vania-janet/multiturn-rag-retrieval-data huggingface dataset:
From the list of secret types, click the Import certificate tile.
5. Click Next.
6. Add a name and description to easily identify your certificate.
7. Select the

secret groupthat you want to assign to the secret.

Don't have a secret group? In the Secret group field, you can click Create to provide a name and a description for a new group. Your secret is added to the new group automatically. For more information about secret groups, check out [Organizing your secrets](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-secret-groups).
8. Optional: Add labels to help you to search for similar secrets in your instance.
9. Optional: Add metadata to your secret or to a specific version of your secret.



1. Upload a file or enter the metadata and the version metadata in JSON format.



10. Click Next.
11. Select a certificate file or enter its value.

You can store unexpired X.509 certificate files that are in PEM format. If you're working with certificates that are in a different format, you can use command-line utilities to convert your certificates to .pem. For more information, see [Why can't I import my certificate?](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-troubleshoot-pem)
12. Optional: Select a private key file or enter its value.

If you choose to store a private key, ensure that it matches to your certificate. The private key must be unencrypted before you can import it to the service.
13. Optional: Select an intermediate certificate file or enter its value.
14. Click Next.
15. Review the details of your certificate.
16. Click Add.







 Importing certificates from the CLI
Set up [Kubernetes load balancer services](https://cloud.ibm.com/docs/openshift?topic=openshift-loadbalancer-qs), [routes](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_routes), or the [Ingress service](https://cloud.ibm.com/docs/containers?topic=containers-managed-ingress-about) to expose the apps in your cluster.
2. Set up the CIS global load balancer by following steps 1 - 5 in [Getting Started with IBM Cloud Internet Services (CIS)](https://cloud.ibm.com/docs/cis?topic=cis-getting-startedgetting-started). These steps walk you through provisioning the service instance, adding your app domain, and configuring your name servers, and creating DNS records. Create a DNS record for each router service or NLB IP address that you collected. These DNS records map your app domain to all your cluster router services or NLBs, and ensure that requests to your app domain are forwarded to your clusters in a round-robin cycle.
3. [Add health checks](https://cloud.ibm.com/docs/cis?topic=cis-configure-glbadd-a-health-check) for the router services or NLBs. You can use the same health check for the router services or NLBs in all your clusters, or create specific health checks to use for specific clusters.
4. [Add an origin pool](https://cloud.ibm.com/docs/cis?topic=cis-configure-glbadd-a-pool) for each cluster by adding the cluster's ALB or NLB IPs. For example, if you have 3 clusters that each have two router services, create three origin pools that each have two router service IP addresses. You can find the NLB or router service IP addresses by running oc get svc -n <namespace>. Add a health check to each origin pool that you create.
5.
VMware Solutions DNS configuration 



 Collecting Active Directory credentials 



1. Log in to [IBM Cloud®](https://cloud.ibm.com/login).
2. From left menu, select VMware.
3. From the IBM Cloud for VMware Solutions console, click Resources > vCenter Server from the left navigation pane.
4. Select your deployed instance.
5. Click the Access information tab and collect the AD/DNS IP and remote desktop credentials.
6. From a jump server or by using SSL VPN, remote desktop to the AD/DNS server.







 Creating DNS records 



1. Based on the following example, create a table to record your values.
2. Update the following PowerShell commands with your values.
3. From the Windows® RDP Session, open a PowerShell command window.
4. Run commands to create the DNS artifacts.



* Reverse Lookup Zones
* Create DNS A Records, with PTR
* Create DNS Service record for etcd
* Create DNS SRV record for etcd







 Notes about DNS records 



* The Add-DnsServerPrimaryZone-networkid cmdlet creates only classful reverse lookup zones. Therefore, if you specify a prefix longer than /24, then the cmdlet creates a /32 reverse lookup zone. Therefore, as a workaround in the script use /24 instead of a /26. You also need to modify the private portable subnet to match classful /24 network in the commands.
* Do not create CNAME entries because the Red Hat® OpenShift® certificates are keyed to the DNS returning the IP address only and not a referral to the base hostname. Use the following format for DNS naming standards: HostName.ClusterName.SubDomain.DomainName



* HostName - Name of the virtual machine or host, for example, control-plane-0
* ClusterName - Red Hat OpenShift cluster name, for example, ocp
* SubDomain - Subdomain of the IBM Cloud for VMware Solutions deployment, for example, dallas
Usage of the branch https://github.com/guruprasad0110/tf_cloudless_sleepy_13/ repository, after 1st October 2020, can see this error message.

If the repository is created after 1 October 2020, the main branch syntax needs to be https://github.com/username/reponame/tree/main. For example, https://github.com/guruprasad0110/tf_cloudless_sleepy_13/tree/main





 Can I increase the timeout for null-exec and remote-exec resource? 

No, the null-exec (null_resources) and remote-exec resources has maximum timeout of 60 minutes. Longer jobs need to be broken into shorter blocks to provision the infrastructure faster. Otherwise, the execution times out automatically after 60 minutes.





 How can I save user-defined files that are generated by the Terraform modules and use them across multiple Terraform plan, apply, destroy, refresh, or import commands? 

IBM Cloud Schematics already stores and securely manages the state file generated by the Terraform engine in a Schematics Workspace. Schematics periodically saves the state file in the secured location. Further the state file is automatically restored before executing the Schematics job or Terraform plan, apply, destroy, refresh, or import commands.

In the same way IBM Cloud Schematics supports the ability to store user-defined files that are generated by the Terraform template or modules. Schematics expects the user-defined Terraform template or modules to generate and place the files in a predefined location. Schematics will automatically save and restore them before and after running the Schematics jobs or Terraform command.

Your files must be placed in the /tmp/.schematics folder and the size limit is set to 10 MB. Schematics backups and restores all the files in the /tmp/.schematics folder.





 How do I identify the best way to synchronize a deleted resource with the Terraform state? 

Currently, the IBM Cloud Schematics service does not support the ability to import or synchronize the IBM Cloud resource state into the Schematics Workspace.
Each of the non-default clusters can be expanded to have up to 59 ESXi servers. Since you can add up to 10 clusters to an instance, each deployed instance can have a maximum of 51 + 9x59 = 582 ESXi servers across all clusters.
* How many ESXi servers can I add to a cluster?

You can add a maximum of 51 ESXi servers to an initial cluster and a maximum of 59 ESXi servers to the added clusters.

For instances deployed in V2.1 or earlier, you must enable the necessary vSAN™ support to increase the cluster size beyond 32. Complete the following steps to enable the necessary vSAN support:



1. On each deployed ESXi server, run the following commands:

esxcli system settings advanced set -o /VSAN/goto11 -i 1

esxcli system settings advanced set -o /Net/TcpipHeapMax -i 1576
2. Restart each ESXi server. For more information, see [Creating vSAN clusters with up to 64 nodes](https://kb.vmware.com/s/article/2110081).
3. You might need to increase the size of the vCenter Server to accommodate the added virtual machines and ESXi servers.
4. Open an IBM Support ticket to indicate that you applied the vSAN changes manually by completing steps 1 to 3. In the ticket, request that your upgraded instance is enabled for ESXi servers beyond 32.



* Can I change the ESXi server names and IP addresses?

The ESXi server names and IP addresses cannot be changed because they are registered for Windows® DNS resolution. Changes might result in failure during deployment or failure of vCenter Server functions.

Don't use the Rename Device feature on the IBM Cloud user interface to change ESXi server names. This function changes the FQDN of the ESXi server, but the configured vCenter Server and the Windows VSI host registrations are incorrect and might cause failures.
* Can I disable root access on my ESXi servers?

It is recommended to keep root access enabled on ESXi servers, otherwise failure in the IBM Cloud for VMware Solutions functions might occur.
* In all cases, it is advised to back up the original controllers before you remove the original vCenter Server instance.







 Can I use vMotion with vSphere Encryption between the two vCenter Server instances? 

With VMware vSphere® encryption, it is possible to perform an advanced cross vCenter vMotion on vSphere–encryption–protected VMs. You need to upgrade the source vCenter to v7.0 and connect both vCenters to the same Key Management System (KMS) and assign it the same name. Also, ensure that you have equivalent storage encryption policies in each vCenter Server.





 What happens to assets that were deployed manually? 

If you added deployed assets to the instance manually, after initial deployment, the automation does not know about them. Therefore, you must migrate the assets to the new instance manually.





 I have VMware workloads on IBM Cloud bare metal servers with vSphere 6.5 and 6.7 and the support is ending. I am not using NSX for my workloads. What do I need to do keep the environment supported, and what options do I have? 

General support for vSphere® 6.x ended on 15 October 2022. For more information, see [End of general support for vSphere 6.5 and vSAN 6.5 or 6.6](https://kb.vmware.com/s/article/83223) and [VMware product lifecycle matrix](https://lifecycle.vmware.com//).

Instances with IBM Cloud bare metal servers with vSphere 6.7 cannot be ordered post 21 June 2022. IBM Cloud support for ordering all update levels of vSphere 6.5 ended on 10 October 2021, and vSphere 6.5 cannot be ordered post 21 June 2022.

IBM Cloud recommends an upgrade to vSphere 7.x. If you ordered your servers from the Bare metal catalog for IBM Cloud Classic Infrastructure, you have the following options.



* Check whether your server and its hardware options are compatible with vSphere 7.0.
oc get bc/$MYPROJECT -o yaml | grep -A 3 "- gitlab"
* Replace<secret> in the webhook GitLab URL with the secret value under gitlab in the above command output.



3. Open your private git repo on a browser using the Git repo HTTPS link then click on Settings and click Webhooks.
4. Paste the URL and click Add webhook. Test the URL by clicking Test and selecting Push events. You should see Hook executed successfully: HTTP 200 message. This triggers a new build.
5. Update the ImagePolicy of the image stream to query Container Registry at a scheduled interval to synchronize tag and image metadata. This will update the tags definition

oc tag $MYREGISTRY/$MYNAMESPACE/${MYPROJECT}:latest ${MYPROJECT}:latest --scheduled=true
6. Open the cloned repo in an IDE to update the h1 tag of local public/index.html file and change it to Congratulations! <YOUR_NAME>.
7. Save and push the code to the repo

git add public/index.html
git commit -m "Updated with my name"
git push -u origin master
8. You can check the progress of the build and deploy with oc status command. Once the deployment is successful, refresh the route HOST address to see the updated web app.

Sometimes, the deployment may take up to 15 minutes to import the latest image stream. You can either wait or manually import using oc import-image $MYPROJECT command. Refer to this [link](https://docs.openshift.com/container-platform/4.12/registry/registry-third-party-registries_registry-overview) for more info.









 Step 7: (Optional) Use your own custom domain 

This section requires you to own a custom domain and to be able to modify the DNS records of the domain. You will need to create a CNAME record pointing to the IBM-provided domain.
* Case title: SMTP / outbound email activation
* Case description: Please initiate domain authentication for customerdomain.com. This domain should align with the email addresses used in Manage. Please provide contact details / email address of a person who has access to add DNS records for the domain(s) you specify. With these details the IBM SRE Team can generate the DKIM / Domain Authentication records which will be sent to the contact you specify (which has access to add DNS records). Once said contact adds the DNS records, the IBM SRE team will then need to perform a lookup / validation to ensure these records are intact. Once validated, customer will be able to send email as email addresses from the domain(s) specified.
* Note: If SendGrid DKIM records already exist in the DNS server in question, please let the IBM SRE team know so they can generate a unique DKIM selector.







 Customer Managed SMTP Configuration 

If you plan to use your own SMTP server instead of the provided MAS SMTP relay, you must raise an IBM Support case.

In the case, please include:



1. Case title: SMTP / outbound email activation
2. Case description: Please configure our MAS-Dedicated environment to use the following SMTP server:





* SMTP hostname
* SMTP Port
* SMTP user
* SMTP password
* SMTP SSL Certificate (if using SMTP over SSL / port 465)
* Sender Address (the email address that MAS should send FROM / as)



Once this case and details are received, we generate and send 3 DNS records for you to add to your DNS server to complete the outbound email configuration.







 Site-to-Site IPsec VPN 

A Site-to-Site IPsec VPN can be configured between the IBM Cloud environment and a customer site or third party location. This type of VPN establishes a persistent tunnel between the two sites. Site-to-Site VPNs are not configured by default. The setup and configuration of a Site-to-Site VPN can be complex and will require both IBM and the customer's network SMEs to work together.
ibmcloud ks alb ls -c <cluster_name_or_ID>
2. Ensure that the private ALBs have a Status of enabled. If they are disabled, run the following command to enable each private ALB.

ibmcloud ks ingress alb enable classic --alb <ALB_ID> -c <cluster_name_or_ID> --version 0.45.0_1228_iks
3. Optional: Disable each public ALB.

ibmcloud ks ingress alb disable classic --alb <ALB_ID> -c <cluster_name_or_ID>
4. Set up a custom domain for the private ALBs that the NGINX reverse proxy is accessible through, and optionally set up TLS for the domain.



1. Create a custom domain through your DNS service provider. Your custom domain must be 130 characters or fewer to meet Ingress requirements.
2. Map your custom domain to the private ALBs by adding their IP addresses as A records (classic clusters) or their VPC hostname as a CNAME (VPC clusters). To find the ALB IP addresses (classic) or hostname (VPC), run ibmcloud ks ingress alb ls -c <cluster_name_or_ID>. Note that in VPC clusters, a hostname is assigned to the ALBs because the 10.X.X.X IP addresses are not static and might change over time.
3. To use TLS termination, create a secret in the dl-reverse-proxy namespace that contains a TLS certificate for your custom domain. For example, if a TLS certificate is stored in IBM Cloud Certificate Manager that you want to use, you can import its associated secret into your cluster by running the following command. For more information, see [Custom domains with Ingress](https://cloud.ibm.com/docs/containers?topic=containers-managed-ingress-setupingress-custom-domain).
The following is an example of a long CNAME chain that is a combination of private zones and public zones.



* Private zones



* foo.com
* bar.com



* Public zones



* prod.com
* containers.appdomain.cloud





abc.foo.com CNAME abc.bar.com
abc.bar.com CNAME new.prod.com
new.prod.com CNAME 1234.containers.appdomain.cloud
1234.containers.appdomain.cloud A 10.10.24.4

Longer CNAME chains, with or without global load balancers, increase the DNS response times. Typically, DNS clients have a 2-second default query timeout, so the client will timeout and will retry the query when resolution takes longer than 2 seconds.





 Limitations 



* MX and NS records can't point to a CNAME record; they must point to an A record (for IPv4) or an AAAA record (for IPv6).
* The CNAME chain length should not be greater than 5.
* The CNAME can’t share the same name as another record type for a single domain.
* You can't have mulitple CNAME records with the same name in the same domain.







 Managing CNAME DNS records 

You can manage a CNAME record in the same way as you manage any other record. To learn more about creating, reading, updating, and deleting CNAME records, see [Managing DNS records](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-managing-dns-records).
If you want to create routes for more apps by using a different subdomain, repeat all steps in this section to create a new private Ingress controller.







 Setting up private routes in VPC clusters with a private cloud service endpoint only 

If your cluster is created on VPC infrastructure and you enabled the only private cloud service endpoint during cluster creation, your cluster is created with a private Ingress controller by default. You can use this Ingress controller to create private routes for your app.



1. Create a Kubernetes ClusterIP service for your app deployment. The service provides an internal IP address for the app that the Ingress controller can send traffic to.

oc expose deploy <app_deployment_name> --name my-app-svc
2. Choose a domain for your app.



* IBM-provided domain: If you don't need a custom domain, a route subdomain is generated for you in the format <service_name>-<project>.<cluster_name>-<random_hash>-i000.<region>.containers.appdomain.cloud.
* Custom domain: To specify a custom domain, work with your DNS provider or [IBM Cloud® Internet Services](https://cloud.ibm.com/catalog/services/internet-services).



1. Get the external IP address for the private Ingress controller service in each zone in the EXTERNAL-IP column. Note that the Ingress controller service in the first zone where you have workers nodes is always named router-default, and Ingress controller services in zones that you subsequently add to your cluster have names such as router-dal12.

oc get svc -n openshift-ingress
2. Create a custom domain with your DNS provider. If you want to use the same subdomain for multiple services in your cluster, you can register a wildcard subdomain, such as .example.com.
3. Map your custom domain to the Ingress controller services' private IP address by adding the IP addresses as A records.





3.
A route has a subdomain and a domain. A subdomain is typically the application name. A domain might be a system domain or a custom domain that you registered for your application. If you add a custom domain, you must configure your DNS server to resolve your custom domain to point to the IBM Cloud system domain. In this way, when IBM Cloud receives a request for your custom domain, it can properly route it to your application.

Quota
: Represents the resources that are available to an org, including the number of services and the amount of memory that can be allocated for use by the org. Quotas are assigned when orgs are created. Any application or service in a space within an org contributes to the usage of the quota. With Pay-As-You-Go or Subscription accounts, you can adjust your quota for Cloud Foundry applications and containers as the needs of your org change.

In a Subscription account, the quota is a user-defined limit that initiates spending notifications.





 Managing Cloud Foundry orgs and spaces 

You can manage Cloud Foundry orgs and spaces by going to Manage > Account in the IBM Cloud console, and selecting Account resources > Cloud Foundry orgs.

When Cloud Foundry services become IAM-enabled, they are eligible to migrate to a resource group. You're notified when your Cloud Foundry services become eligible, and you're in control of the migration. Your services can't be moved from one org to another.





 Creating orgs in the console 

If you have a billable account, you can add as many orgs as you need. Lite accounts can have only one org, which is already created in your account. Orgs can't be deleted after you add them.



1. In the IBM Cloud console, go to Manage > Account, and select Account resources > Cloud Foundry orgs. Click Create.
2. Enter an org name. The name must be unique in IBM Cloud.

If the org name is already in use by another IBM Cloud Public, Dedicated, or Local user, you must specify a different name.
3. Click Add.
About DNS Services 

To better understand IBM Cloud® DNS Services, it helps to know more about DNS in general.



 DNS overview 

Computers on a network can find one another by IP addresses. To make it easier to work within a computer network, people can use a Domain Name System (DNS) to associate human-friendly domain names with IP addresses, similar to a phonebook. A DNS can also associate other information beyond just computer network addresses to domain names.

That way, people can use human friendly domain names instead of obscure, hard-to-remember, machine-oriented data.





 DNS Services overview 

DNS Services allow you to



* Create private DNS zones that are collections for holding domain names.
* Create DNS resource records under these DNS zones.
* Specify access controls used for the DNS resolution of resource records on a zone-wide level.



DNS Services also maintains its own worldwide set of DNS resolvers. Instances that are provisioned under IBM Cloud on an IBM Cloud network can use resource records that are configured through IBM Cloud DNS Services by querying DNS Services resolvers.

Resource records and zones that are configured through DNS Services are



* Separated from the wider, public DNS and their publicly accessible records.
* Hidden from machines outside of and not part of the IBM Cloud private network.
* Accessible only from machines that you authorize on the IBM Cloud private network.
* Resolvable only via the resolvers provided by the service.







 Clock synchronization 

ISO 27001 requires that clocks of all relevant information processing systems within an organization or security domain must be synchronized with a single reference time source. DNS Services synchronizes the systems with Network Time Protocol (NTP) servers to ensure that all time-based activities occur synchronously everywhere on the network.

IBM DNS Services uses the following internal NTP servers:



* time.adn.networklayer.com
* systemd-timesyncd.service







 Resolving DNS names with DNS Services 

Zoom

!