs/containers?topic=containers-istio-aboutistio_limitations)



[Setting up Istio](https://cloud.ibm.com/docs/containers?topic=containers-istioistio)
While creating a CDN of type Wildcard HTTPS, your CNAME acts as the CDN endpoint, and the CNAME is used to serve the traffic.
* Is HTTP/2 supported by the IBM Cloud Content Delivery Network service?

Yes, HTTP/2 is supported by Akamai's Edge servers.
* Is WebSocket supported by the IBM Cloud Content Delivery Network service?

No, WebSocket is not supported by Akamai's Edge servers.
* With multiple file purges, what's the difference between a favorite group and an unfavorite group?

A favorite is a permanent group, which means that it will never be deleted unless you change it to an unfavorite group. An unfavorite group is a temporary group. This type of group is automatically deleted after 15 days of inactivity.

Favorite groups names must be unique. Unfavorite groups do not have this limitation.
* In what status is a CDN allowed to perform multiple file purges?

Multiple file purges are allowed in the following states:



* Running
* Running - HTTP only
* CNAME configuration required
* Stopped



* Is IBM CDN compliant with Payment Card Industry Data Security Standard (PCI DSS)?

Yes, IBM CDN is PCI DSS 3.2.1 compliant through our partner Akamai's certification. For more information, see the Akamai [Attestation of Compliance](https://www.akamai.com/uk/en/multimedia/documents/infosec/pci-dss-3.2-attestation-of-compliance.pdf).
* How to get the client IP address?

Akamai Edge servers add the True-Client-IP and X-Forwarded-For headers in the requests to the origin. Then, in your backend origin server, you can get the client IP address from the value of the True-Client-IP, or extract the first IP in the chain of X-Forwarded-For.
* FAQs for CDN with ICOS



 Can I use ICOS private endpoints for CDN?
[Adding services by using Helm charts](https://cloud.ibm.com/docs/openshift?topic=openshift-helmhelm)



* [About Helm in Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-helmabout-helm)



* [What is Helm and how do I use it?](https://cloud.ibm.com/docs/openshift?topic=openshift-helmwhat-is-helm)
* [What Helm charts are supported in Red Hat OpenShift on IBM Cloud?](https://cloud.ibm.com/docs/openshift?topic=openshift-helmsupported-charts)



* [Installing Helm v3 in your cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-helminstall_v3)



[Adding services by using IBM Cloud service binding](https://cloud.ibm.com/docs/openshift?topic=openshift-service-bindingservice-binding)



* [About service binding](https://cloud.ibm.com/docs/openshift?topic=openshift-service-bindingsvc-bind-about)



* [What types of services can I bind to my cluster?](https://cloud.ibm.com/docs/openshift?topic=openshift-service-bindingsvc-bind-types)
* [What is IBM Cloud service binding?](https://cloud.ibm.com/docs/openshift?topic=openshift-service-bindingsvc-bind-what)
* [I already have an IBM Cloud service. Can I still use IBM Cloud service binding?](https://cloud.ibm.com/docs/openshift?topic=openshift-service-bindingsvc-bind-existing)
* [What if I want to use service credentials that use the private cloud service endpoint?]
You must reinitiate the VPN session from your VPN client if it is disconnected.
* If I delete a VPN server with connected VPN clients, what happens to the VPN clients?

The VPN clients are disconnected along with the VPN server.
* What happens to a VPN server if I try to delete the subnet that the VPN server is on?

You cannot delete the subnet if any VPN servers are present.
* How do I update the security group that my VPN server is attached to?



1. In the navigation pane, click VPNs > Client-to-site servers, and select the VPN server you want to update.
2. Click Attached security groups > Attach, and select the security group you want to attach.



* What happens to a VPN server if I try to delete the security group that the VPN server is attached to?

You cannot delete a security group if any VPN servers are present.
* Why must I choose subnets during VPN server provisioning?

The server resides in the VPN subnet that you choose. A VPN server needs two available private IP addresses in each subnet to provide high availability and automatic maintenance. It is best if you use the dedicated subnet for the VPN server of size 8, where the length of the subnet prefix is shorter or equal to 29. With dedicated subnets, you can customize the security group and ACL for greater VPN server flexibility.
* Does VPN server support high-availability configurations?

Yes, it supports high availability in an Active/Active configuration. You must choose two subnets if you want to deploy a high availability VPN server with two fault domains. You can also upgrade the stand-alone VPN server to high-availability mode, and downgrade the high-availability VPN server to stand-alone mode.
* Are there any caps on throughput for VPN server?

Up to 600 Mbps of throughput is supported with a stand-alone VPN server. A maximum of 1200 Mbps of throughput is supported with a high availability VPN server.
* Can I use a VPN server for IBM Cloud classic infrastructure?
Why did my SAML authentication request fail? 

You encounter issues with your SAML authentication.



 Why can't my SAML message signature be validated? 

 What’s happening 

When you test your application, you receive the following error message:

The SAML message signature could not be validated

 Why it’s happening 

This error occurs when App ID cannot verify the signature that is sent by SAML.

 How to fix it 

To resolve the issue, verify that you have Inbound Signature set to None in your configuration.





 Why is the RelayState parameter missing from my authentication response? 

 What’s happening 

The RelayState parameter is missing from your authentication response.

 Why it’s happening 

App ID sends an opaque parameter that is known as RelayState as part of the authentication request. If you do not see the parameter in your response, your identity provider might not be configured to return it correctly. The RelayState takes the following form.

https://idp.example.org/SAML2/SSO/Redirect?SAMLRequest=request&RelayState=token

 How to fix it 

Verify that your SAML provider is configured to return the RelayState parameter to App ID without modifying it in any way.





 Why am I receiving an error about my Name ID? 

 What’s happening 

When you send an authentication request, you receive an error that regards the NameID.

 Why it’s happening 

App ID, as the service provider, defines the way that users are identified by the service and by the identity provider. With App ID, users are identified in the NameID authentication request in the NameID field as shown in the following example.

<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>

 How to fix it 

To resolve the issue, be sure that your identity provider NameID is formatted as an email address. Verify that all the users in your identity provider registry have a valid email address format. Then, verify that the NameID field is correctly defined so that a valid email is always returned - even if users in your registry have multiple emails.
Symphony multicluster Troubleshooting 



 What happens if a Lone symphony cluster won’t join with SMC while adding Lone symphony cluster with SMC ? 

 What’s happening 

You are getting status as ERROR, when trying to join Lone Symphony cluster with SMC.

[root@hpc-primary-smc] smcadmin cluster list
NAME STATUS MEMBERSHIP
lone error nonmember

 Why it’s happening 

This error happens when:



* The outbound connection configuration is unsuccessful
* SMCP service may be down in lone symphony cluster
* The network communication between SMC and lone symphony cluster is not communicable.
* The VEMKD port used is SMC may be not correct.



 How to fix it 

To make the outbound connection:



* check whether in lone symphony cluster enabled outbound as <ego:EnvironmentVariable name="SMC_PROXY_INBOUND_CONNECTION">Y</ego:EnvironmentVariable> in SMCP.xml
* If SMCP service is down in lone symphony cluster, execute command egosh service start SMCP to start SMCP service
* If network connection not happening, check whether you added SMC cidr block in Lone symphony cluster security group vice versa.







 How to resolve “End of file or no input: ‘Operation interrupted or timed out'“ when trying to add lone symphony cluster to smc? 

 What’s happening 

You see thius message:

[root@hpc-primary-smc] smcadmin cluster add -c lone1 -p 17870 -m "hpc-lone-primary-0,hpc-symphony-secondary-0"
End of file or no input: 'Operation interrupted or timed out'

 Why it’s happening 

When you try to add a lone symphony cluster with SMC, because of a time out issue you get the warning message. The message is a warning and does not impact adding lone symphony cluster with SMC.

 How to fix it 

This error won’t impact on adding a lone symphony cluster with SMC. Keep on addding other lone symphony clusters.





 What happen after provisioning SMC cluster, immediately if you try to logon as egosh user in secondary nodes of SMC?
You can automatically grant federated users or compute resources access to your account by creating trusted profiles. For federated users, add conditions based on SAML attributes to define which federated users can apply a profile. For compute resources, specify specific resources, or add conditions based on resource attributes to define which compute resources can apply a profile. For both entity types, the level of access that is granted is determined by the access policies that are specified within each trusted profile, or the access groups that the trusted profile is a member of. However, trusted profiles don't require federated users to be invited to an account, and only users that are federated by an external identity provider (IdP) can apply a trusted profile.

When you're a member of multiple access groups, all policies apply at once when you access an account. As a federated user, you might have the option to apply different trusted profiles, but you select just one profile to apply when you log in. For example, if you want to complete developer-related tasks, select the Developer profile when you log in. If you want to complete an administrator-related task, you select theAdmin profile that has privileged permissions. This way, you reduce the risk of taking privileged actions by mistake.

A policy consists of a subject, target, and role. The subject in this case is the access group or trusted profile. The target is what you want the subject to access, such as a set of resources in a resource group, a service instance, all services in the account, or all instances of a service. The role defines the level of access that is granted.

The following diagram shows how an access policy works:

Zoom

![What is an access policy](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/account/images/Access-Policy.svg)

Figure 1. What is an Access Policy

The most commonly used roles are viewer, editor, operator, and administrator platform roles.



* The viewer role provides the least amount of access for viewing instances and resource groups in an account.
* CentOS 8.2
* ESXi for Bare Metal Servers
* RHEL 8.2
* RHEL 8.2 for SAP
* Windows server 2016, 2019



For more information about 25 Gbps port speeds, check out this [blog post](https://www.ibm.com/cloud/blog/announcements/newly-released-25gbe-standard-on-ibm-cloud-bare-metal-servers).







 Public egress bandwidth 

Select the public egress bandwidth option to choose the amount of included outbound, or egress, public traffic that you want for your server. The selected value is per billing period. Any traffic that is recorded over the selection for the period is charged per gigabyte (GB) as an overage. A value of 0 GB means that all traffic is charged. Inbound, or ingress, public traffic is free of charge.





 Provision VLAN selection 

When you configure a server, you are sometimes provided a VLAN selector. This selection is optional, and shows only existing VLANs located that are within the selected data center. The selector is for a private VLAN, and when you choose a private VLAN, a public VLAN selector is presented. It shows public VLANs that are available in the same pod as the selected private VLAN (if a public interface is applicable). These selections help you control what VLANs, and therefore what pod your server resides. VLAN selection becomes more relevant when you take advantage of [gateway](https://cloud.ibm.com/docs/gateway-appliance?topic=gateway-appliance-getting-started) or [hardware firewall](https://cloud.ibm.com/docs/hardware-firewall-shared?topic=hardware-firewall-shared-about-hardware-firewall-shared-) products, or if you are constructing multitier network architectures. Review [Premium VLANs](https://cloud.ibm.com/docs/vlans?topic=vlans-about-vlansabout-premium-vlans) if you want to deploy a specific network topology before server provisioning.



 VLAN trunks
It is highly recommend that customers take immediate action to migrate onto an alternate solution, such as the IBM Cloud® Virtual Router Appliance (VRA; based on the Vyatta 5600) or Juniper vSRX. See [Migrating Vyatta 5400](https://cloud.ibm.com/docs/virtual-router-appliance?topic=virtual-router-appliance-migration-overview) to get started.





 What happens if I'm still running my IBM Cloud workloads using a Vyatta 5400 after March 31? 

Your Vyatta 5400 continues to work after March 31. However, your business and application environments might be exposed to potential security threats and other tampering violations due to latent vulnerabilities in the Vyatta 5400 software.

If you encounter a network issue which takes down your business and application environment, and you trace the root cause to the Vyatta 5400, escalate this matter to our 5400 Offering Manager, because support is no longer be available from IBM or AT&T. You can reach the Offering Management team through email at nwom@us.ibm.com.





 What about my underlying Bare Metal Server hardware – is it still supported? 

Hardware replacements are supported, but if trouble-shooting indicates that your problem is related to the Vyatta OS, you will be directed to migrate to a supported hardware offering immediately. See [Migrating Vyatta 5400](https://cloud.ibm.com/docs/virtual-router-appliance?topic=virtual-router-appliance-migration-overview) to get started.





 As a customer who owns a Vyatta 5400, what do I need to do by March 31, 2019? 

Customers who have a Vyatta 5400 should migrate to either VRA (Vyatta 5600), Juniper vSRX, or Fortigate Security Appliance (FSA) 10G. The VRA (Vyatta 5600) is still fully supported.
Make sure that the public SSH key that's used in the region matches the id_rsa.pub content from the local machine. Use the commands cd .ssh and cat id_rsa.pub to check.
7. Ensure that there are no duplicate id_rsa.pub files present in the .ssh folder in the local machine.







 What is the subnet_not_in_address_prefix error or invalid CIDR format error during the VPC and subnet creation? 

 What’s happening 

You are receiving the following error when you try to apply a plan to your workspace: Apply failed due to Error: [ERROR] Error while creating subnet. The specified CIDR does not fit in any of the address prefixes in the specified VPC. Make sure the subnet's CIDR is a subset of the CIDR of one of the address prefixes.

 Why it’s happening 

During the apply plan process, the workspace tries to create the VPC and subnet with the specified range of the CIDR address prefix from the deployment value. If the address prefix range is out of scope or doesn't belong to the family of the IP address range of the VPC, then you get an error that the address is not in range.

 How to fix it 

Validate if the address prefix range that's provided for subnet creation is from the same range of addresses that are used for the VPC. For example, if the VPC address prefix is 10.241.0.0/18, then the subnet should be in the 10.241.x.x range. If a different IP address range is used, then you need to divide the [subnets](https://www.davidc.net/sites/default/subnets/subnets.html?network=10.23.124.128&mask=25&division=11.721) and choose the IP address range that's required for subnet creation.





 Why does my instance provisioning remain in Starting state? 

 What’s happening 

After you apply a plan, the workspace takes a long time to provision the virtual server instance, and you notice in the UI that the virtual server instance remains in Starting state.

 Why it’s happening