vania-janet/multiturn-rag-retrieval-data huggingface dataset:
If License Keys for the operating system or any IBM i Licensed Program Products (LPP) have not been applied, follow instructions in the [PowerVS license key issues](https://www.ibm.com/support/pages/mustgather-powervs-license-key-issues) document.

If this is an upgraded system that contained License Keys before, please allow a weekend (Saturday-Sunday) to process the updated keys before collecting the [PowerVS license key issues](https://www.ibm.com/support/pages/mustgather-powervs-license-key-issues) information.





 Changing the System Service Tools (SST) and Dedicated Service Tools (DST) passwords 

By default, the SST and DST passwords are expired. Complete the following tasks to get into SST, change your passwords, and configure the newly attached disk. Configuring a newly attached disk is required and must be done if other disks are attached.

For more information on user ID types, see [Managing service tools user IDs](https://www.ibm.com/support/knowledgecenter/en/ssw_ibm_i_74/rzamh/rzamhmanageuserids.htm).

To change the System Service Tools (SST) and Dedicated Service Tools (DST) passwords complete the following steps:



1. Click the VM instance to view the Server details pane and click Operations.
2. Choose (21) Active dedicated service tools option from the displayed list under the Job operations.
3. Click Run action.



For more information on user ID types, see [Managing service tools user IDs](https://www.ibm.com/support/knowledgecenter/en/ssw_ibm_i_74/rzamh/rzamhmanageuserids.htm).





 Managing the IBM i VM instance 

You can use the Operations panel to manage advanced VM operations and configuration. To open the Operations panel and to run job operations or boot operations, complete the following steps:



1. Click the VM instance to view the Server details pane.
2. Click Operations.
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: system:serviceaccounts:default
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: system:serviceaccounts:test
* Users: You might want to remove authorization for all authenticated users to deploy pods with privileged access. Remove the following system:authenticated entry.

- apiGroup: rbac.authorization.k8s.io
kind: Group
name: system:authenticated



4. Create the modified cluster role binding resource in your cluster. Now, any users and service accounts that are not explicitly authorized to the privileged pod security policy can create pods only by using the restricted pod security policy.

kubectl apply -f privileged-psp-user.yaml
5. Verify that the resource was modified.

kubectl get clusterrolebinding privileged-psp-user -o yaml







 Deleting RBAC resources 

To delete the RBAC resources,



1. Get the name of the RBAC cluster role binding. The following steps use the privileged-psp-user RBAC as an example, but you can take similar steps for the restricted-psp-user RBAC or custom pod security policies.

kubectl get clusterrolebinding
2. Delete the RBAC role that you want to remove. Now, any users and service accounts can create pods only by using the restricted pod security policy.

kubectl delete clusterrolebinding privileged-psp-user
3. Verify that the RBAC cluster role binding is no longer in your cluster.

kubectl get clusterrolebinding







 Creating your own pod security policy 

To create your own pod security policy resource and authorize users with RBAC, review the [Kubernetes documentation](https://kubernetes.io/docs/concepts/security/pod-security-policy/).

Make sure that you modified the existing policies so that the new policy that you create does not conflict with the existing policy.
In the center pane, click the Hybrid Services tab.
3. Locate the Hybrid Cloud Gateway appliance and click the entry to display the details.
4. On the lower right, click the Delete icon to remove the appliance.
5. If a stretched network does not share an IP address with the Hybrid Cloud Gateway, you must remove it separately. Expand the Network Extensions Service details, and click the Delete icon to remove the Layer 2 Concentrator.



The Hybrid Cloud Gateway and any hybrid service virtual appliances that use the Hybrid Cloud Gateway are removed from both the vCenter and the vCenter Server Hybrid Cloud Services Cloud.







 Uninstalling HCX Manager 

Uninstall the HCX Manager appliance before you remove the HCX solution from the on-premises data center. Follow these steps to uninstall the Hybrid Cloud Services virtual machine (VM).



1. Unstretch all Layer 2 networks.
2. Remove the hybrid service virtual appliances.
3. In the on-premises vCenter, power off the Hybrid Cloud Services VM.
4. Delete the Hybrid Cloud Services VM.



All virtual service appliances are removed. The following elements might remain behind:



* Logs
* Migrated VMs





 What to do next 

The migrated VMs and logs can be manually backed up or deleted.







 Logging in to the HCX management portal 

The Hybrid Cloud Services deployment can be administered from the management portal by using a browser-based user interface.



1. In a web browser, enter the IP address that is assigned to the Hybrid Cloud Services, and specify the port number 9443. For example, https://HCXip:9443.
2. The Hybrid Cloud Services user interface opens in a web browser window by using SSL. If necessary, accept the security certificate. The VMware® Hybridity and Networking log in screen opens.
3. Enter the username and password. By default, the username is Admin. The password is the value that was supplied when the Hybrid Cloud Services virtual appliance was installed.







 Related links
* Invalid field error: for wrap The field 'plaintext' must be: a base64 encoded key material if invalid plaintext is passed in the request; and The field 'ciphertext' must be: the original base64 encoded ciphertext from the wrap operation for unwrap if invalid ciphertext is passed. - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-invalid-field-err)
* Key restoration has expired - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-key-restore-expired)
* Missing body in request - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-no-body-err)
* Only a single instance policy may be created per query parameter: Please pass single resource object - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-num-collection-resource-err)
* Only imported keys may be restored - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-key-impt-req-err)
* Requested action can only be completed with a root key - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-key-root-req-err)
* The action could not be performed on the key because the key is expired - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-key-expired-err)
What access enables a user to work with a single resource? 

A user must be assigned an access policy on the specific resource with at least the Viewer role that is assigned on the resource group itself that contains the resource. To assign this type of policy, see [Assigning access to resources](https://cloud.ibm.com/docs/account?topic=account-assign-access-resources).





 What access do I need to provide others access? 

For IAM-enabled services, you must have Administrator role on the service or resource that you want to assign users access to. If you want to assign access to all services or resources in the account, you need a policy on All Identity and Access enabled services with the Administrator role. And, to assign users access to account management services, you must be assigned the Administrator role on the specific service or all account management services. Assigning users the Administrator role delegates the granting and revoking of administrator access of the account, including the ability to revoke access for other users with the administrator role.

For classic infrastructure, you must have the Manage user classic infrastructure permission and the service and device category permissions for the resources that you want to give the user access to.





 What's the difference between access to manage a resource group and access to resources within a resource group? 

When you have access to manage a resource group, you can view, edit the name, and manage access for the resource group itself depending on the assigned role. Access to a resource group itself doesn't give a user access to the resources within the group.

When you have access to resources within a resource group, you can edit, delete, and create instances, or have all management actions for the specified services within the resource group depending on the assigned role.

For example, platform management roles and actions for account management services, see [Platform roles table](https://cloud.ibm.com/docs/account?topic=account-userrolesplatformroles).





 Who can remove users? 

The account owner can remove any users from the account, and any user with the following access can remove users from an account:



* An IAM policy for the User management account management service with the Administrator role assigned.
Why can't I delete my Block Storage for VPC volume snapshot resources? 

Infrastructure provider: VPC

 What’s happening 

When you try to remove your volumesnapshot and volumesnapshotcontents objects, the removal fails, but your volume snapshot object shows a ReadyToUse status as false.

 Why it’s happening 

There are [finalizers](https://kubernetes.io/docs/concepts/overview/working-with-objects/finalizers/) preventing the resources from being removed.

 How to fix it 

Remove the finalizers and continue deleting the resources. Note that stale volumesnapshot and volumesnapshotcontents objects can cause unnecessary CreateSnapshot requests, which can eventually lead to request spamming.

If the volumesnapshot and volumesnapshotcontent objects are included as a single mapping, follow these steps.



1. Delete the volumesnapshot and volumesnapshotcontent objects.

kubectl delete volumesnapshot snapshot-csi-block-3
2. Remove the finalizers section from the volumesnapshot resource.

kubectl patch volumesnapshot/VOLUMESNAPSHOT --type json --patch='[ { "op": "remove", "path": "/metadata/finalizers" } ]'
3. Remove the finalizers section from the volumesnapshotcontents resource.

kubectl patch volumesnapshotcontent/snapcontent-VOLUMESNAPSHOTCONTENT --type json --patch='[ { "op": "remove", "path": "/metadata/finalizers" } ]'



If the the volumesnapshot object is deleted, but volumesnapshotcontent object still exists, follow these steps to remove the volumesnapshotcontent object.



1. Find volumesnapshotcontent object that do not have a ReadyToUse status as empty or false.

kubectl get volumesnapshotcontents | egrep -v 'true'
2.
* What access enables a user to work with a single resource?

A user must be assigned an access policy on the specific resource with at least the Viewer role that is assigned on the resource group itself that contains the resource. To assign this type of policy, see [Assigning access to resources](https://cloud.ibm.com/docs/account?topic=account-assign-access-resources).
* What access do I need to provide others access?

For IAM-enabled services, you must have Administrator role on the service or resource that you want to assign users access to. If you want to assign access to all services or resources in the account, you need a policy on All Identity and Access enabled services with the Administrator role. And, to assign users access to account management services, you must be assigned the Administrator role on the specific service or all account management services. Assigning users the Administrator role delegates the granting and revoking of administrator access of the account, including the ability to revoke access for other users with the administrator role.

For classic infrastructure, you must have the Manage user classic infrastructure permission and the service and device category permissions for the resources that you want to give the user access to.
* What's the difference between access to manage a resource group and access to resources within a resource group?

When you have access to manage a resource group, you can view, edit the name, and manage access for the resource group itself depending on the assigned role. Access to a resource group itself doesn't give a user access to the resources within the group.

When you have access to resources within a resource group, you can edit, delete, and create instances, or have all management actions for the specified services within the resource group depending on the assigned role.

For example, platform management roles and actions for account management services, see [Platform roles table](https://cloud.ibm.com/docs/account?topic=account-userrolesplatformroles).
* Who can remove users?

The account owner can remove any users from the account, and any user with the following access can remove users from an account:



* An IAM policy for the User management account management service with the Administrator role assigned.
Learn about the SQL Server plug-in 

The SQL Server plug-in is installed with the Windows® Agent on the SQL database host. Through the Cloud Backup Portal, you can configure jobs, back up SQL databases to a secure, remote vault, and restore SQL databases.



 Capabilities provided 



* You can run full database backups, full database with transaction logs backups, or transaction logs only backup.
* You can run multiple backups at the same time.
* You can restore SQL databases to the same SQL instance or to a different SQL instance,
* You can restore databases with the original database names, overwrite existing databases, and restore by using the No Recovery option.







 Main features 



* Ability to specify the names of databases to include and exclude in SQL Server backup jobs by using wildcard characters (asterisks and question marks). New databases with names that match a backup job's filters are automatically included or excluded when the job runs.
* Ability to protect secondary databases in AlwaysOn Availability Groups by using the 64-bit Agent and SQL Server plug-in.
* Ability to share SQL safe-sets that contain SharePoint 2010/2013 content databases for use with the Granular Restore for Microsoft® SharePoint application. After the safe-set is shared, the Granular Restore application can be used to restore site collections, websites, lists, libraries, folders, list items, or documents.
* Support for Delta-friendly backup of databases that are on spanned volumes.
* Ability to protect databases in full recovery model with a single schedule entry. This option allows protecting databases and managing truncation of transaction logs in a single schedule entry.
* The SQL Server plug-in supports Full, Full with Include Transaction Logs, and Transaction Log backups (updated terminology to align with SQL Server terminology). The application continues to support the Single Pass Restore function that allows the customer to select a point in time “transaction log” backup. IBM Cloud Backup for Classic restores the full database and all transaction logs necessary to restore the database to the selected point in time.
* A backup job can contain one or more databases from the same single SQL Server instance. A separate Job can be created to back up other databases from a different SQL Server instance, which can be run simultaneously if wanted.
The following table lists the registration actions that generate an event.



Table 5. Registration actions

 Action Description 

 hs-crypto.registrations.list List registrations for any key. 
 hs-crypto.registrations.default Invalid registration request event. 







 Trusted Key Entry events 

The following table lists the Trusted Key Entry (TKE) actions that generate an event.



Table 6. Trusted Key Entry actions

 Action Description 

 hs-crypto.tke-cryptounit-admin.add Add a crypto unit administrator to the selected crypto units. 
 hs-crypto.tke-cryptounit-admin.remove Remove a crypto unit administrator from the selected crypto units. 
 hs-crypto.tke-cryptounit-threshold.set Set the signature thresholds for the selected crypto units. 
 hs-crypto.tke-cryptounit-master-key-register.add Load the new master key register. 
 hs-crypto.tke-cryptounit-master-key-register.commit Commit the new master key register. 
 hs-crypto.tke-cryptounit-master-key-register.activate Activate the current master key register. 
 hs-crypto.tke-cryptounit-new-master-key-register.clear Clear the new master key register. 
 hs-crypto.tke-cryptounit-current-master-key-register.clear Clear the current master key register. 
 hs-crypto.tke-cryptounit.reset Zeroize and reset the selected crypto units 







 Certificate manager events 

The following table lists the certificate manager actions that generate an event.



Table 7. Certificate manager actions

 Action Description 

 hs-crypto.mtlscert-admin-key.create Create the administrator signature key for the certificate administrator to connect to the certificate manager server. 
 hs-crypto.mtlscert-admin-key.update Refresh and update the administrator signature key for the certificate administrator. 
 hs-crypto.mtlscert-admin-key.read Get the administrator signature key of the certificate administrator.
The following table lists the registration actions that generate an event:



Table 6. Registration actions

 Action Description 

 hs-crypto.registrations.list List registrations for any key. 
 hs-crypto.registrations.default Invalid registration request event. 







 Trusted Key Entry events 

The following table lists the Trusted Key Entry (TKE) actions that generate an event:



Table 7. Trusted Key Entry actions

 Action Description 

 hs-crypto.tke-cryptounit-admin.add Add a crypto unit administrator to the selected crypto units. 
 hs-crypto.tke-cryptounit-admin.remove Remove a crypto unit administrator from the selected crypto units. 
 hs-crypto.tke-cryptounit-threshold.set Set the signature thresholds for the selected crypto units. 
 hs-crypto.tke-cryptounit-master-key-register.add Load the new master key register. 
 hs-crypto.tke-cryptounit-master-key-register.commit Commit the new master key register. 
 hs-crypto.tke-cryptounit-master-key-register.activate Activate the current master key register. 
 hs-crypto.tke-cryptounit-new-master-key-register.clear Clear the new master key register. 
 hs-crypto.tke-cryptounit-current-master-key-register.clear Clear the current master key register. 
 hs-crypto.tke-cryptounit.reset Zeroize and reset the selected crypto units 







 Certificate manager events 

The following table lists the certificate manager actions that generate an event:



Table 8. Certificate manager actions

 Action Description 

 hs-crypto.mtlscert-admin-key.create Create the administrator signature key for the certificate administrator to connect to the certificate manager server. 
 hs-crypto.mtlscert-admin-key.update Refresh and update the administrator signature key for the certificate administrator. 
 hs-crypto.mtlscert-admin-key.read Get the administrator signature key of the certificate administrator.
ansible-playbook -T 40 -l BACK_NIC_IP -u root --ssh-common-args "-F ../../scripts/ssh.notstrict.config -o ProxyJump=root@$(cd tf; terraform output -raw BASTION_IP_ADDRESS)" -i inventory lamp.yaml







 Test the configuration of the virtual servers 

Now that Terraform has deployed resources and Ansible installed the software, you can validate they were correctly provisioned.



1. Validate that the frontend virtual server instance is reachable and has outbound access to the Internet:

../test_provision.bash $(cd tf && terraform output -raw FRONT_IP_ADDRESS) INTERNET hi

The command output should be:

success: httpd default file was correctly replaced with the following contents:
INTERNET
success: provision of file from on premises worked and was replaced with the following contents:
hi
2. Validate that the backend can be reached through the bastion host and does not have access to the internet:

../test_provision.bash $(cd tf && terraform output -raw BACK_NIC_IP) ISOLATED hi "ssh -F ../../scripts/ssh.notstrict.config root@$(cd tf && terraform output -raw FRONT_NIC_IP) -o ProxyJump=root@$(cd tf && terraform output -raw BASTION_IP_ADDRESS)"

The command output should be:

success: httpd default file was correctly replaced with the following contents:
ISOLATED
success: provision of file from on premises worked and was replaced with the following contents:
hi







 Remove resources 



1. Remove the resources created by Terraform:

cd $CHECKOUT_DIR/vpc-app-deploy/ansible/tf

and

terraform destroy



Depending on the resource it might not be deleted immediately, but retained (by default for 7 days). You can reclaim the resource by deleting it permanently or restore it within the retention period.
* UI
* CLI







 Managing your OpenShift Data Foundation deployment 

Review the following topics to manage your OpenShift Data Foundation deployment.



 Removing the OpenShift Data Foundation add-on from your cluster 

You can remove ODF add-on from your cluster by using the [Red Hat OpenShift clusters console](https://cloud.ibm.com/kubernetes/clusters?platformType=openshift) or the CLI.

When you disable the OpenShift Data Foundation add-on, only the ODF operator is removed from your cluster. Your existing workloads remain, but you can't create more ODF workloads. You also can't delete your OcsCluster custom resource after the operator is removed. If you want to remove all your ODF resources and data, see [Removing ODF from your cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-ocs-manage-deploymentocs-rm-crd). If you removed the add-on and can't delete your OcsCluster, reinstall the add-on, then delete the OcsCluster.





 Removing ODF from your apps 

To remove ODF from your apps, you can delete your app or deployment and the corresponding PVCs.

If you want to fully remove ODF and all your data, you can [remove your storage cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-ocs-manage-deploymentocs-rm-crd).



1. List your PVCs and note the name of the PVC and the corresponding PV that you want to remove.

oc get pvc
2. Remove any pods that mount the PVC.



1. List all the pods that currently mount the PVC that you want to delete. If no pods are returned, you don't have any pods that currently use your PVC.