vania-janet/multiturn-rag-retrieval-data huggingface dataset:
If you use the existing workload edge cluster, you must create the edge bridge profile by using that cluster and change the existing-distributed port group to allow Promiscuous mode and Forged transmits. This setup shares the capacity of the private uplinks from the edge nodes for both private routed and bridged traffic. Transport zones are defined in the edge host switch (N-VDS), for example add the new tz-bridge to nvds-edge-private.

Zoom

![Layer 2 bridge setup with workload edge cluster](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/arch-pattern-l2-workload-edge.svg)

Figure 2. Layer 2 bridge setup with workload edge cluster

Alternatively, you can deploy a new edge cluster for bridging. In this case, you must create new edge nodes and create a new edge cluster by using these nodes. When you configure the edge bridge profile, you can then use this edge cluster for bridging only. This alternative scales better, and provides a better dedicated bridging performance. Transport zones are defined in the edge host switch (N-VDS), for example add the new tz-bridge to nvds-bridge.

Zoom

![Layer 2 bridge setup with a new bridge edge cluster](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/arch-pattern-l2-bridge-edge.svg)

Figure 3. Layer 2 bridge setup with a new bridge edge cluster

Make sure you have the bridged VLANs transport zone (for example tz-bridge) configured on all wanted transport nodes.





 Considerations 

When you design or deploy this architecture pattern, consider the following steps:



* Using the existing workload edge cluster is good for testing the layer 2 capability and for small deployments.
Enabling the second layer of authentication for EP11 connections - Standard Plan only 

To ensure the exclusive control on the execution of cryptographic operations, you can use the Hyper Protect Crypto Services certificate manager CLI to enable the second layer of authentication for EP11 (GREP11 or PKCS #11 API) connections. By enabling this function, you add an extra layer of access control on top of the Identity and Access Management (IAM) token to the EP11 applications. A mutual TLS connection is established to ensure that only EP11 applications with a valid client certificate can perform EP11 operations.

The second layer of authentication for EP11 connections is currently only supported by the Hyper Protect Crypto Services Standard Plan.



 Security and availability best practices for enabling mutual TLS authentication 

With mutual TLS as a second layer of authentication for accessing EP11, you need to be aware of the following security and availability considerations:



* If you need to prevent certain people from accessing EP11, separate certificate administrators from service users. Control access by assigning the Certificate Manager role only to the people that manage the client certificates, and assigning other service users the corresponding roles for operational usage. To manage user access, you need to be assigned the Administrator role with account management access.
* EP11 APIs are not accessible if you use invalid client certificates or use unavailable private keys to sign client certificates. To ensure the availability, assign more than one person the Certificate Manager role as a backup. Certificate administrators need to securely maintain their unique administrator private keys. Certificate administrators also need to maintain a backup of all client certificates outside of the Hyper Protect Crypto Services instance, for example, by using [IBM Cloud Secrets Manager](https://www.ibm.com/cloud/secrets-manager). It is also suggested to monitor the expiration of the certificates.







 Before you begin 

Before you can enable the second layer of authentication for GREP11 or PKCS #11 API connections, make sure that you complete the following prerequisites:



1. You are assigned the Certificate Manager IAM role to perform the corresponding actions.
[solution icon](https://cloud.ibm.com/media/docs/images/homepage/magic-wand.svg) [Modern web application using MEAN stack](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-mean-stack)Modern web application using MEAN stack Solution tutorial

This tutorial walks you through the creation of a web application using the popular MEAN stack. It is composed of a MongoDB, Express web framework, Angular front end framework and a Node.js runtime. You will learn how to run a MEAN sample app locally, create and use a managed database-as-a-service (DBasS), deploy the app to IBM Cloud and scale both the runtime and database resources.

![solution tutorial icon](https://cloud.ibm.com/media/docs/images/homepage/solution-tutorial.svg) [Moving a VM based app to Kubernetes](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vm-to-containers-and-kubernetes)Moving a VM based app to Kubernetes Solution tutorial

This tutorial walks you through the process of moving a VM based app to a Kubernetes cluster by using Kubernetes Service. Kubernetes Service delivers powerful tools by combining container and Kubernetes technologies, an intuitive user experience, and built-in security and isolation to automate the deployment, operation, scaling, and monitoring of containerized apps in a cluster of compute hosts.

![solution tutorial icon](https://cloud.ibm.com/media/docs/images/homepage/solution-tutorial.svg) [PHP web application on a LAMP Stack in VPC](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-lamp-stack-on-vpc)PHP web application on a LAMP Stack in VPC Solution tutorial
You can read more about this in the topic [Cloud Load Balancer Horizontal Scaling](https://cloud.ibm.com/docs/loadbalancer-service?topic=loadbalancer-service-ibm-cloud-load-balancer-basicshorizontal-scaling).





 What protocols can I choose when using the Cloud Load Balancer? 

You can choose HTTP, HTTPS, and TCP protocols. IBM also offers layer 7 support. Refer to [About IBM Cloud Load Balancer](https://cloud.ibm.com/docs/loadbalancer-service?topic=loadbalancer-service-about-ibm-cloud-load-balancer) for supported features.





 I need a particular type of cipher. Does Cloud Load Balancer support that? 

IBM Cloud Load Balancer supports TLS version 1.2 with SSL offload. You can find more information about the supported SSL ciphers in [Cloud Load Balancer SSL cipher suites](https://cloud.ibm.com/docs/loadbalancer-service?topic=loadbalancer-service-ssl-offload-with-ibm-cloud-load-balancerssl-cipher-suites)
The system learns from the types of examples you label, and applies what it learns to identify potential new examples. For example, after you label red, orange, yellow, green, and blue as examples of the color entity type, the Example suggestions panel might show indigo and violet as suggested examples for you to label. Suggestions are not displayed until after you label many examples of an entity type.

The following example shows suggestions that are made for family member mentions.

Zoom

![Shows suggestions for family member entities.](https://cloud.ibm.com/docs-content/v1/content/f16b1f78a92498247223b337bd9303c2758b9ba8/discovery-data/images/suggestions-example.png)

Figure 10. Entity example suggestions

You might notice that a term that you chose to bulk label is not labeled, but is displayed as a suggestion instead. A term is skipped in the following situations:



* The term might occur in different noun phrases in different sections of the document. For example, the term father might occur in the noun phrases the kindest father and to her father. When a word is included in a noun phrase with adjectives, the meaning can change. Therefore, such terms sometimes are suggested rather than labeled automatically.
* A word might be a valid example on its own and as part of a multiple-word mention. For example, a mention of IBM might refer to the company International Business Machines, Corp. or might be used as part of a product name, such as IBM Cloud Pak for Data. However, a word or phrase can be part of only one example. Example labels cannot overlap one another. Therefore, you must choose which example suggestion is the most accurate. In this example, where the term IBM is used as part of a product name, it is more accurate to label the full phrase as an example of the Product entity type.
* The service might recognize that a term is a possible example of more than one entity type. For example, the word top might mean the best or might mean shirt.



To investigate a suggestion further, click it to see the word in context within the document.
Applications follow the scale-to-zero model, where no instances are created in the absence of traffic, leading to cost optimization. When there is an incoming request, an app automatically scales up from zero to accommodate the workload.

With Code Engine, you can control autoscaling by setting the minimum and maximum number of instances. You can also specify the concurrency of the application by specifying the number of requests to run in parallel for a specific application instance, to help determine when a new instance is provisioned.

For more information about scaling your app, see [Configuring application scaling](https://cloud.ibm.com/docs/codeengine?topic=codeengine-app-scale).





 Security 

Code Engine provides out-of-the-box DDOS protection for your application. Code Engine's DDOS protection is provided by Cloud Internet Services (CIS) at no additional cost to you. DDoS protection covers System Interconnection (OSI) Layer 3 and Layer 4 (TCP/IP) protocol attacks, but not Layer 7 (HTTP) attacks. See [DDoS protection](https://cloud.ibm.com/docs/codeengine?topic=codeengine-securesecure-ddos).

Code Engine also provides a service mesh to use its networking layer, which enables mutual Transport Layer Security (TLS) traffic on applications, thus securing service-to-service and user-to-service communication.

For more information about security, see [Code Engine and security](https://cloud.ibm.com/docs/codeengine?topic=codeengine-secure).





 Triggering applications with events 

You can subscribe Code Engine applications to receive cron events, IBM Cloud Object Storage events or Kafka topics. When you subscribe to an event producer, you must specify the name of your destination application to receive the events.

For more information about working with event producers, see [Getting started with subscriptions](https://cloud.ibm.com/docs/codeengine?topic=codeengine-subscribing-events).





 Visibility
ibmcloud resource service-key-create mean-sample-mongodb-key --instance-name mean-sample-mongodb







 Step 2: Run the MEAN app locally 

In this section, you will clone a MEAN sample code and run the application locally to test the connection to the MongoDB database running on IBM Cloud.



1. Clone the MEAN sample code.

git clone https://github.com/IBM-Cloud/nodejs-MEAN-stack
cd nodejs-MEAN-stack
2. Copy .env.example file to .env.

cp .env.example .env
3. In the .env file, add your own SESSION_SECRET. For MONGODB_URL and CERTIFICATE_BASE64, run the below command:

ibmcloud resource service-key mean-sample-mongodb-key --output json

You can find the value required for MONGODB_URL under credentials -> connection -> mongodb -> composed and the value for CERTIFICATE_BASE64 under credentials -> connection -> mongodb -> certificate -> certificate_base64 in the returned JSON output. Make sure the values added to the .env do not include any quotation or space.
4. Optional - Install the required packages.

npm install
5. Optional - Run the application locally. Access the app using the URL provided in the output, create a new user and log in.

node server.js







 Step 3: Deploy app to the cloud 

IBM Cloud® Code Engine is a fully managed, serverless platform that runs your containerized workloads, including web apps, microservices, event-driven functions, or batch jobs. In this section, you will create a Code Engine project and deploy the containerized Node.js app to the project. In the previous section, the source code reads the .env that you have locally to obtain the URL and credentials to the MongoDB service. You will create a secret in the project to contain these same keys/values that will be read by the app when it is run.
[Name the rule](https://cloud.ibm.com/docs-content/v1/content/63322f2f3a72050206eb05ba7f590fdcb741105c/images/cbr_3.png)





 Step 3: Scope the rule 

Now you can choose the specific object storage resources to which you would like to apply the context-based restrictions. This can become as specific or generic as you wish - you could apply the rule to all object storage instances and buckets, a specific service instance, or even a specific bucket. Additionally, you can choose which networks (public, private, or direct) you wish to be included.

In this example, we will choose a service instance.



1. Select IAM services.
2. Choose Cloud Object Storage from the drop down menu.
3. Select the Resources based on specific attributes radio button.
4. Check the Service instance box.
5. Select the service instance you want the rule to affect.



![Scope the rule](https://cloud.ibm.com/docs-content/v1/content/63322f2f3a72050206eb05ba7f590fdcb741105c/images/cbr_4.png)

If you want to instead only limit access to a specific bucket, you can select the Resource ID checkbox instead. Provide the name of the bucket in the field - nothing else is necessary.





 Step 4: Create a network zone 

Now that we know what the rule will affect, we need to decide what the rule will allow. To do this, we'll create a new network zone and apply it to the new rule.



1. Click on Create +.



![Scope the rule](https://cloud.ibm.com/docs-content/v1/content/63322f2f3a72050206eb05ba7f590fdcb741105c/images/cbr_5.png)



2. Give the network zone a helpful name and description.
You can backup and restore a workspace by following the steps in [Backing up and restoring data](https://cloud.ibm.com/docs/watson-knowledge-studio?topic=watson-knowledge-studio-backup-restore). These backup and restore tasks allow you to perform a manual data migration from one Knowledge Studio instance to another, backing up your data from one instance and restoring it on another instance.





 Experimental services and features: What does experimental mean? 

IBM releases experimental services and features for you to try out. These services might be unstable, change frequently in ways that are not compatible with earlier versions, and might be discontinued with short notice. These services and features are not recommended for use in production environments.

For more information about experimental services, see the [IBM Cloud documentation ![External link icon](https://cloud.ibm.com/docs-content/v1/content/icons/launch-glyph.svg)](https://cloud.ibm.com/docs/get-support/servicessupport.htmls-services-exporcont). For the full details of experimental services, see the latest version of the [IBM Cloud Service Description ![External link icon](https://cloud.ibm.com/docs-content/v1/content/icons/launch-glyph.svg)](https://www.ibm.com/software/sla/sladb.nsf/sla/bm?OpenDocument).
IBM Cloud Foundry application deployment analysis 

IBM® Cloud Foundry is deprecated and no longer supported as of 1 June 2023. For more information, see the [deprecation details](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-deprecationdep_details).

Before migrating your applications to another IBM Cloud compute type, look at your applications in your IBM® Cloud Foundry hosting environment.

For most cloud hosted applications, internal application code makes up most of the effort for that application. Where it is hosted, how it is connected, how traffic flows, services connections, and so on is a thin layer on top of or connected to the application. As you migrate your applications, only the thin layer should need to be addressed. Most of your application will function the same on any hosting compute service.

There are a few things you need to determine and decide before you migrate your set of applications to a new IBM Cloud location. You might already know most of the details about your IBM® Cloud Foundry application deployments, especially if your organization planned the deployment and set up the hosting environment for the applications.

For those users wanting to confirm their application hosting layout, or investigate what they currently have deployed to IBM® Cloud Foundry, there are several methods to analyze their current deployment.



 IBM® Cloud Foundry CLI 

The IBM® Cloud Foundry CLI method is comprehensive in that it has complete access to all your IBM® Cloud Foundry deployment details. The CLI allows you to output command results to files, visually on the screen and in JSON output. This gives the most data to analyze.





 The IBM Cloud console 

The [IBM Cloud web console](http://cloud.ibm.com) is a good way to fully investigate the details of your your IBM® Cloud Foundry environments and deployments, it can give you all the same information as the CLI method. This page will not go into details using that method, since we do so below with the CLI method, but you can use this as a double check or if you prefer to do it that way.





 Investigating your application deployments 

These steps show you how to investigate your IBM® Cloud Foundry application deployments and capture data that you can use to evaluate how to set up your migration hosting target.
[Edit response](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/edit-slot.png) icon for the conditional response you just added. From the Options![Advanced response](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/kebab.png) menu, click Open JSON editor. Add a context block that sets the slot context variables to null, as shown.

{
"output":{
"text": {
"values": [
"Alright. Let's start over. I'll try to keep up this time."
]
}
},
"context":{
"date": null,
"time": null,
"guests": null
}
}
4. Click Back, and then click Save.
5. Click the Edit slot![Edit slot](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/edit-slot.png) icon for the confirmation slot again. In the Not found prompt, clarify that you are expecting the user to provide a Yes or No answer. Add a response with the following values.



Not found response details

 Condition Response 

 `true` Respond with Yes to indicate that you want the reservation to be made as-is, or No to indicate that you do not. 



6. Click Save.
7. Now that you have confirmation responses for slot values, and you ask for everything at once, you might notice that the individual slot responses are displayed before the confirmation slot response is displayed, which can appear repetitive to users.
Purchase a secondary subnet. After you have a subnet that is routed to the IP address or VLAN you want, you'll want to refer to the specific compute documentation for how to set up your new IP addresses:



* [Bare Metal Server IP address assignment](https://cloud.ibm.com/docs/bare-metal?topic=bare-metal-bm-assigning-and-binding-ip-addressesbm-assign-ip-address)
* [Virtual Server Instance IP address assignment](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-assigning-server-ip-addressesassigning-server-ip-addresses)







 What does "Reserved for HSRP" when I look at a subnet's IP addresses mean? 

In some locations, IBM Cloud has routers using a technique that is known as Hot Router Standby Protocol (HSRP). Specifically, the way it's used impacts the IP addresses available to secondary portable subnets, meaning that you lose access to two more addresses in these locations. "Reserved for HSRP" indicates these IP addresses are reserved to fulfill the needs of HSRP. You might even have subnets on the same router, some with and some without, such reservations. As with any IP conflict, do not attempt to use these addresses or you risk affecting traffic on the entire subnet.





 Can I order secondary subnets that are unrouted? 

Yes. When ordering a secondary subnet, you can choose Unrouted as the routing type. The unrouted secondary subnet delivered is bound to the single data center you chose when ordering and will be unusable until routed by you. Unrouted secondary subnets are billed the same as routed secondary subnets, and re-routing by you has no effect on billing.





 How long can unrouted subnets remain unused on my account? 

Starting November 30, 2022, secondary subnets that remain unrouted on your account for 60 days or more are subject to automatic cancellation of billing and reclaim of the subnet in order to maintain sufficient subnet availability for all customers.





 Can I re-route static or portable secondary subnets on my account? 

Yes.
Larger WAL files potentially mean that more disk space is required. Write throughput can decrease, along with replication lag that affects high availability and read-only replicas, and longer restore times from a backup.
* Logical decoding has a set of restrictions on what replicates. Some of these include schema/DDL, sequences, TRUNCATE, and Large Objects.
* When a controlled HA switchover happens, it is possible that replication events will be delivered more than once. Downstream applications must be able to handle events being delivered more than once.
* If you create a logical replication slot, and a consumer is not connected and consuming the changes, you run the risk of running your deployment out of disk space. The replication slot tells PostgreSQL to keep all the transaction logs that have the changes that the consumer needs. If nothing is consuming those changes, PostgreSQL continues collecting them until it is out of disk space. You can monitor disk space with the [IBM Cloud® Monitoring integration](https://cloud.ibm.com/docs/databases-for-postgresql?topic=databases-for-postgresql-monitoring). If you run out of space, you can [scale up disk](https://cloud.ibm.com/docs/databases-for-postgresql?topic=databases-for-postgresql-resources-scaling), which allows the database to start. Then, you can either start consuming the changes or drop the slot.
* You can check how much disk space is being used by a specific replication slot and whether that replication slot has an active consumer. Use the admin user to run one of the following commands:

PostgreSQL 10.x and newer

SELECT slot_name, pg_size_pretty(pg_wal_lsn_diff(pg_current_wal_lsn(),restart_lsn)) AS lag, active from pg_replication_slots WHERE slot_type='logical';

PostgreSQL 9.x
Why can't I see Connector logs? 

  What’s happening 

When trying to view logs for your Connector agents, you see an error similar to the following.

Failed to get configuration from API /v1/connectors/U2F0ZWxsaXRlQ29ubmVjdG9yOiJjaTExMGxpdzFwazluMGdybXUyMCI, region us-east, code: 401. IAM Error: "status code: 400. Provided API key could not be found.", API Error: "null"

  Why it’s happening 

If your API key is deleted while a Connector agent is running, the change is detected by the Connector agent after about 45 minutes. Without a valid API key, the Connector agent close the tunnel. As a result, any applications using an endpoint will receive a communication error.

  How to fix it 

You must update your API key and restart the Connector agent before you can use the tunnel or endpoints again.