vania-janet/multiturn-rag-retrieval-data huggingface dataset:
istio: ingressgateway
servers:
- port:
number: 443
name: https
protocol: HTTPS
tls:
mode: SIMPLE
credentialName: <secret_name>
hosts:
- ""
Show more
3. Create the new bookinfo-gateway in your cluster.

kubectl apply -f bookinfo-gateway.yaml
4. In a web browser, open the BookInfo product page. Ensure that you use HTTPS for the subdomain that you found in step 2.

https://<subdomain>/productpage
5. Try refreshing the page several times. The requests to https://<subdomain>/productpage are received by the Istio gateway load balancer. The different versions of the reviews microservice are still returned randomly because the Istio gateway manages the virtual service and destination routing rules for microservices.







 Understanding what happened 

The BookInfo sample demonstrates how three of Istio's traffic management components work together to route ingress traffic to the app.

Gateway
: The bookinfo-gateway[Gateway](https://istio.io/latest/docs/reference/config/networking/gateway/) describes a load balancer, the istio-ingressgateway service in the istio-system namespace that acts as the entry point for inbound HTTP/TCP traffic for BookInfo. Istio configures the load balancer to listen for incoming requests to Istio-managed apps on the ports that are defined in the gateway configuration file. To see the configuration file for the BookInfo gateway, run the following command.

kubectl get gateway bookinfo-gateway -o yaml

VirtualService
: The bookinfo[VirtualService](https://istio.io/latest/docs/reference/config/networking/virtual-service/) defines the rules that control how requests are routed within the service mesh by defining microservices as destinations.
If the oldTtl and newTtl inputs are equal, it exits early.



* Parameters - stringuniqueId, stringoldPath, stringnewPath, intoldTtl, intnewTtl
* Return - An object of type SoftLayer_Network_CdnMarketplace_Configuration_Cache_TimeToLive.



--------------------





 deleteTtl 

Deletes an existing TimeToLive object.



* Parameters - stringuniqueId, stringpathName
* Return - A string with the status of the delete.



--------------------





 listTtl 

Lists existing TimeToLive objects based on a CDN's uniqueId.



* Parameters - stringuniqueId
* Return - An array of objects of type SoftLayer_Network_CdnMarketplace_Configuration_Cache_TimeToLive.



--------------------







 API for Metrics 

[Metrics container](https://cloud.ibm.com/docs/CDN?topic=CDN-metrics-container)

All metrics time is UTC+0.



 getCustomerInvoicingMetrics 

Returns all mappings' bandwidth and hits (including static and dynamic separately) of predetermined statistics for direct display for a customer's account, over a given period of time with granularity of day.



* Parameters:



* vendorName - Provide the name of the CDN provider for this customer. Currently, only akamai is supported.
* startDate - Provide the start date timestamp (UTC+0) for query.
* endDate - Provide the end date timestamp (UTC+0) for query.
* frequency - Provide the data frequency for data format, the following options are available to configure frequency:



* aggregate - Aggregated metrics data from startDate to endDatedefault.
* day - Daily metrics data from startDate to endDate.
--------------------



 Collecting metrics by using Prometheus exporters 

You can use Prometheus exporters to collect metrics from hosts, services, or apps which do not natively expose Prometheus-formatted metrics. You can monitor these metrics through a Monitoring instance.

There are different sources for Prometheus exporters:



* Official exporters are available in [the official Prometheus GitHub organization](https://github.com/prometheus) and are lable official.
* Sysdig curates and maintains [PromCat](https://promcat.io/). PromCat is an enterprise resource catalog where you can find supported Monitoring integrations for Kubernetes platforms and cloud-native services.



You can collect metrics from different sources such as:



* Hosts for which a Monitoring agent is not available such as Windows systems or VMware ESXi-Host systems.
* Hosts for which a Monitoring agent is available, but you need to collect other types of metrics such as IPMI sensor metrics or hardware and kernel-relaed metrics.
* Services like MySQL database



Zoom

![Prometheus integration with Monitoring](https://cloud.ibm.com/docs-content/v1/content/220cdcbf6f4421bd7fee83fd1028048dba3f16c8/monitoring/exporters/images/prometheus.svg)

Figure 1. Prometheus integration with Monitoring

The following table lists some Prometheus exporters that you can use to monitor your infrastructure:



Table 1. Exporters

 Exporters Use case Source 

 Blackbox exporter Allows blackbox probing of endpoints over HTTP, HTTPS, DNS, TCP and ICMP. The monitoring agent can be used in conjunction with the Blackbox exporter to collect availability metrics. [Prometheus Blackbox exporter](https://github.com/prometheus/blackbox_exporter) 
 IPMI exporter Collects Intelligent Platform Management Interface (IPMI) device sensor metrics.
IAM actions by role 

The following tables show the IBM Cloud Metrics Routing actions by role.

For IBM Cloud Metrics Routing, the IAM actions and Metrics Router actions are the same.



 Operator 



Table 1. IBM Cloud Metrics Routing actions for the operator role

 Platform role Metrics Router action Action 

 Operator metrics-router.target.read View a target. 
 Operator metrics-router.target.list List all targets. 
 Operator metrics-router.route.read View a route. 
 Operator metrics-router.route.list List all routes. 
 Operator metrics-router.setting.get View configuration settings. 
 Operator metrics-router.onboarding.get For IBM use only. 







 Viewer 



Table 2. IBM Cloud Metrics Routing actions for the viewer role

 Platform role Metrics Router action Action 

 Viewer metrics-router.target.read View a target. 
 Viewer metrics-router.target.list List all targets. 
 Viewer metrics-router.route.read View a route. 
 Viewer metrics-router.route.list List all routes. 
 Viewer metrics-router.setting.get View configuration settings. 
 Viewer metrics-router.onboarding.get For IBM use only. 







 Editor 



Table 3. IBM Cloud Metrics Routing actions for the editor role

 Platform role Metrics Router action Action 

 Editor metrics-router.target.read View a target. 
 Editor metrics-router.target.create Create a target. 
 Editor metrics-router.target.update Update a target. 
 Editor metrics-router.target.delete Delete a target. 
 Editor metrics-router.target.list List all targets. 
 Editor metrics-router.route.read View a route. 
 Editor metrics-router.route.create Create a route. 
 Editor metrics-router.route.update Update a route. 
 Editor metrics-router.route.delete Delete a route. 
 Editor metrics-router.route.list List all routes. 
 Editor metrics-router.setting.get View configuration settings.
Every time that you deploy a blockchain component, such as a peer, ordering node, or CA, a new pod is created for the component in a worker node. Containers and pods are, by design, short-lived and can fail unexpectedly. For example, a container or pod might crash if an error occurs in your component. So, to make your node highly available, you must ensure that you have enough instances of it to handle the workload plus extra instances in case of a failure.

Peers How many peers are required? In a production scenario, the recommendation is to deploy three peers from the same organization to each channel. This configuration allows one peer to go down (for example, during a maintenance cycle) and still maintain two highly available peers. Therefore, to compensate for a peer failure, and for the most basic level of HA, you can achieve peer redundancy by simply deploying three peers per organization on a channel on your worker node. Note that you need to ensure that you have adequate resources available on your node to support these components.

Ordering service As mentioned above, the HA ordering service is based on Raft, and contains five ordering nodes by default. Because the system can sustain the loss of nodes, including leader nodes, as long as there is a majority of ordering nodes (what’s known as a “quorum”) remaining, Raft is said to be “crash fault tolerant” (CFT). In other words, if you have five nodes in a channel, you can lose two nodes (leaving three remaining nodes). When you deploy an ordering service from the console, choose the five node service for HA.

CA You can configure replica sets, which are represented as shaded CA boxes in the diagram above, for your CA. Replica sets guarantee that if the CA node goes down, the CA replica immediately begins processing requests. You must provision an instance of a PostgreSQL database if you plan to use CA replica sets. See these instructions for more information about [how to configure CA replica sets](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-build-ha-ca).
Using service endpoints to privately connect to IBM Cloud Metrics Routing 

To add more control and security over your data when you use IBM Cloud® Metrics Routing, you have the option of using private routes to IBM Cloud service endpoints. Private routes are not accessible or reachable over the internet. By using the IBM Cloud Private service endpoints feature, you can protect your data from threats from the public network and logically extend your private network.



 Before you begin 

You can use private and public endpoints to configure IBM Cloud Metrics Routing resources in your account.

You can connect to IBM Cloud Metrics Routing over a private network by using IBM Cloud Private service endpoints.



* When you use the classic infrastructure, you connect to resources in your account over the IBM Cloud public network by default. You can enable virtual routing and forwarding (VRF) to move IP routing for your account and all of its resources into a separate routing table. If VRF is enabled, you can then enable IBM Cloud service endpoints to connect directly to resources without using the public network. [Enabling VRF and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint).
* Virtual Private Clouds (VPCs) are automatically enabled for virtual routing and forwarding (VRF). To enable service endpoints for your VPC, continue to [Enabling service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpointservice-endpoint).



To check whether the account is VRF enabled, run the following command:

ibmcloud account show

To enable private endpoints, run the following command:

ibmcloud account update --service-endpoint-enable true





 Setting up service endpoints for IBM Cloud Metrics Routing 

By default, private and public endpoints are enabled. For more information about supported endpoints, see [Endpoints](https://cloud.ibm.com/docs/metrics-router?topic=metrics-router-endpoints).





 Disabling public service endpoints 

You can disable public endpoints in your account for IBM Cloud Metrics Routing:
When you create a load balancer, it starts with two appliances, but the number of appliances can be increased to 16 as the monitoring system detects an increase in the load. The IP addresses of each of the active appliances are added as DNS A-Records to the Fully Qualified Domain Name (FQDN) of the load balancer.

Internal load balancer
: A highly demanded "internal" version of our IBM Cloud® Load Balancer is now available. This load balancer is not exposed publicly, but can still be used to balance applications within their IBM Cloud private networks (in a multi-tiered deployment, for instance, as shown in the figure).
: Zoom

![Internal Load Balancer](https://cloud.ibm.com/docs-content/v1/content/4b22b8d0e113e2faeb720360eb986a54d8bf3a05/loadbalancer-service/images/InternalLB.png)

Internal load balancer
: It is both secure and consistent with the previous versions of IBM Cloud® Load Balancer on the public side.

Monitoring metrics
: You can now use the "IBM Cloud Monitoring" service to monitor the following performance metrics that are associated with your load balancer and application:



* Throughput
* Connection rate
* Active connections



: Up to two weeks of samples are collected and displayed by the load balancer web UI. The data can also be viewed on the IBM Cloud Monitoring service portal. If you require data for longer than two weeks, depending on the volume of other cloud metrics you might be sending to your Cloud Monitoring instance, you might need to upgrade your monitoring plan. For more information, see [Monitoring metrics using IBM Cloud Monitoring](https://cloud.ibm.com/docs/loadbalancer-service?topic=loadbalancer-service-monitoring-metrics).

Cipher suite customization
: You can now customize the cipher suites that are used when the load balancer is configured for SSL termination.
How do I rotate my credentials? 

In most cases, rotating credentials is a straight-forward process:



1. Generate a replacement service credential. For more information, see [How can I generate service credentials?](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-faq-authenticating-cloudantfind-service-credentials-iam).
2. Replace the current credential with the newly generated credential.
3. Delete the no-longer-used service credential.



However, when you rotate the credentials for a replication, if you are using legacy credentials in the replication document, the replication starts from the beginning. To ensure that changes arrive in a timely manner, we advise you to create a new replication once it catches up with deleting the previous replication and the associated service credential. The process is described in the following steps:



1. Generate a replacement service credential. For more information, see [How can I generate service credentials?](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-faq-authenticating-cloudantfind-service-credentials-iam).
2. Create a replication with the same settings but new credentials.
3. Monitor the new replication by using [Active Tasks](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-active-tasks), or you can use [_scheduler/jobs](https://cloud.ibm.com/apidocs/cloudantgetschedulerjobs).
4. Once the changes_pending field for the new replication is a suitably low value for your requirements, the replication that uses the previous credentials can be deleted.
5. Delete the no-longer-used service credential.



Replications that use IAM API keys can be updated to use a new API key directly, without delaying the changes that are replicating.
Working with configmaps 

Learn how to work with configmaps in Code Engine. In Code Engine, you can store your information as key-value pairs in configmaps that can be consumed by your job or application by using environment variables.



 What are configmaps and why would I use them? 

In Code Engine, both secrets and configmaps are key-value pairs. When mapped to environment variables, the NAME=VALUE relationships are set such that the name of the environment variable corresponds to the "key" of each entry in those maps, and the value of the environment variable is the "value" of that key.

A configmap provides a method to include non-sensitive data information to your deployment. By referencing values from your configmap as environment variables, you can decouple specific information from your deployment and keep your app or job portable. A configmap contains information in key-value pairs.

Because secrets and configmaps are similar entities (except secrets are stored more securely), the way you interact and work with secrets and configmaps is also similar. To learn more about secrets, see [Working with secrets](https://cloud.ibm.com/docs/codeengine?topic=codeengine-secret).





 I see configmaps that I didn't create. Can I delete them? 

No. Code Engine automatically creates the following configmaps in your namespace: istio-ca-root and kube-root-ca. Code Engine uses these configmaps internally. If you delete these configmaps, Code Engine automatically re-creates them.





 Creating configmaps 

Create configmaps with Code Engine.



 Creating a configmap from the console 

Create configmaps with the Code Engine console.

Before you begin, [create a project](https://cloud.ibm.com/docs/codeengine?topic=codeengine-manage-project).



1.
(https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-provisioning-operationsfaq-application-connection)
* [Can I generate master key on-premises and store the master key parts in the smart cards?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-provisioning-operationsfaq-generate-master-key-on-premises)
* [Can I import root keys from an on-premises HSM?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-provisioning-operationsfaq-import-key-on-premises)
* [Can I use Hyper Protect Crypto Services only for cryptographic operations, but use other IBM Cloud services such as Key Protect for key management?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-provisioning-operationsfaq-hpcs-with-key-protect)
* [Can I use Hyper Protect Crypto Services for applications hosted in other cloud service providers such as AWS, Azure, and GCP?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-provisioning-operationsfaq-hpcs-other-cloud-vendor)
* [How can I know whether the IBM Cloud services that I adopt can integrate with Hyper Protect Crypto Services for key encryption?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-provisioning-operationsfaq-hpcs-service-integration)



[FAQs: Hyper Protect Crypto Services Standard Plan](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-performance-capacityfaq-performance-capacity)



* [How many keys can be stored in a Hyper Protect Crypto Services service instance?]
* How can I use Schematics services with a test ID?

The test IDs are considered as a valid IBM ID to set the global catalog or resource controller-related API calls. If you are unable to access, do [Contact support service](https://cloud.ibm.com/docs/schematics?topic=schematics-schematics-help).
* How to limit Git repo folder cloning

By default when creating a workspace via the UI, Schematics default to cloning the full Git repository and all subfolders. De-select the 'Use full repository' flag to limit the folders cloned and improve download performace.

Schematics introduced a compact flag in the [create workspace](https://cloud.ibm.com/apidocs/schematics/schematicscreate-workspace) and [update workspace](https://cloud.ibm.com/apidocs/schematics/schematicsreplace-workspace) API to download the subfolders in Git repositories. If the compact flag is set to true it will download and save subfolders recursively, otherwise, you can continue to download and save the full repository on workspace creation.

You can get the response by starting get workspace API to view the compact flag value. The compact flag can be given only if the template_repo.url field is passed. On update, if this field is not passed, but URL is passed, the download is compact.

Compact usage in the payload is .template_data[0].compact = true/false. For more information, see [Compact download for Schematics Workspaces](https://cloud.ibm.com/docs/schematics?topic=schematics-compact-download).
* How do I delete a workspace when the delete fails

If a resource has already been deleted outside of Schematics, a workspace delete operation will as the resource no longer exists.

You need to delete the workspace and NOT destroying the resources as if resource is not available.
Setting dual authorization policies for keys 

You can use IBM® Key Protect for IBM Cloud® to set dual authorization policies for individual encryption keys.

Dual authorization is an extra policy that helps to prevent accidental or malicious deletion of keys in your Key Protect instance. When you enable this policy at the key level, Key Protect requires an authorization from two users to delete a key.

After you enable dual authorization at the key level, the policy that is associated with the key can no longer be changed to allow a single authorization to delete the key.

To enable dual authorization settings at the instance level, check out [Managing service settings](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-dual-auth).



 Managing dual authorization policies with the API 

Consider the following items before you enable dual authorization for a key:



* Determine whether a dual authorization policy is required for the key. As a security admin, assess the sensitivity of your workload to determine whether a key requires a dual authorization policy based on your requirements. After you enable dual authorization for a key, the policy can no longer be changed to allow a single authorization to delete the key.
* Determine who can authorize deletion of your Key Protect resources. After you create a dual authorization policy for a key, the key will require [an action from two users](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-dual-auth-keys) before it can be deleted. Be sure to identify two distinct users with the [appropriate levels of access](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-accessmanage-access-roles) to the instance or key.



To learn how to delete a key that has a dual authorization policy, see [Deleting keys using dual authorization](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-dual-auth-keys).



 Viewing a dual authorization policy for a key 

For a high-level view, you can retrieve the dual authorization policy for a single key by making a GET call to the following endpoint.
For more information about the migration process, see [Migrating Cloud Foundry service instances and apps to a resource group](https://cloud.ibm.com/docs/account?topic=account-migrate).





 Why can't I add a resource to a resource group? 

Most likely you're dealing with an access issue. You must have at least the Viewer role on the resource group itself and at least the Editor role on the service in the account. Learn more in [Adding resources to a resource group](https://cloud.ibm.com/docs/account?topic=account-rgsadd_to_rgs).

For more information about how to check your assigned access, see [Managing access to resources](https://cloud.ibm.com/docs/account?topic=account-assign-access-resourcesassign-access-resources).

If you need additional access in the account, contact the account owner that is listed on the [Users](https://cloud.ibm.com/iam/users) page.





 Who can create resource groups? 

You can create resource groups only if you're assigned the Administrator role on All Account Management services in the account. For more information, see [Assigning access to account management services](https://cloud.ibm.com/docs/account?topic=account-account-services).

Lite accounts can have only the default resource group, so you can't create any additional resource groups even if you have the required access.





 Can I delete a resource group? 

Yes, you can delete a resource group only if it doesn't contain any resources, and it's not the default resource group. See [Deleting a resource group](https://cloud.ibm.com/docs/account?topic=account-delete_rgs) for more information.





 How do I add users to a resource group? 

Resource groups are a method of organizing resources and are not directly associated with the management of users. For information on creating a resource group, see [Adding resources to a resource group](https://cloud.ibm.com/docs/account?topic=account-rgsadd_to_rgs).