vania-janet/multiturn-rag-retrieval-data huggingface dataset:
This option is typically used with Db2 Lite plans, which provide restricted access for a single user in a shared database. It can also be used with Standard plans, but the service credentials for Standard plans always allow full administrator access. If the SQL user has only restricted access to the target database, use the subsequent "Db2 table URI location" option.

The CRN table has the form:

<db service crn>/<table name>

You retrieve the <db service crn> by opening the resource list in the IBM Cloud dashboard. Scroll down to the database service instance and click in any of the columns other than the first column. An overlay panel to the right opens where you find a field that is labeled CRN: with the value and an option to copy it to your clipboard.

The <table name> part specifies the table that is created in your database. It has the format <schemaname>.<tablename>. If you omit the <schemaname> part, the table is created in the schema of the "username" in the credentials of your database service instance – for a Db2 Lite plan, it is the only schema that you have access to. The table name is case-preserving, so use uppercase to match database defaults.

An example for a CRN table is: crn:v1:bluemix:public:dashdb-for-transactions:us-south:s/c3882b7e-00c4-4e7c-a63b-cded1c298f25:23eb50c5-723d-41e0-b7d8-603feaa79ccc:cf-service-instance:/RWS46052.QUERY_RESULT





 Db2 table URI location 

If the SQL user cannot access the service credentials for the Db2 on Cloud instance (because the user does not have access to the account that contains the database instance, or is not granted Operator privilege on the instance), the user can specify the database location by using a URI with the Db2 database hostname.

By default the access to this database is performed with the IAM identity of the user who submitted the query.
You can [restore a private catalog](https://cloud.ibm.com/docs/account?topic=account-resource-reclamation&interface=clirestore-resource-cli) within 7 days after you delete it.





 Creating a private catalog with all products included by using the CLI 

Complete the following steps to create a catalog that includes all products in the IBM Cloud catalog:



1. Target a resource group to create a catalog. You can run the ibmcloud resource groups command, and then the ibmcloud target -g "resource group" command.
2. Use the following command to create a new private catalog in your account.

ibmcloud catalog create --name CATALOG [--catalog-description "DESCRIPTION"]



All the IBM Cloud catalog products are visible by default when you create a new private catalog. See the [Catalogs management CLI](https://cloud.ibm.com/docs/cli?topic=cli-manage-catalogs-pluginprereqs-managecatalogs) for more information.





 Creating a private catalog with select products included by using the CLI 

Complete the following steps to create a catalog that includes a specific set of products in the IBM Cloud catalog:



1. Target a resource group to create a catalog. You can run the ibmcloud resource groups command, and then the ibmcloud target -g "resource group" command.
2. Create a new private catalog in your account using the following command.

ibmcloud catalog create --name CATALOG [--catalog-description "DESCRIPTION"]
3. Update the filter to include or exclude a particular product or products and any applicable pricing plans. Make sure to specify your catalog, or the filter will default to the account level. See [Catalogs management CLI](https://cloud.ibm.com/docs/cli?topic=cli-manage-catalogs-pluginoffering-filter) for more command options.

ibmcloud catalog filter offering --offering PRODUCT-NAME







 Setting the visibility of the IBM Cloud catalog by using the CLI 

By default, the IBM Cloud public catalog is visible to all users in the account.
Service instance my-cos-1 with ID crn:v1:bluemix:public:cloud-object-storage:global:a/ea998d3389c3473aa0987652b46fb146:4b636e74-f3ca-40bb-80b8-3bd21801ccb8:: is deleted successfully

 view resources (COS and KMS should no longer exist)
$ ibmcloud resource service-instances

Retrieving instances with type service_instance in resource group Default in all locations under account <account name> as <email address>...
OK
No service instance found.
<-- </section "id="section-kp-registrations-example-2" "> --><-- <section "id="section-kp-registrations-example-3" "> --> Example 3 This example shows what happens when one of the following occurs between COS and Key Protect (KP) - COS is not able to access the Key Protect root key.<-- <ul> --> * Delete the KP root key * Remove the CMS/KP authorization policy<-- </ul> -->This example does not show command output except when relevant. create a Cloud Object Storage (COS) service instance
 "lite" is the pricing plan and "global" is the region
$ COS_NAME=my-cos-1

$ ibmcloud resource service-instance-create $COS_NAME cloud-object-storage lite global

 capture the COS instance id (GUID)
$ COS_INSTANCE_ID=c488e11a-c8a0-4688-b002-9327266ea55f

 create a Key Management Service (KMS) service instance
 "tiered-pricing" is the pricing plan and "us-south" is the region
$ KMS_NAME=my-kms-1

$ ibmcloud resource service-instance-create $KMS_NAME kms tiered-pricing us-south

 capture the Key Protect (KP) instance id (GUID)
Managing user access for Continuous Delivery in resource groups 

Access to IBM Cloud® Continuous Delivery service instances in resource groups for users in your account is controlled by IBM Cloud Identity and Access Management (IAM).

User access for toolchains is managed separately. For more information about managing user access to toolchains in resource groups, see [Managing user access to toolchains in resource groups](https://cloud.ibm.com/docs/services/ContinuousDelivery?topic=ContinuousDelivery-toolchains-iam-security).

Every user that accesses Continuous Delivery services in your account must be assigned an IAM access policy. The policy determines which Continuous Delivery instances the user can access and what actions the user is allowed to take.

Policies enable access to be granted at different levels or scopes, including, but not limited to:



* Access across all Continuous Delivery instances in your account
* Access across all Continuous Delivery instances in a resource group within your account
* Access to a specific Continuous Delivery instance in your account



After you define the scope of the access policy, you assign a role. Review the following tables which outline what actions each role allows within the Continuous Delivery service.

The following table details actions that are mapped to platform management roles. Platform management roles enable users to perform tasks on service resources at the platform level, for example assign user access for the service, create or delete service IDs, create instances, and bind instances to applications.



Table 1. IAM user roles and actions

 Platform Management Role Description of Actions Example Actions 

 Viewer, Operator View instances of the Continuous Delivery service. Click a Continuous Delivery service instance to open its dashboard. 
 Editor, Administrator Create, view, update, modify the plan for, and delete instances of the Continuous Delivery service. Provision an instance of Continuous Delivery in a resource group. /n /n Delete an instance of Continuous Delivery from a resource group. /n /n Change a Continuous Delivery instance plan from Lite to Professional. 
 Administrator Update the Authorized Users list. Add a user to the Authorized Users list. /n /n Remove a user from the Authorized Users list. 



The following table details actions that are mapped to service access roles.
Best practices for organizing resources and assigning access 

After you set up your IBM Cloud® account, you're ready to start planning how you want to organize resources and assign access to identities in your account. These best practices provide you with the basic building blocks to enable successful and secure app development in IBM Cloud.

The following best practices focus on resources that are enabled for IBM Cloud Identity and Access Management (IAM) and that are assigned to resource groups. Classic infrastructure services aren't IAM-enabled, which means that they can't be assigned to resource groups.



 What makes a good resource group strategy? 

Use resource groups to organize your account

resourcesfor access control and billing purposes.

Administrators can have better control of resource usage at the project environment level if one resource group per project environment is used. For example, a typical project has development, test, and production environments. A project that is named CustApp might have the following resource groups:



* CustApp-Dev
* CustApp-Test
* CustApp-Prod



In this scenario, you might assign a developer wide-ranging access to the development resource group and much tighter or no access to the production resource group.



 Organizing resources in resource groups 

All resources that are managed by using IAM access control belong to a resource group. You assign a resource to its resource group when you create it from the catalog. It's important to [create your resource groups](https://cloud.ibm.com/docs/account?topic=account-rgscreate_rgs) first because you can't change the assignment of resources after you set it. If you accidentally assign a resource to the wrong resource group, delete the resource and create a new one.

A default resource group is created for your account. If you have a Lite account, you're limited to the use of one resource group. If you want to create multiple resource groups, [upgrade](https://cloud.ibm.com/docs/account?topic=account-upgrading-account) to a Pay-As-You-Go or Subscription account.





 Searching for resources 

You can use user tags to easily organize and search for the resources in your account.
The [blueprints-basic-example](https://cloud.ibm.com/docs/schematics?topic=schematics-deploy-schematics-blueprint-cli) as used in the [tutorial](https://cloud.ibm.com/docs/schematics?topic=schematics-deploy-schematics-blueprint-cli) demonstrates the principles of deploying cloud resources by using two modules, which reference and create cloud resources. If the user has insufficient IAM access permissions to these resources, the Terraform Apply operations can fail, resulting in an Apply failure.

This example assumes, the user has IAM access permissions to create resources in the default resource group and also [Cloud Object Storage](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-iam) instances. Additionally the user must also have permissions to create Schematics [workspaces and blueprints](https://cloud.ibm.com/docs/schematics?topic=schematics-access).



* Creating the Cloud Object Storage instance:



* You can have one instance of a Lite plan per service. To create a new instance, either delete your existing Lite plan COS instance or select a paid plan.



* Creating the Cloud Object Storage instance, the following error can occur if the user does not have the correct IAM permissions:



* AccessDenied: Access Denied status code: 403.









 What is the time taken to create an IBM Kubernetes Service cluster and other resources? 

Schematics Blueprint utilizes IaC automation code modules that are written in Terraform HCL. The time taken to create resources is dependent on the resource type. Terraform automation modules are written not to return on initial resource creation, but to return only when the resource is fully initialized and available to be used by subsequent automation modules. This is different compared to the experience of creating resources through the UI. In the UI control is returned immediately and initialization continues in the background. With automation modules the perception is that they can take significantly longer to run.





 How do you configure the version of Terraform to used?
Getting started tutorial Cognos Dashboard Embedded 



 Step 1: Provisioning a Cognos Dashboard Embedded service instance 

You can create one or more instances of the Cognos Dashboard Embedded service.

Note: The Lite pricing plan is unrestricted. When the Cognos Dashboard Embedded service becomes generally available, quotas will be enforced for the entire account. Creating additional Lite plans will share the same quota.

To see your GUID, use the following command in the command line interface (CLI):

bx account list

To create a Cognos Dashboard Embedded service instance, do the following steps:



1. In your web browser, go to [https://cloud.ibm.com/login](https://cloud.ibm.com/login).
2. Log into your IBM Cloud® account, or create an account.
3. Navigate to the IBM Cloud® catalog: [https://cloud.ibm.com/catalog](https://cloud.ibm.com/catalog).
4. In the Analytics section, click the Cognos Dashboard Embedded tile.
5. On the Cognos Dashboard Embedded catalog page, specify the following:



* Specify a name for the new Cognos Dashboard Embedded service instance.
* Choose a region.
* Choose a resource group.
* Choose the Lite planning price.
* Click Create.





The Cognos Dashboard Embedded service instance page displays once the service instance is created. This page allows you to access the Getting Started documentation, create credentials, and view or change your plan settings.

For billing and security purposes, you can create multiple instances.





 Step 2: Creating a service credential 

You use a service credential to programmatically access the service from your application. The service credential includes the URL to access the service instance and the credentials to access the service. It may be desirable to create multiple service credentials for different applications or deployments of your applications. You cannot restore removed credentials. You'll have to create new credentials for your application.



1. On the left side, click Service credentials and click New credential.
[Flowchart showing how to configure my local CLI to manage the Activity Tracker Event Routing account configuration](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/atracker/images/atracker_version.svg)

Figure 1. Flowchart showing steps depending on your configuration version



 What API version is targeted by the atracker CLI plugin 

When you are logged in to an IBM Cloud account from your local system, the API version that the atracker CLI plugin targets is set as follows:



* If your IBM Cloud account is running an Activity Tracker Event Routing V1 configuration and you have a CLI V1 plugin installed in your local system, the CLI plugin is set by default in your local system to use the API V1.
* If your IBM Cloud account is running an Activity Tracker Event Routing V1 configuration and you have a CLI V2 plugin installed in your local system, you must set the API version that the CLI plugin targets in your local system to V1 by running the ibmcloud atracker init version command.
* If your IBM Cloud account is running an Activity Tracker Event Routing V2 configuration and you have a CLI V1 plugin installed in your local system, you must upgrade your local system by installing the CLI V2 plugin.
* If your IBM Cloud account is running an Activity Tracker Event Routing V2 configuration and you have a CLI V2 plugin installed in your local system, the CLI plugin is set by default in your local system to use the API V2.
* If you have a CLI V2 plugin installed in your local system and you migrate your account from an Activity Tracker Event Routing V1 configuration to an Activity Tracker Event Routing V2 configuration, you must set the API version that the CLI plugin targets in your local system to V2 by running the ibmcloud atracker init version command.







 IAM permissions
If you chose to use resource groups, go to [Manage → Account → Resource groups (in Account resources)](https://cloud.ibm.com/account/resource-groups) and click Create.





 Step 3: Create Qiskit Runtime service instances 

If you already created Qiskit Runtime service instances, skip this step.



* If you are using resource groups, make sure to create the service instances on the appropriate resource group.
* The service instance name, such as QR-ml, is needed for access group references.





1. From the [Qiskit Runtime Provisioning page](https://cloud.ibm.com/catalog/services/quantum-computing), select the Create tab, then choose the appropriate service plan, depending on what you need access to:



* Lite: Free simulators-only plan to help you get started with Qiskit Runtime. Learn to use Qiskit Runtime by following our examples and tutorials for one of the pre-built programs available for running circuits efficiently.
* Standard: A pay-as-you-go model for accessing IBM Quantum systems and simulators. Build your own programs and use all the benefits of Qiskit Runtime by running on real quantum hardware, while maintaining access to all of the simulators available on the Lite plan.



2. Complete the required information, then click Create.







 Step 4: Create access groups for projects 

First, we create a custom role that allows users to perform actions to work with Qiskit Runtime service instances for each access group. Next, we create an access group for each project and give that group the minimum set of permissions that are required to work with the project resources. In a later step, we map users to access groups.

Follow these steps to set up an access group:



1. Create a custom role.



1. From [Manage → IAM → Roles](https://cloud.ibm.com/iam/roles), click Create.
2. Enter a name, ID, description, and select Qiskit Runtime from the service, as shown in the image:

Zoom

![This image shows a custom role that is being created.]
In the initial IBM Cloud data center, access to private network is provided though private uplinks, which are attached to a portable subnet on a private primary VLAN on the IBM Cloud private network. If you provision your instance with public interfaces, access to public network is provided though public uplinks, which are attached to a portable subnet on a public VLAN on the IBM Cloud public network. The uplinks have specific IP addresses to this data center and they cannot move between the data centers.
4. You must deploy two additional edge cluster transport nodes manually. Also, you must create a new edge cluster for your Tier-0 and Tier-1 gateways in the second IBM Cloud data center hosts.
5. In the second IBM Cloud data center, access to private network is provided though private uplinks, which are attached to a portable subnet on a private primary VLAN on the IBM Cloud private network. If you provision your instance with public interfaces, access to public network is provided though public uplinks, which are attached to a portable subnet on a public VLAN on the IBM Cloud public network. The uplinks have specific IP addresses to this data center and they cannot move between the data centers.
6. You must deploy two or more edge cluster transport nodes in the regional edge cluster manually. Consider at least one in each zone or data center for high availability. Then, create a new edge cluster by using these edge transport nodes, and create your regional Tier-0 in this cluster. You can select which data center (or edge node) is your preferred Tier-0 path in the regional cluster. You can separate routing tables at this level by using VRF lite capability in the Tier-0 Gateway. Refer to VMware documentation for more details.
7. Manually create an overlay transit segment and create uplinks in Tier-0 gateways into the transit segment. Establish dynamic routing between the Tier-0 gateways. BGP is the preferred routing protocol. If you use VRF lite capability in the Tier-0 Gateway, you can use multiple transit segments, depending on your design.
8. Then, create your Tier-1 gateways in the regional edge cluster.
Choose a method to login to an OpenShift cluster. [Learn more about the methods to login](https://cloud.ibm.com/docs/openshift?topic=openshift-access_clusteraccess_automation).







 Step 2. Store your logging ingestion key as a Kubernetes secret 

You must create a Kubernetes secret to store your logging ingestion key for your service instance. The logging ingestion key is used to open a secure web socket to the logging ingestion server and to authenticate the logging agent with the IBM Log Analysis service.



1. Create a project. A project is a namespace in a cluster.

oc adm new-project --node-selector='' ibm-observe

Set --node-selector='' to disable the default project-wide node selector in your namespace and avoid pod recreates on the nodes that got unselected by the merged node selector.
2. Create the service account logging-agent in the cluster namespace ibm-observe. A service account is in Openshift what a service ID is in IBM Cloud. Run the following command:

oc create serviceaccount SERVICEACCOUNT_NAME -n PROJECT

Where

PROJECT is the namespace where the logging pods run. Set this value to ibm-observe.

SERVICEACCOUNT_NAME is the name of the service account that you use to deploy the logging agent. Set this value to logging-agent. Notice that if you leave the service account name blank, the default service account is used instead of the service account that you created.

oc create serviceaccount logging-agent -n ibm-observe
3. Grant the serviceaccount access to the Privileged SCC so the service account has permissions to create priviledged logging pods. Run the following command:

oc adm policy add-scc-to-user privileged system:serviceaccount:PROJECT:SERVICEACCOUNT_NAME

Where

PROJECT is the namespace where the logging pods run. Set this value to ibm-observe.
* UI
* CLI
* API
* Terraform







 Managing resource groups 

A resource group is a way for you to organize your account resources in customizable groupings so that you can quickly assign users access to multiple resources at a time. Any account resource that is managed by using IBM Cloud® Identity and Access Management (IAM) access control belongs to a resource group within your account. You can group resources and assign access to individual service instances or entire resource groups that use IAM.

To start managing your resource groups, in the IBM Cloud® console, go to Manage > Account > Account resources > Resource groups. You can create, view, and rename your resource groups, add resources and manage access to your resource groups. You can also delete any resource group only if it doesn't contain any resources, and it isn't the default resource group. The IBM Cloud account owner can add resources to any resource group, but other users must be granted access by using an IAM access policy.

For more information about working with resource groups, see [Best practices for organizing resources and assigning access](https://cloud.ibm.com/docs/account?topic=account-account_setup).



 Creating a resource group 

If you have a Pay-As-You-Go or Subscription account, you can create multiple resource groups to easily manage quota and view billing usage for a set of resources. You can also group resources to make it easier for you to assign users access to more than one instance at a time. You can have a maximum of 1000 resource groups per account.

You must be assigned an IAM policy with the Administrator role on All Account Management services to create additional resource groups. If you have a Lite account or 30-day trial, you can't create extra resource groups, but you can rename your default resource group.





 Creating a resource group in the console 



1. In the IBM Cloud console, go to Manage > Account > Account resources > Resource groups.
2. Click Create.
3. Enter a name for your resource group.
4. Click Create.







 Creating a resource group by using the CLI