vania-janet/multiturn-rag-retrieval-data huggingface dataset:
How can I get access to invite users to the account? 

You must have specific access to invite users to an IBM Cloud® account if you aren't the account owner. Without the correct access, you can't invite users to an account.

  What’s happening 

When you click Invite users, the following message might be displayed:

> Looks like you don't have access to invite users. You must be assigned the editor or administrator role for the User management service or be a Cloud Foundry org manager. Contact your account owner for access.

  Why it’s happening 

You aren't assigned the correct access.

  How to fix it 

To invite users and manage outstanding invitations, you must be an account owner, an organization manager, a user with an IAM access policy with the Editor role or higher on the user management account management service, or you must have classic infrastructure permissions to add users.

To review your assigned access in the account, complete the following steps:



1.  In the IBM Cloud console, click Manage > Access (IAM), and select Users.
2.  Select your name.
3.  Review the assigned access in the Access tab.



If you aren't assigned the correct access, contact the account owner. After you have the correct access, go to Manage > Access (IAM), then select Users, and click Invite users to add users to the account.

If you're the account owner and can't invite users, contact [Support](https://cloud.ibm.com/unifiedsupport/supportcenter).

To contact support, you can use the following methods:



*  If you have a Pay-As-You-Go or Subscription account, you can click Live chat with support.
*  You can [create a case](https://cloud.ibm.com/unifiedsupport/cases/form).
Description Enter your [service instance ID](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-instance-ID), the region that your service instance resides in, and the number of crypto units you want to add. You can have no more than three crypto units for a service instance. 
 Selected resources Select your Hyper Protect Crypto Services service instance. 



3. Check the Email me updates about this issue box, and click Continue to review > Create case.

After the operation is completed successfully, you will get an email notification. You can also check the state in the Support Center by clicking the Help icon ![Help icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/help.svg) > Support center from the IBM Cloud console menu bar.
4. To view the number of crypto units in the current service instance, run the ibm tke cryptounits command in the CLI. Or you can select the Crypto units tab in the Trusted Key Entry application, depending on how you store your master key parts.



For availability and disaster-recovery capability, if you request to add crypto units, the new crypto units are automatically allocated in different availability zones within the same region.

Before you can use the new crypto units, complete the following two steps to initialize and activate them.





 Step 2: Initialize the new crypto units 

Depending on how you store your master key parts, you might initialize the new crypto units with the TKE CLI plug-in, or smart cards together with the Management Utilities. Make sure to configure the new crypto units the same as the existing crypto units by referring to the following instructions:



* If you load the master key from your workstation, see [Initializing service instances with the IBM Cloud TKE CLI plug-in](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm).
Thank you for watching this installment of the IBM Cloud Console Guide.







 Before you begin 

To manage or create new access groups, you must have the following type of access:



* Account owner
* Administrator or editor on the IAM Access Groups account management service in the account
* Administrator or editor for the All Account Management services



Additionally, an administrator or editor can be assigned access to manage an individual group by creating an access policy where the resource is the Access group ID. For more information about access policies and roles for the IAM Access Groups service, see [IAM access](https://cloud.ibm.com/docs/account?topic=account-userrolesuserroles).

Before you can set up access groups by using Terraform, make sure that you have completed the following:



* Install the Terraform CLI and configure the IBM Cloud Provider plug-in for Terraform. For more information, see the tutorial for [Getting started with Terraform on IBM Cloud®](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-getting-started). The plug-in abstracts the IBM Cloud APIs that are used to complete this task.
* Create a Terraform configuration file that is named main.tf. In this file, you define resources by using HashiCorp Configuration Language. For more information, see the [Terraform documentation](https://www.terraform.io/docs/language/index.html).







 Creating an access group in the console 

A unique name is required to differentiate access groups in the account. To create an access group, complete the following steps:



1. In the IBM Cloud® console, click Manage > Access (IAM), and select Access Groups.
2. Click Create.
3. Enter a unique name to identify your access group, an optional description, and click Create.



Next, continue to set up your groups by adding users, service IDs, or trusted profiles.
Why is a policy limit blocking me from assigning access? 

You might encounter an error when you're assigning access if you already have the maximum number of policies in your IBM Cloud® account.

You tried to assign access, but received an error message that you reached the limit of access policies in the account.

  What’s happening 

A new policy can't be created to assign access, and you receive an error message that states:

> 422: Exceeded maximum policies quota error.

  Why it’s happening 

The account is at the [limit of total number of policies allowed](https://cloud.ibm.com/docs/account?topic=account-known-issues).

  How to fix it 

Reduce the number of policies on the account by following the [Best practices for organizing resources and assigning access](https://cloud.ibm.com/docs/account?topic=account-account_setup). For more information about policy limits for the account, see [IBM Cloud IAM limits](https://cloud.ibm.com/docs/account?topic=account-known-issues).
Before you can start evaluating your resources for compliance, you must configure an Object Storage bucket where Security and Compliance Center can forward your results data for long-term storage. For more information about bucket requirements, see [Storing and processing data in Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-storage).

To connect your Object Storage bucket, you can use the Security and Compliance Center UI.



1. Go to the Security and Compliance Center by clicking the Menu icon in the IBM Cloud console and selecting Security and Compliance.
2. In the navigation, click Settings.
3. On the Storage tile, click Connect.
4. Ensure that the service-to-service policy between Object Storage and Security and Compliance Center is configured. If a policy is already in place, this screen is not shown and you can skip to the next step.
5. Select an instance of Object Storage.
6. From the table, select the bucket that you want to use.
7. Click Connect.







 Creating an attachment 

An attachment is how you target a specific grouping of your resources to evaluate against a specific profile.



1. In the Security and Compliance Center navigation, click Dashboard Then, click Get started.
2. Select the Profile that you want to use to evaluate compliance.

If you don't see a profile that meets your specific needs, you can always create [a custom profile](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-build-custom-profiles).
3. Target your attachment by selecting a Scope and identifying any resources that you want to Exclude. Then, click Next.
4. Optional: Customize the evaluations in your scan by editing the default parameters to match your specific use case.
5. Click Next.
6. Select the frequency at which you want to evaluate your attachment.
7. Optional: Configure notifications.



1. If you want to receive notifications, toggle Notify me to On.
2.
Also, requirements for your project, such as proof-of-concept (PoC) or regarding performance and response time, might be different.

After you determine your SAP applications and the SAPS numbers are calculated through the SAP Quick Sizer, or based on your current landscape, you can choose from the IBM Cloud® for SAP portfolio and the various infrastructure sizes available (as profiles or customizable/flexible in some cases).



 Assessment of SAP HANA with the SAP Quick Sizer 

SAP HANA is supported in production on single-node and multi-node SAP HANA-certified servers. The SAP HANA database uses column storage for some tables and fields, reducing the storage below row storage in traditional Relation Database Management System (RDMS); data can be highly compressed and compression ratios can range from 3:1 to over 10:1 based on the source data and database.

Sizing SAP HANA correctly is key to the success of your project. It is a best practive to complete the sizing before you order any SAP HANA certified server from IBM Cloud® for SAP. Improperly sized memory or storage requirements can lead to an upgrade and migration to a larger server.

Main memory is one of the most important resources to consider when you size an SAP HANA-certified appliance.

The [SAP HANA Master Guide](https://help.sap.com/viewer/eb3777d5495d46c5b2fa773206bbfb46/latest/en-US) provides a starting point for sizing-related topics.

The [Sizing SAP HANA - SAP HANA Master Guide](https://help.sap.com/viewer/eb3777d5495d46c5b2fa773206bbfb46/latest/en-US/d4a122a7bb57101493e3f5ca08e6b039.html) information within the guide provides guidance on how to size your SAP HANA system. It points to the different installation and migration scenarios for both greenfield installations and existing systems.

This information includes a link to the SAP HANA version of the SAP Quick Sizer tool (an SAP S-user ID is required to access the tool). The page also lists the SAP Notes that are related to sizing your SAP HANA server.
The final stage of the cut-over is to initiate the unextend networks workflow with connect cloud network to cloud edge gateway after unextending option. This workflow removes the HCX L2 bridge between the NSX-V and NSX-T environments.
2. The workflow connects the NSX-T segment to the T1 router.
3. The workflow disconnects the logical switch from the NSX-V distributed logical router.
4. North-south traffic from the VMs hosted on this segment is now through the NSX-T T0 uplink networks that are hosted on the public or primary VLANs.
5. The network switchover is now complete.







 Considerations for migrating with HCX 

Each HCX-NE appliance can extend up to eight segments at a time, and you can create multiple HCX-NEs if needed. You can configure them when you create the service mesh.





 Related links 



* [Ordering VMware HCX in IBM Cloud](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-hcx_ordering)
* [HCX for IBM Cloud for VMware Solutions guide](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-hcxclient-planning-prep-install)
* [VMware HCX user guide](https://docs.vmware.com/en/VMware-HCX/4.3/hcx-user-guide/GUID-BFD7E194-CFE5-4259-B74B-991B26A51758.html)
* You can order an LHR for any of the Veeam deployment types: VM, VSI, or bare metal server.
* There is no charge for LHR beyond the cost of the bare metal infrastructure.



See the following information:



* [Cyber recovery with Veeam architecture](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-veeam-cr-sa-overview), which describes two solution architectures to help you with cyber recovery.
* [Cyber recovery with Veeam guide](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-veeam-cr-sag-overview), which describes how to create two cyber-recovery solution architectures.
* [Hardened repository](https://helpcenter.veeam.com/docs/backup/vsphere/hardened_repository.html?ver=120) in the Veeam Backup and Replication 12 - User Guide for VMware vSphere.







 Networking for Veeam 

One primary private IP address. Bare metal and VSI options use one primary private IP address. However, the VM option uses one primary portable IP address.

The Veeam® VSI and Veeam bare metal services are not configured with an IBM Cloud Infrastructure portable IP address or with a NAT connection to the public network, even if you have public interfaces in your instance. This implementation helps to avoid the possibility of asymmetric routing when it uses a network gateway appliance.

When you deploy Veeam as a bare metal server or VSI, you can optionally configure your own proxy or NAT connection to the public network to connect to Veeam support for updates.

When you deploy Veeam as a VM, if your instance has public interfaces, VMware Solutions still creates a NAT connection for Veeam to the public network through the NSX-T services edge.





 Licenses and fees for Veeam 

For Veeam Availability Suite™ 12, you can order any number of VM licenses.
Developers working on a project need access to all of its resources. As an account administrator, you can grant access by creating access groups for each project and incorporating access management tags into each group's access policies.

Flexibility is important, and with IAM, you can share resources between various groups. Let's say you notice that a resource might work well for both projects. You can share a resource between the two projects by tagging the resource and relying on the existing permissions to grant access to the developers. If a project doesn't require a resource anymore, you can simply revoke the developers' access by detaching the appropriate tag from the service instance. Check out the following video to gain a better understanding of how you can use access management tags to manage access to the resources in your account.



* Video transcript

As an account administrator, you can use tags to centrally manage access to the resources in your account at scale.

For example, you have two functional projects: One is called soulmate, which is used for Watson language services and storage, and the other one is called Soul-FAQ, which is a support for project soulmate. It uses Watson Assistant and Cloud Object Storage.

To create access management tags as an account administrator, click Manage then Account in the IBM Cloud console. From the Tags page, click Access management tags. To create new tags, type the tag names that are separated by commas. We're creating two tags: one for the project soulmate and one for the project soul-faq.

Jumping to the resource list you can see all resources on the account. You can tag project-related resources here and view them throughout the account by filtering by tags.

At this point, the developer cannot view the resources because they don't have the correct permissions that are assigned yet.

An account administrator can give the developer permissions to access the resources on their project by using a combination of access-groups and tags.

As an account administrator, click Manage then Access and select Access groups. You have two access groups set up: one for the soulmate project, one for the FAQ.

There's one developer in the soulmate developer's group. There are no policies set up, so the account administrator needs to assign access.
Onboarding a Terraform template 

This tutorial walks you through how to onboard a Terraform template to your account. By completing this tutorial, you learn how to create a private catalog and import the template. After that, you can validate that the template can create resources, or run a script, and you can make it available to users who have access to your account.



 Before you begin 



1. Verify that you're using a Pay-As-You-Go or Subscription account. See [Viewing your account type](https://cloud.ibm.com/docs/account?topic=account-account_settingsview-acct-type) for more details.
2. Verify that you're assigned the following roles. For more information, see [Assigning access to account management services](https://cloud.ibm.com/docs/account?topic=account-account-services) and [Managing access to resources](https://cloud.ibm.com/docs/account?topic=account-assign-access-resources).



* Administrator on all account management services and all IAM-enabled services
* Editor on the catalog management service
* Manager service access role for IBM Cloud Schematics
* Operator platform role for VPC Infrastructure
* Editor on the software instance service
* Required permission to complete a specific task



3. Create your [Terraform template](https://cloud.ibm.com/docs/schematics?topic=schematics-create-tf-config).
4. To test your Terraform template, run the following commands from the Terraform CLI:



* terraform init
* terraform validate



5. Upload your Terraform template to a GitHub release and create a .tgz file. For more information, see [Upload your Terraform template and readme file to your GitHub repository](https://github.com/IBM-Cloud/isv-vsi-product-deploy-sample/tree/mainupload-your-terraform-template-to-a-github-release).
Get started with the Estimator primitive 

Use the examples in this topic to learn how to set up and use the Estimator primitive program.



 Overview 

With the Estimator primitive, you can efficiently calculate and interpret expectation values of quantum operators that are required for many algorithms. You can specify a list of circuits and observables, then evaluate expectation values and variances for an input parameter.

If you are using physical backends, running Estimator incurs a cost. For cost details, see [Manage costs](https://cloud.ibm.com/docs/quantum-computing?topic=quantum-computing-cost).





 Prepare the environment 

Before running any of these examples, you must prepare your environment.



1. Follow the steps in the [getting started guide](https://cloud.ibm.com/docs/quantum-computing?topic=quantum-computing-get-started) to get your quantum service instance ready to use.
2. You need at least one circuit to submit to the program. Our examples all have circuits in them, but if you want to submit your own circuit, you can use Qiskit to create one. To learn how to create circuits by using Qiskit, see the [Circuit basics tutorial](https://qiskit.org/documentation/tutorials/circuits/01_circuit_basics.html).
3. Create a list of observables. Use observables to define the properties of the circuit that are relevant to your problem and efficiently measure their expectation value. For simplicity, you can use the [PauliSumOp class](https://qiskit.org/documentation/stubs/qiskit.opflow.primitive_ops.htmlmodule-qiskit.opflow.primitive_ops) in Qiskit to define them, as illustrated in the following example.







 Single experiment example 

from qiskit.circuit.random import random_circuit
from qiskit.quantum_info import SparsePauliOp
from qiskit_ibm_runtime import QiskitRuntimeService, Estimator

service = QiskitRuntimeService()
Then, assign three access policies that grant administrator access to all three CustApp resource groups and their resources.

A trusted profile, like other IAM identities, can be granted access by using a policy or by adding it to an access group. If you have access groups that have the same level of access that a trusted profile needs, then the trusted profile can be added to that access group.

The following diagram shows how access is assigned to trusted profiles:

Zoom

![Assigning access to trusted profiles](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/account/images/trusted-profiles.svg)

Figure 3. Assigning access to trusted profiles

You can select only one trusted entity type when you first create a trusted profile. You can [update trusted profiles](https://cloud.ibm.com/docs/account?topic=account-trusted-profile-update) at any time to add trust relationships with compute resources.

You can assign administrator access to everything in an account by creating a trusted profile and assigning two policies to it. To create the first policy, select All Identity and Access enabled services with the Administrator platform role and Manager service role. For the second policy, select All Account Management services with the Administrator role assigned. Users in this access group have administrator access on the [IAM Access Groups service](https://cloud.ibm.com/docs/account?topic=account-account-services&interface=uiaccess-groups-account-management) and can grant or revoke access to all resources and identities in the account by adding or removing users from the access group. They can also manage all administrator access across the account.



 Sample access policies 

Review the following sample access policies to help you determine how you might want to assign trusted profiles access to resources that are organized in resource groups.



* A policy that grants federated users a platform administrator role on the IBM Cloud Kubernetes Service across the entire account. Federated users are allowed to apply this profile when the federated user's external IdP attributes fulfill the conditions of the trust relationship.
Onboarding an Operator from a GitHub repository 

This tutorial walks you through how to onboard a sample Operator from a GitHub repository to your account. You can onboard an Operator bundle using a TGZ file or an Operator using a CSV file. By completing this tutorial, you learn how to create a private catalog, import your CSV or TGZ file, validate that it can be installed on a Red Hat OpenShift cluster, and make the Operator available to users who have access to your account.



 Before you begin 



1. Verify that you're using a Pay-As-You-Go or Subscription account. See [Viewing your account type](https://cloud.ibm.com/docs/account?topic=account-account_settingsview-acct-type) for more details.
2. [Upload your Operator and application images to IBM Cloud® Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-getting-started).
3. [Create your Red Hat OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-getting-started).
4. Upload your source code to your GitHub repository.

Use the [latest release of the sample Node-RED Operator](https://github.com/IBM-Cloud/operator-bundle-sample/releases) as an example of how to set up your directory structure.
5. Make sure you're assigned the IBM Cloud Identity and Access Management (IAM) editor role on the catalog management service. See [Assigning access to account management services](https://cloud.ibm.com/docs/account?topic=account-account-services) for more information.
6. For Operator bundles, you also need the following IBM Cloud Identity and Access Management (IAM) roles.



* Administrator on all account management services and all IAM-enabled services
* Editor on the software instance service
* Editor on the IBM Cloud Container Registry service
* Administrator on the Red Hat OpenShift on IBM Cloud cluster