vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Why can't I create a new admin certificate? 

  What’s happening 

When you try to create a new admin certificate, you see an error message similar to the following example.

You have reached the maximum number of admin certificates. To create a new admin certificate, you must remove an existing one by revoking a user's IAM admin permissions and then removing their entry from the ibm-admin-cert ClusterRoleBinding.

  Why it’s happening 

You have reached the limit of 50 admin certificates per cluster.

  How to fix it 

You must remove an existing admin certificate before you can add a new one.

To complete the following tasks, you must have the Administrator IAM access role for the cluster.



1.  Log in to the CLI.
2.  [Remove the user's IAM access permissions](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iam).
3.  Set the context for your cluster. Include the --admin option.

ibmcloud ks cluster config --cluster mycluster --admin
4.  Edit the ibm-admin-cert ClusterRoleBinding file. The following command opens an editor in your terminal window.

kubectl edit clusterrolebinding ibm-admin-cert
5.  In the ibm-admin-cert ClusterRoleBinding file, find the admin certificate to remove. If you logged in with a service ID, the name of the entry contains Service-ID-XX, with XX as the service ID to remove. Otherwise, the name of the entry contains IBMid-XX in the name, with XX as the user ID to remove.

The following entries show examples to remove.

- apiGroup: rbac.authorization.k8s.io
kind: User
name: iam-ServiceId-XXX-admin-<DATE>

- apiGroup: rbac.authorization.k8s.io
kind: User
name: IBMid-YYY-admin-<DATE>
6.  Try again to create the admin certificate.
Why can't I create a new admin certificate? 

  What’s happening 

When you try to create a new admin certificate, you see an error message similar to the following example.

You have reached the maximum number of admin certificates. To create a new admin certificate, you must remove an existing one by revoking a user's IAM admin permissions and then removing their entry from the ibm-admin-cert ClusterRoleBinding.

  Why it’s happening 

You have reached the limit of 50 admin certificates per cluster.

  How to fix it 

You must remove an existing admin certificate before you can add a new one.

To complete the following tasks, you must have the Administrator IAM access role for the cluster.



1.  Log in to the CLI.
2.  [Remove the user's IAM access permissions](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iam).
3.  Set the context for your cluster. Include the --admin option.

ibmcloud oc cluster config --cluster mycluster --admin
4.  Edit the ibm-admin-cert ClusterRoleBinding file. The following command opens an editor in your terminal window.

oc edit clusterrolebinding ibm-admin-cert
5.  In the ibm-admin-cert ClusterRoleBinding file, find the admin certificate to remove. If you logged in with a service ID, the name of the entry contains Service-ID-XX, with XX as the service ID to remove. Otherwise, the name of the entry contains IBMid-XX in the name, with XX as the user ID to remove.

The following entries show examples to remove.

- apiGroup: rbac.authorization.k8s.io
kind: User
name: iam-ServiceId-XXX-admin-<DATE>

- apiGroup: rbac.authorization.k8s.io
kind: User
name: IBMid-YYY-admin-<DATE>
6.  Try again to create the admin certificate.
From the menu bar, click Manage > Access (IAM), and select Users to browse the existing users in your account.
2. Select a table row, and click the ⋯ icon to open a list of options for that user.
3. From the options menu, click Assign access.
4. Click Assign access to the users.
5. Click the IAM services tile.
6. From the list of services, select Key Protect.
7. Select Resources based on selected attributes.
8. Click the Instance ID box and select the instance in which the key ring resides from the drop-down list.
9. Click the Key Ring ID box and enter the name of the key ring. Note that the key ring ID is case sensitive and must be exact.
10. Choose the combination of [platform and service access roles](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-accessmanage-access-roles) you want this user to have.
11. Click Add.
12. Continue to add platform and service access roles as needed and when you are finished, click Assign. Note that the user must be assigned at least Reader access to the entire instance in order for them to list, create and delete key rings within the instance.



Zoom

![The image shows an example of how to grant user access to a key ring.](https://cloud.ibm.com/docs-content/v1/content/0bc8db34a3d90b2a5103c9c71b08a96de9525bbc/key-protect/images/key-ring-iam-policy.png)

Figure 1. Shows how to grant user access to a key ring.







 Granting access for specific functions 

In order to use the Key Protect [Key Purge feature](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-purge-keys), a specific role called KeyPurge must be granted as it is not enabled by default, even for the account owner.
You can create multiple API keys for a user to support key rotation scenarios, and the same key can be used for accessing multiple services. IBM Cloud API keys enable users who use two-factor authentication or a federated ID to automate authentication to the console from the command line. A user can also have a single classic infrastructure API key that can be used to access classic infrastructure APIs; however, this is not required as you can use IBM Cloud API keys to access the same APIs. For more information, see [Understanding API keys](https://cloud.ibm.com/docs/account?topic=account-manapikey).





 Service IDs 

A service ID identifies a service or application similar to how a user ID identifies a user. These are IDs that can be used by applications to authenticate with an IBM Cloud service. Policies can be assigned to each service ID to control the level of access that is allowed by an application that uses the service ID, and an API key can be created to enable the authentication. For more information, see [Creating and working with service IDs](https://cloud.ibm.com/docs/account?topic=account-serviceids).

Infrastructure-as-a-Service (IaaS) doesn't support operations that are made by service IDs. If an account includes IaaS and PaaS, administrative functions that are made by a service ID might not work as intended if the operation depends on API calls to IaaS. In an account that includes IaaS, be sure that account administrators complete the administrative functions. For example, functional IDs can be used for administrative functions. In some cases, IBM support might be able to assist with some administrative functions that span both IaaS and PaaS.





 Multifactor authentication 

You can require multifactor authentication (MFA) for every user in the account or just users with non-federated IDs who do not use SSO. All users with an IBMid use a time-based one-time passcode (TOTP) MFA factor, and any users with a different type of ID must be enabled to use the TOTP, security questions, or external authentication factor separately.
Auditing events 

As a security officer, auditor, or manager, you can use the Activity Tracker service to track how users and applications interact with the IBM® API Connect for IBM Cloud® V10 Reserved instance service in IBM Cloud®.

IBM Cloud Activity Tracker records user-initiated activities that change the state of a service in IBM Cloud. You can use this service to investigate abnormal activity and critical actions and to comply with regulatory audit requirements. In addition, you can be alerted about actions as they happen. The events that are collected comply with the Cloud Auditing Data Federation (CADF) standard. For more information, see the [getting started tutorial for IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started).

API Connect V5 does not support the use of the Activity Tracker service.



 List of events 

Table 1 describes the actions that the API Connect V10 Reserved service provides for APIs, subscriptions, and domains.



Table 1. Actions that generate events

 Action Description 

 apiconnect.user_registry_create.create Create a User Registry object 
 apiconnect.user_registry_clear.delete Clear the User Registry objects 
 apiconnect.user_registry_update.update Update the User Registry object by name or ID 
 apiconnect.user_registry_del.delete Delete the User Registry object by name or ID 
 apiconnect.user_registry_executeById.create Execute a User Registry operation 
 apiconnect.user_registry_testConnectionById.create Test a User Registry connection 
 apiconnect.user_registry_execute.create Execute a User Registry operation 
 apiconnect.user_registry_testConnection.create Test a User Registry connection 
 apiconnect.user_registry_search.create Search for users in the user registry 
 apiconnect.user_create.create Create a User object 
 apiconnect.user_clear.delete Clear the User objects 
 apiconnect.user_update.update Update the User object by name or ID 
 apiconnect.user_del.delete Delete the User object by name or ID
How to fix it 

You can use any of the following methods to resolve this problem:



* Reduce the size of your Git Repos and Issue Tracking repo. For more information about reducing the size of your repo, see [Reducing the repository size using Git](https://docs.gitlab.com/ce/user/project/repository/reducing_the_repo_size_using_git.html).
* Use SSH to bypass the default clone timeout of 180 seconds.
* If you are attempting to clone a repo, complete a shallow clone (git clone --depth) to reduce the amount of data that is transferred by truncating the commit history. For more information about completing a shallow clone, see the [Git Reference documentation](https://git-scm.com/docs/git-cloneDocumentation/git-clone.txt---depthltdepthgt).







 I tried adding a user to my GitLab project by way of email, but they didn't receive the invitation. How do I add them to my project? 

The invitation might be blocked by the user's email.

 What’s happening 

I invited a user to my GitLab project by using their email address that is listed in Git Repos and Issue Tracking, but they didn't receive the email.

 Why it’s happening 

The email might be blocked from the user's inbox by spam filters.

 How to fix it 

You can use any of the following methods to resolve this problem:



* Check your email spam folder to determine whether the email invitation was marked as spam. Emails are sent from a noreply@ address. Update your spam filters to allow emails from this address.
* Investigate whether corporate spam filters that are outside of the user's control are blocking the email. Ask the user to log in to the Git Repos and Issue Tracking user interface and send you their user ID. You can add the user to the GitLab project by using their user ID.







 When I use Terraform to update the configuration of an existing Git tool integration, why does the configuration fail?
[Navigation Menu icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/icon_hamburger.svg) > Resource list, then select the name of the service to open its details. Click Service credentials to view the details or to select New Credential.

To save a copy of the service credentials, most services provide a download option or the option to copy to your clipboard.





 Why use resource groups and access groups? 

A resource group is a logical container for resources. When a resource is created, you assign it to a resource group and the resource can't be moved.

An access group is used to easily organize a set of users, service IDs, and trusted profiles into a single entity to make access assignments easy. You can assign a single policy to an access group to grant all members those permissions. If you have more than one user or service ID that needs the same access, create an access group instead of assigning the same access multiple times per individual user, service ID, or trusted profile.

By using both resource groups and access groups, you can streamline the access assignment policy by assigning a limited number of policies. You can organize all of the resources a specific group of users and service IDs needs access to in a single resource group, group all the users or service IDs into an access group, and then assign a single policy that grants access to all resources in the resource group.

For more information, see [Best practices for organizing resources and assigning access](https://cloud.ibm.com/docs/account?topic=account-account_setuphow_access).





 How do I ensure that my users can create resources within a resource group? 

To create a resource in a resource group, the user must have two access policies: one assigned to the resource group itself, and one assigned to the resources in the group. Access to the resource group itself is simply access to the container that organizes the resources, and this type of policy allows a user to view, edit, or manage access to the group, but not the resources within it.
Its configuration is similar to the production environment. It is loaded with realistic data (anonymized production data as example).
* Production - this environment is updated with the version validated in the previous environment.



A delivery pipeline manages the progression of a build through the environment. It can be fully automated or include manual validation gates to promote approved builds between environments - this is really open and should be set up to match the company best practices and workflows.

To support the execution of the build pipeline, we introduce a [Service ID](https://cloud.ibm.com/docs/account?topic=account-serviceids). A service ID identifies a service or application similar to how a user ID identifies a user. Policies can be assigned to a service ID, providing it access to resources. This service ID is used in the delivery pipelines and any other cloud resources requiring strong ownership. This approach helps in the case where a team member leaves the company or is moving to another project. The service ID will be dedicated to your project and will not change over the lifetime of the project. The [service ID should be locked](https://cloud.ibm.com/docs/account?topic=account-serviceidslock_serviceid) to protect it against accidental deletion. The next thing you will want to create is [an API key](https://cloud.ibm.com/iam/serviceids) for this service ID. You will select this API key when you set up the DevOps (or DevSecOps) pipelines, or when you want to run automation scripts, to impersonate the service ID.

When it comes to assigning responsibilities to the project team members, let's define the following roles and related permissions:



Roles and permissions across environments

 Development Testing Production
Any user that uses your email domain can create their own IBMid, and the password they create is managed by IBMid. They can create an IBM Cloud account and invite other users with an IBMid to their account. They can also access other IBM web offerings by using that same IBMid.

Federated IBMid users
: Enterprise customers often connect their internal user directory, or IdP, with IBMid so that their employees don't need to manage an additional password. Instead, they can reuse their normal login to their IdP to log in to IBM web offerings, including IBM Cloud. Connecting an external IdP with IBMid is called federation, and the technical underlying protocol is called SAML. Those users are often referenced as federated IBMid users. As IBMid is federating with multiple enterprise customers at the same time, one prerequisite of a successful federation is a unique email address for each IBMid user.

IBM Cloud App ID users
: Instances of the IBM Cloud App ID can also connect to an IdP. An App ID instance can connect to onlyone external IdP using SAML, and therefore a unique email address isn't required.





 IBM Cloud account owners 

To create an IBM Cloud account, you need an IBMid user that will be the IBM Cloud account owner. You can create this IBMid user during the [IBM Cloud account registration process](https://cloud.ibm.com/registration), or you use an existing IBMid user. We recommend creating the account by using a [functional ID](https://cloud.ibm.com/docs/account?topic=account-identity-overviewfunctionalid-bestpract) or service account with a valid email address, this can help simplify account ownership continuity in your organization.

For any additional members of your IBM Cloud account, you have the option to use normal or federated IBMid users as IBM Cloud account members. Alternatively, you can connect your IdP to your IBM Cloud account by using an IBM Cloud App ID service instance. All users that log in through that IBM Cloud App ID service instance are added to your account automatically, so you don't need to invite those users.





 How do you onboard IBM Cloud account members?
<br>For details on how to request Client Communications Center access, see [How to Request Client Communications Center Access](https://cloud.ibm.com/docs/mas-ms?topic=mas-ms-ssphow-to-request-ccc-access) 
 Create Database Service Account Creates a database service account on the asset the access request is linked to. This account should be used for integration (i.e. used by a program not by a user). <br>Database accounts requested for non-production assets will be granted read/write access to the primary database server. Accounts for production assets (not yet available) will be granted read only access on the standby database server. <br>The database password and the required SSL certificate information will be populated on the Access record when the account is created. <br>Note: Database service account passwords expire every 365 days. Passwords can be reset through the Access Management Tool. <br>For details on how to request a Database Service Account, see [How to Request a Database Service Account](https://cloud.ibm.com/docs/mas-ms?topic=mas-ms-ssphow-to-request-database-service-account) 
 Create Database User Account Creates a database user account on the asset the access request is linked to. <br>Database accounts requested for non-production assets will be granted read/write access to the primary database server. Accounts for production assets (not yet available) will be granted read only access on the standby database server. <br>The database password and the required SSL certificate information will be populated on the Access record when the account is created. <br>Note: Database user account passwords expire every 90 days. Passwords can be reset through the Access Management Tool. <br>For details on how to request a Database User Account, see [How to Request a Database User Account](https://cloud.ibm.com/docs/mas-ms?topic=mas-ms-ssphow-to-request-ccc-access) 
 Reset Database Account Password Issues a request to reset the password for the selected Database User or Service Account.
Limiting access to a single Object Storage bucket 

IBM Cloud IAM resource groups and access groups allow administrators to restrict users access to various service instances, but what if a user needs to only access a limited number of buckets within a service instance? This can be accomplished using a custom role and a narrowly tailored IAM policy.

This tutorial provides an introduction to granting access to a single Object Storage bucket.

If you're not familiar with IBM Cloud® Object Storage, you can quickly get an overview by [getting started with IBM Cloud Object Storage](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-getting-started-cloud-object-storage). Also, if you're not familiar with IAM, you may wish to check out how to [get started with IAM](https://cloud.ibm.com/docs/account?topic=account-iamoverviewiamoverview).



 Before you begin 

If you are already managing instances of Object Storage or IAM, you do not need to create more. However, as this tutorial will modify and configure the instance we are working with, make sure that any accounts or services are not being used in a production environment.

This tutorial will create a new access policy and a new custom role in the process.

For this tutorial, you need:



* An [IBM Cloud® Platform account](https://cloud.ibm.com)
* An [instance of IBM Cloud Object Storage](http://cloud.ibm.com/catalog/services/cloud-object-storage)
* A bucket to which a user should be constrained
* To complete the steps to manage access to the service, your user ID needs administrator platform permissions to use the IAM service. You may have to contact or work with an account administrator.







 Step 1: Create a custom role 

First, we need to create a role that allows a user to view a list of buckets, but not to access them or be able to create new buckets.



1. Navigate to IAM by following the Manage drop-down menu, and selecting Access (IAM).
2. Select Roles from the navigation menu.
3.
Managing archiving by using the API 

You can archive logs from an IBM Log Analysis instance into a bucket in an IBM Cloud Object Storage (COS) instance by using an API.



 Prerequisites on the IBM Log Analysis service 



* You must have a paid service plan for the IBM Log Analysis service. [Learn more](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-service_plans).
* Check that your user ID has permissions to manage archiving. The following table lists the minimum roles that a user must have to manage archiving by using the API:





Table 1. IAM roles

 Role Permission granted 

 Platform role: Viewer Allows the user to view the list of service instances. 
 Service role: Manager Allows the user to manage archiving by using the API. 



For more information on how to configure policies for a user, see [Granting user permissions to a user or service ID](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-iam_view_events).

You must have a COS bucket configured, and the details of the service credential that you must use to write data to the bucket. For more information on creating buckets, see [Create some buckets to store your data](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-getting-started-cloud-object-storage).





 Get details of the archiving configuration 

Use [this method](https://cloud.ibm.com/apidocs/log-analysisget-v1-config-archiving) to get the details about an existing streaming configuration.

curl -X GET https://<ENDPOINT>/v1/config/archiving
-H "content-type: application/json"
-H "servicekey: <SERVICE_KEY>"



* Replace <ENDPOINT> with the IBM Log Analysis API endpoint.
Your CLI session is targeted to this or another resource group.
* You don't have access to the cluster.



 How to fix it 

To check your user access permissions:



1. List all your user permissions.

ibmcloud iam user-policies <your_user_name>
2. Check if you have access to the cluster and to the resource group that the cluster is in.



1. Look for a policy that has a Resource Group Name value of the cluster's resource group and a Memo value of Policy applies to the resource group. If you have this policy, you have access to the resource group. For example, this policy indicates that a user has access to the test-rg resource group:

Policy ID: 3ec2c069-fc64-4916-af9e-e6f318e2a16c
Roles: Viewer
Resources:
Resource Group ID 50c9b81c983e438b8e42b2e8eca04065
Resource Group Name test-rg
Memo Policy applies to the resource group
2. Look for a policy that has a Resource Group Name value of the cluster's resource group, a Service Name value of containers-kubernetes or no value, and a Memo value of Policy applies to the resource(s) within the resource group. If you this policy, you have access to clusters or to all resources within the resource group. For example, this policy indicates that a user has access to clusters in the test-rg resource group:

Policy ID: e0ad889d-56ba-416c-89ae-a03f3cd8eeea
Roles: Administrator
Resources:
Resource Group ID a8a12accd63b437bbd6d58fb6a462ca7
Resource Group Name test-rg
Service Name containers-kubernetes
Service Instance
Region
Resource Type
Resource
Memo Policy applies to the resource(s) within the resource group
3. If you have both of these policies, skip to Step 4, first bullet.