vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Check out [Responsibilities](https://cloud.ibm.com/docs/key-protect?topic=key-protect-satellite-aboutsatellite-about-before-begin-responsibilities) for more information about the responsibilities taken on by IBM and those you must cover.
* End-to-end key lifecycle [service integrations](https://cloud.ibm.com/docs/key-protect?topic=key-protect-integrate-cos) and [sync of associated resources](https://cloud.ibm.com/docs/key-protect?topic=key-protect-sync-associated-resources) is not currently supported in Key Protect on Satellite.
* While you can [assign fine-grained access to a single key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grant-access-keysgrant-access-key-level), note that calling the [list keys API](https://cloud.ibm.com/apidocs/key-protectgetkeys) will not return keys that you have been assigned individual access to (that only you can access, in other words). Calling this API will however return the keys in key rings you have access to (if you have access to all of the keys in an instance, you will see all keys). You can, however, see the keys that only you have access to by following the instructions in [Granting access to keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grant-access-keys) to view the key through IAM or by using the API to pass the specific key ID.







 Responsibilities 

The division of responsibilities between the end-user and IBM for the Key Protect on Satellite service are derived from the responsibilities inherent in Satellite itself, which can be found in [Your responsibilities](https://cloud.ibm.com/docs/satellite?topic=satellite-responsibilities). Study this document carefully, as it outlines a number of important considerations and preparations a user must keep in mind when operating any service on Satellite.

In addition to understanding the responsibilities when using Satellite, there are a number of specific considerations to keep in mind when operating Key Protect on Satellite.
Get metadata that describes a specific rule.

ibmcloud fn rule get RULE_NAME [--summary]



 Command options 

RULE_NAME
: The name of a rule. This value is required.

--summary
: Get a summary of the rule details.





 Example 

ibmcloud fn rule get myrule







 ibmcloud fn rule list 

List all the rules that you created or a specific number of rules.

ibmcloud fn rule list RULE_NAME [--limit NUMBER_OF_RULES] [--name-sort] [--skip NUMBER_OF_RULES]



 Command options 

RULE_NAME
: The name of a rule. This value is optional. If not specified, all rules are listed.

--limit NUMBER_OF_RULES, -l NUMBER_OF_RULES
: List a specified number of rules. The default is 30 rules.

--name-sort, -n
: Sort the list of returned rules by name, otherwise the list is sorted by creation date.

--skip NUMBER_OF_RULES, -s NUMBER_OF_RULES
: Exclude a specified number of the most recently created rules from the result.





 Example 

ibmcloud fn rule list







 ibmcloud fn rule status 

See whether a rule is active or inactive. Run the ibmcloud fn rule disable or ibmcloud fn run enable commands to change the status.

ibmcloud fn rule status RULE_NAME



 Example 

ibmcloud fn rule status myrule







 ibmcloud fn rule update 

To change which triggers are associated with which rules, you can update a rule.

ibmcloud fn rule update RULE_NAME TRIGGER_NAME ACTION_NAME



 Example 

ibmcloud fn rule update myrule mytrigger myaction









 SDK command 

Install SDK components, such as docker, iOS, and bashauto.

To see CLI help for the sdk command, run ibmcloud fn sdk.



 ibmcloud fn sdk install 

Install an SDK.
Ensure that your computing environment can allow this process to run.

You will need instances of the S3 Client and IAM Token Manager classes to initialize the AsperaTransferManager. The s3Client is required to get FASP connection information for the COS target bucket. The tokenManager is required to allow the Aspera high-speed transfer SDK to authenticate with the COS target bucket.



 Initializing the AsperaTransferManager 

Before initializing the AsperaTransferManager, make sure you've got working [s3Client](https://cloud.ibm.com/docs/cloud-object-storage/libraries?topic=cloud-object-storage-javajava-examples-config) and [tokenManager](https://cloud.ibm.com/docs/cloud-object-storage/libraries?topic=cloud-object-storage-javajava-examples-config) objects.

It is advised to use TokenManager tokenManager = new DefaultTokenManager(new DelegateTokenProvider(apiKey)); and avoid .withTokenManager(tokenManager) when building AsperaTransferManager with AsperaTransferManagerBuilder.

There isn't a lot of benefit to using a single session of Aspera high-speed transfer unless you expect to see significant noise or packet loss in the network. So we need to tell the AsperaTransferManager to use multiple sessions using the AsperaConfig class. This will split the transfer into a number of parallel sessions that send chunks of data whose size is defined by the threshold value.

The typical configuration for using multi-session should be:



* 2500 MBps target rate
* 100 MB threshold (this is the recommended value for most applications)



AsperaTransferManagerConfig transferConfig = new AsperaTransferManagerConfig()
.withMultiSession(true);

AsperaConfig asperaConfig = new AsperaConfig()
.withTargetRateMbps(2500L)
Ensure that your computing environment can allow this process to run.

You will need instances of the S3 Client and IAM Token Manager classes to initialize the AsperaTransferManager. The s3Client is required to get FASP connection information for the COS target bucket. The tokenManager is required to allow the Aspera high-speed transfer SDK to authenticate with the COS target bucket.



 Initializing the AsperaTransferManager 

Before initializing the AsperaTransferManager, make sure you've got working [s3Client](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-javajava-examples-config) and [tokenManager](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-javajava-examples-config) objects.

It is advised to use TokenManager tokenManager = new DefaultTokenManager(new DelegateTokenProvider(apiKey)); and avoid .withTokenManager(tokenManager) when building AsperaTransferManager with AsperaTransferManagerBuilder.

There isn't a lot of benefit to using a single session of Aspera high-speed transfer unless you expect to see significant noise or packet loss in the network. So we need to tell the AsperaTransferManager to use multiple sessions using the AsperaConfig class. This will split the transfer into a number of parallel sessions that send chunks of data whose size is defined by the threshold value.

The typical configuration for using multi-session should be:



* 2500 MBps target rate
* 100 MB threshold (this is the recommended value for most applications)



AsperaTransferManagerConfig transferConfig = new AsperaTransferManagerConfig()
.withMultiSession(true);

AsperaConfig asperaConfig = new AsperaConfig()
.withTargetRateMbps(2500L)
.withMultiSessionThresholdMb(100);
* Quantum Safe TLS is only supported through the Key Protect software development kit (SDK). Quantum safe TLS support will be added to the Key Protect command line interface (CLI) in the future. To find out more about accessing the Key Protect SDK, check out [Setting up the SDK](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-up-api).







 Using Quantum Safe TLS with Key Protect 

You can choose between hybrid and non-hybrid quantum safe TLS connection modes when sending requests to Key Protect.



 Quantum Safe Mode vs Hybrid Mode 

Key Protect supports two modes that protect your keys during a TLS connection: Quantum Safe Mode and Hybrid mode.



* Hybrid Mode: Hybrid mode uses a combination of a quantum safe algorithm and classic key exchange algorithms to protect your data while in transit. When you make a request using this mode, the classic elliptic algorithm and the quantum safe algorithm will be used in a key exchange mechanism to cryptographically protect your data as it makes its way to the Key Protect service.

Hybrid mode supports the hybrid Kyber algorithm with the following parameter sets (key sizes):



* p256_kyber512: combines kyber512 with ECDH using p_256 curve. It provides L1 security.
* p384_kyber768: combines kyber768 with ECDH using p_384 curve. It provides L3 security.
* p521_kyber1024: combines kyber1024 with ECDH using p_521 curve. It provides L5 security.





The hybrid algorithm is used based on guidance from the Open Quantum Safe (OQS) project community. For more information about the algorithm and its associated key sizes, see [Prototyping post-quantum and hybrid key exchange](https://csrc.nist.gov/CSRC/media/Events/Second-PQC-Standardization-Conference/documents/accepted-papers/stebila-prototyping-post-quantum.pdf).



* Quantum Safe Mode: Quantum safe mode uses a quantum safe algorithm to protect your data while in transit.
On an object PUT, HEAD, or GET request, the If-None-Match header will check to see if a provided Etag (MD5 hash of the object content) matches the provided Etag value. If this value does not match, the operation will proceed. If the match succeeds, the system will return a 412 Precondition Failed error on a PUT and a 304 Not Modified on GET or HEAD.

> If-None-Match is primarily used in conditional GET requests to enable efficient updates of cached information with a minimum amount of transaction overhead. When a client desires to update one or more stored responses that have entity-tags, the client SHOULD generate an If-None-Match header field containing a list of those entity-tags when making a GET request; this allows recipient servers to send a 304 (Not Modified) response to indicate when one of those stored responses matches the selected representation.





 Using If-Modified-Since 

On an object HEAD or GET request, the If-Modified-Since header will check to see if the object's Last-Modified value (for example Sat, 14 March 2020 19:43:31 GMT) is newer than a provided value. If the object has been modified, the operation will proceed. If the object has not been modified, the system will return a 304 Not Modified.

> If-Modified-Since is typically used for two distinct purposes: 1) to allow efficient updates of a cached representation that does not have an Etag and 2) to limit the scope of a web traversal to resources that have recently changed.





 Using If-Unmodified-Since 

On an object PUT, HEAD, or GET request, the If-Unmodified-Since header will check to see if the object's Last-Modified value (for example Sat, 14 March 2020 19:43:31 GMT) is equal to or earlier than a provided value. If the object has not been modified, the operation will proceed. If the Last-Modified value is more recent, the system will return a 412 Precondition Failed error on a PUT and a 304 Not Modified on GET or HEAD.
L, list Displays a list of the currently associated workers 



Note: If a connection has been specified with the select command and another command is called without providing a worker ID, the command will attempt to run on the connection specified by select.

For more details on configuring the Access Control List, [click here](https://cloud.ibm.com/docs/services/SecureGateway?topic=SecureGateway-acl).

Return to [Getting Started - Adding a Client](https://cloud.ibm.com/docs/services/SecureGateway?topic=SecureGateway-add-client).







 Client UI 

Note: The Client UI is not supported when using Docker on Windows or MacOS.

The client UI provides a local web interface for the user to interact with the Secure Gateway Client rather than the CLI. By default, this UI is available at localhost:9003/dashboard The UI is split into the following pages:



 Connect 

This is the initial landing page for the UI where a user can provide a gateway ID and security token to connect their first client.





 Login 

This page will be displayed if the UI has been password protected. If this page is reached while no password is being enforced, please refresh the page to be redirected.





 Dashboard 

This is the main page once a client has been connected. From here, you can access the View Logs page, the Access Control List page, and the Connection Info page. At the bottom, you can also choose to disconnect one/many of the connected clients. On the top of the page, the currently selected client will be displayed, and there will be an option to connect additional clients.





 View Logs 

This page will allow you to see the logs being generated by the selected client (shown in the upper right of the page). The displayed logs can be filtered by the check boxes below the logs.





 Access Control List 

This page will allow you to manipulate the Access Control List for the selected client (shown in the upper right of the page). Rules can be individually added to the allow/deny tables or a file can be uploaded at the bottom of the page.





 Connection Info
Applications may want to check if an object exists or has been modified before writing to it. Often this leads to inefficient application logic that will send a HEAD request followed by a PUT or GET request. This anti-pattern results in wasted networking and server resources, and should be discouraged. Instead of using a HEAD request as an existence check within some function, use a conditional request header. These standard HTTP headers will compare MD5 hashes or timestamps to determine whether the data operation should proceed or not. For more information, see Conditional Requests.





 Using conditional requests 

When making a request to read or write data, it is possible to set conditions on that request to avoid unnecessary operations. This is accomplished using the following pre-conditional HTTP headers: If-Match, If-None-Match, If-Modified-Since, and If-Unmodified-Since.

It is generally preferable to use If-Match because the granularity of the Last-Modified value is only in seconds, and may not be sufficient to avoid race conditions in some applications.



 Using If-Match 

On an object PUT, HEAD, or GET request, the If-Match header will check to see if a provided Etag (MD5 hash of the object content) matches the provided Etag value. If this value matches, the operation will proceed. If the match fails, the system will return a 412 Precondition Failed error.

> If-Match is most often used with state-changing methods (e.g., POST, PUT, DELETE) to prevent accidental overwrites when multiple user agents might be acting in parallel on the same resource (i.e., to prevent the "lost update" problem).





 Using If-None-Match 

On an object PUT, HEAD, or GET request, the If-None-Match header will check to see if a provided Etag (MD5 hash of the object content) matches the provided Etag value. If this value does not match, the operation will proceed. If the match succeeds, the system will return a 412 Precondition Failed error on a PUT and a 304 Not Modified on GET or HEAD.

> If-None-Match is primarily used in conditional GET requests to enable efficient updates of cached information with a minimum amount of transaction overhead.
AppID.sharedInstance.userProfileManager?.setAttribute("key", "value") { (error, result) in
guard let result = result, error == nil else {
return // an error has occurred
}
// attributes recieved as a Dictionary
})

// Server-side Swift

let userProfileManager = UserProfileManager(options: options)
let accesstoken = "access token"

userProfileManager.setAttribute(accessToken: accessToken, attributeName: "name", attributeValue : "abc") { (error, response) in
guard let response = response, error == error else {
return // an error has occurred
}
// attributes received as a Dictionary
}
fmt.Println(jsonErr)
return
}
println(string(jsonData))
}

/
Prints the Event Logs.
/
func printLogs(logs []datatypes.Event_Log){
fmt.Printf("| %35s | %25s |%10s |n","Event Name","Event Create Date","User Type")
for _, log := range logs {
if log!=(datatypes.Event_Log{}){
fmt.Printf("| %35s ", log.EventName)
fmt.Printf("| %25s ", log.EventCreateDate)
fmt.Printf("| %10s |n", log.UserType)
}
}
}

To get all Events logs, use [SoftLayer_Event_Log::getAllObjects()](https://softlayer.github.io/reference/services/SoftLayer_Event_Log/getAllObjects/). In this case, just the first 50 events are returned by using pagination limit resultLimit=0,50. For more information, see [Using Result Limits in the SoftLayer API](https://sldn.softlayer.com/article/using-result-limits-softlayer-api/). A mask is shown in this example, mask[eventName,eventCreateDate,userType], that restricts other local fields and limits the amount of information returned.

This example deals with a few ways of pulling data from SoftLayer_Event_Log. There can be many Logs, so by using a filter, like the recentLogs function, you can limit how far back you search for Events.

This example deals with a few ways of pulling data from [SoftLayer_Event_Log](https://sldn.softlayer.com/reference/services/SoftLayer_Event_Log/).
[View AT](https://cloud.ibm.com/docs-content/v1/content/63322f2f3a72050206eb05ba7f590fdcb741105c/cloud-object-storage/images/at-tut-7-empty-at.png)





 Step 7: Trigger an event 

Let's navigate back to our bucket. When we open the bucket in the console it will trigger a listing, even though the bucket is empty. Behind the scenes, the console is sending a GET bucket request to list the objects, and Activity Tracker is going to log this listing event.

![View bucket](https://cloud.ibm.com/docs-content/v1/content/63322f2f3a72050206eb05ba7f590fdcb741105c/cloud-object-storage/images/at-tut-8-view-bucket.png)





 Step 8: View the Activity Tracker events 

Now, assuming there has been enough time for the metadata to propagate, when we return to the Activity Tracker interface we will see some listing events.

![View AT](https://cloud.ibm.com/docs-content/v1/content/63322f2f3a72050206eb05ba7f590fdcb741105c/cloud-object-storage/images/at-tut-9-view-at.png)





 Next steps 

Congratulations, you've just set up a bucket with Activity Tracker enabled.
If you define a variable that stores multiple values in a JSON array, you can return a subset of values from the array, and then use the join() method to format them properly.



 Collection projection 

A collection projection SpEL expression extracts a subcollection from an array that contains objects. The syntax for a collection projection is array_that_contains_value_sets.).get(0) ?>.value_of_interest]

For example, the following context variable defines a JSON array that stores flight information. There are two data points per flight, the time and flight code.

"flights_found": [!
{
"time": "10:00",
"flight_code": "OK123"
},
{
"time": "12:30",
"flight_code": "LH421"
},
{
"time": "16:15",
"flight_code": "TS4156"
}
]

To return the flight codes only, you can create a collection projection expression by using the following syntax:

<? $flights_found..flight_code]

This expression returns an array of the flight_code values as [!"OK123","LH421","TS4156"]. See the [SpEL Collection projection documentation](https://docs.spring.io/spring/docs/3.0.x/reference/expressions.html) for more details.

If you apply the join() method to the values in the returned array, the flight codes are displayed in a comma-separated list. For example, you can use the following syntax in a response:

The flights that fit your criteria are:
<? T(String).join(",", $flights_found. ?>flight_code]

Result: The flights that match your criteria are: OK123,LH421,TS4156.







 JSONArray.joinToArray(template)
If you define a variable that stores multiple values in a JSON array, you can return a subset of values from the array, and then use the join() method to format them properly.



 Collection projection 

A collection projection SpEL expression extracts a subcollection from an array that contains objects. The syntax for a collection projection is array_that_contains_value_sets.).get(0) ?>.value_of_interest]

For example, the following context variable defines a JSON array that stores flight information. There are two data points per flight, the time and flight code.

"flights_found": [!
{
"time": "10:00",
"flight_code": "OK123"
},
{
"time": "12:30",
"flight_code": "LH421"
},
{
"time": "16:15",
"flight_code": "TS4156"
}
]

To return the flight codes only, you can create a collection projection expression by using the following syntax:

<? $flights_found..flight_code]

This expression returns an array of the flight_code values as [!"OK123","LH421","TS4156"]. See the [SpEL Collection projection documentation](https://docs.spring.io/spring/docs/3.0.x/reference/expressions.html) for more details.

If you apply the join() method to the values in the returned array, the flight codes are displayed in a comma-separated list. For example, you can use the following syntax in a response:

The flights that fit your criteria are:
<? T(String).join(",", $flights_found. ?>flight_code]

Result: The flights that match your criteria are: OK123,LH421,TS4156.







 JSONArray.joinToArray(template, retainDataType)
Click the gateway appliance name to access the gateway appliance details page.
5. Click Renew license.



The license renewal can take up to 30 minutes to complete. To verify that the process completed successfully, follow the preceding steps in [Viewing your license expiration date](https://cloud.ibm.com/docs/vsrx?topic=vsrx-license-renewallicense-view-steps). Verify that the expiration shows a 2024 expiration. The renewal process will not reboot the host(s) or node(s) and there should be no outages and minimal traffic disruptions as a result of this action.

After the renewal completes, future actions, such as OS Reload and License Update, automatically apply the new license.
IN A 172.16.1.101 ; nameserver IP of second NetScaler
www.tsstesting.com. IN CNAME gslb.tsstesting.com ; alias to the GSLB object on the NetScaler appliance

Remember, you can only use CNAMEs with hostnames, not the root of the domain.

This configuration sets the name servers for requests for gslb.tsstesting.com to the NetScaler IPs you configured DNS on. The CNAME record translates tsstesting.com to a request for gslb.tsstesting.com. Any requests for www.tsstesting.com will then go to the NetScaler to be resolved, and will return a record based on the load balancing method you configured.

For more information on NetScaler global load balancing, refer to:



* [How DNS(Domain Name System) works with GSLB feature on NetScaler](https://support.citrix.com/article/CTX122619)
* [Information on the MEP protocol and site monitoring](http://support.citrix.com/article/CTX111081)



There are other products that can offer a similar functionality for spreading out traffic on a geographical basis:





 CDN 

Content delivery networks (CDN) allow you to upload or provide an origin server to geographically dispersed cache servers, which then provide the content to the requesting client. CDNs work best with static, bulk content, such as images and videos that does not change over time.

See [Getting started with Content Delivery Network (CDN)](https://cloud.ibm.com/docs/CDN?topic=CDN-getting-started) for more details on CDN.





 Object storage 

IBM Cloud's Object Storage can be configured to use multiple geographic locations in various data centers to provide content. A geographically aware application can perform location lookups on the client request and return a URL to Object Storage that is close to the client. Object Storage also comes with a CDN front end, if needed, to provide additional caching services as noted above.