vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Boot volume The default boot volume size for all profiles is 100 GB. You can specify a larger boot volume capacity, up to 250 GB, depending on what the image allows. You can also specify user tags. 
 Data volumes You can add one or more secondary data volumes to be included when you provision the instance. To add volumes, click Create. You can specify customer-managed encryption and user tags for the volume. 
 Virtual private cloud Specify the IBM Cloud VPC where you want to create your instance. You can use an existing VPC or you can create a new VPC. To create a new VPC, click New VPC. 
 Network interfaces Defines the networking connection into the IBM Cloud VPC. 
 User data You can add user data that automatically performs common configuration tasks or runs scripts. For more information, see [User data](https://cloud.ibm.com/docs/vpc?topic=vpc-user-data). 
 Metadata Disabled by default, lets instances created from this template gather metadata about itself. Click the toggle to turn the metadata service on. For more information, see [About Instance Metadata for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-imd-about). 
 Host failure auto restart This setting is enabled by default. To disable host failure auto restart, click the toggle. For more information, see [Host failure recovery policies](https://cloud.ibm.com/docs/vpc?topic=vpc-host-failure-recovery-policies&interface=ui). 
 Add instance to placement group You have the option to select a placement group for the instance. To enable placement groups, click the toggle. Then, select or create a placement group for the instance. If you add a placement group, the instance is placed according to the placement group strategy. For more information, see [About placement groups](https://cloud.ibm.com/docs/vpc?topic=vpc-about-placement-groups-for-vpc). 



Important: Instance groups don't support instance templates that have the following configurations:



* Secondary network interfaces aren't supported.
While you cannot delete mysql database, users can drop tables, including the mysql.users table that contains internal users. Clients shouldn't delete any table belonging to mysql database as this action can result in a broken formation, which can only be resolved with a Point-in-time recovery (PITR).

IBM Cloud does not alert on formation breaking because of a system table dropped by a client.





 More Users and Connection Strings 

Access to your Databases for MySQL deployment is not limited to the admin user. You can create users by using the Service Credentials panel, the IBM CLI, or through the IBM Cloud Databases API.

All users on your deployment can use the connection strings, including connection strings for either public or private endpoints.

When you create a user, it is assigned certain database roles and privileges. These privileges include the ability to log in, create databases, and create other users. For more information, see the [Managing Users, Roles, and Privileges](https://cloud.ibm.com/docs/databases-for-mysql?topic=databases-for-mysql-user-management) page.



 Creating Users in Service Credentials 



1. Navigate to the service dashboard for your service.
2. Click Service Credentials to open the Service Credentials panel.
3. Click New Credential.
4. Choose a descriptive name for your new credential.
5. (Optional) Specify whether the new credentials should use a public or private endpoint. Use either { "service-endpoints": "public" } / { "service-endpoints": "private" } in the Add Inline Configuration Parameters field to generate connection strings using the specified endpoint. Use of the endpoint is not enforced. It just controls which hostnames are in the connection strings. Public endpoints are generated by default.
6. Click Add to provision the new credentials. A username and password, and an associated database user in the MySQL database are auto-generated.



The new credentials appear in the table, and the connection strings are available as JSON in a click-to-copy field under View Credentials.
You must install a monitoring agent to collect and forward metrics from a bare metal server to an IBM Cloud Monitoring instance.

Complete the following steps from the command line to install a monitoring agent:



1. Obtain the access key. For more information, see [Getting the access key through the IBM Cloud UI](https://cloud.ibm.com/docs/monitoring?topic=monitoring-access_keyaccess_key_ibm_cloud_ui).
2. Obtain the ingestion URL. For more information, see [collector endpoints](https://cloud.ibm.com/docs/monitoring?topic=monitoring-endpointsendpoints_ingestion).
3. Deploy the monitoring agent. Run the following command:

curl -sL https://ibm.biz/install-sysdig-agent | sudo bash -s -- --access_key ACCESS_KEY --collector COLLECTOR_ENDPOINT --collector_port 6443 --secure true --tags TAG_DATA --additional_conf 'sysdig_capture_enabled: false'

Where



* ACCESS_KEY is the ingestion key for the instance.
* COLLECTOR_ENDPOINT is the ingestion URL for the region where the monitoring instance is available.
* TAG_DATA are comma-separated tags that are formatted as TAG_NAME:TAG_VALUE. You can associate one or more tags to your monitoring agent. For example, role:serviceX,location:us-south. Later on, you can use these tags to identify metrics from the environment where the agent is running.
* The SECURE flag must be set to true to use a secure SSL/TLS connection to send metrics to the collector.
* Set sysdig_capture_enabled to false to disable the capture feature. By default is set to true. For more information, see [Working with captures](https://cloud.ibm.com/docs/monitoring?topic=monitoring-capturescaptures).



If cURL is not available, you must install it.
Key name Select the root key within the KMS instance that you want to use for encrypting the share. 
 Key ID Shows the key ID that is associated with the data encryption key that you selected. 



5. When all the required information is provided, click Create file share. You're returned to the File Shares for VPC page, where a message indicates that the file share is provisioning. When completed, the status changes to Active.



If you created your Key Protect or Hyper Protect Crypto Services instance by using a private endpoint, root keys that were created by using that instance are not shown in the UI. You must use the CLI or API to access and use those root keys.





 Create customer-managed encryption file shares from the CLI 

To create a file share with customer-managed encryption from the CLI, use the ibmcloud is share-create command with the --encryption-key option. The encryption_key parameter specifies a valid CRN for the root key in the key management service.

Before you begin, verify that you completed the [prerequisites](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-createbefore-creating-file-storage-cli), then follow these steps:



1. Use the procedure in [Step 1 - Obtain service instance and root key information](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-instances-byokbyok-cli-setup-prereqs) to obtain the ID of your key management service and the CRN of the root key in that service.
2. Specify the ibmcloud is share-create command with the --encryption-key option to a volume with customer-managed encryption. The encryption_key parameter specifies a valid CRN for the root key in the key management service.



As of 30 May 2023, you can use --mount-targets instead of -targets option. To see and use the updated option, set the feature environment variable IBMCLOUD_IS_FEATURE_FILESHARE_CHANGE_TO_MOUNT_TARGETS to true with the export command.

ibmcloud is share-create
Configuring Direct Link on Classic 

After your IBM Cloud® Direct Link on Classic connectivity is established, you can follow the steps that are given in this document to configure your subnet to interact with IBM Cloud.

In general, to get your Direct Link on Classic connection working, you must do some basic network configuration steps, and then set up Border Gateway Protocol (BGP). During the setup process, an IBM engineer works with you to enable your network to use Virtual Routing Function (VRF) capability, which is required.



 Basic network configuration 



1. Define your remote network that uses the standard RFC1918 private address space.



* For new environments, the 10.0.0.0/8 space.
* For existing environments that use 10.0.0.0/8, we recommend that you obtain a more detailed assessment to ensure that there is not a conflict with the IBM Cloud services network, or with the networks that are already assigned to your account.



2. Our staff at IBM Cloud assigns a /31 or /30 for each connection and configures an interface IP address on the IBM Cloud cross-connect router (XCR) infrastructure.
3. Configure the interface on your customer edge router (CER) by using the IP address provided: use the IBM Cloud XCR IP as a next-hop for any traffic that is destined to IBM Cloud.
4. For return traffic, IBM Cloud uses the assigned CER IP as a next-hop for any traffic destined for the remote network, as advertised via BGP.







 Configuring BGP 

To exchange route information with your environment, IBM Cloud requires BGP to be configured. Options are as follows:



* ASN: IBM Cloud assigns a private ASN for each customer's use. Alternatively, you can use your own public ASN. Your preference is requested at the time you place your order. Your assigned private ASN is provided to you during the implementation process.
* VRF: Using VRF, IBM Cloud advertises the specific private subnets that are assigned to your customer account. You must advertise the remote networks that you want to be reachable from the IBM Cloud private network.
Creating a custom Linux image in OVA format 

You can use Power Systems Virtual Server workspace to deploy a Linux® virtual machine (VM) with a custom Linux image and receive support from a Linux vendor. When you are provisioning a VM, select Linux-Client supplied subscription for your own Linux image (OVA format) and subscription.

If you bring your own image, you must obtain the subscription for Linux directly from the vendor. After you deploy your Linux VM, you must log in to the VM and register it with the Linux vendor's satellite server. To reach the Linux vendor satellite servers (where you can register and obtain packages and fixes), you must attach a public network to your VM. To learn more about the registration process, see [Registering and subscribing to SLES](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-using-linuxregistering-sles) or [Registering and subscribing to RHEL](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-linux-with-powervssubscribing-to-rhel).



 How to create an OVA format Linux image 

Learn how to create an OVA image of a Linux operating system and import it into the Power Systems Virtual Server environment. You can use PowerVC or VIOS to capture an image.



 Using PowerVC to capture and import an OVA image 

If you've deployed PowerVC in your on-premises environment, you can use it to [Capture a virtual machine](https://www.ibm.com/docs/en/powervc/2.0.3?topic=images-capturing-virtual-machine) and create an OVA image. After you create the OVA image, upload it to your Cloud Object Storage account and import it into the Power Systems Virtual Server environment.





 Capturing an image from VIOS
"token_endpoint": "https://iam-region2.cloud.ibm.com/identity/token",
...
}

This request can be done when the application starts, and again if the authorization_endpoint fails. You can cache the authorization_endpoint value for a short amount of time, and refresh after the cache expires or an error occurs.





 Step 2: Redirecting users to your dashboard_url 

When users navigate to your dashboard_url, redirect the browser to the following URL to check whether they are logged in to your application and have the access token:

<authorization_endpoint>?client_id=<your-client-id>&redirect_uri=<your-redirect-uri>&response-type=code&state=<your-resource-instance-id>

The redirect_uri value refers to the redirect URL that you set up in the [Configuring your client ID and secret](https://cloud.ibm.com/docs/sell?topic=sell-develop-auth-authz&interface=uidevelop-oauth-prereq) step.



* If a user is logged in, they are immediately redirected. The browser does a callback to redirect the URI with a code response parameter and state value.
* If a user is not logged in, a login prompt appears. After a successful login, the browser does a callback to redirect the URI with a code response parameter and state value.







 Step 3: Calling the access token endpoint 

After the user successfully logged in, exchange the code that you received in Step 2 for the access token of the user by calling the access token endpoint.



 POST request to the token endpoint 

To obtain an access token, you must include the following headers and parameters:



 Parameters 



* client_id=[client ID]
* client_secret=[client secret]
* grant_type=authorization_code
* response_type=cloud_iam
* redirect_uri=[this parameter refers to the same URL from Step 1]
* To crawl SharePoint OnPrem, you must have the list of SharePoint site collection paths that you want to crawl. Discovery does not support folder paths as input.
* The number of gateways that you can create is limited to 50. If you exceed this limit, you will be unable to create any more gateways, and you will see an error message that states, Failed to update or create the network resource..
* SharePoint OnPrem cannot crawl Personal SiteCollections.







 IBM Cloud Object Storage 

When you connect to an IBM Cloud Object Storage source, the following credentials are required. You can obtain them from your IBM Cloud Object Storage administrator:



* endpoint - The endpoint name used to interact with IBM Cloud Object Storage data. Do not enter http:// or https://, as part of the IBM Cloud Object Storage endpoint credential. Otherwise, you might receive an error message indicating that you have invalid or expired credentials. For the proper formatting of endpoints, see the column named Endpoint in the table in [Regional Endpoints](https://cloud.ibm.com/docs/cloud-object-storage/basics?topic=cloud-object-storage-endpointsendpoints-region).
* access_key_id - access_key_id obtained when the IBM Cloud Object Storage instance was created.
* secret_access_key - secret_access_key to sign requests obtained when the IBM Cloud Object Storage instance was created.



IAM authentication is not currently supported for this connector. You need to set up HMAC authentication before you configure this connector. See [Service Credentials](https://cloud.ibm.com/docs/cloud-object-storage/iam?topic=cloud-object-storage-service-credentials) for instructions.

After this information is entered, you can choose how often you want to sync your data and select the buckets you want to sync to.

Other items to note when you crawl IBM Cloud Object Storage:



* This connector does not support crawling private endpoints.
* [How to implement an endpoint handler](https://cloud.ibm.com/docs/mqcloud?topic=mqcloud-mqoc_dr_notificationsmqoc_dr_handler)





 How to configure notification calls 



* Within the IBM Cloud console for the service instance in which your queue managers are deployed, navigate to your service instance and select the queue manager you wish to configure DR notification calls for.
* Click the tab titled 'Notification settings'.

![Image of the service instance options](https://cloud.ibm.com/docs-content/v1/content/3a120b16db5fdc3e70d071af8a63ce5515c1b096/mqcloud/images/mqoc_dr_menu.png)
* Click 'Create' to begin setting up your notification.
* Choose a display name for your notification and insert the endpoint url that you wish to receive the notifications calls.

This must be a secure url (HTTPS).

![Image of creating the DR notification](https://cloud.ibm.com/docs-content/v1/content/3a120b16db5fdc3e70d071af8a63ce5515c1b096/mqcloud/images/mqoc_dr_creation.png)
* To prevent malicious users from triggering your DR endpoint (i.e. invoking the url you have chosen to receive your notifications), it is recommended you use a query parameter in your url, which can be checked by the handler when invoked.



* For example:

https://example.com/disaster-recovery?token=R4nd0m5tr1ng0fCh4r4ct3r5
* When TLS is implemented during the connection (using HTTPS) the entire url, including the query parameter, is encrypted as it flows over the network, so the query parameter cannot be seen by a malicious user observing network traffic



* Click 'Create' to finish configuring your DR notification.
NSX-T provides a highly secure and flexible software-defined network to support the application requirements. NSX-T management is external to the workload cluster thus ensuring that network and security changes are not possible by anyone other than the designated administrators. All north-south network access in the workload cluster is done through private and secure connections by using IPsec or IBM Direct Link.

Add more workload clusters to deliver dedicated resources for more applications or to satisfy business or compliance requirements.





 Option for consolidated workload and management cluster 

Smaller deployments, such as those for Development, Test, or a minimal footprint DR site, might not require the deployment of both dedicated management and workload clusters. You can order the VMware Regulated Workloads environment with a consolidated management and workload cluster. When you use a consolidated cluster, additional operation and security risks exist. No option is offered to deploy without a Perimeter Gateway.

Resource exhaustion is an operational risk that might require reserving sufficient compute, storage, and network resources for management functions to ensure that the necessary resources are available to manage the environment. Another option to prevent resource exhaustion is through the assignment of quotas to workloads.

Before you deploy a consolidated cluster, consider the following possible security risks:



* An attacker who gets access to a workload VM might be able to use future microarchitectural vulnerabilities to steal secrets from or manipulate memory on an ESXi host.
* An attacker who gets access to a workload VM might be able to use future hypervisor vulnerabilities to escape from the VM and manipulate the management VMs on the same ESXi host.







 How to order VMware Regulated Workloads instances 

For more information, see:



* [VMware Regulated Workloads overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vrw-overview)
* [Ordering VMware Regulated Workloads](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vrw-orderinginstance-req)







 Related links
For more information, see [Ordering domain-validated certificates from third-parties](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-public-certificatesorder-public-certificates) or check out the [announcement blog](https://www.ibm.com/cloud/blog/announcements/now-available-order-domain-validated-tls-certificates-with-single-tenant-ibm-cloud-secrets-manager).





 30 August 2021 

Migrate certificates from Certificate Manager to Secrets Manager
: Ready to try Secrets Manager for certificates management? You can now take advantage of automation scripts that can help you to move certificates from Certificate Manager to Secrets Manager.

For more information, check out the [migration scripts in GitHub](https://github.com/ibm-cloud-security/certificate-manager-to-secrets-manager).





 20 June 2021 

Import and manage your existing TLS certificates
: Looking for the ability to centralize TLS certificates into a single secrets management service? You can now use Secrets Manager to import TLS certificates that are issued by external certificate authorities (CA).

For more information, check out [Importing TLS certificates](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-certificates).

Connect to Secrets Manager from your VPC network
: You can now connect to a Secrets Manager service instance by using Virtual Private Endpoints (VPE) for VPC.

To learn how to connect your existing Secrets Manager instance, see [Regions and endpoints](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-endpoints). For more information about setting up a virtual private endpoint gateway, check out [About virtual private endpoint gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe).





 19 May 2021 

Upcoming updates to supported cipher suites
: On 29 May 2021, Secrets Manager will deliver changes to the cipher suites that it supports for TLS connections to the service. This update is being implemented to enhance the security of IBM Cloud users and protect user data.
This way, you can assign a single policy to the access group rather than an individual policy for each user or service ID. For more information about using access groups, see [What makes a good access group strategy?](https://cloud.ibm.com/docs/account?topic=account-account_setupaccessgroup_strategy)







 Organize secrets in your Secrets Manager instance by using secret groups 

Use secret groups to narrow the scope of access to specific secrets at an instance level.



1. Create secret groups to assign even more granular access to a group of secrets, such as those that map to a specific application. To create a secret group, go to the Secrets Manager UI > Secret groups > Create.

If you're familiar with using resource groups, think of organizing secrets in a secret group similar to the way that you organize resources in resource groups. As an admin, you create secret groups to control access to secrets in your instance. For example, you can create a secret group that contains only the secrets that are used to authenticate to a specific resource or system. Then, you assign the secret group to an IAM access group so that only your selected users or service IDs are able to access those secrets. For more information about managing secret groups, see [Organizing your secrets](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-secret-groups).

A default secret group is created for you when you create a Secrets Manager instance. It's important that you create your secret groups first because you can't change the assignment of secrets after you create them. If you accidentally assign a secret to the wrong secret group, or if you don't want a secret to belong to the default secret group, delete the secret and create a new one.
2. Optionally, use secret groups to allow privileged access to specific resources in your account.

Secret groups can be used to grant direct access to resources that otherwise wouldn't be possible through IAM. For example, assume that User A has no access to Service A in IAM.