vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Granting permissions to users 

With an IBM Cloud account, you have administrative privileges for your account, which enables you to perform all operations on IBM Analytics Engine service instances. However, when you onboard other users to your account, you need to manage their permissions so that they have the required privileges to use IBM Analytics Engine service instances under your account.

Access to IBM Analytics Engine service instances for users in your account is controlled by IBM Cloud Identity and Access Management (IAM). Every user that accesses the IBM Analytics Engine service in your account must be assigned an access policy with an IAM role defined. The policy determines what actions a user can perform within the context of the service or instance. Permitted actions are customized and defined by the IBM Cloud service as operations that are allowed to be performed on the service. The actions are then mapped to IAM user roles.



* Access policies enable access to be granted at different levels. You can see which access policies are set for you in the [IBM Cloud® catalog](https://cloud.ibm.com/catalog) console.



1. Go to [Access IAM users](https://cloud.ibm.com/iam/users).
2. Click your name in the user table.
3. Click the Access policies tab to see your access policies.



* Roles define the actions that a user or service ID can run. There are different types of roles in the IBM Cloud:



* Resource group roles. When you create an IBM Analytics Engine service instance, you assign the service to a resource group. This resource group helps you to organize your account resources for access control. Users with resource group roles can create or delete service instances.
* Service access roles. Users with service access roles can be assigned varying levels of permission for calling the service's API.





Access to IBM Analytics Engine resources requires certain access permissions at the resource group level and the service level. A user is given the desired level of access to a service instance only after the required roles at these levels were granted.



 IBM Cloud platform roles
After completing steps 1 and 2 you have tested 4 of the 5 components.
3. Load the final component. This is the front-end UI. From a browser navigate to [http://$appname-gateway.mybluemix.net/products](http://$appname-gateway.mybluemix.net/products)

If for some reason you have a problem deploying the last component try running ibmcloud cf push $appname-frontend. This might, or might not resolve the problem. If you can't get the final component deployed, you can still move forward with the move2kube steps and work with just the first 4 components.







 Next steps - move2kube phases (collect, plan, transform) 

There are three phases when running move2kube. These are: collect, plan, and transform.



 Collect information from your IBM® Cloud Foundry application 

Now that you have a working deployment of a sample IBM Cloud Foundry application, you can use the first phase of the move2kube tool to collect information about the Cloud Foundry app.

In the transform phase, You will collect information about the buildpacks that are supported, the memory, the number of instances, and the ports that are supported. If there are environment variables, that information is collected as well.

Running the ./deploy-to-cf script to deploy application services into IBM Cloud Foundry will generate artifacts. Because of this you will need a new copy of the source code to invoke move2kube. If you followed the folder structure mentioned above, no actions are required.

cd ../.../../../move2kube-demos-<name_of_target>
move2kube collect -a cf

The following is an example of the output from this command:

INFO[0000] Begin collection
INFO[0000] [collector.CfAppsCollector] Begin collection
INFO[0006] Changing metadata name from IBM Cloud to ibm-cloud
INFO[0009] [collector.CfAppsCollector] Done
INFO[0009] [collector.CfServicesCollector] Begin collection
* [Spark application management](https://cloud.ibm.com/docs/AnalyticsEngine?topic=AnalyticsEngine-CLI_analytics_engineanalytics-engine-v3-spark-app-cli)
* [Log forwarding configuration](https://cloud.ibm.com/docs/AnalyticsEngine?topic=AnalyticsEngine-CLI_analytics_engineanalytics-engine-v3-log-forwarding-config-cli)
* [Spark history server management](https://cloud.ibm.com/docs/AnalyticsEngine?topic=AnalyticsEngine-CLI_analytics_engineanalytics-engine-v3-history-server-cli)



$ ibmcloud ae-v3 --help

NAME:
analytics-engine-v3 - Manage serverless Spark instances and run applications.

USAGE:
ibmcloud analytics-engine-v3 [command] [options]

ALIASES:
analytics-engine-v3, ae-v3

COMMANDS:
history-server Commands for HistoryServer resource.
instance Commands for Instance resource.
log-forwarding-config Commands for LogForwardingConfig resource.
spark-app Commands for SparkApp resource.
target All commands run after setting a target will be run on the target instance

OPTIONS:
-h, --help Show help
-j, --jmes-query string Provide a JMESPath query to customize output.
--output string Choose an output format - can be 'json', 'yaml', or 'table'. (default "table")
-q, --quiet Suppresses verbose messages.
-v, --version version for analytics-engine-v3

Use "ibmcloud analytics-engine-v3 service-command --help" for more information about a command.
Show more





 Set a target instance 

The following command allows you to set a target instance against which all subsequent CLI commands are run.

Note: If the instance ID is passed explicitly in any v3 CLI commands, it will override the instance ID that is set as the target.
* GA products are widely available for sale and delivery to customers or channels, usually across multiple geographies.
* Select availability products are production-ready, available for sale, and accessible to select customers.
* Beta products are made solely available for evaluation and testing purposes. There are no warranties, SLAs, or support provided and beta products are not intended for production use.
* Experimental products are made solely available for evaluation and testing purposes, and might be unstable or not compatible with previous versions. An experimental product can be discontinued with short notice. There are no warranties, SLAs, or support provided, and experimental products are not intended for production use.
* Deprecated products are in the process of being withdrawn from service and are eligible to be removed after the deprecation period.
While Schematics deploys the infrastructure resources, the automation code is configured with a few Ansible playbooks, which are required to set up the Spectrum Scale function on the virtual server instance nodes with the help of the Ansible provisioner. When the Ansible provisioner tries to SSH to these nodes to se the Spectrum Scale feature, the nodes go to an unreachable state.

To fix the issue, you can:

 How to fix it 



1. Try to destroy the resources from the workspace and deploy again.
2. If this issue is observed on all of the deployments, raise a support issue with the IBM Cloud support team to investigate if there is an infrastructure issue.
3. If there are no issues with the infrastructure, report this issue to the automation team who can investigate further.







 Why do I see resource errors due to authentication or timeout issues? 

You are receiving the following error messages during the creation of any specific resource:

 What’s happening 



* Error: An error occurred while performing the ‘authenticate’ step: Post “https://iam.cloud.ibm.com/identity/token”: context deadline exceeded (Client.Timeout exceeded while awaiting headers)
* Error: timeout while waiting for state to become 'done, ' (last state: 'provisioning', timeout: 10m0s)



 Why it’s happening 

While Schematics deploys the infrastructure resources, it authenticates with IBM Cloud through API calls. If there are too many requests through the API to the cloud environment, Schematics won't be able to authenticate and could error out with the authentication error.

 How to fix it 

To fix either issue (resource failing due to authentication error or the timeout error), destroy the resources from the Schematics workspace and retry deploying the resources.





 Limitation of available profiles for dedicated hosts 

The offering automatically selects instance profiles for dedicated hosts to be the same prefix (for example, bx2 and cx2) as ones for worker instances (worker_node_instance_type). However, available instance prefixes can be limited, depending on your target region.
.____ __ _ ___ __ __ _ ____
( __)( ( / __)( )( ( ( __)
.) _) / /( (_ )( / / ) _)
(____)_)__) ___/(__)_)__)(____)

Some Env Vars:
--------------
CE_DOMAIN=us-south.codeengine.appdomain.cloud
CE_JOB=myjob-daemon
CE_JOBRUN=myjobrun-daemon
CE_SUBDOMAIN=glxo4k7nj7d
HOME=/root
HOSTNAME=myjobrun-daemon-0-0
JOB_INDEX=0
JOB_MODE=daemon
KUBERNETES_PORT=tcp://172.21.0.1:443
KUBERNETES_PORT_443_TCP=tcp://172.21.0.1:443
KUBERNETES_PORT_443_TCP_ADDR=172.21.0.1
KUBERNETES_PORT_443_TCP_PORT=443
KUBERNETES_PORT_443_TCP_PROTO=tcp
KUBERNETES_SERVICE_HOST=172.21.0.1
KUBERNETES_SERVICE_PORT=443
KUBERNETES_SERVICE_PORT_HTTPS=443
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
PWD=/
SHLVL=1
z=Set env var 'SHOW' to see all variables



Now that your job is created in daemon mode, the job runs indefinitely. Because there is no timeout and failed instances are restarted indefinitely, the --maxexecutiontime and --retrylimit options are not allowed when you run a job in daemon mode.
To view the property details of a vCenter Server with Hybridity Bundle instance:



1. In the vCenter Server table, click an instance name.
2. Under Properties, view the details for the instance.





Table 3. vCenter Server with Hybridity Bundle instances properties

 Property Description 

 Name The name of the instance. 
 ID The ID of the instance. 
 Location The IBM Cloud data center where the instance is hosted. 
 Current version The current version of IBM Cloud for VMware Solutions. 
 vCenter version The VMware vCenter Server with Hybridity Bundle version.<br><br>Note: There is a slight variation between the vCenter Server version that is displayed on the IBM Cloud for VMware Solutions console and the VMware vSphere® Web Client. Both are correct. 
 NSX for vSphere The VMware NSX® for vSphere product version. 
 NSX license edition The version and edition of the VMware NSX license. 
 DNS, Root domain The root domain name is the DNS (Domain Name System) domain name and the Microsoft® Active Directory™ (AD) forest root name. 
 DNS, SSO domain The SSO domain is the vSphere Single Sign-On domain. The SSO domain name is fixed for all deployed vCenter Server with Hybridity Bundle instances with a value of vsphere.local. 
 DNS, Subdomain The subdomain is the DNS subdomain name of the root domain name where the local vCenter Server with Hybridity Bundle instance host names reside. The subdomain name is in the format vcenter_server_instance_name.root.domain_name. 
 Hybridity Bundle Indicates if the vCenter Server with Hybridity Bundle is installed. 
 Status The status of the instance.<br><br>The information that is displayed provides an update on the progress of the deployment or the action that is taken on the instance. If there are issues, a message might be displayed to help you investigate and resolve the problem. 







 Procedure to view access information for vCenter Server with Hybridity Bundle instances 

Under Access information, view the access information for the instance-related components.
Run the following command: [ibmcloud target](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_cliibmcloud_target)

By default, the default resource group is set.
4. Get the instance name and plan ID. Run the following command: [ibmcloud resource service-instances](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_resourceibmcloud_resource_service_instances)

ibmcloud resource service-instance InstanceName --output JSON

Copy the value of the field resource_plan_id. This value is needed to update the instance.
5. Set on the default_receiver property. Run the following command:

Check that the change will not affect other account members. There is only 1 instance per region that can collect platform logs. After you make this change, platform logs are collected through this instance in the region, and permissions to view platform logs are impacted.

ibmcloud resource service-instance-update InstanceName --service-plan-id PlanID -p '{"default_receiver": true}'

Where PlanID is the resource plan ID of your logging instance.







 Changing the instance that collects platform logs from the command line 

You must use a user that has permissions to see all instances in the account.

Before you change the instance that collects platform logs, check that the change will not affect other account members. There is only 1 instance per region that can collect platform logs. After you make this change, platform logs are collected through this instance in the region, and permissions to view platform logs are impacted.

Complete the following steps:



1. [Pre-requisite] [Install the IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli).
2. [Pre-requisite]Get the details of the instance with the flag Platform Logs set in the region that you want to reconfigure.
3.
The maximum number of projects includes projects that are active and any projects that are not permanently deleted. When you delete a project, the project is soft deleted, and can be restored within 7 days before it is permanently deleted. Use the console or the CLI to display soft-deleted projects. For more information, see [deleting a project](https://cloud.ibm.com/docs/codeengine?topic=codeengine-manage-projectdelete-project).

The following table lists the quotas for projects.

Be aware that the limits apply independently from each other within a project. If a limit is reached, such as the limit of 512 GB of memory, this quota limit might impact the ability to run a workload, even if another limit is not yet reached, such as 250 instances of apps or jobs.



Project quotas

 Category Description 

 Apps You are limited to 40 apps per project. 
 App revisions You are limited to a total of 120 revisions for all apps per project. 
 Builds You are limited to 100 build configurations per project. 
 Build runs You are limited to 100 build runs per project before you need to remove or clean up old ones. 
 Configmaps You are limited to 100 configmaps per project. 
 CPU The total combination for all the app instances, running job instances, and running build instances cannot exceed 128 vCPU. 
 Domain mappings (custom) You are limited to 80 custom domain mappings per project. 
 Ephemeral storage The total combination for all the app instances, running job instances, and running build instances cannot exceed 512 G of ephemeral storage. 
 Instances (active) The number of app instances, running job instances, and running build instances cannot exceed 250. 
 Instances (total) The number of active instances and the number of completed job and build instances cannot exceed 2500. 
 Jobs You are limited to 100 jobs per project. 
 Job runs You are limited to 100 job runs per project before you need to remove or clean up old ones. 
 Memory The total combination for all the app instances, running job instances, and running build instances cannot exceed 512 G of memory. 
 Secrets You are limited to 100 secrets per project. 
 Subscriptions (IBM Cloud Object Storage) You are limited to 100 (Object Storage) subscriptions per project.
For more information, see [Updating idle time before worker nodes are removed](https://cloud.ibm.com/docs/hpc-spectrum-symphony?topic=hpc-spectrum-symphony-update-idle-time&interface=api).





 Incorrect provider configuration values do not result in an error 

When updating the IBM Cloud provider configuration from the Symphony GUI, at Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) Resources > Cloud > Configuration, the values set in the configuration are not validated. If there are invalid values in the configuration, the virtual machine provisioning fails. If a failure happens, check the host factory logs on the host running the HostFactory service in /opt/ibm/spectrumcomputing/hostfactory/log for more information.





 Limitation of available profiles for dedicated hosts 

The offering automatically selects instance profiles for dedicated hosts to be the same prefix (for example, bx2 and cx2) as ones for worker instances (worker_node_instance_type). However, available instance prefixes can be limited, depending on your target region. If you use dedicated hosts, check ibmcloud target -r {region_name} and ibmcloud is dedicated-host-profiles to see whether your worker_node_instance_type has the available prefix for your target region.





 Why do I see resource errors due to authentication or timeout issues? 

You are receiving the following error messages during the creation of any specific resource:

 What’s happening 



* Error: An error occurred while performing the ‘authenticate’ step: Post “https://iam.cloud.ibm.com/identity/token”: context deadline exceeded (Client.Timeout exceeded while awaiting headers)
* Error: timeout while waiting for state to become 'done, ' (last state: 'provisioning', timeout: 10m0s)



 Why it’s happening 

While Schematics deploys the infrastructure resources, it authenticates with IBM Cloud through API calls. If there are too many requests through the API to the cloud environment, Schematics won't be able to authenticate and could error out with the authentication error.
Load balancer basics 

The IBM Cloud® Load Balancer service distributes traffic among multiple server instances (bare metal and virtual server) that reside locally, within the same data center.



 Public-to-private load balancer 

A publicly accessible, fully qualified domain name is assigned to your load balancer service instance. You must use this domain name to access your applications hosted behind the load balancer service. This domain name can be registered with one or more public IP addresses. The public IP addresses and number of public IP addresses can change over time based on maintenance and scaling activities, which are transparent to users. The back-end compute instances hosting your application must be on an IBM Cloud Private network.

As a good practice, it is recommended that you provision your back-end servers as private-only, unless they require direct public connectivity. This practice helps achieve better security, and it preserves your public IP address. The applications that are hosted on these back-end servers are still accessible over public networks by using the load balancer.

There are two ways to allocate public IP addresses to the load balancer:



* Allocate from IBM system pool: This is the default method. This method allocates IP addresses from IBM system pool.
* Allocate from a public subnet in this account: This method allocates IP addresses from a public subnet from your account. By default, the subnet selection is automatic. If you are using API, you can select a particular subnet by passing the public subnet ID when placing the order.







 Private-to-private load balancer 

The internal load balancer is only accessible within the IBM Cloud Private network.

Just like a public-to-private load balancer, your internal load balancer service instance is also assigned a fully qualified domain name. However, this domain name is registered with one or more private IP addresses.

Similar to a public load balancer, the private IP addresses and their numbers can change over time based on maintenance and scaling activities, which are transparent to end users.

The back-end compute instances hosting your application must also be on the IBM Cloud private network.





 Public-to-public load balancer 

The public-to-public load balancer is publicly accessible.
After location and cluster creation

If you create a Satellite cluster at version 4.12 and later, there are Calico Hostendpoint instances that are deployed to the cluster for every worker node’s network interface.

You can use these Hostendpoint instances to define global network policies with the help of the “ibm-cloud.kubernetes.io/interface-name: <network_interface_name>” label that is added to each Hostendpoint instance.

In addition to this label, all the worker node’s labels are added for additional customization options.

These Hostendpoints have the “projectcalico-default-allow" profile, which means these Hostendpoints may change the previously expected behavior when you update to 4.12.

Before updating to 4.12, make sure all the previously expected networking rules, policies, Hostendpoints work the same after the update as well.

For more information, see the [Calico documentation](https://docs.tigera.io/calico/latest/reference/resources/hostendpoint).





 Restricting NodePort service access 

After location and cluster creation

By default, NodePort services are accessible on all network interfaces that are available to the cluster, for example 0.0.0.0.

However, in Satellite locations where multiple networks are available to the hosts, you can limit the available network interfaces for your services.

To limit the range, you restrict the listening addresses for NodePort services at the cluster level. This restriction allows the cluster administrator to limit access to a specific network interface by using the IP subnet as the allowed listening address range. Complete the following steps to reconfigure the kube-proxy component to limit the listening address range for your NodePort services.

Incorrectly configuring the node-port-addresses might isolate your services from valid sources. Make sure you plan for all the required subnets your service needs. IBM Cloud doesn't require access to any subnet to manage your clusters.



1. [Access your Red Hat OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-access_cluster).
2.
[Checkmark](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker//images/checkmark-icon.svg) [Location-based events](https://cloud.ibm.com/docs/bare-metal?topic=bare-metal-bm-at-eventsbm-at-events) 







 Compute serverless services 

The following table lists serverless compute services that send auditing events:



Table 3. List of serverless compute services

 Service CRN service name Activity Tracker hosted event search offering Events 

 [IBM Cloud® Functions](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-getting-started) functions ![Checkmark](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker//images/checkmark-icon.svg) [Location-based events](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-at_events) 
 [IBM Cloud® Code Engine](https://cloud.ibm.com/docs/codeengine?topic=codeengine-getting-started) codeengine ![Checkmark](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker//images/checkmark-icon.svg) [Location-based events](https://cloud.ibm.com/docs/codeengine?topic=codeengine-at_events) 







 Container services 

The following table lists container platform services that send auditing events:



Table 4. Container events

 Service CRN service name Activity Tracker hosted event search offering Events