vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Managing your account, resources, and access



* 20 minutes
* 2023-03-03



[Onboarding a virtual server image for VPC](https://cloud.ibm.com/docs/account?topic=account-catalog-vsivpc-tutorial)Onboarding a virtual server image for VPC

This tutorial walks you through how to onboard a sample virtual server image for virtual private cloud (VPC) to your account. By completing this tutorial, you learn how to create a private catalog, import the image, validate that it can be installed on a selected deployment target, and make the virtual server image available to users who have access to your account. As you complete the tutorial, adapt each step to match your organization's goal.

Object Storage Virtual Private Cloud (VPC)

+1

Managing your account, resources, and access



* 20 minutes
* 2022-08-25



[Leveraging context-based restrictions to secure your resources](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-tutorial)Leveraging context-based restrictions to secure your resources

This tutorial walks you through how to use context-based restrictions as an extra layer of protection to your resources. By completing this tutorial, you learn how to create network zones and rules that define access restrictions to specific resources based on context in addition to IAM identity. For more information, see What are context-based restrictions?

Managing your account, resources, and access



* 20 minutes
* 2023-02-08



[Customizing your IBM Cloud dashboard](https://cloud.ibm.com/docs/account?topic=account-tutorial-custom-dash)Customizing your IBM Cloud dashboard

This tutorial walks you through how to customize your dashboard in the IBM Cloud® console to ensure that what is displayed is relevant to you. By completing this tutorial, you learn how to create a new dashboard, add and organize widgets, duplicate a dashboard, share a dashboard with other users, and delete unused dashboards.

Managing your account, resources, and access



* 10 minutes
* 2021-09-24
Code Engine includes Managed runtimes that you can use for your Functions, but also supports Custom runtimes if the Function program logic has specific demands on its runtime environment.

Managed runtimes include Node.js and Python versions and specific CPU and memory combinations. These runtimes are optimized for fast startup. These runtimes are pre-warmed, which avoids the overhead of pulling container images and starting containers and processes. Your code is injected into an already running container. Use these managed runtimes when possible.

Custom runtimes are available for experienced users. You can build your own custom runtime that allows you to pre-package common libraries that are used across different Function implementations. This approach gives you more flexibility in the development process, but still allows for faster startup times, when compared to containerized applications.

For more information, see [Runtimes](https://cloud.ibm.com/docs/codeengine?topic=codeengine-fun-runtime).





 Running Functions 

Whether your code exists as source in a local file or in a Git repository, or your code is a container image that exists in a public or private registry, Code Engine provides you a streamlined way to run your code as an app.

You can create and invoke your Function in Code Engine in the following ways:



* Run from an existing code bundle.
* Run from existing source code. If you are starting with source code that is located in a Git repository or on your local workstation, you can point to the location of your source and Code Engine takes care of building the image for you.



For more information about creating and invoking Functions, see [Working with Functions in Code Engine](https://cloud.ibm.com/docs/codeengine?topic=codeengine-fun-work).





 Security 

Code Engine provides out-of-the-box DDOS protection for your Function. Code Engine's DDOS protection is provided by Cloud Internet Services (CIS) at no additional cost to you. DDoS protection covers System Interconnection (OSI) Layer 3 and Layer 4 (TCP/IP) protocol attacks, but not Layer 7 (HTTP) attacks.
Troubleshooting for IBM Cloud Shell 

Use these tips to help troubleshoot problems that you might run into when you use IBM® Cloud Shell.

Running into issues that you can't fix? We want to hear about it. [Submit feedback](https://cloud.ibm.com/docs/cloud-shell?topic=cloud-shell-feedback) about Cloud Shell through our UI. Or come chat with the development team on [IBM Cloud Dev Tools Slack](https://ic-devops-slack-invite.us-south.devops.cloud.ibm.com/). After you request your invitation, sign in and join the ask-your-question channel.



 Why can't my sessions start? 

 What’s happening 

When you try to start Cloud Shell or restart it after you were idle or your connection was lost, the following message is displayed:

Your session couldn't be started. or Session could not be started. Please wait for a few minutes, then restart the cloud shell and try again.

 How to fix it 

Refresh your Cloud Shell browser tab or window. If Cloud Shell still can't start, try the following possible solutions:



* Restart from the Cloud Shell menu.
* Check if the IP address restriction is [defined for the account or the user](https://cloud.ibm.com/docs/account?topic=account-ips). If the IP address restriction is defined, [add the Cloud Shell ingress IP ranges](https://cloud.ibm.com/docs/cloud-shell?topic=cloud-shell-cs-ip-ranges) to log in from the Cloud Shell service. If the IP address restriction is not defined and you continue to see this issue, create a support case.
* Log out of IBM Cloud®. Clear your browser cache and cookies to remove your preferences and then log in again and open Cloud Shell.
* Check whether [Concurrent sessions](https://cloud.ibm.com/docs/account?topic=account-iam-work-sessions&interface=uisessions-concurrent) is set. If so, ensure that the number of logged in sessions for the account does not exceed the Limit sessions value.
If the configurations are complex or have many firewall rules, consider the use of third-party tool to ease up duplicate manual work.





 Workload migration 

After the configuration migration, the workload VMs can be migrated by using either a Layer 3 or Layer 2 connection between workload VMs awaiting migration on the NSX-V environment. Also, those workload VMs that migrated to the NSX-T environment. To migrate your workloads from NSX-V to the NSX-T environment, consider the following steps:



* Bridge the NSX-T and NSX-V overlays and use the [available L2 extension methods](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-v2t-planningv2t-planning-nwl2ext), by allowing for gradual migration of individual or small batches of VMs.
* Migrate all the VMs on a subnet by using your preferred migration method or tool and move the default gateway to NSX-T.



Considerations include the following questions:



* Do you need to move workload VM with or without limited downtime?
* Do you need to move workload VMs individually or in small batches but cannot move a subnet at a time?
* Do you need to extend Layer 2 between the existing and new vCenter Server environments?



* How many networks do you need to extend at one time?
* Do you need high availability?
* How much spare capacity do you have on the NSX-V prepared host to deploy the required number of NSX-T Edge node VMs for L2 Bridge edge VMs?





The following migration patterns for workload migration must be considered:



* HCX™ - VMware HCX application migration enables the scheduling and migration of thousands of VMs. For more information, see [VMware HCX Migration Types](https://docs.vmware.com/en/VMware-HCX/4.3/hcx-user-guide/GUID-8A31731C-AA28-4714-9C23-D9E924DBB666.html).
[deployment guide icon](https://cloud.ibm.com/media/docs/images/homepage/deployment-guide.svg) [Linking secure private networks over the IBM network](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-linking-secure-network-enclosures)Linking secure private networks over the IBM network Solution tutorial

This tutorial presents setup of a privately routed IP connection over the IBM Cloud private network between two secure private networks hosted in different data centers. All resources are owned by one IBM Cloud account. It uses the Isolate workloads with a secure private network tutorial to deploy two private networks that are securely linked over the IBM Cloud private network using the VLAN Spanning service.

![solution tutorial icon](https://cloud.ibm.com/media/docs/images/homepage/solution-tutorial.svg) [Microsoft Software on IBM Cloud](https://cloud.ibm.com/docs/microsoft)Microsoft Software on IBM Cloud Solution guide

IBM Cloud has a strategic relationship with Microsoft to offer their suite of software natively in our cloud and as Bring Your Own Licenses (BYOL).

![solution icon](https://cloud.ibm.com/media/docs/images/homepage/magic-wand.svg) [Modern web application using MEAN stack](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-mean-stack)Modern web application using MEAN stack Solution tutorial

This tutorial walks you through the creation of a web application using the popular MEAN stack. It is composed of a MongoDB, Express web framework, Angular front end framework and a Node.js runtime. You will learn how to run a MEAN sample app locally, create and use a managed database-as-a-service (DBasS), deploy the app to IBM Cloud and scale both the runtime and database resources.

!
Portworx uses this key to encrypt data at rest and during transit when data is sent to a different worker node. 
 Built-in snapshots and cloud backups You can save the current state of a volume and its data by creating a [Portworx snapshot](https://docs.portworx.com/portworx-install-with-kubernetes/storage-operations/create-snapshots/). Snapshots can be stored on your local Portworx cluster or in the cloud. 
 Integrated monitoring You can view the health of your Portworx cluster, including the number of available storage nodes, volumes and available capacity, and analyze your data in [Prometheus, Grafana, or Kibana](https://docs.portworx.com/install-with-other/operate-and-maintain/monitoring/). 







 Integration with IBM Cloud Kubernetes Service 

If you have a classic IBM Cloud Kubernetes Service cluster, you can choose worker node flavors that are optimized for SDS usage and that come with one or more raw, unformatted, and unmounted local disks that you can use to store your data. Portworx offers best performance when you use [SDS worker node machines](https://cloud.ibm.com/docs/containers?topic=containers-planning_worker_nodessds) that come with 10Gbps network speed. However, you can install Portworx on non-SDS worker node flavors in classic clusters, but you might not get the performance benefits that your app requires.

Portworx is installed by using a [Helm chart](https://cloud.ibm.com/docs/containers?topic=containers-storage_portworx_about). When you install the Helm chart, Portworx automatically analyzes the local persistent storage that is available in your cluster and adds the storage to the Portworx storage layer. To add storage from your Portworx storage layer to your apps, you must use [Kubernetes persistent volume claims](https://cloud.ibm.com/docs/containers?topic=containers-storage_portworx_deploy).
FAQs about Context-based restrictions 

FAQs for IBM Cloud® Context-based restrictions might include questions about access restrictions for IBM Cloud resources.

To find all FAQs for IBM Cloud®, see our [FAQ library](https://cloud.ibm.com/docs/faqs).



  What are IBM Cloud Context-based restrictions? 

As an account owner or administrator, you can define and enforce access restrictions for IBM Cloud® resources based on the network location of access requests by enabling context-based restrictions. For more information, see [What are context-based restrictions?](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-whatis).





  How do you use Context-based restrictions and IAM policies together? 

These restrictions work with traditional IAM policies, which are based on identity, to provide an extra layer of protection. Since both IAM access and context-based restrictions enforce access, context-based restrictions offer protection even in the face of compromised or mismanaged credentials.

Unlike IAM policies, context-based restrictions don't assign access. Context-based restrictions check that an access request comes from an allowed context that you configure.





  What's the difference between Context-based restrictions and allowed IP addresses? 

Context-based restrictions enforce access restrictions at the individual service level and access is evaluated when a user attempts to access a resource. Allowed IP address restrict access at the account level, which is evaluated at login.





  How can I make sure that my rule doesn't break an access flow? 

As an administrator, you manage users, applications, and workflows that depend on having the right access when they need it. To make sure that your context-based restrictions rules don't brake an access flow, set the rule to report-only mode for at least 30 days before you enable the rule. This way, you can monitor the impact of the rule on your access flows, such as when access is denied or allowed and for which identities. For more information, see [Monitoring context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-cbr-monitor).
Some of the microservices do not benefit from being scaled up; more replicas does not always mean more throughput.



* etcd cannot be scaled to more than 5 replicas by using the kubectl scale statefulset command.
* master triggers workspace trainings. Adding more master microservice replicas adds resiliency.
* TAS and ed-mm manage how many models are loaded and where they are loaded. More replicas might mean that a model can be loaded more times. However, unless high load is present, scaling too high does not help.
* Minio has a hardcoded number of replicas and cannot be scaled manually.
* MongoDB cannot be scaled manually.
* Redis can be scaled, but adding more redis-servers only improves resiliency to outages because only one of the servers is marked as coordinator and responds to requests.
* Store can be scaled up to a maximum of 10 replicas.
* PostgreSQL can be scaled, but you might reach a limit to the number of database connections that can be created.





1. Disable Horizontal Pod Autoscaling (HPA). If you want to scale the deployment manually, you must disable HPA first or autoscaling will override any values you try to set manually.

To disable HPA, you must delete the HPA resource.

kubectl delete hpa NAME-OF-HPA
2. To increase the number to scale up or decrease the number to scale down, use one of these commands:

kubectl scale deploy {pod-name} --replicas={number}

or

kubectl scale statefulsets {set-name} --replicas={number}









 Stopping and restarting the cluster 

You can manually scale the cluster down and back up or use a script to stop and restart the service.



 Use a script to stop and restart Watson Assistant 

You can use the wactl.sh script to stop or restart the service.

To use the script to stop or restart the service, complete the following steps:



1.
Why does the Ingress status show an ESSSMI error? 

Virtual Private Cloud

Classic infrastructure

Satellite

  What’s happening 

When you check the status of your cluster's Ingress components by running the ibmcloud ks ingress status-report get command, you see an error similar to the following example.

Could not access Secrets Manager instance (ESSSMI).

  Why it’s happening 

IBM Cloud Kubernetes Service receives an unauthorized message when attempting to update or apply secrets from the Secrets Manager instance registered with the cluster.

  How to fix it 



1.  Follow the steps to ensure you have a valid [service-to-service authorization policy](https://cloud.ibm.com/docs/containers?topic=containers-secrets-mgrsecrets-mgr_setup_s2s) in place for the Kubernetes Service and Secrets Manager.
2.  If the issue persists, contact support. Open a [support case](https://cloud.ibm.com/docs/get-support?topic=get-support-using-avatar). In the case details, be sure to include any relevant log files, error messages, or command outputs.
[Cloud databases dashboard in monitoring](https://cloud.ibm.com/docs-content/v1/content/6da1ae87b1f476791c38688e7a0b7f7c7a7d71b9/databases-for-elasticsearch/images/monitoring-ibm-list.png)

Figure 2. Cloud databases dashboard



 Monitoring Availability 

IBM Cloud Monitoring is available for deployments in every region. Deployments in Multi-zone Regions (MZRs) - eu-gb, eu-de, us-east, us-south, jp-tok, au-syd - have their metrics in the corresponding region.

If you have deployments that are in Single-zone Region (SZR) che01 then your logs are forwarded to an IBM Cloud Monitoring instance in another region. You need to provision monitoring instances in the region where your metrics are forwarded to. Metrics for deployments in che01 go to jp-tok.





 Available Metrics 



Table 1. Available Metrics Reference Table

 Metric Name 

 [Cluster status](https://cloud.ibm.com/docs/databases-for-elasticsearch?topic=databases-for-elasticsearch-monitoringibm_databases_for_elasticsearch_cluster_status) 
 [Disk read latency mean](https://cloud.ibm.com/docs/databases-for-elasticsearch?topic=databases-for-elasticsearch-monitoringibm_databases_for_elasticsearch_disk_read_latency_mean) 
 [Disk write latency mean](https://cloud.ibm.com/docs/databases-for-elasticsearch?topic=databases-for-elasticsearch-monitoringibm_databases_for_elasticsearch_disk_write_latency_mean) 
 [GC Percentage](https://cloud.ibm.com/docs/databases-for-elasticsearch?topic=databases-for-elasticsearch-monitoringibm_databases_for_elasticsearch_garbage_collection_percent_average_15m)
The Security and Compliance Center also offers security insights that you can use to detect potential threats when observing your account activity. For more information, see [Getting started with Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).





 Creating resources 

The resource controller is the next-generation IBM Cloud platform provisioning layer that manages the lifecycle of IBM Cloud resources in your account. Resources are created globally in an account scope. The resource controller supports the creation of resources both synchronously and asynchronously. Examples of resources include databases, accounts, processors, memory, and storage limits.

In general, resources that are tracked by the provisioning layer are intended to associate usage metrics and billing, but that isn’t always the case. In some cases, the resource might be associated with the provisioning layer to ensure that its lifecycle can be managed along with the account lifecycle. The resource controller uses IBM Cloud Identity and Access Management (IAM) for authentication and authorization of actions that are taken against the provisioning layer.

The resource controller provides common APIs to control the lifecycle of resources from creating an instance to creating access credentials to removing access to deleting an instance.





 Managing your resources 

A collection of resources is managed by [resource groups](https://cloud.ibm.com/docs/account?topic=account-rgs). A resource group is associated with your account. All IBM Cloud resources must be assigned to a resource group. When you create an account, a default resource group is created for you. All IBM Cloud IAM-enabled resources must be created within a resource group. If you have a Lite account, you can have only one resource group, but with a a Pay-As-You-Go or Subscription account, you can create more than one resource group. If an account is suspended, the corresponding resource group is suspended as well, and all resources within the resource group are suspended.





 Managing Infrastructure as Code (IaC) deployments with projects 

IBM Cloud

projectsare a named collection of configurations that are used to manage related resources and Infrastructure as Code (IaC) deployments across accounts.
Why does the Ingress status show an ESSSMI error? 

Virtual Private Cloud

Classic infrastructure

Satellite

  What’s happening 

When you check the status of your cluster's Ingress components by running the ibmcloud oc ingress status-report get command, you see an error similar to the following example.

Could not access Secrets Manager instance (ESSSMI).

  Why it’s happening 

Red Hat OpenShift on IBM Cloud receives an unauthorized message when attempting to update or apply secrets from the Secrets Manager instance registered with the cluster.

  How to fix it 



1.  Follow the steps to ensure you have a valid [service-to-service authorization policy](https://cloud.ibm.com/docs/openshift?topic=openshift-secrets-mgrsecrets-mgr_setup_s2s) in place for the Kubernetes Service and Secrets Manager.
2.  If the issue persists, contact support. Open a [support case](https://cloud.ibm.com/docs/get-support?topic=get-support-using-avatar). In the case details, be sure to include any relevant log files, error messages, or command outputs.
[Cloud databases dashboard in monitoring](https://cloud.ibm.com/docs-content/v1/content/5b067197eff6fba69b2fcb2a802b03639f12f3d7/databases-for-cassandra/images/monitoring-ibm-db-list.png)

Figure 2. Cloud databases dashboard



 Monitoring Availability 

IBM Cloud Monitoring is available for deployments in every region. Deployments in Multi-zone Regions (MZRs) - eu-gb, eu-de, us-east, us-south, jp-tok, au-syd - have their metrics in the corresponding region.

If you have deployments that are in Single-zone Region (SZR) che01 then your logs are forwarded to an IBM Cloud Monitoring instance in another region. You need to provision monitoring instances in the region where your metrics are forwarded to. Metrics for deployments in che01 go to jp-tok.





 Available Metrics 



Table 1. Available Metrics

 Metric Name 

 [Disk read latency mean](https://cloud.ibm.com/docs/databases-for-cassandra?topic=databases-for-cassandra-monitoringibm_databases_for_cassandra_disk_read_latency_mean) 
 [Disk write latency mean](https://cloud.ibm.com/docs/databases-for-cassandra?topic=databases-for-cassandra-monitoringibm_databases_for_cassandra_disk_write_latency_mean) 
 [IO utilization in percent 5-minute average](https://cloud.ibm.com/docs/databases-for-cassandra?topic=databases-for-cassandra-monitoringibm_databases-for-cassandra_disk_io_utilization_percent_average_5m) 
 [IO utilization in percent 15-minute average](https://cloud.ibm.com/docs/databases-for-cassandra?topic=databases-for-cassandra-monitoringibm_databases-for-cassandra_disk_io_utilization_percent_average_15m)