vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Because redundancy is the key to ensuring that when a node goes down another node is able to continue to process requests, you have the option to configure replica sets for CA nodes. For a complete understanding of what replica sets are and how they can be configured for a CA, see this topic on [Building a high availability Certificate Authority (CA)](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-build-ha-ca).





 Deployment zone selection 

If your Kubernetes cluster is configured across multiple zones, when you deploy a CA you have the option of selecting which zone the CA is deployed to. Check the Advanced deployment option that is labeled Deployment zone selection to see the list of zones that is currently configured for your Kubernetes cluster.





 Sizing a CA during creation 

Unlike peers and ordering nodes, which are actively involved in the transaction process, CAs are involved only in the registration and enrollment of identities, and in the creation of an MSP. This means that they require less CPU and memory. To stress a CA, a user would need to overwhelm it with requests (likely using APIs and a script), or have issued so many certificates that the CA runs out of storage. Under typical operations, neither of these things should happen, though as always, these values should reflect the needs of a particular use case.

The CA has only one associated container that we can adjust:



* CA container: Encapsulates the internal CA processes, such as registering and enrolling nodes and users, as well as storing a copy of every certificate it issues.



As we noted in our section on [Considerations before you deploy a node](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-adv-deploymentibp-console-adv-deployment-before), it is recommended to use the defaults for the CA container and adjust them later when it becomes apparent how they are being utilized by your use case.



 Resources Condition to increase 

 CA container CPU and memory When you expect that your CA will be bombarded with registrations and enrollments. 
 CA storage When you plan to use this CA to register a large number of users and applications.
This is equivalent to setting two page rules: "Edge Cache TTL" and "Cache Level" (to "Cache Everything"; for example,300).
* resolveOverride: Redirects the request to an alternate origin server. You can use this to implement load balancing across several origins (for example,us-east.example.com). For security reasons, the hostname set in resolveOverride must be proxied on the same CIS zone of the incoming request. Otherwise, the setting is ignored. CNAME hosts are allowed, so to resolve to a host under a different domain or a DNS only domain first declare a CNAME record within your own zone’s DNS mapping to the external hostname, set proxy on CIS, then set resolveOverride to point to that CNAME record.



Enterprise only:



* cacheKey: A request's cache key is what determines if two requests are "the same" for caching purposes. If a request has the same cache key as some previous request, then we can serve the same cached response for both (for example, 'some-key').
* cacheTtlByStatus: This option is a version of the cacheTtl feature which chooses a TTL based on the response's status code. If the response to this request has a status code that matches, CIS caches for the instructed time, and overrides cache instructions sent by the origin (for example, { "200-299": 86400, 404: 1, "500-599": 0 }). CIS still adheres to standard cache levels, so by default this overrides cache behavior for static files. If you wish to cache non-static assets, you must set a Cache Level of Cache Everything using a Page Rule.



An Edge functions script runs after CIS security features, but before everything else. Therefore, an Edge functions script cannot affect the operation of security features (since they are already finished), but it can affect other features, like Image Size Optimization, or how the response is cached at the edge.

Updating the cf object is similar to modifying a request.
If a global load balancer is created with the name glbcust.ibmmo.com using the origin pool, then a client on the internet can execute the command:

$ ping glbcust.ibmmo.com
PING glbcust.ibmmo.com (169.61.244.18): 56 data bytes

In this example, CIS:



* Created a DNS record named glbcust.ibmmo.com.
* Used the global load balancer to resolve the DNS name to one of the IP addresses identified in the origin pool.



Notice that the global load balancer does not terminate the TCP connection.

Setting a DNS element or global load balancer to proxy changes the behavior. If, for example, you turn on proxy and Security > TLS > Mode to something besides Off, the CIS now terminates the TCP connection and establishes a second connection between CIS and the originator.

In this example, CIS:



* Created a DNS record named: glbcust.ibmmo.com.
* Used the global load balancer to resolve the DNS name to a CIS provided IP address.



Now, connections to glbcust.ibmmo.com are terminated by CIS, and HTTPS certificates are hosted by CIS (which is required for TCP termination).

After the client connects to the application the picture looks like this:

[client]<--tls-->[cis]<-->[origin server]
Accessing metadata from an instance 

Most often, you want to access metadata from a running instance and use it to bootstrap an instance. This topic describes the general procedure for enabling the metadata service, creating an instance identity access token, and accessing the metadata.



 Before you begin 



1. Install the IBM Cloud CLI and the VPC CLI plug-in. For more information, see the [CLI prerequisites](https://cloud.ibm.com/docs/vpc?topic=vpc-set-up-environmentcli-prerequisites-setup).
2. After the installation of the VPC CLI plug-in, set the target to generation 2 by running the ibmcloud is target --gen 2 command.
3. Make sure that you [created an IBM Cloud VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-clicreate-a-vpc-cli).
4. Configure a floating IP so that you can SSH into the virtual servers over the floating IP address.







 General procedure to access instance metadata 

Table 1 describes the steps that are involved in accessing instance metadata. The information provides the context for each step and links to specific information for completing the step. In an actual environment, steps 3 - 5 would more likely be started by your instance's initialization software at startup or by using cloud-init.



Table 1. General procedure for accessing instance metadata

 Step Context Service Called User Action 

 1 IBM Cloud VPC UI, CLI, API Create a virtual server instance and enable the metadata service on it. (The service is disabled by default.) You can also enable the service on an existing instance, in the [UI](https://cloud.ibm.com/docs/vpc?topic=vpc-imd-configure-service&interface=uiimd-enable-on-instance-ui) or with the API.
Set the Monitor type to HTTPS and the Port to 443.
5. Accept the defaults for the rest of the options. Note that if you are using an app other than codeengine/helloworld app, adjust any options that your app requires.
6. Click Create.



For more information, see [Setting up health checks](https://cloud.ibm.com/docs/cis?topic=cis-glb-features-healthchecks).





 Step 7: Configure the Cloud Internet Services (CIS) load-balancer 

After your custom domain mappings are in a Ready state, configure the Cloud Internet Services (CIS) load-balancer for your application global endpoint. For more information, see [Configuring a global load balancer](https://cloud.ibm.com/docs/cis?topic=cis-configure-glb).



1. Go to the Reliability page in the Cloud Internet Services (CIS) console.
2. Select Origin pools and click Create.



1. Name your pool global-app-au-syd.
2. Set the Origin address to the CNAME target of your domain name mapping.
3. Set the Host header to your domain name.
4. From the Health check, select Existing health check and then select global-app.
5. Click Save.
6. Repeat these steps for each region that contains your deployed app. Change the name to reflect the region that you are targeting. For example, global-app-de-eu and global-app-br-sao.



3. Select Load balancers and click Create.



1. Name your load balancer. Note that this name appears in your custom domain URL. For example, if your custom domain is global-app.example.com and you name your load balancer global-app, your URL is global-app.example.com.
2. Set Traffic steering to Geo.
3. Add your Geo routes. You can choose to create a route for all CIS regions or only some regions.
Using resolve override with Cloud Object Storage 

The following use case makes the request matching the page rule resolve to a COS bucket resource.



 Prerequisites 

The following steps assume you have an existing COS instance and bucket with public access. For information on public access see [Allowing public access](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-iam-public-access).





 Proxy DNS entries are required for domains that are to be matched by the page rule 

To perform the actual rewrite and redirection to the COS bucket, the domains that you want to use with this page rule (such as www.foo.com) must have DNS entries in CIS with the proxy flag set. See [Proxying DNS Records](https://cloud.ibm.com/docs/cis?topic=cis-dns-conceptsdns-concepts-proxying-dns-records) for more information. If all requests to www.foo.com are redirected, then a CNAME entry that points to <bucket-name> with proxy enabled is sufficient.





 Create page rule steps 



1. Navigate to Performance > Page Rules.
2. Click Create rule.
3. Input the value you want for the URL match. For example, .foo.com/.



* The URL match must be the same as your COS object name. For example, if you have an object called reports.txt under the bucket my-bucket1, then both of these URL matches would be valid:



* .foo.com/
* .foo.com/reports.txt





4. Use the list menu to select Resolve Override with COS under the Performance section.
5. Use the Cloud Object Storage Instance list to select the instance you want.
6. Use the Bucket list to select the bucket you want.
7. Click Create to complete the rule.







 Editing a page rule 

After editing the page rule, the Resolve Override with COS is no longer displayed on the page.
Once resizing an instance is complete, you are billed the hourly rate of the new instance profile selected.

For the steps to resize a virtual server instance using the CLI, see [Resizing a virtual server instance using the CLI](https://cloud.ibm.com/docs/vpc?topic=vpc-resizing-an-instanceresizing-a-virtual-server-CLI).





 Resize a virtual server instance using the API 

You can increase or decrease the amount of vCPU and RAM available for greater flexibility in workload management to address resource requirement changes, optimize cost or workload performance. Once resizing an instance is complete, you are billed the hourly rate of the new instance profile selected.

For the steps to resize a virtual server instance using the CLI, see [Resizing a virtual server instance using the API](https://cloud.ibm.com/docs/vpc?topic=vpc-resizing-an-instanceresizing-a-virtual-server-API).





 Delete a virtual server instance using the UI 

From the Virtual server instances page in IBM Cloud console, click Delete.

If the instance has a floating IP address, it must be unassociated or released before the instance is deleted. The account associated with the floating IP will continue to be charged if it is not released.

The delete action permanently removes an instance and its connected vNIC, and data from your account. The instance boot volume is also deleted if the volume auto-delete setting is configured to be deleted when the attached instance is deleted. If an existing boot volume is attached as part of provisioning a virtual server instance, the volume is preserved by default when the instance is deleted. If a boot volume created as part of provisioning a virtual server instance, the volume will be deleted by default when the instance is deleted. After you confirm the delete action, the process to delete the instance and its associated vNIC, boot volume, and data begins. The delete action can take up to 30 minutes, but when the process is complete, the instance no longer appears on the virtual server instances page.





 Delete a virtual server instance using the CLI
secret_access_key: 8not8ed850cddbece407exampledonotuse43r2d2586



 Setting HMAC credentials as environment variables 

Once you have created your credentials, you can set them as environment variables (the instructions for which are specific to the operating system involved). For instance, in Example 3, a .bash_profile script contains COS_HMAC_ACCESS_KEY_ID and COS_HMAC_SECRET_ACCESS_KEY that is exported upon starting a shell and used in development.

export COS_HMAC_ACCESS_KEY_ID="7exampledonotusea6440da12685eee02"
export COS_HMAC_SECRET_ACCESS_KEY="8not8ed850cddbece407exampledonotuse43r2d2586"







 Next steps 

Note that when using HMAC credentials to create signatures to use with direct [REST API](https://cloud.ibm.com/docs/services/cloud-object-storage/api-reference?topic=cloud-object-storage-compatibility-api) calls that extra headers are required:



1. All requests must have an x-amz-date header with the date in %Y%m%dT%H%M%SZ format.
2. Any request that has a payload (object uploads, deleting several objects, etc.) must provide a x-amz-content-sha256 header with an SHA256 hash of the payload contents.
3. ACLs (other than public-read) are unsupported.



Not all S3-compatible tools are currently supported. Some tools attempt to set ACLs other than public-read on bucket creation. Bucket creation through these tools will fail. If a PUT bucket request fails with an unsupported ACL error, first use the console as shown in the [getting started with IBM Cloud Object Storage](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-getting-started-cloud-object-storage) to create the bucket, then configure the tool to read and write objects to that bucket.
* You can resend the file from the Troubleshooting section, or return to the previous step if the bucket path is incorrect
* Click "Next"



4. Select the log fields that you want included in the log push.



* Verify that the logpush details are correct
* Select the logpush settings from the Timestamp and Frequency list menus
* Choose whether to enable the logpush job using the Enabled switch
* Select the log fields to include in the logpush job
* Click Create service.











 Setting up Logpush using the CLI 

Prerequisite: Before you create a Logpush job, you must have an IBM Cloud Object Storage instance with a bucket that has Object Writer access granted to IBM Cloud® account cislogp@us.ibm.com. This enables CIS to write request logs into the Object Storage bucket.



 Creating Logpush with Log Analysis CLI 

To create a Logpush job for a specific domain and enable the job using Log Analysis, run the following command:

ibmcloud cis logpush-job-create DNS_DOMAIN_ID --destination https://logs.us-south.logging.cloud.ibm.com/logs/ingest?hostname=example.com&apikey=xxxxxxx --name JOB_NAME --fields all --enable true

Where:



* --destination specifies the path to the Log Analysis instance. The hostname is the domain name in CIS for which you are sending log data. You can find it by running imbcloud cis domains -i <instance-name>. The URL must match the region of your Log Analysis instance (for example, https://logs.{LOGDNA_REGION}.logging.cloud.ibm.com/logs/ingest?hostname={DOMAIN_NAME}&apikey={LOGDNA_INGESTION_KEY}). For more information, see [Log Analysis regions](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-regions).
* --name specifies the Logpush job name.
* --fields specifies the list of log fields to be included in log files.
[menu icon](https://cloud.ibm.com/docs-content/v1/content/c5288bed34c3820e3a5251d820ee91adcd2591a3/icons/icon_hamburger.svg) and open the Resource List.
2. Scroll to the Services twistie and expand it to view your service instance.
3. If your instance is listed, click the action menu for the service instance, then Delete, to delete this service instance.
4. Scroll to the Kubernetes Clusters twistie and expand it to view your free cluster.
5. If your free cluster is listed, click the action menu for the cluster and then click Delete to delete the free cluster.



When these actions are complete, you can follow the [original steps](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-v2-deploy-iksibp-v2-deploy-iks) to create a new Kubernetes cluster and blockchain service instance from the IBM Cloud catalog page.

Note that if you delete your Kubernetes cluster, you will still be charged for your IBM Blockchain Platform service instance until you delete that as well.
Setting up health checks 

A health check helps gain insight into the availability of pools so that traffic can be routed to the healthy ones.

These checks periodically send HTTP, HTTPS, or TCP requests and monitor the responses. They can be configured with a customized port, interval, timeout, status code, and more. As soon as a pool is marked unhealthy, traffic is intelligently rerouted to another available pool.

Be aware that your logs have references to Cloudflare because IBM is partnering with Cloudflare to provide CIS.

CIS health checks track the health of pools. They are configured through monitors, which define what type of health check to run and how frequently to run them. CIS monitors your servers from each of the IBM data centers.

Health checks that result in a status change for an origin server are recorded as events in the load balancer event logs. You can create, attach, and configure health checks from either the global load balancer dashboard or the CIS API.



 Health check considerations 



* Availability monitoring checks the health of origin servers every 15 seconds. It reports results via email notifications and the CIS API.
* The default retry rate is 5 retries per second, and is completely configurable. It is not recommend to increase the retry rate significantly. Retries use exponential backoff (1, 2, 4, 8, and 16 seconds, by default).
* You can configure monitoring for specific URLs by sending periodic HTTP requests to the load balancer, taking advantage of customizable intervals, timeouts, and status codes. After an origin server is marked unhealthy, multi-region failover reroutes traffic to the next available server in failover order.
* Load balancer monitors use the following HTTP user-agent: "Mozilla/5.0 (compatible; Cloudflare-Traffic-Manager/1.0; +https://www.cloudflare.com/traffic-manager/; pool-id: $poolid)". The $poolid contains the first 16 characters of the load balancer pool that is the target of the health check.
Identify the team and select it. The details of the team are displayed.
5. Change configuration details in the Visibility section.
6. Click Save.







 Deleting a team 

You must have manager role to delete a team in a monitoring instance.

Complete the following steps to delete a team:

The default team, Monitor Operations, cannot be deleted.



1. Launch the web UI. For more information on how to launch the Web UI, see [Navigating to the Web UI](https://cloud.ibm.com/docs/monitoring?topic=monitoring-launchlaunch).
2. Click the user icon. This is the icon with the initials of the logged on user. Then click Settings.
3. Select Teams. The list of existing teams is displayed.
4. Identify the team that you want to delete and select it. The details of the team are displayed.
5. Click Delete team.



When you delete a team, users that only belong to this team will be moved to the default team.
The service automatically deletes original documents and any associated translated documents after they have not been used for a certain period of time. For more information, see [Information security](https://cloud.ibm.com/docs/language-translator?topic=language-translator-information-security).

To delete documents manually, use the Delete document method. In this tutorial, the English file curriculum.html was involved with two translations, so two requests are required to delete all copies of the original document.

Delete the original submission of curriculum.html and the French translation by using the document ID for that translation, bae02796-0d28-435c-9115-888359fdde621:

curl -X DELETE --user "apikey:{apikey}" "{url}/v3/documents/bae02796-0d28-435c-9115-888359fdde62?version=2018-05-01"

Delete the duplicate of the original curriculum.html file and the Portuguese translation by the using the document ID for that translation, a0ge2746-ad38-7d5c-7025-4cd3g9f451ab:

curl -X DELETE --user "apikey:{apikey}" "{url}/v3/documents/a0ge2746-ad38-7d5c-7025-4cd3g9f451ab?version=2018-05-01"





 Supported file formats 

The service supports translation of Microsoft Office, Open Office, subtitle, and many other common formats. To translate a file, you must identify the format of the file in one of the following ways:



* By specifying the appropriate file extension for the format. For example, to translate an HTML file named example.html from English to French, you would use the following command:

curl -X POST --user "apikey:{apikey}" --form "file=@example.html" --form "source=en" --form "target=fr" "{url}/v3/documents?version=2018-05-01"
Enabling Proxy protocol 

IBM Cloud Internet Services intercepts packets before forwarding them to your server, so that if you look up a client IP, you see CIS's IP rather than the true client IP. However, some services you run might require you to know the true client IP. In those cases, you can use a proxy protocol for CIS to pass the client IP to your service.

Sending proxy information along is dependent on whether TCP or UDP is used. For TCP, Range supports adding Proxy Protocol v1, which is the human readable-version supported by Amazon ELB and NGINX. For UDP applications, CIS has developed a custom proxy protocol called Simple Proxy Protocol.

This feature requires an Enterprise plan. If you would like to upgrade, contact your account team.



  Enable proxy protocol v1 for TCP 



1.  Log in to the CIS dashboard
2.  Click Range.
3.  Locate the application that will use the PROXY protocol and click Configure.
4.  From the menu, select PROXY Protocol v1.



When TCP applications are configured to use proxy protocol v1, CIS prepends each inbound TCP connection with the proxy protocol plain-text header.





  Enabling Proxy Protocol v2 for TCP/UDP 



1.  Log in to the CIS dashboard.
2.  Click Range.
3.  Locate the application that will use the proxy protocol and click Configure.
4.  From the menu, select PROXY Protocol v2.



When TCP applications are configured to use proxy protocol v2, CIS prepends each inbound TCP connection with the proxy protocol binary header.

When UDP applications are configured to use PROXY Protocol v2, CIS prepends the first UDP datagram on a stream with a proxy protocol binary header.





  Enable Simple Proxy Protocol for UDP 

When using UDP, the client source IP and port information can be obtained by using Simple Proxy Protocol, a lightweight protocol developed specifically for UDP.

To enable it, click Configure on a Range application and toggle the setting for Simple Proxy Protocol to On.

Simple Proxy Protocol dictates that your origin must also prepend packets meant for the client with the same header, including original client source information. This is done to validate that packets coming in are in fact intended for the client.