vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Configure your build job to use the [private worker](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-private-workersconfigure_private_worker_integration).







 Why can't the Delivery Pipeline communicate through a firewall? 

Your firewall configuration prevents the Delivery Pipeline from communicating with environments that are behind a firewall.

 What’s happening 

When I attempt to use the Delivery Pipeline, it cannot communicate through my firewall.

 Why it’s happening 

Your firewall must be configured to allow the Delivery Pipeline to communicate with environments that are behind a firewall.

 How to fix it 

You can update your firewall configurations to allow the Delivery Pipeline to access resources that are behind the firewall. Use the [CIS allowlist](https://cloud.ibm.com/docs/cis?topic=cis-cis-allowlisted-ip-addresses) and the [subnet ranges](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-pipeline-subnet-ranges), for your specific region.





 Why did I receive a notification that repo references are fixed in my pipeline triggers or definitions? 

You changed, added, or removed repo integrations from your toolchain, which caused references to the integrations that are stored in the pipeline triggers or definitions to become invalid.

 What’s happening 

When I change, add, or remove repo integrations from my toolchain, warning icons and validation errors are displayed in my pipeline configuration.

 Why it’s happening 

In certain scenarios, when you change, add, or remove repo integrations from your toolchain, references to these integrations that are stored in the pipeline triggers or definitions might become invalid.

 How to fix it 

If a matching repo integration is located in the toolchain, the pipeline attempts to automatically update these references to fix the invalid integration references. A notification is displayed in the UI with one of the following messages:



* Repository reference fixed in the following triggers: [list of triggers]
* Repository reference fixed in the following definitions: [list of definitions]
Archiving events to IBM Cloud Object Storage 

You can archive events from an IBM Cloud Activity Tracker instance into a bucket in an IBM Cloud Object Storage (COS) instance.

In Activity Tracker, by default archiving is not enabled. Data is available for search and analysis for the number of days that your service instance plan indicates. However, you might need to access the data longer for troubleshooting. You might also have to keep the data for longer for compliance, and for corporate or industry regulations. When you need access to data for longer than the number of search days, you must configure archiving.

You can only have 1 Activity Tracker instance per region. Each IBM Cloud Activity Tracker instance has its own archiving configuration.

The following figure shows a high-level view of the different components that are involved when archiving events:

Zoom

![High-level view archiving events](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/Activity-Tracker-Search-02-Archiving-Events.svg)

Figure 1. High-level view archiving events

The IBM Cloud Object Storage instance is provisioned within the context of a resource group. The IBM Cloud Activity Tracker instance is also provisioned within the context of a resource group. Both instances can be grouped under the same resource group or in different ones.

IBM Cloud Activity Tracker uses a service ID to communicate with the IBM Cloud Object Storage service.



* The service ID that you create for an IBM Cloud Object Storage instance is used by IBM Cloud Activity Tracker to authenticate and access the IBM Cloud Object Storage instance.
* You can assign specific access policies to the service ID that restrict permissions on the IBM Cloud Object Storage instance. Restrict the service ID to only have writing permissions on the bucket where you plan to archive the events.
* You can also restrict the IP addresses that are allowed to manage the bucket.



You are responsible for configuring and managing the bucket and the data stored in it.
Subfolders will be created as appropriate, for example: 'cos://cis-test-bucket/logs/{DATE}?region=us&instance-id=f75e6d90-4212-4026-851c-d572071146cd'--enable value: Enable the job or not. The job is disabled by default.--fields value: Define the list of log fields to be included in log files. Multiple fields can be separated by commas and use command ibmcloud cis logpush-available-fields DNS_DOMAIN_ID to get the comprehensive list of available log fields, or use all to include all available fields in log files. Note that fields are expected to be case sensitive.--timestamps value: Set the format in which response timestamps are returned. Valid values: unix, unixnano, rfc3339.--dataset value: The category of logs you want to receive. This value cannot be changed after the job is created. Valid values: http_requests, range_events, firewall_events. The default value is http_requests.--jobid value: JOB_ID is the ID of logpush job.--frequency value: The frequency at which CIS sends batches of logs to your destination. Setting frequency to high sends your logs in larger quantities of smaller files. Setting frequency to low sends logs in smaller quantities of larger files. Valid values: high, low.-i , --instance value: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.--output: Specify output format, only JSON is supported.<-- </section "id="section-command-options-logpush-job-update" "> --><-- <section "id="section-command-example-logpush-job-update" "> --> Examples Update range_events log push job for domain 31984fea73a15b45779fa0df4ef62f9b.
If the mapping's state is in DOMAIN_VALIDATION_PENDING state for more than 48 hours, the mapping creation is cancelled, and the mapping's state will be CREATE_ERROR. And in this state, you can choose to Retry creation or delete the mapping.
* Does a Wildcard certificate need to validate a domain for my CDN?

No, but you can only use the CNAME to retrieve content from your origin. For example, https://www.example-cname.cdn.appdomain.cloud.
* I received an email indicating that my domains is not pointed to IBM CDN CNAME. What do I do now?

This email means that your CDN is not being used. To use the CDN and make the domain(s) active in the certificate(s), you must set the listed CNAME DNS record(s) in your DNS provider system. If you complete this action within 7 days, both HTTP and HTTPS traffic will be restored for your CDN and the CDN will go to RUNNING status. If the CDN is still unused after 7 days, we must permanently disable HTTPS for your CDN domain, to prevent your unused domain from blocking new CDN domain requests to be added to the Shared SAN certificate. HTTP traffic access through the CDN might still be restored later by adding a CNAME record for your domain. For details on how to address this situation, refer to the [Completing Domain Control Validation for HTTPS](https://cloud.ibm.com/docs/CDN?topic=CDN-completing-domain-control-validation-for-https-with-dv-sancname) document.
* If I use the SAN certificate type for my CDN, can I still use the CNAME for access to my service?

No. For the SAN certificate, you can use only the custom domain to access the content from the origin.
* Are all of my IBM Cloud CDN domains added into one certificate?

Not necessarily. Certificate selection is handled by Akamai to ensure that the certificates are in the most efficient state. Domains are added into different certificates in a well-proportioned manner, so we cannot guarantee that all of your domains are on the same certificate.
Platform access roles 

Use platform access roles to grant permissions at the account level, such as the ability to create or delete DNS Services instances in your IBM Cloud account.



Table 1. Platform access roles

 Action Role 

 View IBM Cloud® DNS Services instances Administrator, Operator, Editor, Viewer 
 Create IBM Cloud® DNS Services instances Administrator, Editor 
 Delete IBM Cloud® DNS Services instances Administrator, Editor 







 Service access roles 

Use service access roles to grant permissions at the service level, such as the ability to view, create, or delete DNS zones, resource records, and permitted networks.

The following table shows how service access roles map to DNS Services permissions.



Table 2. Service access roles

 Role Description Actions 

 Reader A reader can browse a high-level view of DNS zones, resource records, and permitted networks. Readers cannot create, delete or modify any resources under DNS Services instances. View DNS zones, resource records, and permitted networks. 
 Writer A writer can modify DNS zones and resource records, in addition to actions that a reader can perform. All actions that a reader can perform, also can update DNS zones and resource records. 
 Manager A manager can perform all actions that a reader and writer can perform, including the ability to create and delete DNS zones, create and delete resource records, and also add and remove permitted networks. All actions that a Reader or a Writer can perform, also can create and delete DNS zones. Additionally, can create and delete resource records, and add or remove permitted networks. 









 Working with permitted network (VPC) related IAM access 

To add a VPC into permitted networks for a DNS zone, users must have the Operator role on the VPC resource. The permission can be granted to any user by creating an IAM access policy with the following assignments in IBM Cloud UI:



1. Select VPC Infrastructure for What type of access do you want to assign?.
2. Select Virtual Private Cloud for Resource Type.
3. Choose the appropriate VPC under VPC ID.
See [Known limitations](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-known-limitations) for more details.
* What do the different zone states mean?

The zone states definitions are as follows.



* Pending: When a DNS zone is added to the instance it will be in Pending. In this state Resource Records can be added, deleted or updated. Since the zone does not have any permitted networks, the zone will not be served by the resolvers in any region.
* Active: When a domain has one or more permitted networks added then the domain state changes to ACTIVE and the domain will be served by the resolver from all the regions.
* Disabled: In this state the zone will not be served and all control path operations will be disabled except deleting the zone.



* Can I use any name for the zone?

In general, yes, you can use any name for the zone. Certain IBM-owned or IBM-specific DNS zone names are restricted, in other words, they can't be created in DNS Services. See [Restricted DNS zone names](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-managing-dns-zonesrestricted-dns-zone-names) for the complete list.
* Can I create two DNS zones with the same name?

Creating two DNS Zones with the same name is allowed. Use label and description as described in the following steps to differentiate between the two.



1. Create an instance of DNS Services.
2. Create a DNS zone for each environment (for example, production, staging, development, testing). When creating the zone, be sure to include a description indicating what environment the zone is for. The zone name is the same for each zone (for example, testing.com). A single DNS Services instance can only contain 10 zones.
3. Add a zone to the instance of DNS Services.
4. In each respective zone, add specific VPCs as permitted networks.
FAQ about ESXi servers 

Find answers to frequently asked questions about the VMware ESXi™ servers managed on the IBM Cloud® for VMware Solutions console.



 How many ESXi servers can I add to my instance? 

Your VMware vCenter Server® instance allows you to expand the default cluster to have up to 51 ESXi servers. Each of the non-default clusters can be expanded to have up to 59 ESXi servers. Since you can add up to 10 clusters to an instance, each deployed instance can have a maximum of 51 + 9x59 = 582 ESXi servers across all clusters.





 How many ESXi servers can I add to a cluster? 

You can add a maximum of 51 ESXi servers to an initial cluster and a maximum of 59 ESXi servers to the added clusters.

For instances deployed in V2.1 or earlier, you must enable the necessary vSAN™ support to increase the cluster size beyond 32. Complete the following steps to enable the necessary vSAN support:



1. On each deployed ESXi server, run the following commands:

esxcli system settings advanced set -o /VSAN/goto11 -i 1

esxcli system settings advanced set -o /Net/TcpipHeapMax -i 1576
2. Restart each ESXi server. For more information, see [Creating vSAN clusters with up to 64 nodes](https://kb.vmware.com/s/article/2110081).
3. You might need to increase the size of the vCenter Server to accommodate the added virtual machines and ESXi servers.
4. Open an IBM Support ticket to indicate that you applied the vSAN changes manually by completing steps 1 to 3. In the ticket, request that your upgraded instance is enabled for ESXi servers beyond 32.







 Can I change the ESXi server names and IP addresses? 

The ESXi server names and IP addresses cannot be changed because they are registered for Windows® DNS resolution. Changes might result in failure during deployment or failure of vCenter Server functions.

Don't use the Rename Device feature on the IBM Cloud user interface to change ESXi server names.
For more information, see For more information, see [About Instance Metadata for VPC (Beta)](https://cloud.ibm.com/docs/vpc?topic=vpc-imd-about).





 Can I use the same operating system image for more than one account? 

Yes, when you create a custom image for IBM Cloud VPC, you can import those images into a private catalog for use among multiple accounts. A private catalog provides a way for you to manage access to products for multiple accounts, if those accounts are within the same enterprise. You must first complete all the steps to import the custom image into IBM Cloud VPC before you can import the image into a private catalog. For more information about private catalog considerations and limitations, see [Getting started with custom images](https://cloud.ibm.com/docs/vpc?topic=vpc-about-custom-images).





 Can I use a custom image in a private catalog with an instance group? 

Yes, you can use a custom image in a private catalog with an instance group. However, you must first create a service-to-service policy to globalcatalog-collection.instance.retrieve before you can create the instance group. For more information, see [Using a custom image in a private catalog with an instance group](https://cloud.ibm.com/docs/vpc?topic=vpc-private-catalog-image-instance-group&interface=ui).





 Can I change the boot volume associated with my resource group after creating the resource group? 

No. The resource group of a volume is set at resource creation and cannot be changed. This behavior is shared by all VPC resources.





 Can I move my volume to another region or zone? 

No, a volume is restricted to the zone it was created in. However, you can move the volume's data by creating a new snapshot from the volume, and creating a new volume from that snapshot in a different zone.
Auditing events for DNS Services 

As a security officer, auditor, or manager, you can use the Activity Tracker service to track how users and applications interact with the IBM Cloud® DNS Services service in IBM Cloud®.

IBM Cloud Activity Tracker records user-initiated activities that change the state of a service in IBM Cloud. You can use this service to investigate abnormal activity and critical actions and to comply with regulatory audit requirements. In addition, you can be alerted about actions as they happen. The events that are collected comply with the Cloud Auditing Data Federation (CADF) standard. For more information, see the [getting started tutorial for IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started).



 DNS zone events 

The following table lists the actions that are related to DNS zones and generate an event.



Table 1. DNS zones

 Action Description 

 dns-svcs.zones.read Get or list DNS zones. 
 dns-svcs.zones.create Create a DNS zone. 
 dns-svcs.zones.update Update a DNS zone. 
 dns-svcs.zones.delete Delete a DNS zone. 







 Resource records events 

The following table lists the actions that are related to resource records and generate an event.



Table 2. Resource records

 Action Description 

 dns-svcs.resource-records.read Get or list resource records. 
 dns-svcs.resource-records.create Create a resource record. 
 dns-svcs.resource-records.update Update a resource record. 
 dns-svcs.resource-records.delete Delete a resource record. 







 Permitted networks events 

The following table lists the actions that are related to permitted networks and generate an event.



Table 3. Permitted networks

 Action Description 

 dns-svcs.permitted-networks.read Get or list permitted networks from DNS zone. 
 dns-svcs.permitted-networks.create Add a permitted network to DNS zone. 
 dns-svcs.permitted-networks.delete Remove a permitted network from DNS zone. 







 Global balancer events
The location policy (if one is defined in the AZ), has the highest priority and is used first. If every origin pool in the location policy is down, then the DNS resolver uses origin pools from default policy. If all of the origin pools in the default policy are also down, then the DNS resolver goes to the origin pool designated in the fallback policy.





 How DNS resolvers handle resource record TTLs for DNS responses 

As noted earlier, if an origin's address is a hostname, then this hostname can represent the name to an A, AAAA, or CNAME resource record. In these scenarios, a DNS query resolved using a global load balancer might require the resolver to consider multiple resource records at the same time.

When the DNS resolver responses to a query, it chooses the lowest TTL observed among the set of resource records considered and the TTL configured on the global load balancer itself as the TTL for the resource records in the response.

The resulting DNS response that is based on a global load balancer might only contain the necessary A or AAAA records, referring to the load-balanced IP addresses. However, the configuration of other items that a global load balancer depends on can also affect the TTL in the DNS response. This is especially true when there are origins with an address which refers to a CNAME resource record that is part of a CNAME chain to the desired A or AAAA resource record.

There might be other scenarios where an origin's address refers to a resource record, or leads to a chain of other resource records, configured on a different DNS zone on the public internet. As a result, some resource records considered by DNS resolvers can come from other, upstream DNS resolvers. If an upstream DNS resolver's cached resource records contains a lower TTL in its cache as a result of its particular caching method, then the minimum TTL observed among all considered resource records might be pushed lower. This results in a DNS response that contains resource records with TTLs lower than the maximum expected duration.







 Viewing, editing, or deleting components of a global load balancer 

To view, edit or delete a load balancer, or one of its components, click an action from the overflow menu !
Access within the account is separate from the enterprise, and users don't automatically get access within the enterprise when the account is imported.
* Resources within the account are not changed. Users with the correct access permissions can continue to view usage information for resources in the account.



To import existing accounts into an enterprise, the following access is required:



* Within the account to be imported, you must be the account owner or have the Administrator role on the Billing service within the account.
* Within the enterprise account, you need the Editor or Administrator role on the Enterprise service and the Administrator role on the Billing service.





 Importing an account in the console 

To import an existing account, complete the following steps:



1. Log in to your enterprise account, and go to Manage > Enterprise in the IBM Cloud console.
2. Click Accounts to view the accounts and account groups in the enterprise. In the Accounts section, select Add > Import account.
3. Select the account that you want to import.

If no accounts are displayed, you likely don't have the correct access in any existing accounts.
4. If you want to add the account to an account group, select the account group to be its parent. The parent that you select determines where in the enterprise hierarchy the account exists.
5. Review the information about impacts to your account, and select I understand the impact to my account. Then, click Import.

After the account is imported to the enterprise, it can't be removed. Be sure you want to permanently move the account to the enterprise.







 Importing accounts by using the CLI 



1. Find the ID of the account that you want to import to the enterprise.

ibmcloud account list
2. If you want to add the account to an account group, find the names and IDs of existing account groups in the enterprise.

ibmcloud enterprise account-groups --recursive
3. Import the account into the enterprise, specifying the account ID for the --account ID parameter. If you don't specify a parent account group, the account is added directly under the enterprise.

ibmcloud enterprise account-import --account-id ID
Log in to the Thales Support Portal is required.
* How can I back up my IBM Cloud HSM configuration?

To backup your IBM Cloud HSM configuration, see the Appliance Administration Guide for your HSM version. The appropriate Appliance Administration Guide can be found from the [My Products](https://supportportal.gemalto.com/csm?id=csm_my_products) page on the Thales Portal.



IBM Cloud for Education



* What happens after I create my service instance?

After you create your service instance order for IBM Cloud For Education, your service instance should be shown on the Resource List and the status of your service instance is "Provision in progress". It means that your have submitted successfully your order and our backend engineer needs to review your order and we might need to reach out to you with some detail questions on your VM environment configuration so we can setup the VM image correctly. Following is the sample questions we'll need your input:



* The name of your institution
* How many potential users will use Applications Lab? (E.g. the size of your institution)
* What is the authentication method do you and your institution want to use to login Applications Lab? You can choose to use your institution federated system to authenticate your users, or IBMid, or customized local account.
* Which user group (on your institution federated system, or list of users) need to have the privilege to create/manage images? And which user group (on your institution federated system, or list of users) need to have the administrator privilege for your institution?
* Do you need to use Windows image? We can provide base Windows 10 Pro image, but you need to bring your own Windows VDA license for your organization. (Windows Server 2019 with license is provided.)
* Do you have any specific access control requirement? For instance, which user group (on your institution federated system, or list of users) need to access which image. You can always submit new request through “Help” on Applications Lab main page.