vania-janet/multiturn-rag-retrieval-data huggingface dataset:
See [Working with jobs and job runs](https://cloud.ibm.com/docs/codeengine?topic=codeengine-job-plan). 
 cf push Build and deploy Process of building a container image from source code and deploying an app in a single step. You can build code based on a Dockerfile or that use a Paketo buildpack. You can build from a single step in the CLI as well as from the Code Engine console. See [Planning your build](https://cloud.ibm.com/docs/codeengine?topic=codeengine-plan-build). 
 Service binding Service binding Attach a workload to an IBM Cloud managed service. The credentials and connection information is exposed to the workload through environment variables. The VCAP_SERVICES environment variable in Cloud Foundry is called CE_SERVICES in Code Engine. See [Integrating IBM Cloud services with service bind](https://cloud.ibm.com/docs/codeengine?topic=codeengine-service-binding). 
 Routes and domains Custom domain mapping Define and manage external URLs to your workloads. Code Engine provides support for [custom domains mappings](https://cloud.ibm.com/docs/codeengine?topic=codeengine-domain-mappings) from the console. You can also add [custom domains](https://cloud.ibm.com/docs/codeengine?topic=codeengine-deploy-multiple-regions) through IBM Cloud Internet Services or any other domain provider of your choice. For more information about adding a custom domain, see the [Configuring a Custom Domain for Your IBM Cloud Code Engine Application](https://www.ibm.com/cloud/blog/configuring-a-custom-domain-for-your-ibm-cloud-code-engine-application) blog. 



For more terms and capabilities for Code Engine, see [Learn about Code Engine](https://cloud.ibm.com/docs/codeengine?topic=codeengine-about).



 Next steps 



1. Just starting your migration?
0.0.0.0/0 is a special case of a CIDR notation, which is allowed. Use it with caution because of the following reasons:



* When you use 0.0.0.0/0 as a block policy, all traffic to and from your Netezza Performance Server database is restricted.
* When you use 0.0.0.0/0as an allow policy, all traffic to and from your Netezza Performance Server database is allowed.



You can use CIDR ranges to represent public and private IP addresses. Devices or services that are in a private or enterprise network that uses private IP addresses have gateways. These gateways typically have network interfaces with public IP addresses, which do network address translation (NAT). This allows entities in the private network to connect to external services.

You must use a CIDR range that represents only the public IP addresses of gateways when you are setting allow and block policies.

Do not specify a CIDR range that represents private IP addresses space as block policies. You might impact the functioning of the database.





 Defining network policies with DNS hostnames 

With Netezza Performance Server, you can specify DNS hostnames in network policies.

DNS hostnames are names that are assigned to devices or services that serve as their network identity and are used to connect with them. An example of DNS hostname is cloud.ibm.com.

If you use a DNS hostname in policies, the local DNS name resolves the hostname to a single static IP address in the Netezza Performance Server instance so that the policy can work effectively.

If the hostname resolves to multiple IP addresses or if the assigned IP addresses can change (for example, load balancer), make sure that you provide the CIDR range of those IP addresses in the policy rather than the DNS hostname.







 Domain Name Server (DNS) resolution 

When you use DNS hostname in a policy, the database tries to resolve the domain by using the local name server on the node. If you use domain names that typically are not cached by the local name servers, for example, a service that is not native to or provided by the cloud infrastructure provider, the local name servers cannot resolve to it.
06496f64-a689-4693-ba23-320959b7b677 kube-bh077ne10vqpekt0domg-046e0f754d624dca8b287a033d55f96e 8 minutes ago 1234abcd-us-south.lb.appdomain.cloud no 95482dcf-6b9b-4c6a-be54-04d3c46cf017 online 717f2122-5431-403c-b21d-630a12fc3a5a 10.XXX.XXX.XXX active - c6540331-1c1c-40f4-9c35-aa42a98fe0d9 00809211b934565df546a95f86160f62
8. From your connection to the VPC private network, access the IP address of the Kubernetes LoadBalancer service that you found in step 6 and your app port in the format <external_IP>:<app_port>.
9. Optional: Repeat these steps to deploy a private VPC NLB in each zone where you want to expose your app. Then, you can register the external IP addresses of the VPC NLB in each zone with one [DNS subdomain](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-lbaasvpc_nlb_dns).







 Registering a DNS record and TLS certificate 

VPC NLBs provide static external IP addresses through which you can access your app. To register an SSL certificate for your app domain to support HTTPS, you can create an IBM-provided subdomain or bring your own custom domain.

For example, say that you have a multizone cluster, and run replicas of your app on worker nodes in each zone of your cluster.
To update a custom domain mapping, use the [ibmcloud ce domainmapping update](https://cloud.ibm.com/docs/codeengine?topic=codeengine-clicli-domainmapping-list) command.

Suppose the custom domain mapping for www.example.com has a certificate that expires soon. You can update the domain mapping to use an updated certificate or even replace the TLS secret for the mapping with the --tls-secret option. You can also update your domain mapping to point to a different application in your project with the --target option.

The following example updates the www.example.com custom domain mapping to use an updated TLS secret, mytlssecret.



1. Update the TLS secret mytlssecret with updated certificate and private key information, which are contained in the mycertchain2.txt and myprivatekey2 files that reside on a local workstation.

ibmcloud ce secret update --name mytlssecret --cert-chain-file mycertchain2.txt --private-key-file myprivatekey2.txt

Example output

Updating secret mytlssecret..
OK
2. Update the domain mapping to use the updated TLS secret.

ibmcloud ce domainmapping update --domain-name www.example.com --tls-secret mytlssecret2

Example output

Getting domain mapping 'www.example.com.org'...
Updating domain mapping 'www.example.com.org'...









 Deleting domain mappings 

When you delete a domain mapping, you are removing the association of your Code Engine application with your custom domain mapping within Code Engine. This action does not delete the associated application or TLS secret.

If you delete an application that is referenced in a domain mapping, this action also deletes any custom domain mapping that is associated with the application.

When you delete a custom domain mapping, if the DNS settings of your domain are still configured, such that the CNAME points to the Code Engine project, your traffic still is routed to the Code Engine project.
Example output

Hello world from hello-world-deployment-5fd7787c79-sl9hn! Your app is up and running in a cluster!

If you created a private LoadBalancer service, you must be [connected to your private VPC network](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-onprem-example) to curl the hostname.



Do not delete the subnets that you attached to your cluster during cluster creation or when you add worker nodes in a zone. If you delete a VPC subnet that your cluster used, any load balancers that use IP addresses from the subnet might experience issues, and you might be unable to create new load balancers.





 Registering a DNS record and TLS certificate 

The Application Load Balancer for VPC (VPC ALB) provides a default HTTP hostname in the format 1234abcd-<region>.lb.appdomain.cloud through which you can access your app. However, if you want a TLS certificate for your app domain to support HTTPS, you can create an IBM-provided subdomain or bring your own custom domain for both public and private VPC ALBs.

After you create a DNS subdomain for a VPC ALB hostname, you can't use nlb-dns health-monitor commands to create a custom health check. Instead, the default VPC load balancer health check that is provided for the default VPC ALB hostname is used. For more information, see the [VPC documentation](https://cloud.ibm.com/docs/vpc?topic=vpc-alb-health-checks).

Before you begin



* [Set up a VPC ALB](https://cloud.ibm.com/docs/containers?topic=containers-vpc-lbaassetup_vpc_ks_vpc_lb). Ensure that you define an HTTPS port in your Kubernetes LoadBalancer service that configures the VPC ALB.
* To use the TLS certificate to access your app via HTTPS, your app must be able to terminate TLS connections.
However, when a hardware firewall is associated with a VLAN, the type of firewall might impose restrictions on the number of devices that reside on the VLAN.





 What kinds of devices are assigned to a VLAN? 

Any device that has a network connection is associated with a VLAN. Dedicated servers have both a public and private network connection, so you see those devices associated with both public and private VLANs.





 How do I trunk my VLANs to my servers? 

For more information about managing VLANs as trunks, see [Configuring VLAN trunks](https://cloud.ibm.com/docs/vlans?topic=vlans-configuring-vlan-trunks&interface=ui).





 As I order a VLAN, what does it mean when I'm told that no VLANs are available? 

If you are told that no VLANs are available, see [A note about capacity](https://cloud.ibm.com/docs/vlans?topic=vlans-getting-startednote-about-capacity).





 How long can empty Premium VLANs remain unused on my account? 

Starting February 13, 2023, Premium VLANs which are not participating in Layer 2 or Layer 3 networks for 90 days or more are subject to automatic cancellation of billing and reclaim of the VLAN in order to maintain sufficient VLAN capacity for all customers. Any secondary subnets present on the VLAN will be unrouted as part of VLAN reclaim. For more information regarding the automatic reclaim policy of unrouted secondary subnets, see the [Subnets FAQs](https://cloud.ibm.com/docs/subnets?topic=subnets-faqfaq-unrouted-subnets-automatic-reclaim).





 Why can't my devices communicate with one another on the same private VLAN? 

If each server is on a different subnet, then by default, they are not able to communicate via IP addresses. Technically, your servers can communicate by using OSI Model Layer 2 methods because they are on the same VLAN (a Layer 2 construct). For Internet Protocol (IP) (also called Layer 3) communication to work, you can do either of the following:
For example, a vehicle entry in the dictionary results in annotations for vehicle, Vehicle, or VEHICLE mentions when they occur in text. For a Sat entry in the dictionary, annotations are added for Sat or SAT, but not for sat.

Dictionary matching is case-sensitive for Arabic, Chinese, Korean, Japanese, and Hebrew.
7. To add synonyms for the term, click the Edit icon, and then enter synonyms in the Other terms field. Separate multiple synonyms with a comma. Click Save term.

The dictionary can contain terms and their synonyms or a category and terms that belong to the category.

For the term vehicle, you can specify synonyms such as car, automobile, sedan, convertible, station wagon, and so on. For engine, you can specify gasket, carburetor, piston, and valves.

Be careful not to add too many synonyms. Test the impact of any synonyms that you add. When you test, use data that is different from the data you use to derive the synonyms.
8. Continue adding terms.

Similar terms from all of the collections in the current project are suggested as new entries.

Suggested terms are taken from the field to which the Part of Speech enrichment is applied. Suggestions are not displayed if the Part of Speech enrichment is not enabled.
9. Click Save dictionary.
10. Choose the collections and fields where you want to apply the dictionary, and then click Apply.





 Example 

A transportation dictionary is added to a project.

Zoom

![Transportation dictionary in the product ui](https://cloud.ibm.com/docs-content/v1/content/f16b1f78a92498247223b337bd9303c2758b9ba8/discovery-data/images/dict-transportation.png)

Figure 1. Transportation dictionary

The resulting facet that is created for the dictionary is displayed in the search page.

Zoom

!
Location message
: R0038: The Satellite location has clusters in the middle of an operation. Wait for them to finish and check back later.
: R0101: The Satellite location has clusters in the middle of an operation. Wait for them to finish and check back later.

Steps to resolve
: Wait for the clusters to finish their operations and check back later.





 R0043: Layer 3 connectivity 

Location message
: R0043: The location does not meet the following requirement: Hosts must have TCP/UDP/ICMP Layer 3 connectivity for all ports across hosts. If you still have issues, contact IBM Cloud Support and include your Satellite location ID.

Steps to resolve
: Hosts must have TCP/UDP/ICMP Layer 3 connectivity for all ports across hosts. You cannot block access to certain ports that might block communication across hosts. Review [Host network requirements](https://cloud.ibm.com/docs/satellite?topic=satellite-reqs-host-network) and unblock the ports on the host in your infrastructure provider. This error can also mean that the host does not have the required RHEL packages installed, or the required CPU, memory, disk space and firewall ports opened up. After you verify that your hosts meet all the requirements, take a look at the platform logs. For more information, see [Setting up Log Analysis for Satellite location platform logs](https://cloud.ibm.com/docs/satellite?topic=satellite-healthsetup-la).

To test TCP/UDP/ICMP Layer 3 connectivity for all ports across hosts,



1. SSH into a host that is attached to your location but that is not assigned to any resources.

You can only SSH into the machine if you did not assign the host to a cluster, or if the assignment failed. Otherwise, Satellite disables the ability to log in to the host via SSH for security purposes. You can [remove the host](https://cloud.ibm.com/docs/satellite?topic=satellite-host-remove) and reload the operating system to restore the ability to SSH into the machine.
2.
See [Ordering VLANs](https://cloud.ibm.com/docs/vlans?topic=vlans-ordering-premium-vlans) for instructions. You can order as many premium VLANs as you like, subject to capacity limitations. If capacity is unavailable, seek VLANs in another pod or data center.

An important distinction of Premium VLANs is that they're not selected automatically to fulfill a server order. Premium VLANs must be explicitly selected while you are ordering servers to have servers reside on them. See the [FAQs](https://cloud.ibm.com/docs/vlans?topic=vlans-vlans-faqsspecify-vlan-during-order) for instructions on VLAN selection.

Premium VLANs which are not in use may be subject to automatic reclaim. Refer to the [FAQs](https://cloud.ibm.com/docs/vlans?topic=vlans-vlans-faqsempty-vlan-automatic-reclaim) for more details on this policy.







 VLAN identification 

VLANs exist on routers within IBM Cloud data centers. Each VLAN is identified by a unique fully qualified name. For example, the fully qualified name dal10.fcr03.1431 is identified by the VLAN number 1431, on router fcr03, and within data center dal10 (Dallas 10).





 VLANs and subnets 

VLANs can contain one or more subnets. Like VLANs, some subnets are automatically added and removed as devices require IP addresses. The different types of subnets and how they operate is further detailed in [Subnets and IPs](https://cloud.ibm.com/docs/subnets?topic=subnets-getting-started).





 Communication within a VLAN 

All resources on a VLAN can communicate, but that does not mean they will by default. Remember that VLANs are an OSI Model layer 2 construct, and that subnet/IPs are a layer 3 construct. Communication happens differently at each layer.
* How many devices can be assigned to a single VLAN?

Currently, no limit exists for the number of devices that are associated with a single VLAN at any time. However, when a hardware firewall is associated with a VLAN, the type of firewall might impose restrictions on the number of devices that reside on the VLAN.
* What kinds of devices are assigned to a VLAN?

Any device that has a network connection is associated with a VLAN. Dedicated servers have both a public and private network connection, so you see those devices associated with both public and private VLANs.
* How do I trunk my VLANs to my servers?

For more information about managing VLANs as trunks, see [Configuring VLAN trunks](https://cloud.ibm.com/docs/vlans?topic=vlans-configuring-vlan-trunks&interface=ui).
* As I order a VLAN, what does it mean when I'm told that no VLANs are available?

If you are told that no VLANs are available, see [A note about capacity](https://cloud.ibm.com/docs/vlans?topic=vlans-getting-startednote-about-capacity).
* How long can empty Premium VLANs remain unused on my account?

Starting February 13, 2023, Premium VLANs which are not participating in Layer 2 or Layer 3 networks for 90 days or more are subject to automatic cancellation of billing and reclaim of the VLAN in order to maintain sufficient VLAN capacity for all customers. Any secondary subnets present on the VLAN will be unrouted as part of VLAN reclaim. For more information regarding the automatic reclaim policy of unrouted secondary subnets, see the [Subnets FAQs](https://cloud.ibm.com/docs/subnets?topic=subnets-faqfaq-unrouted-subnets-automatic-reclaim).
* Why can't my devices communicate with one another on the same private VLAN?

If each server is on a different subnet, then by default, they are not able to communicate via IP addresses.
For more information regarding the automatic reclaim policy of unrouted secondary subnets, see the [Subnets FAQs](https://cloud.ibm.com/docs/subnets?topic=subnets-faqfaq-unrouted-subnets-automatic-reclaim).
* Why can't my devices communicate with one another on the same private VLAN?

If each server is on a different subnet, then by default, they are not able to communicate via IP addresses. Technically, your servers can communicate by using OSI Model Layer 2 methods because they are on the same VLAN (a Layer 2 construct). For Internet Protocol (IP) (also called Layer 3) communication to work, you can do either of the following:



* Add a route for the subnet you're attempting to communicate with on each server (the route is different on each server)
* Enable [VLAN Spanning](https://cloud.ibm.com/docs/vlans?topic=vlans-vlan-spanning)



Keep in mind that [VLAN Spanning](https://cloud.ibm.com/docs/vlans?topic=vlans-vlan-spanning) has additional implications, so review the feature in detail before enabling it.
* What options do I have if I need devices on different private subnets within the same VLAN to communicate by default, but I don't want to enable VLAN Spanning?

If you cannot enable VLAN spanning but require some VLANs and subnets to route between each other, you can associate those VLANs with a firewall or gateway, and manage the routing and security to fit your needs. To route between Pods and data centers, all VLANs requiring connectivity must be associated with the gateway device and an overlay, typically GRE tunnels, established between the gateway devices.



Virtual Private Cloud (VPC)



* What is the VPC backup service?

With the VPC backup service, you can create backup policies for your Block Storage for VPC volumes. A backup policy contains a backup plan, where you set a scheduled backup of your volumes. You can create up to four backup plans per policy. When a backup is triggered, it creates a snapshot of the volume contents.
Target your preferred IBM Cloud region and resource group. In the example below we will use the ca-tor (Toronto) region and the default resource group.

ibmcloud target -r ca-tor -g default

You can find more CLI commands in the [General IBM Cloud CLI (ibmcloud) commands](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_cli) topic in the documentation.
2. Create an instance of Databases for MongoDB via the [command line](https://cloud.ibm.com/docs/databases-for-mongodb?topic=databases-for-mongodb-provisioning&interface=cli) or use the [console UI](https://cloud.ibm.com/docs/databases-for-mongodb?topic=databases-for-mongodb-provisioning&interface=ui). The service name must be named mean-sample-mongodb as the application used in this tutorial is configured to look for the service by this name. For <region>, you can choose a region that is closer to you, however we will use ca-tor in this tutorial.

ibmcloud resource service-instance-create mean-sample-mongodb databases-for-mongodb standard ca-tor
3. Wait for the instance to be ready. You can check the provisioning status with the following command:

ibmcloud resource service-instance mean-sample-mongodb
4. Once you have verified the service status changed to "create succeeded", you may proceed to create a service key.

ibmcloud resource service-key-create mean-sample-mongodb-key --instance-name mean-sample-mongodb







 Step 2: Run the MEAN app locally 

In this section, you will clone a MEAN sample code and run the application locally to test the connection to the MongoDB database running on IBM Cloud.



1. Clone the MEAN sample code.

git clone https://github.com/IBM-Cloud/nodejs-MEAN-stack
cd nodejs-MEAN-stack
2.
During the apply plan process, Terraform initiates the virtual server instance provisioning process based on the selected deployment values. If there is a resource capacity issue or a quota issue from the region where you are trying to deploy, the resources won't provision as expected.

 How to fix it 

You need to talk to the administrator of the account to increase the quota for the specific region, or you can try to clean up all of the unwanted resources that are associated with the cloud infrastructure. If you clean up unwanted resources, you might free up space for the deployment to process.





 Why does the cluster fail with an IBM Customer Number error? 

 What’s happening 

You are receiving the following error when you try to apply a plan to your workspace: Apply failed due to "ERROR - [CLOUD-DEPLOY] Provided IBM Customer Number is not entitled to use Spectrum Scale on Cloud. Kindly contact IBM Support Team. Exiting!"

 Why it’s happening 

During the apply plan process, the bootstrap node initiates provisioning the resources for storage and compute cluster creation. During the process, rpm- and gpfs-related packages need to be decrypted through the Bring-Your-Own-License concept. If the IBM Customer Number is valid, the deployment begins. If not, the automation errors out the deployment.

 How to fix it 

You need to provide a valid IBM Customer Number that is entitled to Spectrum Scale without any spaces in the number. If the value that you provided is valid and you still received this error, contact IBM support to clarify about the entitlement.





 Why does the SSH connection fail and I can't connect to the nodes? 

 What’s happening 

You aren't able to SSH to the nodes from a local machine after a successful cluster deployment.

After a successful cluster deployment, you won't be able to SSH to the nodes due to the following issues:

 Why it’s happening 



1. SSH keys were not properly installed on the virtual server instance during the automation process.
2. The wrong SSH key names were used. For example, SSH key names that aren't owned by the individual trying to establish SSH connection were used.
3.