vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Now that my application, my local server, and my Client have all been configured, I get the following output from my application and my Client:



 Application 

Client connected, authorized: true
Client data: Successful connection message from the server
Client connection closing





 Secure Gateway Client 

[2017-04-07 12:22:42.363] [INFO] (Client ID Nn5TJ34LyVQ_qCB) Connection 1 is being established to localhost:8999
[2017-04-07 12:22:42.381] [INFO] (Client ID Nn5TJ34LyVQ_qCB) Connection 1 to localhost:8999 was closed







 Success! 

We have successfully configured Mutual Authentication for both User Authentication and Resource Authentication!
Nn5TJ34LyVQ_i2NOT_destKey.pem Auto-generated key for the SG Client to use when connecting to the destination 
 Nn5TJ34LyVQ_clientCert.pem Auto-generated certificate from your gateway for the SG Client to use in the event it does not have a _destCert or _destKey file 
 localServerCert.pem The certificate of my local resource to be used in the CA of the Secure Gateway Client 







 Creating the Application 

Now that I have my cloud host and port for my destination as well as the various certificates and keys, I can begin writing my application to connect to Secure Gateway. This is a simple Node.js application that will connect to my local TLS server, receive a small amount of data, and then close the connection.

let fs = require('fs');
let tls = require('tls');

let client_opts = {
cert : fs.readFileSync('Nn5TJ34LyVQ_i2NOT_cert.pem'),
key : fs.readFileSync('Nn5TJ34LyVQ_i2NOT_key.pem'),
host : 'cap-sg-prd-1.integration.ibmcloud.com',
port : 17996,
rejectUnauthorized : true
}

let so = tls.connect(client_opts, function() {
console.log('Client connected, authorized:', so.authorized);
if (!so.authorized) console.log('Client authorization error:', so.authorizationError)
});

so.on('data', function(data) {
console.log('Client data:', data.toString())
});

so.on('error', function(err) {
console.log('Client error',err);
});

so.on('close', function() {
console.log('Client connection closing');
[IBM Cloud Hardware Security Module (HSM)](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-hsm-gemaltoibp-hsm-gemalto)



* [Why would I want to use an HSM with my IBM Blockchain Platform network?](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-hsm-gemaltoibp-hsm-gemalto-why)
* [Using IBM Cloud HSM](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-hsm-gemaltoibp-hsm-gemalto-using)
* [Process overview](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-hsm-gemaltoibp-hsm-gemalto-overview)



* [Part One: Set up the HSM device and HSM client](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-hsm-gemaltoibp-hsm-gemalto-part-one)
* [Part Two: Configure communications between the HSM server and client](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-hsm-gemaltoibp-hsm-gemalto-part-two)
* [Part Three: Register the client with the HSM server](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-hsm-gemaltoibp-hsm-gemalto-part-three)
* [Part Four: Build a Docker image](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-hsm-gemaltoibp-hsm-gemalto-part-four)
* [Scenario: Allow limited public connectivity with a gateway appliance](https://cloud.ibm.com/docs/openshift?topic=openshift-plan_basicsvyatta-gateway)



* [Worker-to-worker communication, worker-to-master and user-to-master communication with a gateway appliance](https://cloud.ibm.com/docs/openshift?topic=openshift-plan_basicslimited-public-gw-worker)
* [Worker communication to other services or networks with a gateway appliance](https://cloud.ibm.com/docs/openshift?topic=openshift-plan_basicslimited-public-gw-services)
* [External communication to apps that run on worker nodes with a gateway appliance](https://cloud.ibm.com/docs/openshift?topic=openshift-plan_basicslimited-public-gw-external)





[Planning your cluster for high availability](https://cloud.ibm.com/docs/openshift?topic=openshift-ha_clustersha_clusters)



* [Single zone clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-ha_clusterssingle_zone)



* [Is my master highly available in a single zone cluster?](https://cloud.ibm.com/docs/openshift?topic=openshift-ha_clusterssz-master-ha)
* [How can I protect my workloads against a single zone failure?](https://cloud.ibm.com/docs/openshift?topic=openshift-ha_clusterssz-workload-failover)



* [Multizone cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-ha_clustersmz-clusters)



* [Why do I need worker nodes in three zones?](https://cloud.ibm.com/docs/openshift?topic=openshift-ha_clustersmz-cluster-zones)
: See [Choosing a build strategy](https://cloud.ibm.com/docs/codeengine?topic=codeengine-plan-buildbuild-strategy).

CLI version 1.41.1 released
: See [CLI version history](https://cloud.ibm.com/docs/codeengine?topic=codeengine-cli_versions).





 09 February 2023 

Added information about troubleshooting job runs
: See [How can I find information about my job run](https://cloud.ibm.com/docs/codeengine?topic=codeengine-ts-jobrun-learnmore)?

CLI version 1.41.0 released
: See [CLI version history](https://cloud.ibm.com/docs/codeengine?topic=codeengine-cli_versions).





 03 February 2023 

Added information about troubleshooting service bindings
: 

* See [Debugging service bindings](https://cloud.ibm.com/docs/codeengine?topic=codeengine-troubleshoot-servicebindings).
* See [Why do the service credentials in my service binding to IBM Cloud Object Storage show as REDACTED](https://cloud.ibm.com/docs/codeengine?topic=codeengine-ts-sb-cosredacted)?
* See [Why does my service binding to a Db2 Enterprise instance fail](https://cloud.ibm.com/docs/codeengine?topic=codeengine-ts-sb-db2createfails)?



CLI version 1.40.8 released
: See [CLI version history](https://cloud.ibm.com/docs/codeengine?topic=codeengine-cli_versions).

Updated versions for buildpacks
: See [Choosing a build strategy](https://cloud.ibm.com/docs/codeengine?topic=codeengine-plan-buildbuild-strategy).







 January 2023 

Review the release notes for January 2023.
* Why can I ping my ServiceVE but cannot log in to via SSH (PIM/PMC)?

Make sure that the host node doesn't have any IP addresses assigned other than the IP addresses that are listed in the Portal (1 public IP and 1 private IP [located in 10.0.0.0/8]).

If you have any range files that are configured on the host node, then you need to remove these files and restart networking.

[root@virtuozzo ] mv –vi /etc/sysconfig/network-scripts/eth[0-9]-range[0-9] /.sl-orig-configs/

[root@virtuozzo ] /sbin/service network restart

vzcp isn't started within the Service VE. Start vzcp within the Service VE from the hardware node.

[root@virtuozzo ] vzctl exec2 1 service vzcp status

vzcp is stopped

[root@virtuozzo ] vzctl exec2 1 service vzcp start

Starting vzcpd: [ OK ]

Starting vzcp: [ OK ]

[root@virtuozzo ] vzctl exec2 1 service vzcp status

vzcp (pid 3775 3774 3771) is running...

[root@virtuozzo ]



Containers Container Registry



* How do you list public images?

 How do you list public images? 

To list public images, run the following ibmcloud commands to target the global registry and list the public images that are provided by IBM:

ibmcloud cr region-set global

ibmcloud cr images --include-ibm
* What tools can I use to build and push images?

 What tools can I use to build and push images? 

You can use Docker and non-Docker tools to build and push images to the registry. You can use non-Docker tools that support OCI container image A container image that is compliant with the OCI Image Format Specification format and protocol.
Secure Gateway can not replay the RST packet on the other end of the tunnel since the TCP packets have already been ACKed for that side of the tunnel. Define the timeouts on the application, which never receives an acknowledging response, are the only method to end the hang.







 Configure your Docker client to restart when your server restarts 



 What is happening 

When you restart the server where your Secure Gateway client runs, you must manually restart the Secure Gateway Docker client. How can you get the client to start automatically after a restart of the system?





 How to fix it 



* On Linux or UNIX systems:
* Integrate the Docker command into a script that can be called as a result of a CRON job.
* If you are using a Linux work station, you can create an upstart configuration to ensure that the client is started every time that the server is restarted. For more information, see Automatically Start Containers in the Docker website.
* On Windows systems, issue the following command to start the client:



for /L %i in (0,0,0) do docker run -it ibmcom/secure-gateway-client <gateway_id>







 Connection error message: host is not in cert's CN 



 What is happening 

You are trying to implement on-premises client-side TLS by using the Secure Gateway client and the [Reject unauthorized](https://cloud.ibm.com/docs/services/SecureGateway?topic=SecureGateway-add-destdest-user-auth) of the destination is enabled, but you receive the following error message.

[ERROR] Connection <connection ID> had error: Host: <host name>. is not cert's CN: <mycommonname>

Where:
- connection ID is a client assigned connection number.
- host name is the host name for the connection.
- mycommonname is the FDQN or common name that is used in the certificate.





 Why it is happening 

The Common Name, for example, the server FQDN or YOUR name, between your on-premises application and the certificate that you uploaded into IBM Cloud for this destination do not match.



* Check the following items:
I deleted a portable subnet and now my Classic cluster my Load Balancers are failing. How do I recover? 

Classic

 What’s happening 

your cluster is experiencing network errors.

 Why it’s happening 

A portable subnet was deleted.

 How to fix it 

Complete the following steps.



1. For the cluster that is experiencing issues, run the following command and make a note of the cluster ID.

ibmcloud ks cluster ls
2. List the subnets your cluster is using. In the output, make a note of the subnets that your cluster is using.

ibmcloud ks subnets --provider classic | grep CLUSTER-ID
3. List the subnets in your account. Check whether any subnets that you found in step 1 are missing from the list of subnets in your account. This means your cluster is using a subnet that was deleted, which is causing your Load Balancer to fail.

ibmcloud sl subnet list

ibmcloud sl subnet detail SUBNET-ID
4. For each subnet that was deleted, re-create it. If you need public IP addresses for your ALBs or LoadBalancers, specify the public VLAN ID of your worker nodes; for private IPs specify the private VLAN ID of your worker nodes.

ibmcloud ks cluster subnet create -c CLUSTER --size 8 --vlan VLAN-ID
5. Disable any ALBs that use the deleted portable subnets.



1. List your ALBs and note the IDs of ALBS that you want to remove.

ibmcloud ks ingress alb ls -c CLUSTER-ID
2. Disable the ALBs to delete the Load Balancer for the ALB, which releases the portable IP address in the portable subnet you want to detach

ibmcloud ks ingress alb disable -c CLUSTER-ID --alb ALB-ID



6. Complete the following steps to find any Load Balancers that use IP addresses from the deleted portable subnet(s), save their settings, and then delete them.



1.
Added summary information for getting started with apps and batch jobs in Code Engine
: 

* See [Application workloads](https://cloud.ibm.com/docs/codeengine?topic=codeengine-ceapplications).



: 

* See [Batch job workloads](https://cloud.ibm.com/docs/codeengine?topic=codeengine-cebatchjobs).



Added support for the scale-down delay autoscaling option
: 

* See [Configuring application scaling](https://cloud.ibm.com/docs/codeengine?topic=codeengine-app-scale).



: 

* See the [app create](https://cloud.ibm.com/docs/codeengine?topic=codeengine-clicli-application-create) and [app update](https://cloud.ibm.com/docs/codeengine?topic=codeengine-clicli-application-update) commands in the Code Engine CLI reference.



CLI version 1.44.0 released
: See [CLI version history](https://cloud.ibm.com/docs/codeengine?topic=codeengine-cli_versions).

Added support for service binding operations in the Code Engine V2 API
: See [API change log](https://cloud.ibm.com/docs/codeengine?topic=codeengine-api-changelog).

Updated versions for buildpacks
: See [Choosing a build strategy](https://cloud.ibm.com/docs/codeengine?topic=codeengine-plan-buildbuild-strategy).





 13 June 2023 

Added troubleshooting information about deleting jobs and job runs when the limit is exceeded
: See [I'm over my limit for jobs or job runs. How can I delete them](https://cloud.ibm.com/docs/codeengine?topic=codeengine-ts-jobrun-deleteforquota)?

Updated versions for buildpacks
The [Buildpacks community](https://buildpacks.io/community) set all these dates in the image metadata to a fixed timestamp in 1980 to achieve reproducibility.





 Why do images that are built with non-Intel processors not work with Code Engine? 

If you have an image that exists in a container registry and the image was built with a non-Intel based processor, Code Engine cannot run your container image. Code Engine uses Intel-based processing. You can build your own image if you use Intel processing (x86 processor). You can also choose to let Code Engine handle the build process for you. For more information, see [Planning your build](https://cloud.ibm.com/docs/codeengine?topic=codeengine-plan-build).





 Do Code Engine apps support WebSockets? 

Yes! You can find a [sample app that uses WebSockets](https://github.com/IBM/CodeEngine/tree/main/websocket) by visiting our Code Engine samples repository on GitHub.

The maximum time for any connection to an application is 10 minutes, even if the connection is not idle. With Code Engine, you can configure this connection time with the timeout value. With the CLI, use the --timeout option with the [app create](https://cloud.ibm.com/docs/codeengine?topic=codeengine-clicli-application-create) command or the [app update](https://cloud.ibm.com/docs/codeengine?topic=codeengine-clicli-application-update) command. From the console, you can set the Timeout value for your app from the Runtime tab. For an app that use WebSockets, the client must reconnect to the app after the connection is closed. So, if your app needs a persistent connection, create a new connection before the timeout value is reached.





 How can I review the Code Engine service terms?
* CPU: The total combination for all the app instances, running job instances, and running build instances cannot exceed 128 vCPU.
* Domain mappings: 80 custom domain mappings per project
* Ephemeral storage: The total combination for all the app instances, running job instances, and running build instances cannot exceed 512 G of ephemeral storage.
* Memory: The total combination for all the app instances, running job instances, and running build instances cannot exceed 512 G of memory.



CLI version 1.41.2 released
: See [CLI version history](https://cloud.ibm.com/docs/codeengine?topic=codeengine-cli_versions).

Updated versions for buildpacks
: See [Choosing a build strategy](https://cloud.ibm.com/docs/codeengine?topic=codeengine-plan-buildbuild-strategy).





 17 February 2023 

New FAQ for Migrating your Cloud Foundry app
: Added information about migrating a global load balancer. See [I use a global load balancer with my Cloud Foundry app. Can I migrate it to Code Engine](https://cloud.ibm.com/docs/codeengine?topic=codeengine-migrate-cf-ce-faqapp_glb)?

Updated troubleshooting information for apps that don't achieve a ready status
: Added information about confirming the port value. See [Why doesn't my app ever become ready](https://cloud.ibm.com/docs/codeengine?topic=codeengine-ts-app-neverready)?

Updated versions for buildpacks
: See [Choosing a build strategy](https://cloud.ibm.com/docs/codeengine?topic=codeengine-plan-buildbuild-strategy).

CLI version 1.41.1 released
: See [CLI version history](https://cloud.ibm.com/docs/codeengine?topic=codeengine-cli_versions).





 09 February 2023 

Added information about troubleshooting job runs
(https://cloud.ibm.com/docs/blockchain?topic=blockchain-migrating-to-hlf-supportibp-migration-what)
* [Why is it changing?](https://cloud.ibm.com/docs/blockchain?topic=blockchain-migrating-to-hlf-supportibp-migration-why)
* [How do I transition my license?](https://cloud.ibm.com/docs/blockchain?topic=blockchain-migrating-to-hlf-supportibp-migration-licensing)
* [Planning and Considerations](https://cloud.ibm.com/docs/blockchain?topic=blockchain-migrating-to-hlf-supportibp-migration-planning)
* [Next steps](https://cloud.ibm.com/docs/blockchain?topic=blockchain-migrating-to-hlf-supportibp-migration-next-steps)
* [Running the migration tool](https://cloud.ibm.com/docs/blockchain?topic=blockchain-migrating-to-hlf-supportibp-migration-tool)
* [Troubleshooting based on migration tool messages](https://cloud.ibm.com/docs/blockchain?topic=blockchain-migrating-to-hlf-supportibp-migration-troubleshooting)



* [Failure during step two: Migrating Fabric nodes](https://cloud.ibm.com/docs/blockchain?topic=blockchain-migrating-to-hlf-supportfailure-during-step-two-migrating-fabric-nodes)



* [Post-migration considerations](https://cloud.ibm.com/docs/blockchain?topic=blockchain-migrating-to-hlf-supportibp-post-migration-considerations)
IBM Cloud Hardware Security Module (HSM) 

IBM Cloud includes an

HSMservice that provides cryptographic processing for key generation, encryption, decryption, and key storage. This document describes how to use that service with the IBM® Blockchain Platform.

While this tutorial focuses specifically on using IBM Cloud HSM, you can learn more about the overall configuration process for using any HSM that supports PCKS #11 with the IBM Blockchain Platform, see [Configuring a node to use a Hardware Security Module](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-adv-deploymentibp-console-adv-deployment-cfg-hsm).



 Why would I want to use an HSM with my IBM Blockchain Platform network? 

When a Certificate Authority (CA), peer, or ordering node is configured to use an HSM, their private key is generated by and protected inside a tamper resistant HSM device. IBM Cloud HSM is a FIPS 140-2 Level 3 validated, single-tenant device that implements Gemalto (Luna) HSM. When a CA is configured to use HSM, the CA root private key is stored in the HSM. This is the key that is used to sign enrollment requests. After a peer or ordering node is configured to use HSM, the nodes are able to sign and endorse transactions without ever exposing their private key.

Because only the private keys of node identities are secured in the HSM, when you enroll other admin or client application identities with a CA, their private keys are not stored inside the HSM because they will need their private key to transact on the network.





 Using IBM Cloud HSM 

IBM Cloud HSM 6.0 and 7.0 are available in the [IBM Cloud catalog](https://cloud.ibm.com/catalog/infrastructure/hardware-security-module). Both versions are supported, however, these instructions focus on how to configure IBM Cloud HSM 6.0 to work with the IBM Blockchain Platform. If you are using 7.0, it is possible that some of the commands will differ slightly.





 Process overview
To view the common name of your client certificate, use the OpenSSL command openssl x509 -noout -text -in your_client_certificate_file in the subject section.







 How do I assign the VPN client role using IAM access management tags in the API? 

When you manage user access using access management tags on a client-to-site VPN and enable the UserId and Passcode mode for Client Authentication, you must attach the VPN Client role with an access tag. Otherwise, the VPN client cannot connect to the VPN server. For more information, see [Granting users access to tag IAM-enabled resources by using the API](https://cloud.ibm.com/docs/account?topic=account-access&interface=apiiam-managed-api) and set the role_id to crn:v1:bluemix:public:is::::serviceRole:VPNClient to grant access.
If you included [node-specific pod affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/), your pods are not rescheduled. If you did not, pods are created on available worker nodes in other zones, but they might not be balanced. For example, the two pods might be spread across the two available nodes, or they might both be scheduled onto one node with available capacity. Similarly, when the unavailable zone returns, pods are not automatically deleted and rebalanced across nodes. If you want the pods to be rebalanced across zones after the zone is back up, configure the [Kubernetes descheduler](https://github.com/kubernetes-sigs/descheduler). In multizone clusters, try to keep your worker node capacity at 50% per zone so that enough capacity remains to protect your cluster against a zonal failure.

What if I want to spread my app across regions?
: To protect your app from a region failure, create a second cluster in another region, [set up a global load balancer](https://cloud.ibm.com/docs/containers?topic=containers-ha_clustersmultiple-clusters-glb) to connect your clusters, and use a deployment YAML to deploy a duplicate replica set with [pod anti-affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/) for your app.

What if my apps need persistent storage?
: Use a cloud service such as [IBM Cloudant](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-getting-started-with-cloudant) or [IBM Cloud Object Storage](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-getting-started-cloud-object-storage).





 How can I scale my app?
kube-system public-crdf253b6025d64944ab99ed63bb4567b6-alb1-5ff8cdff89-kvs9f 0 (0%) 0 (0%) 0 (0%) 0 (0%)
2. Confirm that no ALB pods are deployed to non-edge nodes.

oc describe nodes -l dedicated!=edge | grep alb

If the ALB pods are correctly deployed to edge nodes, no ALB pods are returned. Your ALBs are successfully rescheduled onto only edge worker nodes.





You labeled worker nodes in a worker pool with dedicated=edge and redeployed all the existing ALBs and NLBs to the edge nodes. All subsequent ALBs and NLBs that are added to the cluster are also deployed to an edge node in your edge worker pool. Next, prevent other [workloads from running on edge worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-edgeedge_workloads) and [block inbound traffic to NodePorts on worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-network_policiesblock_ingress).





 Preventing app workloads from running on edge worker nodes 

A benefit of edge worker nodes is that they can be specified to run networking services only.

Using the dedicated=edge toleration means that all network load balancer (NLB) and Ingress application load balancer (ALB) services are deployed to the labeled worker nodes only. However, to prevent other workloads from running on edge worker nodes and consuming worker node resources, you must use [Kubernetes taints](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/).

Before you begin



* Ensure you that have the [Manager IBM Cloud IAM service access role for all namespaces](https://cloud.ibm.com/docs/openshift?topic=openshift-userschecking-perms).