vania-janet/multiturn-rag-retrieval-data huggingface dataset:
curl -fsSL https://clis.cloud.ibm.com/install/linux | sh



For more information about installing the Mac OS X M1/ARM or Linux 64-bit ARM versions of the CLI, see the IBM Cloud CLI [release notes](https://github.com/IBM-Cloud/ibm-cloud-cli-release/releases/). These versions are provided as-is and are not fully supported.





 Step 2: Verify the installation 

To verify that the CLI was installed successfully, run the help command:

ibmcloud help

The output lists the usage instructions, the current version, and the supported commands.





 Step 3: Install CLI plug-ins and tools 

To manually install the CLI plug-ins and tools, see [Extending IBM Cloud CLI with plug-ins](https://cloud.ibm.com/docs/cli?topic=cli-plug-ins).

To install the container-service or ks plugin, run the following command.

ibmcloud plugin install ks





 Step 4: Install the Kubernetes CLI 

You can use the kubectl CLI to deploy and manage resources in your IBM Cloud Kubernetes Service cluster.

To install the kubectl CLI, see [Install tools](https://kubernetes.io/docs/tasks/tools/).

For a full list of kubectl commands, see the [Command line tool (kubectl) reference](https://kubernetes.io/docs/reference/kubectl/).
Why can't I rotate master keys by using recovery crypto units? 

When you run the ibmcloud tke auto-mk-rotate command to rotate master keys by using recovery crypto units, you might be not able to complete the rotation.

 What’s happening 

During master key rotation, the new master key registers are loaded with the new master key value to be used. The contents of key storage are reencrypted by using the current and new master key values. When the reencryption of key storage is complete, the new master key value is promoted to the current master key registers, and the new master key registers are cleared.

For detailed instructions on how to rotate the master key, see [Rotating master keys by using recovery crypto units](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rotate-master-key-cli-recovery-crypto-unit).

If an error occurs during master key rotation, the action you take to recover depends on how much of the process has completed. An incorrect recovery action can cause the master key value for key storage to be lost and contents of key storage to become unusable. You need to carefully check the command output before the error occurred to determine what recovery action to take.

Some errors are detected before the command starts to work with key storage or the master key registers. For example, if your authentication token has expired, an error is reported. To recover, you need to log in to the IBM Cloud. Similarly, if the initial conditions needed to run the command are not met, an error is reported. Correct the initial conditions and run the command again.

The following initial conditions can be reported as an error by the ibmcloud tke auto-mk-rotate command:



* When you rotate your master key by using key part files, an invalid set of crypto units is selected.
* One or more crypto units are in imprint mode.
* Signature thresholds on the crypto units are not set the same.
* A common set of administrators is not selected and installed in all crypto units large enough to meet the signature threshold value.
* The current master key registers are not all in the Valid state with the same verification pattern.
* If you use the IBM Data Server Driver Package, you can download the SSL certificate from the Db2 on Cloud web console.



* Confirm that ports are available

If your network is behind a firewall, confirm that communications are permitted on the port that is needed to connect to the Db2 on Cloud service. For Enterprise and Standard plans, the port number can be found in the connection information from the Service credentials table of the Db2 on Cloud service instance or from the Db2 on Cloud web console. For legacy plans, the connections will occur on port number 50000 for standard protocols or port number 50001 for SSL connections.





 Collecting connection information 



* [Database details and connection credentials](https://cloud.ibm.com/docs/Db2onCloud/connecting?topic=Db2onCloud-db_details_cxn_creds)







 Downloading and installing driver package 



* [Download driver package](https://cloud.ibm.com/docs/Db2onCloud/connecting?topic=Db2onCloud-drvr_pkg)
* [Installing on Linux or PowerLinux](https://cloud.ibm.com/docs/Db2onCloud/connecting?topic=Db2onCloud-drvr_pkgdrvr_install_linux)
* [Installing on Mac OS X](https://cloud.ibm.com/docs/Db2onCloud/connecting?topic=Db2onCloud-drvr_pkgdrvr_install_mac)
* [Installing on Windows](https://cloud.ibm.com/docs/Db2onCloud/connecting?topic=Db2onCloud-drvr_pkgdrvr_install_windows)







 Configuring your environment 



* [Configuring your environment](https://cloud.ibm.com/docs/Db2onCloud/connecting?topic=Db2onCloud-drvr_pkgdrvr_cfg_loc_env)
Select EP11 Smart Card > Personalize EP11 smart card from the menu bar.
4. Enter a six-digit PIN twice on the smart card reader PIN pad. You need to enter this PIN later when you use the EP11 smart card.
5. Enter a description for the EP11 smart card.
6. If you have more than one EP11 smart card, repeat step 1 to step 5 to initialize other EP11 smart cards.



Your EP11 smart cards are created and personalized.







 What's next 



* After you set up the Management Utilities, you can start to load the master key with the TKE application. For detailed instructions, see [Initializing service instances using smart cards and the Management Utilities](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm-management-utilities).
* If you need to uninstall the Management Utilities, you need to follow the instructions to [zeroize your crypto units first](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-instancezeroize-crypto-unit-step) and then [uninstall the Management Utilities](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-instanceuninstall-management-utilities).
See the following for a summary of the features associated with each edition: [IBM Spectrum Symphony editions](https://www.ibm.com/docs/en/spectrum-symphony/7.3.1?topic=foundations-spectrum-symphony-editions).

If the cluster uses Spectrum Scale storage, the storage nodes include IBM Spectrum Scale 5.1.3.1 software. For more information, see the [IBM Spectrum Scale](https://www.ibm.com/docs/en/spectrum-scale/5.1.3) product documentation.
* What locations are available for deploying VPC resources?

Available regions and zones for deploying VPC resources, and a mapping of those to city locations and data centers can be found in [Locations for resource deployment](https://cloud.ibm.com/docs/overview?topic=overview-locations).
* What permissions do I need in order to create a cluster using the offering?

Instructions for setting the appropriate permissions for IBM Cloud services that are used by the offering to create a cluster can be found in [Granting user permissions for VPC resources, Managing user access for Schematics, Assigning access to Secrets Manager](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-user-permissions-for-vpc-resources&locale=en).
* How do I SSH among nodes?

All of the nodes in the HPC cluster have the same public key that you register at your cluster creation. You can use ssh-agent forwarding, which is a common technique to access remote nodes that have the same public key. It automates to securely forward private keys to remote nodes. Forwarded keys are deleted immediately after a session is closed.

To securely forward private keys to remote nodes, you need to do ssh-add and ssh -A.

[your local PC]$ ssh-add {id_rsa for symphony cluster}
[your local PC] ssh -A -J root@jumpbox_fip root@management_private_ip
...
[root@management] ssh -A worker_private_ip
If you need to use a 32-bit version of the CLI, or a previous version other than the latest for IBM Cloud dedicated environments, see [IBM Cloud CLI releases](https://github.com/IBM-Cloud/ibm-cloud-cli-release/releases/).





 Step 1: Run the installation command 

The latest version of the IBM Cloud CLI is installed when you run the command. As the CLI installs, keep an eye on the command line to authenticate as needed.



* For MacOS, run the following command:

curl -fsSL https://clis.cloud.ibm.com/install/osx | sh
* For Linux™, run the following command:

curl -fsSL https://clis.cloud.ibm.com/install/linux | sh
* For Windows™, run the following command in PowerShell as an administrator:

iex (New-Object Net.WebClient).DownloadString('https://clis.cloud.ibm.com/install/powershell')

To open PowerShell, right-click the Windows™ PowerShell icon, and select Run as administrator.
* For WSL2 on Windows™, run the following command:

curl -fsSL https://clis.cloud.ibm.com/install/linux | sh



For more information about installing the Mac OS X M1/ARM or Linux 64-bit ARM versions of the CLI, see the IBM Cloud CLI [release notes](https://github.com/IBM-Cloud/ibm-cloud-cli-release/releases/). These versions are provided as-is and are not fully supported.





 Step 2: Verify the installation 

To verify that the CLI was installed successfully, run the help command:

ibmcloud help

The output lists the usage instructions, the current version, and the supported commands.





 Step 3: Install CLI plug-ins and tools 

To manually install the CLI plug-ins and tools, see [Extending IBM Cloud CLI with plug-ins](https://cloud.ibm.com/docs/cli?topic=cli-plug-ins).
Configuring Block Storage for Classic for backup with cPanel 

You can use the following instructions to configure your backups in cPanel to be stored in IBM Cloud® Block Storage for Classic. The assumption is that root or sudo SSH and full WebHost Manager (WHM) access are available. These instructions are based on a CentOS 7 host.

For more information, see the [cPanel documentation for backup](https://docs.cpanel.net/knowledge-base/backup/).



1. Connect to the host through SSH.
2. Ensure that a mount point target exists. By default, the cPanel system saves backup files locally, to the /backup directory. For this document, it is assumed that /backup exists and contains backups, and /backup2 is used as the new mount point.
3. Configure your Block Storage for Classic as described in [Connecting to iSCSI LUNs on Linux®](https://cloud.ibm.com/docs/BlockStorage?topic=BlockStorage-mountingLinuxmountingLinux). Make sure that you mount it to /backup2 and configure it in /etc/fstab to enable mounting on start.
4. Optional: Copy existing backups to the new storage. You can use rsync.

rsync -azv /backup/* /backup2/

This command compresses and transmits your data, while it preserves as much as possible, except for hard links. It provides information about what files are being transferred plus a brief summary at the end.
5. Log in to WHM and go to the backup configuration by clicking Home > Backup > Backup Configuration.
6. Edit the configuration to save the backups in the new mount point.



* Change the default backup directory by entering the absolute path to the new location in place of the /backup directory.
* Select Enable to mount a backup drive. This setting causes the backup configuration process to check the /etc/fstab file for a backup mount (/backup2).
Private worker installation can be completed only by way of the command line since no graphical user interface is available.



 Installing the Delivery Pipeline Private Worker by using the CLI 

The following steps are intended for Administrators who are preparing environments and private workers for multiple people or teams. To install private workers for your own use, see [Setting up a Delivery Pipeline Private Worker](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-private-workersset_up_private_worker).

You can install the private worker framework directly on either an IBM Cloud Kubernetes cluster or a Red Hat® OpenShift® on IBM Cloud® cluster, or you can install the framework by using the [Operator Lifecycle Manager (OLM)](https://docs.openshift.com/container-platform/4.9/operators/understanding/olm/olm-understanding-olm.html).



 Installing directly on a cluster 

To install the framework directly on a cluster, you must have admin access to the cluster. From the IBM Cloud CLI, type the following command:

kubectl apply --filename "https://private-worker-service.{REGION}.devops.cloud.ibm.com/install"

Where {REGION} is the location of the toolchain's pipeline. You can specify any of the following values for the {REGION}:



* au-syd (Sydney, Australia)
* eu-de (Frankfurt, Germany)
* eu-gb (London, United Kingdom)
* jp-tok (Tokyo, Japan)
* jp-osa (Osaka, Japan)
* us-south (Dallas, US)
* us-east (Washington DC, US)
* ca-tor (Toronto, CA)
* br-sao (Sao Paulo, Brazil)







 Installing by using the OLM 

The OLM handles the installation and sets the framework for automatic updates. This method ensures that your private worker is always up to date with the latest release. You can use the OLM on both Red Hat® OpenShift® on IBM Cloud® and IBM Cloud Kubernetes clusters.
Installing the backup client in Windows 

Installing the IBM Cloud® Backup for Classic client is completed through a series of interactions on the server that is designated for the IBM Cloud Backup for Classic service.



 Logging in to the target device server 



1. Log in to the [IBM Cloud console](https://cloud.ibm.com/login). From the menu ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/921d024aca5ff45536208840a52f864567eb4068/icons/icon_hamburger.svg), select Classic Infrastructure![Classic icon](https://cloud.ibm.com/docs-content/v1/content/921d024aca5ff45536208840a52f864567eb4068/icons/classic.svg).
2. Select Devices > Device List from the main menu to see the list of available servers.
3. Find the device for which you purchased the IBM Cloud Backup for Classic service, and make note of its public IP address.
4. Click Passwords to display the Password manager, and see the usernames and the passwords that are associated with the account.
5. Log in to the target device by using Remote Desktop Connection.







 Downloading the backup client 



1. On the target server, open a browser session and enter the following URL to download the executable file for the IBM Cloud Backup for Classic client.

http://downloads.service.softlayer.com/evault/

The version number is in the file name. Choose the most recent. IBM Cloud® offers separate 32-bit and 64-bit installers. If you have a 64-bit Operating System, download the file with x64 in its name. (For example, Agent-Windows-x64-8-32-7901.exe.)
2. Double-click the downloaded file.
3. Click Run.







 Installing and Registering the Backup Agent 



1. Enter the Network address:
To access the logs of your cluster components, set up [IBM Log Analysis](https://cloud.ibm.com/docs/openshift?topic=openshift-healthopenshift_logging). IBM Log Analysis provides access to all your logs and you can aggregate logs and build your own customized views across multiple clusters.

How can I monitor the health and performance of my cluster?
: You can verify the health, capacity, and performance of your apps, services, and worker nodes by monitoring your cluster components and compute resources from the Red Hat OpenShift on IBM Cloud console or CLI, such as the CPU and memory usage. To view more in-depth metrics for your cluster, you can use the built-in monitoring capabilities that are based on open source technologies, such as [Prometheus and Grafana](http://docs.openshift.com/container-platform/4.11/monitoring/monitoring-overview.html). Prometheus is automatically installed when you create the cluster and you can use the tool to access real-time cluster and app metrics. Prometheus metrics are not stored persistently. To access historic metrics and to compare metrics across multiple clusters, use [IBM Cloud Monitoring](https://cloud.ibm.com/docs/openshift?topic=openshift-health-monitor) instead.

To set up a host-based intrusion detection system (HIDS) and security event log monitoring (SELM), install third-party tools that are designed to monitor your cluster and containerized apps to detect intrusion or misuse, such as [Twistlock](https://www.paloaltonetworks.com/prisma/cloud) or the [Sysdig Falco project](https://sysdig.com/opensource/falco/).

How can I audit events that happen in my cluster?
: You can [set up IBM Cloud® Activity Tracker in your Red Hat OpenShift on IBM Cloud cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-at_eventsat_events).
Open a [support ticket](https://cloud.ibm.com/unifiedsupport/cases/add) with details if you have time periods longer than a minute with no connectivity so we can investigate.

If you have deployments in more than one region, you must provision IBM Cloud® Monitoring and enable platform metrics in each region. For more information, see IBM Cloud Monitoringyour Cloud Databases deployment's IBM Cloud Monitoring page





 SLAs 

See [How do I ensure zero downtime?](https://cloud.ibm.com/docs/overview?topic=overview-zero-downtimezero-downtime) to learn more about the high availability and disaster recovery standards in IBM Cloud.

All IBM Cloud® Databases general availability (GA) offerings conform to the IBM Cloud® [Service Level Agreement](https://cloud.ibm.com/docs/overview?topic=overview-slas) (SLA) terms.

For more information, see the [Responsibilities for Cloud Databases](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-responsibilities-cloud-databases) page.
To verify that the ibm-cloud-provider-ip and istio-ingressgateway pods don't exist in the same zone:



1. Identify the NODE that your istio-ingressgateway pod is deployed to.

kubectl get pod -n istio-system -o wide
2. Get the EXTERNAL-IP address for the gateway's load balancer service.

kubectl get service -n istio-system
3. Identify the NODE that the ibm-cloud-provider-ip pod for the load balancer is deployed to. Replace <IP-with-hyphens> with the IP address that you found in the previous step. In the IP address, use hyphens (-) instead of periods (.). For example, 169.12.345.67 becomes 169-12-345-67.

kubectl get pod -n ibm-system -o wide -l ibm-cloud-provider-ip=<IP-with-hyphens>
4. List the zones that the worker nodes are in. Compare the worker nodes that you found in step 1 and 3 to determine whether the pods are deployed to worker nodes in different zones.

kubectl get node --no-headers -L ibm-cloud.kubernetes.io/zone

Example output

10.176.48.106 Ready <none> 529d v1.26+IKS dal10
10.176.48.107 Ready <none> 196d v1.26+IKS dal10
10.184.58.23 Ready <none> 2y38d v1.26+IKS dal12
10.184.58.42 Ready <none> 529d v1.26+IKS dal12



 How to fix it 

To resolve this issue, you can either move the istio-ingressgateway pod to the zone that the ibm-cloud-provider-ip pod exists in, or vice versa.
ibm_scope The account, organization, or space GUID associated with the metric. 
 ibm_ctype public, dedicated, or local. 
 ibm_location Location of the Key Protect service instance. 
 ibm_service_name kms. 
 ibm_resource Key Protect service instance ID. 
 ibm_kms_api Key Protect service API name. 
 ibm_resource_group_name Resource group name associated with the Key Protect service instance. 
 ibm_service_instance_name Key Protect service instance name. 
 ibm_service_instance Key Protect service instance ID. 







 Metrics Filter Attributes 

You can scope down your metrics by using the following scope filters. These filters are more granular than the segmentation filters.



Table 4. Describes the scope filters for Key Protect metrics.

 Attribute Name Description 

 ibmResourceGroupName The name of the resource group associated with the Key Protect service instance. 
 ibmScope The account, organization, or space GUID associated with the metric. 
 ibmServiceInstanceName The service instance associated with the metric. 
 ibmKmsApi The Key Protect API call associated with the metric. 



Due to Monitoring limitations, you will only be able to see the values in the dropdown filters for up to 6 hours at a time. You can manually type in value into scope variables to use scope filters for given time periods.





 Default Dashboards 

You will need to configure platform metrics and enable a [metrics policy](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-monitor-metrics) on your KP service instance in order to view your Key Protect operational metrics dashboard.



 How to find the Monitoring dashboard for your Key Protect service instance using Key Protect console 

After configuring your Monitoring instance to receive platform metrics, follow the below steps:



1. Go to the [Provision service instance](https://cloud.ibm.com/docs/key-protect?topic=key-protect-provisionprovision-gui) and create your Key Protect service instance.
2. Click on the Actions dropdown.
3. Select Monitoring. This will take you to the Key Protect dashboard.



Zoom
* In the Metrics field, enter ibm_is to display the ten IBM Cloud VPN for VPC metrics: ibm_is_vpn_gateway_status, ibm_is_vpn_connection_status, ibm_is_vpn_gateway_bytes_in, ibm_is_vpn_gateway_bytes_out, ibm_is_vpn_gateway_packets_in, ibm_is_vpn_gateway_packets_out, ibm_is_vpn_connection_bytes_in, ibm_is_vpn_connection_bytes_out, ibm_is_vpn_connection_packets_in, and ibm_is_vpn_connection_packets_out.
* You can choose a scope to display in your dashboard by clicking Override Dashboard Scope. For example, you can display the metrics for a particular VPN gateway.
* You can also set a segment to compare metrics across the scope that you define. For example, you can look at the connection status for a particular VPN gateway that is segmented by gateway name and connection name.



6. Click Save.

By default, the dashboard is named "blank dashboard". You can change the name by selecting Dashboards from the sidebar and clicking the Pencil icon next to the name.



To return to the default IBM Cloud Monitoring dashboard at any time, select Dashboards > Default Dashboards > IBM > VPC VPN.





 Working with IBM Cloud Monitoring by using APIs 

You can also work with the IBM Cloud Monitoring instance by using metric query APIs. You might want to use APIs if you need raw data points or want to consume your metrics from a command-line interface rather than using the IBM Cloud Monitoring dashboard.

After you create your IBM Cloud Monitoring instance, you must collect the following two pieces of information.



* The Monitor API token
* The endpoint of your IBM Cloud Monitoring instance



To collect this information and work with your IBM Cloud Monitoring instance by using metric query API, follow these steps:



1. Access the [Monitoring home page](https://cloud.ibm.com/observe/monitoring).
2. Click Open Dashboard next to the instance that you want to work with.
3.