vania-janet/multiturn-rag-retrieval-data huggingface dataset:
(https://cloud.ibm.com/docs/CDN?topic=CDN-faq-for-httpswhich-ca-does-ibm-cloud-cdn-service-use-for-issuing-a-dv-san-certificate)[What SSL certificates are supported for IBM Cloud CDN?](https://cloud.ibm.com/docs/CDN?topic=CDN-faq-for-httpswhat-ssl-certificates-are-supported-for-ibm-cloud-cdn)[I received an email asking me to address a Domain Validation challenge that is related to my CDN. What do I do now?](https://cloud.ibm.com/docs/CDN?topic=CDN-faq-for-httpsi-received-an-email-asking-me-to-address-a-domain-validation-challenge-related-to-my-cdn)[What will happen if I don't address the challenge for domain validation of my CDN?](https://cloud.ibm.com/docs/CDN?topic=CDN-faq-for-httpswhat-will-happen-if-i-dont-address-the-challenge-for-domain-validation-of-my-cdn)[Does a Wildcard certificate need to validate a domain for my CDN?](https://cloud.ibm.com/docs/CDN?topic=CDN-faq-for-httpsdoes-a-wildcard-certificate-need-to-validate-a-domain-for-my-cdn)[I received an email indicating that my domains is not pointed to IBM CDN CNAME. What do I do now?](https://cloud.ibm.com/docs/CDN?topic=CDN-faq-for-httpsi-received-an-email-indicating-that-my-domain-is-not-pointed-to-IBM-CDN-CNAME)[If I use the SAN certificate type for my CDN, can I still use the CNAME for access to my service?]
* What happens to a VPN gateway if I try to delete the subnet that the gateway is on?

The subnet cannot be deleted if any virtual server instances are present, including the VPN gateway.
* Are there default IKE and IPsec policies?

When you create a VPN connection without referencing a policy ID (IKE or IPsec), auto-negotiation is used.
* Why do I need to choose a subnet during VPN gateway provisioning?

The VPN gateway must be deployed in the VPC to provide connectivity. A route-based VPN can be configured to provide connectivity to all zones. A VPN gateway needs four available private IP addresses in the subnet to provide high availability and automatic maintenance. It is best if you use a dedicated subnet for the VPN gateway of size 16, where the length of the subnet prefix is shorter or equal to 28.
* What should I do if I am using ACLs on the subnet that is used to deploy the VPN gateway?

Make sure that ACL rules are in place to allow management traffic and VPN tunnel traffic. For more information, see [Configuring ACLs and security groups for use with VPN](https://cloud.ibm.com/docs/vpc?topic=vpc-acls-security-groups-vpn).
* What should I do if I am using ACLs on the subnets that must communicate with an on-premises private network?

Make sure that ACL rules are in place to allow traffic between virtual server instances in your VPC and your on-premises private network. For more information, see [Configuring ACLs and security groups for use with VPN](https://cloud.ibm.com/docs/vpc?topic=vpc-acls-security-groups-vpn).
* Does VPN for VPC support high-availability configurations?

Yes, VPN for VPC supports high availability in an Active-Standby configuration for policy-based VPNs, and Active-Active configuration for a static, route-based VPN.
* Are there plans to support SSL VPN?

No, only IPsec site-to-site is supported.
FAQs for IBM Cloud Load Balancer 

This section contains answers to some frequently asked questions about the IBM Cloud® Load Balancer service.



 How many load-balancing options are available in IBM Cloud? 

For a detailed comparison of IBM's load balancer offerings, refer to [Exploring IBM Cloud load balancers](https://cloud.ibm.com/docs/loadbalancer-service?topic=loadbalancer-service-explore).





 Can I use a different DNS name for my load balancer? 

While the auto-assigned DNS name for the load balancer is not customizable, you can add a Canonical Name (CNAME) record that points your preferred DNS name to the auto-assigned load balancer DNS name.

For example, if your account number is 123456, your load balancer is deployed in dal09 data center and its name is myapp, the auto-assigned load balancer DNS name is myapp-123456-dal09.lb.bluemix.net. Your preferred DNS name is www.myapp.com. You can add a CNAME record (through the DNS provider that you use to manage myapp.com) pointing www.myapp.com to the load balancer DNS name myapp-12345-dal09.lb.bluemix.net.





 What's the maximum number of virtual ports I can define with my load balancer service? 

While trying to create a load balancer service, you can define up to two virtual ports. You can define additional virtual ports after the service is created. The maximum number of virtual ports allowed is 10.





 What's the maximum number of compute instances I can associate with my load balancer? 

While trying to create a load balancer service, you can configure up to 10 compute instances as back-end servers. You can define additional servers after the load balancer is created. The maximum number of back-end members allowed is 50.





 Can my back-end compute instances sit on a subnet different from the load balancer's subnet?
FAQs about managing resources 

FAQs for managing IBM Cloud resources might include questions about working with resource groups, migrating Cloud Foundry instances, and access for working with resources.



 What is a resource group? 

A resource group is a way for you to organize your account resources in customizable groupings. Any account resource that is managed by using IBM Cloud® Identity and Access Management (IAM) access control belongs to a resource group within your account. You assign resources to a resource group when you create them from the catalog. You can then view usage per resource group in your account, and easily assign users access to all resources in a resource group or just to a single resource in a resource group.

For more information about creating and working with resource groups, see [Managing resource groups](https://cloud.ibm.com/docs/account?topic=account-rgs).





 Why should I migrate my Cloud Foundry service instances to a resource group? 

IBM Cloud Foundry Public is deprecated with an end-of-support date of 1 June 2023. For more information, see [Deprecation of IBM Cloud Foundry](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-deprecation).

Migrating your Cloud Foundry services to a resource group means that the services you're using are now available for use with IAM access control and resource groups. You can take advantage of fine-grained access control by using IAM roles. You can also view usage per resource group in your account.

When you have Cloud Foundry services that can be migrated to a resource group, you receive a notification on the Resource list page. For more information about the migration process, see [Migrating Cloud Foundry service instances and apps to a resource group](https://cloud.ibm.com/docs/account?topic=account-migrate).





 Why can't I add a resource to a resource group? 

Most likely you're dealing with an access issue. You must have at least the Viewer role on the resource group itself and at least the Editor role on the service in the account.
If you see "Error 526, Invalid SSL Certificate" when visiting your site, it might mean your origin certificate is invalid. When the CIS proxy is enabled, a valid CA-signed certificate is required at the origin in the default SSL mode, which is "End-to-end CA Signed". Note that the default setting for the SSL mode was previously "End-to-end Flexible", which ignores the validity of certificates presented by the origin. The new default is applied only to newly added domains. If your domain was added when the default SSL mode was End-to-end Flexible, that setting is not overwritten. You can change the mode to a less strict mode, but that is not recommended for production environments.
* What is DDoS?

A distributed denial-of-service (DDoS) attack is an attempt to make an online service unavailable by overwhelming it with traffic from multiple sources. In a DDoS attack, multiple compromised computer systems attack a target such as a server, website, or other network resource, affecting users of the targeted resource.

The flood of incoming messages, connection requests, or malformed packets to the target system forces it to slow down or even crash and shut down, thereby denying service to legitimate users or systems. DDoS attacks have been carried out by diverse threat actors, ranging from individual criminal hackers to organized crime rings and government agencies.
* What do I do if I’m under a DDoS attack?

Step 1: Turn on “Defense mode" in the Overview screen.

![Defense Mode](https://cloud.ibm.com/docs/images/defense-mode.png)

Figure 1. Defense mode

Step 2: Set your DNS records for maximum security.

Step 3: Do not rate-limit or throttle requests from IBM CIS, we need the bandwidth to assist you with your situation.

Step 4: Block specific countries and visitors, if necessary.
* I got a 522 error, what do I do now?

A 522 error indicates we weren't able to establish a connection with your origin server (that is, your host). After about 15 seconds of connection failure, we close the connection and display a 522 error page.
[checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) 
 v1 authoring API (all but /message endpoint) ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) 
 v1 and v2 logs API ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) 







 Access control improvements 

Before April 2020, the service access role assignments that were defined for a Watson Assistant service instance in the IBM Cloud dashboard were not applied. Users with either Reader- or Writer-level service access to an instance effectively had Manager-level access. This behavior changed for all data centers as of 2 April 2020. With the access control improvements released, service-level access role assignments are recognized by the product.





 How to keep your access 

Now that service level access control is supported for instances in your data center, if you have the wrong service level access role to an instance, you might be unable to do things you could do before.



* If you have Manager service access to a Watson Assistant service, then no action is required. You have the same privileges and can do the same actions within the product now that service-level access control is enabled.
* If you have a Reader or Writer service access role, then what you can do has changed.





 I'm a Reader 

With a Reader role, you cannot take any actions in the Watson Assistant application user interface. You can view only the assistants and skills pages. You cannot edit, create, or delete anything, and cannot view analytics.





 I'm a Writer
, and it needs some time to finish the record propagation. The CDN status is shown as CNAME configuration required until the record is propagated. After the propagation is done, refresh the mapping status by clicking the Get status button. The CDN status then changes to Running.
* I received an error similar to "Could not allocate more resource to build new rule in Akamai: x behaviors are needed while only x can be used." What should I do?

When you reach the maximum resource limit, the console shows this error message. To resolve this issue, you can:



* Delete unused resources (TTL, origin, and so on).
* Create a domain to store new resources.



* Can I configure my domain without pointing it to a CDN CNAME?

 Can I configure my domain without pointing it to a CDN CNAME? 

No, you cannot configure your domain without pointing it to a CDN CNAME. You can point your domain only to a CDN CNAME (IBM CNAME or the Akamai CNAME). This way, you can guarantee that your domain is globally distributed to the closest and most efficient edge server for your clients.

The IP addresses of an Akamai edge server are changed dynamically; therefore, setting a fixed Akamai IP address for your domain might cause your traffic to fail.
* Can I update the IBM CNAME or Akamai CNAME?

 Can I update the IBM CNAME or Akamai CNAME? 

No, you can't update the IBM CNAME or Akamai CNAME. You can only define the prefix of the IBM CNAME when you're creating the CDN. The Akamai CNAME is generated automatically by Akamai and you do not have to define or edit it.
* When should I use the Akamai CNAME instead of IBM CNAME?

 When should I use the Akamai CNAME instead of IBM CNAME? 

Akamai CNAME provides a shorter DNS lookup time for your domain. The Akamai CNAME improves the performance of your website by shortening the DNS resolution time.
(https://cloud.ibm.com/docs/CDN?topic=CDN-faq-for-httpsdoes-a-wildcard-certificate-need-to-validate-a-domain-for-my-cdn)[I received an email indicating that my domains is not pointed to IBM CDN CNAME. What do I do now?](https://cloud.ibm.com/docs/CDN?topic=CDN-faq-for-httpsi-received-an-email-indicating-that-my-domain-is-not-pointed-to-IBM-CDN-CNAME)[If I use the SAN certificate type for my CDN, can I still use the CNAME for access to my service?](https://cloud.ibm.com/docs/CDN?topic=CDN-faq-for-httpsif-i-use-a-san-certificate-type-for-my-cdn-can-i-still-use-the-cname-for-access-to-my-service)[Are all of my IBM Cloud CDN domains added into one certificate?](https://cloud.ibm.com/docs/CDN?topic=CDN-faq-for-httpsare-all-of-my-ibm-cloud-cdn-domains-added-into-one-certificate)[Why do I see "wildcard" when I perform a dig or when I try to access content when my CDN is in Requesting Certificate, Domain Validation pending or Deploying Certificate status?](https://cloud.ibm.com/docs/CDN?topic=CDN-faq-for-httpswhy-do-i-see-wildcard)[Is HTTP2 protocol supported for HTTPS requests?](https://cloud.ibm.com/docs/CDN?topic=CDN-faq-for-httpsis-http2-supported)[Why is the newly created wildcard CDN status CNAME configuration required if we don't need to set the DNS record to point the domain to IBM CNAME?]
Step 8: Add an extension to your assistant 

Connect your assistant to your NeuralSeek service instance.



1. Reopen the NeuralSeek service from IBM Cloud. You can find the instance in the AI and Machine Learning section of your [resource list](https://cloud.ibm.com/resources).
2. Click the Integrate tab and follow the instructions to set up the NeuralSeek custom extension for your assistant. Return to this procedure when you're ready to create the action.

Zoom

![Shows the Integrate page of the NeuralSeek instance](https://cloud.ibm.com/docs-content/v1/content/ca9232b3702768f24bb897f48f10778fcda28718/watson-assistant/images/tut-neural-configure.png)

Figure 12. Set up the NeuralSeek instance integration
3. From the Watson Assistant navigation panel, click Actions, and then click New action.
4. Choose Quick start from templates, and then scroll to find and click the NeuralSeek Starter kit.

Zoom

![Shows the start from template option](https://cloud.ibm.com/docs-content/v1/content/ca9232b3702768f24bb897f48f10778fcda28718/watson-assistant/images/tut-neural-action-from-template.png)

Figure 13. Choose Quick start from template
5. Click Select this starter kit, and then click Add templates.
6. Click to open the NeuralSeek search action that you just added to the assistant.
7. Add the following user example queries to the first step in the action:

What Watson Discovery project types are available and what do they do?

What external data sources are supported by Watson Discovery?

Can I add a custom dictionary to Watson Discovery?

How do I use the Content Mining application?

When should I add query expansions to my project?

Which file types support Smart Document Understanding models?
* Publish test data to DevOps Insights by using the ibmcloud CLI doi plug-in. For more information about publishing test data, see [Publishing test data to DevOps Insights](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-publishing-test-data).
* Explore build, environment, quality, deployment frequency, build frequency, and quality trend data only by using the console. For more information about exploring this data, see [Working with DevOps Insights](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-di_working).



* How do I install a multi-cluster worker pool?

You can install agents on multiple clusters that work together within a single private worker pool. By using this configuration, the private worker pool can manage more pipeline runs in parallel, and you can remove clusters from the maintenance rotation without deactivating the worker pool.

Although having multiple agents on the same cluster supports multiple worker pools, it does not improve performance or throughput.

To configure a multi-cluster worker pool, follow the instructions for [installing directly on a cluster](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-install-private-workersinstall_pw) and [registering a Delivery Pipeline Private Worker](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-install-private-workersregister_pw) for each cluster that participates in the worker pool. Make sure that you update the worker name to identify the cluster on which the worker resides.

The multiple worker agents are now listed in the private worker integration UI and jobs are scheduled on those agents based on the cluster load at pipeline run request time.
* How do I view the status of private workers on multiple clusters by using the CLI?

You can use the following command within a script that traverses all of the clusters that private workers are installed on.

kubectl get workeragent -ojson | jq '.items[] | .status.versionStatus.state'

Consider upgrading any private workers that return results that are not OK.
Now we have to build and deploy the different modules that will produce and consume the data, as well as the application that will display the truck position on a map.

Run the build script — but before you do, are you logged into the IBM Cloud CLI and Docker?

Go into the root of the project and type the following:

./build.sh





 Step 5: Watch your trucks truckin' 

The end of the script will output a URL — something like https:// some.thing.eu-gb.appdomain.cloud.

If you visit the URL that has been generated, you should be able to see a map of the US and, after a few seconds, several markers on the map that represent your trucks:

Zoom

![The Truck Tracker Wide View](https://cloud.ibm.com/docs-content/v1/content/ec83e0c9f915f4acf715222aaa5b8387c028200c/databases-for-mongodb/includes/cloud-databases/includes/cloud-databases/images/trucktrackerwide.png)

Figure 3. All-Truck View

If you zoom in on one of these markers you will see it moving along the road. As the fleet manager, you now know where all your trucks are.

Zoom

![The Truck Tracker Zoom View](https://cloud.ibm.com/docs-content/v1/content/ec83e0c9f915f4acf715222aaa5b8387c028200c/databases-for-mongodb/includes/cloud-databases/includes/cloud-databases/images/trucktrackerzoom.png)

Figure 4. Single-Truck View







 What you just did 



 The build.sh script 

The build.sh script does a number of things:



1. It builds a docker image for each of the services you need. The producer, consumers and web application are all in different folders.
Now we have to build and deploy the different modules that will produce and consume the data, as well as the application that will display the truck position on a map.

Run the build script — but before you do, are you logged into the IBM Cloud CLI and Docker?

Go into the root of the project and type the following:

./build.sh





 Step 5: Watch your trucks truckin' 

The end of the script will output a URL — something like https:// some.thing.eu-gb.appdomain.cloud.

If you visit the URL that has been generated, you should be able to see a map of the US and, after a few seconds, several markers on the map that represent your trucks:

Zoom

![The Truck Tracker Wide View](https://cloud.ibm.com/docs-content/v1/content/c1b02d6157702384a9668d8c58bb951e69117793/databases-for-redis/includes/cloud-databases/includes/cloud-databases/images/trucktrackerwide.png)

Figure 3. All-Truck View

If you zoom in on one of these markers you will see it moving along the road. As the fleet manager, you now know where all your trucks are.

Zoom

![The Truck Tracker Zoom View](https://cloud.ibm.com/docs-content/v1/content/c1b02d6157702384a9668d8c58bb951e69117793/databases-for-redis/includes/cloud-databases/includes/cloud-databases/images/trucktrackerzoom.png)

Figure 4. Single-Truck View







 What you just did 



 The build.sh script 

The build.sh script does a number of things:



1. It builds a docker image for each of the services you need. The producer, consumers and web application are all in different folders.
If you have not yet ordered an SSL from IBM Cloud and need to order one with SHA-2, submit a ticket to manually order an SSL for the domain in question. IBM Cloud console still automatically creates SSL certificates using SHA-1, so if you do this, you will then need to have it re-issued.





 Why do I need to choose an email? 

To create an SSL certificate, you need to verify that you own the domain where you are requesting the SSL certificate. You can verify that you own the domain in one of two ways:



1. If you have an email connected to the domain, such as admin@your_domain, you can verify using that email address. Just choose the email address that you use from the list provided, and you receive a verification email at the chosen address.
2. If you do not have an email connected to the domain, you must contact support to use DNS TXT verification. Just open a case, and the Support team will walk you through what to do. Using email verification is generally preferred.



Either way, you verify that the domain is yours to use, and then receive an SSL certificate.





 Why can't I order a wildcard SSL certificate? 

Wildcard SSL certificates are not available in IBM Cloud.





 How do I request SSL-VPN logs? 

Requesting SSL-VPN audit logs requires that you open a support case to ensure proper protocol, security, and policies are followed. For security reasons, only the primary account holder can make the request for SSL-VPN audit logs. VPN logs are not available in real time as there can be a delay in availability. Due to the sensitive nature of the content, sometimes not all information can be shared. Please provide the following items for the request:



1. VPN username or IP address
2. Date (range is preferable)
3. Suggested times including time-zone
4. VPN endpoint (if known)
Why can't I reach my endpoint from IBM Cloud? 

  What’s happening 

I created an endpoint and I cannot access it from IBM Cloud.

  How to fix it 

Follow this list to check for errors.



*  Check your Connector logs. A flowlog entry is generated for each connection and you should see why the connection is not working.
*  Check the Connector agent log for errors trying to connect to your endpoint.
*  Make sure your firewall is not blocking the connection from the Connector agent running in Docker to the endpoint.
*  If you have ACL assigned to the endpoint, make sure it is set up properly with the correct source IP address or CIDR. The source IP might not be what you think it is especially if your source is coming from a kubernetes cluster or instance in VPC. The flowlog entry shows the source IP address. For example:

May 12 15:57:49  satellite-link-tunnel-5476c9bbdf-vv6m2  satellite-link-tunnel-container 50  flowlog: rejected by Sources when client 10.39.62.229:36062 connecting to 172.18.197.208:35665, conn_type: location