vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Resource sharing across accounts 

This tutorial may incur costs. Use the [Cost Estimator](https://cloud.ibm.com/estimator/review) to generate a cost estimate based on your projected usage.

This tutorial walks you through different options on how to share cloud-based resources across accounts.

An uncountable number of services are offered on the internet. You probably own accounts at many service providers. To use these services, you typically access them with a combination of user identity (ID) and password or by providing some form of API key or access token, often combined with additional levels (factors) of authentication. When building cloud native applications with a microservices-based architecture, the individual components can use the same techniques to access each other for collaboration. Ideally, the setup can be automated, and the access scoped to a required minimum for increased security.

With a focus on cloud services, it might be called a connector, service binding, or service-to-service authorization. Such automated service binding provides tighter integration and usually combines authentication and authorization into a single, automated setup. Typically, the service binding requires the services to be in the same cloud account. That grouping is logical and simplifies development and operation. But sometimes, organizational, and especially security- and compliance-related requirements could mean separating some services and maintaining them in central accounts. Thus, applications have to share resources across accounts. Sharing can be between accounts in an [IBM Cloud Enterprise environment](https://cloud.ibm.com/docs/account?topic=account-what-is-enterprise) or without a formal enterprise organization.

This tutorial walks you through typical use cases and benefits of sharing cloud resources across accounts. You will learn how to implement those common sharing scenarios, either manually or fully automated with Terraform.



 Objectives 



* Understand the benefits of sharing resources across accounts
* Learn about different techniques to share resources across accounts







 Resource sharing overview 

It is not unusual to find multiple applications access and use the same resource or parts of it. One example is when applications and compute environments have to live on the same corporate network. Another scenario is that security logs are collected in central storage.
Routing in classic virtual server instances 

If you are attempting to access an IBM Cloud classic infrastructure virtual server instance that has both a private network interface (eth0) and a public network interface (eth1), then the issue could be the traffic being routed to the public network interface versus the private. The routing tables for these interfaces point the default gateway to the public interface (eth1). Transit gateways are connected only to the private networks. You might have to add entries to route the subnets from other VPCs through the private interface.



  GRE tunnel connectivity issues 

If BGP is not established over the GRE tunnel, first try pinging the BGP peer IP address to ensure layer 2 connectivity exists over the GRE tunnel.

If the BGP settings are correct, then check that the MTU setting on your device matches the MTU for the GRE gateway.

Otherwise, if BGP can utilize OpenSent or OpenConfirm, check the BGP multi-hop settings on your device. Some GRE tunnel configurations may not adjust the BGP TCP TTL. As a workaround, set your multi-hop to a value of 16, which will force the TTL value of the BGP packet to expire after 16 routed hops.
[IBM Cloud Container Registry credentials](https://cloud.ibm.com/docs-content/v1/content/562806c0b18119f4d21cb66f5ae6d051634b4a16/ContinuousDelivery/images/custom-image-private-repository.png)

Figure 2. Authentication credentials







 Specifying the script 

You can use the script block in custom Docker image jobs to create a script file that runs in a task folder, similar to how regular pipeline jobs work.

ENTRYPOINT and CMD from your Docker image's Dockerfile are overridden and are not called. In some cases that might mean that you need to add initialization steps to your script.

Custom Docker image jobs give you greater flexibility over how to run your script; specifically, you can control the command interpreter. Typically, if the first line of the script begins with ! and the name of a command interpreter, that entry is used to run the commands in the job. If you do not specify a command interpreter, the default shell for the Docker image is used. Typically, !/bin/bash or !/bin/sh are used; image command interpreters for awk, node, and ruby also work if you specify an appropriate Docker image.
Visualizing your site with IBM Cloud Monitoring 

IBM Cloud® Activity Tracker provides an integration with Monitoring, which allows you to use a VMware® site provided default dashboard to view metrics for your sites. Alternatively, you can create your own dashboard to visualize performance, volume of usage, and to define alerts to monitor your environment.

Use Monitoring dashboards to complete the following tasks.



* Explore and easily visualize your environment.
* Accelerate a diagnosis and a resolution for performance incidents.
* Control cost of monitoring infrastructure.
* Mitigate impact of abnormal situations with proactive notifications.



For more information about the benefits of using Monitoring, see [Getting started with IBM Cloud Monitoring](https://cloud.ibm.com/docs/monitoring?topic=monitoring-getting-startedgetting-started-features).



 Monitoring VMware sites 

Consider the following tasks, predefined alerts, and what they mean when you monitor an instance of the VMware single-tenant service:



Table 1: Tasks and predefined alerts

 Task Predefined alert What to look for 

 Monitor CPU usage per cluster to prevent CPU resource exhaustion. The default is to alert after CPU usage is over 80% for any cluster in the site [VMware Site] Cluster CPU Usage Frequent triggering of this alert might be an indication that you need to scale up your cluster with more bare metal servers. As usage reaches 100%, VMware workloads start to fail, and new deployments of workloads fail. 
 Monitor memory usage per cluster to prevent memory resource exhaustion. The default is to alert after memory usage is over 80% for any cluster in the site. [VMware Site] Cluster Memory Usage Frequent triggering of this alert might be an indication that you need to scale up your cluster with more bare metal servers. As usage reaches 100%, VMware workloads start to fail, and new deployments of workloads fail. 
 Monitor storage usage per cluster to prevent storage resource exhaustion. The default is to alert after storage usage is over 80% for any cluster in the site [VMware Site] Cluster Storage Usage Frequent triggering of this alert might be an indication that you need to scale up your cluster with storage.
Monitoring Availability 

IBM Cloud Monitoring is available for deployments in every region. Deployments in Multi-zone Regions (MZRs) - eu-gb, eu-de, us-east, us-south, jp-tok, au-syd - have their metrics in the corresponding region.

If you have deployments that are in Single-zone Region (SZR) che01 then your logs are forwarded to a monitoring instance in another region. You need to provision IBM Cloud Monitoring instances in the region where your metrics are forwarded to. Metrics for deployments in che01 go to jp-tok.





 Available Metrics 



Table 1: Available Metrics Reference Table

 Metric Name 

 [Disk read latency mean](https://cloud.ibm.com/docs/databases-for-etcd?topic=databases-for-etcd-monitoringibm_databases_for_etcd_disk_read_latency_mean) 
 [Disk write latency mean](https://cloud.ibm.com/docs/databases-for-etcd?topic=databases-for-etcd-monitoringibm_databases_for_etcd_disk_write_latency_mean) 
 [IO utilization as a percent - 5-minute average](https://cloud.ibm.com/docs/databases-for-etcd?topic=databases-for-etcd-monitoringibm_databases_for_etcd_disk_io_utilization_percent_average_5m) 
 [IO utilization as a percent - 15-minute average](https://cloud.ibm.com/docs/databases-for-etcd?topic=databases-for-etcd-monitoringibm_databases_for_etcd_disk_io_utilization_percent_average_15m) 
 [IO utilization as a percent - 30-minute average](https://cloud.ibm.com/docs/databases-for-etcd?topic=databases-for-etcd-monitoringibm_databases_for_etcd_disk_io_utilization_percent_average_30m)
You can switch the KMS provider, but you can't disable KMS provider encryption after it is enabled. For example, if you enabled a key management service (KMS) provider in your cluster, but want to use Hyper Protect Crypto Services instead, you can [enable](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionkeyprotect) Hyper Protect Crypto Services as the KMS provider.

You can't disable KMS provider encryption. Do not delete root keys in your KMS instance, even if you rotate to use a new key. If you delete a root key that a cluster uses, the cluster becomes unusable, loses all its data, and can't be recovered. Similarly, if you disable a root key, operations that rely on reading secrets fail. Unlike deleting a root key, however, you can reenable a disabled key to make your cluster usable again.





 Controlling encryption 

When you enable a KMS provider in your cluster, your own KMS root key is used to encrypt data encryption keys (DEKs) which are used to encrypt Kubernetes secrets. Using your own encryption root key adds a layer of security to Kubernetes secrets and gives you more granular control of who can access sensitive cluster information. For more information, see the [overview](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionencrypt_ov) and your KMS provider's documentation, such as [Key Protect envelope encryption](https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryption).





 Features and limitations of KMS providers 

Review the following known limitations:



* Customizing the IP addresses that are allowed to connect to your key management service, such as a Key Protect instance, is not supported.



Additionally, your cluster version impacts the functionality of the KMS provider. To see what KMS features are available for different cluster versions of Red Hat OpenShift on IBM Cloud, review the following table.

To check your cluster version, run the following command.

ibmcloud oc cluster ls
See the documentation for information about [quotas for the Virtual Private Cloud infrastructure](https://cloud.ibm.com/docs/vpc-on-classic?topic=vpc-on-classic-quotas).





 volume_resource_group_id_invalid 

Message: The resource group ID specified in the request is not valid.

The resource group ID that you specified in the request is not valid. Verify the correct resource group ID. From the CLI, use the ibmcloud is volume VOLUME_ID command. The resulting information will include the resource group and resource group ID. See the [IBM Cloud CLI for VPC Reference](https://cloud.ibm.com/docs/vpc-on-classic?topic=vpc-on-classic-vpc-referencestorage-cli-section) for more information.





 volume_resource_group_not_authorized 

Message: The current action is not authorized on the specified resource group.

You are not authorized to list or create volumes in the specified resource group. Use a different resource group for which you have permission or request permission from your administrator for list and create privileges on the resource group.





 volume_resource_group_not_found 

Message: A resource group with the specified ID could not be found.

The resource group ID could not be found because you might have entered it incorrectly or it does not exist. Verify the correct resource group ID. From the CLI, use the ibmcloud is volume VOLUME_ID command. The resulting information will include the resource group and resource group ID. See the [IBM Cloud CLI for VPC Reference](https://cloud.ibm.com/docs/vpc-on-classic?topic=vpc-on-classic-vpc-referencestorage-cli-section) for more information.





 volume_start_not_found 

Message: A volume with the ID specified as the page start parameter is not found.

The volume ID that you specified in the start parameter of the list volume call could not be found. Verify that the volume ID is correct and whether you have access to the volume.





 volume_status_not_available
Testing the webhook 

Do extensive testing of your webhook before you enable it for an assistant that is being used in a production environment.

The webhook is triggered only when a message has been processed by your assistant, and a response is ready to be returned to the channel.

If you enable the setting that returns an error when the webhook call fails, the processing of the assistant is halted entirely if the webhook encounters any issues. Take steps to test the process that you are calling regularly so you are alerted if the external service is down, and can take actions to prevent all of the message responses from failing to be returned.

If you call an Cloud Functions web action, you can use the logging capability in Cloud Functions to help you troubleshoot your code. You can [download the command line interface](https://cloud.ibm.com/functions/learn/cli), and then enable logging with the [activation polling command](https://cloud.ibm.com/docs/cloud-functions-cli-plugin?topic=cloud-functions-cli-plugin-functions-clicli_activation_poll).





 Troubleshooting the webhook 

The following error codes can help you track down the cause of issues you might encounter. If you have a web chat integration, for example, you will know that your webhook has an issue if every test message you submit returns a message such as There is an error with the message you just sent, but feel free to ask me something else. If this message is displayed, use a REST API tool, such as cURL, to send a test /message API request, so you can see the error code and full message that is returned.



Error code details

 Error code and message Description 

 422 Webhook responded with invalid JSON body The webhook's HTTP response body could not be parsed as JSON. 
 422 Webhook responded with [500] status code There's a problem with the external service you called. The code failed or the external server refused the request. 
 500 Processor Exception : [connections to all backends failing] An error occurred in the webhook microservice. It could not connect to backend services. 







 Webhook security
5. Select any combination of roles or permissions to define the scope of access, and click Review. For more information, see [IAM roles](https://cloud.ibm.com/docs/account?topic=account-userrolesiamusermanrol).
6. Click Add to add your policy configuration to your policy summary.
7. Click Assign to assign all added access to the selected user.



Assign the viewer role or higher to the resource group that contains the resource to ensure that the user can access the resource from their list of resources.





 Editing existing access 

You can update existing access by editing the assigned roles for a user.



1. In the IBM Cloud console, click Manage > Access (IAM), and select Users.
2. Select the name of the user that you want to edit access for.
3. Click Access.
4. Click the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/action-menu-icon.svg) > Edit on the row for the policy that you want to edit.
5. Edit the policy by updating the assigned roles.
6. Click Save.









 Next steps 

Continue securing your cloud resources by creating context-based restrictions, which work with traditional IAM policies, to provide an extra layer of protection. Or, learn what else you can do with IBM Cloud IAM by checking out the [features list](https://cloud.ibm.com/docs/account?topic=account-iamoverviewfeatures).
5. Select any combination of roles or permissions to define the scope of access, and click Review. For more information, see [IAM roles](https://cloud.ibm.com/docs/account?topic=account-userrolesiamusermanrol).
6. Click Add to add your policy configuration to your policy summary.
7. Click Assign to assign all added access to the selected user.



Assign the viewer role or higher to the resource group that contains the resource to ensure that the user can access the resource from their list of resources.





 Editing existing access 

You can update existing access by editing the assigned roles for a user.



1. In the IBM Cloud console, click Manage > Access (IAM), and select Users.
2. Select the name of the user that you want to edit access for.
3. Click Access.
4. Click the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/d4595e5202a9a27767cf034e81b038cdf772e0d5/secure-enterprise/includes/account/includes/icons/action-menu-icon.svg) > Edit on the row for the policy that you want to edit.
5. Edit the policy by updating the assigned roles.
6. Click Save.









 Next steps 

Continue securing your cloud resources by creating context-based restrictions, which work with traditional IAM policies, to provide an extra layer of protection. Or, learn what else you can do with IBM Cloud IAM by checking out the [features list](https://cloud.ibm.com/docs/account?topic=account-iamoverviewfeatures).
entities[0] ?> and <? entities[1] ?>, is that correct? 
 @sys-time && entities.size() < 2 && entities[0].role?.type == 'time_to' Checks whether the input contains one @sys-time mention that has a time_to role type. If the user input matches this condition, it suggests that the user specified the end time of an open-ended time range. For example, the response would be triggered by the input, Are you open until 9pm?. This input matches because it identifies only one time in a time span, and the mention has a time_to role. Do you mean from now (<? now().reformatDateTime('h:mm a') ?>) until <? @sys-time.reformatDateTime('h:mm a') ?>? 
 @sys-date.day_of_week == 'sunday' Checks whether a specific date that the user is asking about falls on a Sunday. We are closed on Sundays. 
 @sys-date.specific_day_of_week == 'monday' && @sys-date.alternative Checks whether the user mentioned the weekday Monday in their query. For example, Are you open Monday. The condition also checks whether any alternative dates were stored. Alternative dates are created when your assistant isn't entirely sure which Monday the user means, so it stores the dates of alternative Mondays also. When a user specifies a weekday, your assistant assumes that the user means the future occurrence of the day (the coming Monday). You can add a response that double checks the intended date, by using the detected alternative value. In this case, the alternative date is the previous Monday's date. Do you mean @sys-date or @sys-date.alternative? 
 true Responds to any other requests for store hour information. We're open from 9AM to 9PM Monday through Saturday.
Correct the data center in your PVC and re-create the PVC. 
 Failed to place storage order with the storage providerStorage with the order ID 12345 could not be created after retrying for xx seconds.Failed to do subnet authorizations for the storage 12345.Storage 12345 has ongoing active transactions and could not be completed after retrying for xx seconds. The storage size, IOPS, and storage type might be incompatible with the storage class that you chose, or the IBM Cloud infrastructure API endpoint is currently unavailable. Review [Deciding on the file storage configuration](https://cloud.ibm.com/docs/openshift?topic=openshift-file_storagefile_predefined_storageclass) and [Deciding on the block storage configuration](https://cloud.ibm.com/docs/openshift?topic=openshift-block_storageblock_predefined_storageclass) to find supported storage sizes and IOPS for the storage class and storage type that you want to use. Then, delete the PVC and re-create the PVC. 
 Failed to find the storage with storage id 12345. You want to create a PVC for an existing storage instance by using Kubernetes static provisioning, but the storage instance that you specified could not be found. Follow the instructions to provision existing [file storage](https://cloud.ibm.com/docs/openshift?topic=openshift-file_storageexisting_file) or [block storage](https://cloud.ibm.com/docs/openshift?topic=openshift-block_storageexisting_block) in your cluster and make sure to retrieve the correct information for your existing storage instance. Then, delete the PVC and re-create the PVC. 
 Storage type not provided, expected storage type is Endurance or Performance. You created a custom storage class and specified a storage type that is not supported. Update your custom storage class to specify Endurance or Performance as your storage type.
Allow customers to configure load-balancer timeout values
: IBM Cloud® Load Balancer now allows you to configure or modify client and server timeout values by using the API. This feature is intended for applications that need customized timeout values.





 22 September 2019 

Support for X-Forwarded-Proto Header
: IBM Cloud® Load Balancer now inserts the X-Forwarded-Proto header for all requests when the front-end protocol is HTTP or HTTPS. This helps the back-end servers to know the protocol that is used by the client to connect to the load balancer.

HTTP cookie session persistence
: IBM Cloud® Load Balancer now supports a new session persistence type called HTTP Cookie. With this type of session persistence, the load balancer adds a cookie to the first response from the back-end server. Subsequent HTTP requests with the cookie arriving at the load balancer are now persistent on the same back-end server.





 3 June 2019 

Public-to-public load balancer
: IBM Cloud® Load Balancer now supports a new load balancer type that is called a public-to-public load balancer. With this type of load balancer, you can add back-end server instances using their public IPs, and traffic is forwarded to them through their public interface. This applies to both layer 4 and layer 7 back-end members.





 21 April 2019 

Layer 7 support
: IBM Cloud® Load Balancer now fully supports layer 7 load balancing with APIs and the user portal. Through our layer 7 support, you can now group VSI or Bare Metal server instances in server pools and handle incoming requests according to set rules and policies so that traffic can be redirected to a URL, rejected, or distributed to layer 7 pool members.





 20 February 2019 

Data logs
: IBM Cloud® Load Balancer now supports data logs forwarding. With data logs enabled, your load balancer log data is forwarded to the IBM Cloud Log Analysis Service.





 11 December 2018 

Back-end encryption and data log forwarding
: IBM Cloud® Load Balancer now supports back-end encryption and the ability to forward your data logs.
[View more](https://cloud.ibm.com/docs/overview?topic=overview-whatsnew)06 June 2023 | New event notifications added for projects

You can now send out notifications when a deployment is complete or when resources are successfully destroyed.

06 June 2023 | Support for access management tags in the projects UI

You can now add, edit, and delete access management tags directly in the projects UI. Previously, you could manage these tags only by using the command-line interface (CLI) or API.

25 April 2023 | Customized compliance validation

In addition to using default controls, you can specify a Security and Compliance Center attachment to validate deployable architectures that you're configuring in a project.