vania-janet/multiturn-rag-retrieval-data huggingface dataset:
There are multiple deployment options:



* IBM Blockchain Platform for IBM Cloud with console
* IBM Blockchain Platform v2.x (Full Platform)
* IBM Blockchain Images
* Open source Hyperledger Fabric images or a non-IBM product



Containers deployed from any of the above sources can be connected on a single channel and transact. You can join IBM Blockchain Platform peers to any network running Hyperledger Fabric components. Similarly, you can invite Fabric peers to join channels hosted on an ordering service deployed on the IBM Blockchain Platform. Note that you will need to use Hyperledger Fabric APIs or the CLI. For more information about what is supported, see [Support for IBM Blockchain Platform](https://www.ibm.com/support/pages/node/1072956). For instructions on how to configure interoperability see [Connect the IBM Blockchain Platform to Hyperledger Fabric components](https://developer.ibm.com/tutorials/hyperledger-fabric-and-ibm-blockchain-peer-interoperability/).





 Is IBM Blockchain Platform HIPAA ready? 

Because HIPAA readiness is only relevant when platform components process Personal Health Information (PHI) or Personally Identifiable Information (PII), the IBM Blockchain Platform does not need to be HIPAA ready. Customers should not store PHI or PII on the ledger since it is immutable and therefore cannot be deleted. Instead, the recommendation is to store all PHI or PII off ledger in another database and simply reference it from the ledger.

The IBM Blockchain platform gives customers total control over their deployments, certificates, and private keys. The console simplifies and accelerates the process of deploying components into a Kubernetes cluster on IBM Cloud that is managed and controlled by the customer. As a reminder, because the customer owns the storage that is mounted to the containers, IBM does not have access to or control over any of the data that the customer chooses to store in their ledger.





 What ports are used by the IBM Blockchain Platform?
Managing PrimaryIO HDM 



 Downloading HDM 

To access the PrimaryIO Hybrid Cloud Data Management (HDM) software, go to [Hybrid Cloud Data Management](https://www.primaryio.com/hybrid-cloud-data-management/).





 Installing PrimaryIO HDM 

To install HDM on the hybrid infrastructure, complete the following steps:



* Deploy PrimaryIO Appliance (henceforth called PIO Appliance) on-premises
* Add on-premises vCenter Server to PIO Appliance
* Install HDM components on premises
* Configure on-premises HDM components
* Configure and Add Cloud Endpoint





 Deploying and installing PrimaryIO HDM on-premises 

The first HDM component to be deployed is the PIO Appliance. This appliance provides interfaces to add an on-premises VMware vCenter Server® and to register the HDM plug-in with it. After successful registration of the HDM plug-in, you can choose one of the clusters in the on-premises data center and install the following HDM components on it:



* PrimaryIO On-premises Manager
* PrimaryIO ESX Manager







 Configuring PrimaryIO HDM on-premises 

Only the on-premises components are deployed (the cloud components are not needed yet). The components are in place for HDM to monitor and analyze virtual machines, make recommendations, and gain insights into the workload that runs in the data center. For more information, see the [HDM documentation](https://docs.primaryio.com).





 Adding an IBM Cloud endpoint 

After successful completion of the previous steps, you can add an IBM Cloud® endpoint to HDM. The following components are installed in the selected cluster in the cloud data center.



* PrimaryIO On-cloud Manager
* PrimaryIO Cloud Cache (one per each VMware® ESXi™ node in cloud cluster)



After the cloud endpoint is successfully configured, a network connection between IBM Cloud and the on-premises cluster is established.

For more information, see the [HDM documentation](https://docs.primaryio.com).







 Troubleshooting PrimaryIO HDM
Follow instructions on [retrieving service credentials](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-v2-apisibp-v2-apis-retrieve-service-credentials) in IBM Cloud to gather these values now that are used with the playbooks later in this topic.





 Step two: Clone the Ansible collection 

The Ansible collection source code is available in a GitHub repository. You need to clone the Ansible collection to your local system so that you can run the playbooks and customize them according to your use case. From the command line on your local system run the command:


git clone https://github.com/IBM-Blockchain/ansible-collection.git


We'll explore the contents of this collection in the next section.





 Step three: Get started with using the playbooks 

After you clone the Ansible collection to your local system, open the ansible-collection directory and navigate to the tutorial folder and take a moment to review the contents.


cd ansible-collection/tutorial


The first thing that you notice is that the playbook .yml files are numbered. Because the playbooks build on each other, the numbers help you understand the order that they should be run. When you want to change some of the configuration properties, you can edit the .yml files and insert your own custom values, for example, if you want to customize a node name or use a different enrollment ID. Each playbook includes either a role or a task. A role includes a set of tasks that in turn call the associated [modules](https://ibm-blockchain.github.io/ansible-collection/modules.html) that submit the requests to your cluster.

The next thing to notice is the set of variable files ordering-org-vars.yml (Ordering Org), org1-vars.yml (Org1), and org2-vars.yml (Org2) that define the IBM Blockchain Platform console connection details for each organization. These variable files are used by the playbook when you run it.
* MQ Administrator username and API key, which you obtain from the service console as described in [Gather required connection details](https://cloud.ibm.com/docs/services/mqcloud?topic=mqcloud-mqoc_admin_mqcliexpgetdetails_mqoc_admin_mqcliexp). Note that this must an Administrator username and API key, and not an Application username and API key
* Queue manager name, which must match what is specified in the JSON CCDT file - for example "QM1"



<Path to MQ/bin directory>/runmqsc -c -u mqusername QM1

All the operations on this runmqsc will now run on a secured channel.







 Configuring runmqsc to use mutual ("two way") TLS connections 

The following steps describe how to extend the instructions above to configure mutual TLS connectivity between the runmqsc client and the queue manager.

In mutual TLS scenarios the client (e.g. runmqsc) presents a client certificate to the queue manager, and the queue manager must be configured to trust that incoming client certificate.



1. Generate a TLS client certificate that will identify the runmqsc client:

In some organizations TLS client certificates are generated for you by a central certificate authority (CA). For the purposes of this example we will generate our own self-signed client certificate.

 Generate a new private key and public certificate for the client
 (fill in the segments of the certificate as you wish when prompted)
openssl req -newkey rsa:2048 -nodes -keyout clientKey.pem -x509 -days 365 -out clientCert.pem

 Combine the private key and public certificate into a single file
cat clientKey.pem > clientCombined.pem
cat clientCert.pem >> clientCombined.pem
2. Add the newly generated client certificate to the local keystore file:

Import the combined client key/cert into the keystore file, making a note of the label that you use.
Resolving upgrade issues 

There are several issues that you might experience after [upgrading](https://cloud.ibm.com/docs/virtual-router-appliance?topic=virtual-router-appliance-upgrading-the-os) your VRA image. To troubleshoot an upgrade issue, start by connecting to the VRA using SSH if possible. Otherwise, connect to the IPMI remote management console. After you are connected, check the status of your interfaces, VRRP, and IPsec tunnels as necessary to find what isn't working. Are the main interfaces up? Is VRRP up? Are the IPsec tunnels up?

A connection to the IPMI requires a [classic SSL VPN](https://cloud.ibm.com/docs/iaas-vpn?topic=iaas-vpn-getting-started) connection.

The following commands are available for checking your VRA's general status and logs:



* show version
* show vrrp
* show interfaces
* show vpn ike sa
* show vpn ipsec sa
* show log messages
* journalctl -f -a



The journalctl commands are only available when user-isolation is disabled.

When opening a [support case](https://cloud.ibm.com/docs/virtual-router-appliance?topic=gateway-appliance-getting-help) for an upgrade issue, include the output of at least the first 3 previous commands along with the output of any other relevant commands and errors that show the issue. If your IPsec tunnels are down, then include the first 5 commands. You should also try to reset any down IPsec tunnels by using reset vpn ipsec-peer <Peer IP> tunnel <tunnel number>. You can also try restarting the entire IPsec daemon with restart vpn.

To avoid prolonged downtime for stand-alone VRAs, try reverting to the previous working version by using the following instructions after you complete your basic troubleshooting and information gathering.



 Reverting to a previous version
Because HIPAA readiness is only relevant when platform components process Personal Health Information (PHI) or Personally Identifiable Information (PII), the IBM Blockchain Platform does not need to be HIPAA ready. Customers should not store PHI or PII on the ledger since it is immutable and therefore cannot be deleted. Instead, the recommendation is to store all PHI or PII off ledger in another database and simply reference it from the ledger.

The IBM Blockchain platform gives customers total control over their deployments, certificates, and private keys. The console simplifies and accelerates the process of deploying components into a Kubernetes cluster on IBM Cloud that is managed and controlled by the customer. As a reminder, because the customer owns the storage that is mounted to the containers, IBM does not have access to or control over any of the data that the customer chooses to store in their ledger.
* What ports are used by the IBM Blockchain Platform?

See the port information in the Security topic that addresses this for the [console](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-securityibp-security-ibp-ports) and the [customer Kubernetes cluster](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-securityibp-security-Kubernetes-ports).
* How can I estimate the IBM Blockchain Platform sizing requirements for my development, test, and production environments?

After you understand how many CAs, peers, and ordering nodes are required, you can examine the default resource allocations table for your [nodes](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-adv-deploymentibp-console-adv-deployment-allocate-resources) to get an approximate estimate of the CPUs (VPCs) required for your network. If you are purchasing IBM Blockchain Platform on IBM Cloud, you can estimate your cost through this method, but you also have the ability to scale dynamically if more sources are needed.
* How does pricing work on the IBM Blockchain Platform for IBM Cloud?
[BGP Neighbors](https://cloud.ibm.com/docs-content/v1/content/7f09c1b3f21dd05ddc2c4638a3dc66976ad73e53/vmware-classic-journey/images/solution-vmware-onboarding-hidden/route-through-setup-and-bgp/bgp-neighbors.png)







 Setup of BGP on vSRX 



1. Gather the ips from nsx for the tier-0 uplinks from the vmware admins.
2. Gather the Local AS value from workload-t0 from the vmware admins.
3. Setup the BGP Options on the vSRX
4. Set the local-as
5. Set the local-address to the ip address of the vSRX that will be used for BGP
6. Set the neighbors to be the ip addresses of the uplink ips from NSX and the peer-as to the Local AS value from workload-t0



Example configuration:

 show protocols 
bgp {
    group region_location {
        type external;
        local-address xxx.xxx.xxx.xxx;
        export [ LOCAL_GATEWAY ATTACHED ];
        peer-as 64546;
        local-as 65001;
        neighbor xxx.xxx.xxx.xxx;
    }
}





 Results of BGP Setup 



1. Examine the ‘show route protocol bgp’ to see the routes on the vSRX









 Next Steps 

The next step on the deployment journey is:



* [Deploy Initial VM workload](https://cloud.ibm.com/docs/vmware-classic-journey?topic=vmware-classic-journey-vmware-onboarding-deploy-workload)
Customizing your IBM Cloud dashboard 

This tutorial walks you through how to customize your dashboard in the IBM Cloud® console to ensure that what is displayed is relevant to you. By completing this tutorial, you learn how to create a new dashboard, add and organize widgets, duplicate a dashboard, share a dashboard with other users, and delete unused dashboards.

The tutorial uses a fictitious project manager who is named Cora. She wants to understand total resource usage over the past year and how her team's budget is used to build a new chatbot with specific resources related to AI and machine learning. As you complete the tutorial, adapt each step to match your project's needs.



 Step 1: Create a dashboard 

First, create a new dashboard and select a template.



1. In the IBM Cloud console, click the Actions icon ![Action icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/action-menu-icon.svg), and select Create a dashboard.
2. Select the Management template from the available options, and then click Create.

The Management template is optimized to provide a mix of billing, access management, and other administrative widgets that Cora needs.
3. Enter your dashboard title in 30 characters or less.
4. Next, use the Dashboard settings panel to add relevant widgets to your dashboard. To add widgets, drag the widgets onto your dashboard. Add the Notes widget to your dashboard. This widget is where Cora can provide essential information that's custom for the team that she shares the dashboard with.
5. Click the Scope tab to select from the available resources in the account that you have access to. The scope determines the data that populates for the selected resources. You can filter the resource by group, tag, and location. Cora wants to select only resources that are related to AI and machine learning, so she filters by the resource group that exists for her team's chatbot project. Not all widgets can be scoped.
Why does the Ingress status show an ERRSNF error? 

Virtual Private Cloud

Classic infrastructure

You can use the the ibmcloud ks ingress status-report ignored-errors add command to add an error to the ignored-errors list. Ignored errors still appear in the output of the ibmcloud ks ingress status-report get command, but are ignored when calculating the overall Ingress Status.

  What’s happening 

When you check the status of your cluster's Ingress components by running the ibmcloud ks ingress status-report get command, you see an error similar to the following.

The load balancer service is missing (ERRSNF).

  Why it’s happening 

ALBs are exposed using LoadBalancer services, but one or more of these services are missing from the cluster.

  How to fix it 

Disable and re-enable your Ingress ALB.



1.  List your ALBs.

ibmcloud ks ingress alb ls -c <cluster>
2.  List the services in the kube-system namespace.

kubectl get services -n kube-system
3.  Review the ALB and services lists to look for missing services.

Classic
:   All ALBs that have an enabled state must have an existing LoadBalancer service with a name matching the ALB IDs.

VPC
:   If you have at least one public ALB in enabled state, there must be an existing public LoadBalancer service having the public-cr-CLUSTER-ID prefix in its name. Similarly, if you have at least one private ALB in enabled state, there must be an existing private LoadBalancer service having the private-cr-CLUSTER-ID prefix in its name.
4.  Complete the following steps for each missing service.



1.  Disable the corresponding ALB using the ibmcloud ks ingress alb disable command.
2.  Wait until the ALB deployment is removed from the kube-system namespace.
3.  Re-enable the ALB using the ibmcloud ks ingress alb enable command.
4.  Wait 10 to 15 minutes, then check that the LoadBalancer services are created.



5.  If the issue persists, contact support. Open a [support case](https://cloud.ibm.com/docs/get-support?topic=get-support-using-avatar). In the case details, be sure to include any relevant log files, error messages, or command outputs.
* Go to the General Properties page and enter the IBM VPN gateway name and public IP address.
* Go to the Topology page and add the IBM VPN gateway public IP address and IBM VPC subnets. Add the IBM VPN public IP address as an external network with netmask 255.255.255.255. Add the IBM VPC subnets as an internal network.



3. To add the VPN Community, follow these steps.

These instructions are based on the Star Community type, but the Meshed Community type is also an option.



* Go to SmartConsole > Security Policies > Access Tools > VPN Communities, click Star Community to open the new VPN community page.
* Enter the new community name.
* Go to the Gateways > Center Gateways page, click the + icon, and add the Check Point Security Gateway.
* Go to the Gateways > Satellite Gateways page, click the + icon, and add the IBM VPN gateway.
* Go to the Encryption page and use the default Encryption Method and Encryption Suite.
* Go to the Tunnel Management page and select One VPN tunnel per subnet pair.
* Go to the Shared Secret page and set the pre-shared key.
* Click OK and publish the changes.



4. To add relevant access rules in the Security Policy page, follow these steps:



* Add the community in the VPN column, the services in the Service & Applications column, the wanted action, and the appropriate track option.
* Install the access control policy.









 Connecting an IBM route-based VPN to a Check Point Security Gateway peer 

These example steps are referred to in the [CheckPoint Administration Guide](https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Gaia_AdminGuide/Topics-GAG/VPN-Tunnel-Interfaces.htm?tocpath=Network%20Management%7CNetwork%20Interfaces%7C_____8)

To connect an IBM route-based VPN to a Check Point Security Gateway peer, follow these steps:



1.
The purpose of this signature feature is to ensure that the workload and env sections are always used together and are not tampered with by a third party. The signature of the workload and the env sections are added as the value to the envWorkloadSignature section. The following are two sections in a contract that are relevant while creating and adding a contract signature:



* envWorkloadSignature: This is section where the signature of the other sections of the contract is added. This section is not required for a contract that is not signed.
* signingKey: This is a subsection that must be added to the env section of the contract. This holds the value to the user-generated public key, whose corresponding private key was used to create the contract signature.



Complete the following steps on an Ubuntu system, to create the contract signature:



1. Use the following command to generate key pair to sign the contract (note that "test1234" is the passphrase to generate keys, you can use your own):

openssl genrsa -aes128 -passout pass:test1234 -out private.pem 4096
openssl rsa -in private.pem -passin pass:test1234 -pubout -out public.pem
2. The following command is an example of how you can get the signing key:

key=$(awk -vRS="n" -vORS="\n" '1' public.pem)
echo ${key%\n}
3. Create the env.yaml file. The following is an example:

type: env
logging:
logDNA:
hostname: syslog-a.eu-gb.logging.cloud.ibm.com
ingestionKey: cfae1522876e860e58f5844a33bdcaa8
port: 6514
volumes:
test:
seed: hogwarts
Note that even if your cluster runs an older version of Calico, you can still use calicoctl version 3.18 to run the commands in the following steps.
2. Check for any IP addresses that are incorrectly detected as in use by the Calico IPAM.

calicoctl ipam check
3. In the output, look for the section that contains the line Scanning for IPs that are allocated but not actually in use.... If IP addresses are allocated in IPAM but are not actually in use, continue to the next step to release them. In this example output, 181 IP addresses can be released.

...
Scanning for IPs that are allocated but not actually in use...
Found 181 IPs that are allocated in IPAM but not actually in use.
Scanning for IPs that are in use by a workload or node but not allocated in IPAM...
Found 0 in-use IPs that are not in active IP pools.
Found 0 in-use IPs that are in active IP pools but have no corresponding IPAM allocation.

Check complete; found 181 problems.
4. Release IP addresses from the Calico IPAM that were previously assigned to a pod endpoint. Note that after you lock the data store in the following steps, existing pods continue to run, but any pods that are created remain in the ContainerCreating state and can't start until you unlock the data store. This data store lock ensures that the IPAM records are not modified while you release IP addresses. For more information, see the [Calico open source documentation](https://docs.tigera.io/calico/latest/reference/calicoctl/ipam/check).



1. Lock the data store for the Calico IPAM records.

calicoctl datastore migrate lock
2. Save the IPAM check results.

calicoctl ipam check -o report.json
3. Release unused IP addresses. This process can run for up to 20 minutes depending on how many IP addresses must be released.

calicoctl ipam release --from-report=report.json
4.
After you click Create, the system displays a message to say that the instance is being provisioned, which returns you to the Resource list. From the Resource list, you see that the status for your instance is, Provision in progress.
8. When the status changes to Active, select the instance.







 Step 3: Set your admin password 



* [Set the Admin Password](https://cloud.ibm.com/docs/databases-for-cassandra?topic=databases-for-cassandra-admin-password) for your deployment.



Review the [Getting to production](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-best-practices) documentation for general guidance on setting up a basic IBM Cloud® Databases for DataStax deployment.





 Step 4: Connect with DataStax drivers 

Drivers are a key component to connecting external applications to your Databases for DataStax deployment. Review the information on [Connecting an external application](https://cloud.ibm.com/docs/databases-for-cassandra?topic=databases-for-cassandra-external-app) for details on compatible drivers. Further details on specific drivers, including upgrade guides, can be found at [Developing applications with Apache Cassandra and DataStax Enterprise](https://docs.datastax.com/en/devapp/doc/devapp/aboutDrivers.html).

Only DataStax drivers that are explicitly listed in the [Connecting an external application](https://cloud.ibm.com/docs/databases-for-cassandra?topic=databases-for-cassandra-external-app) table function correctly for connecting to Databases for DataStax.





 Step 5: Node repairs with NodeSync 

[NodeSync](https://docs.datastax.com/en/dse/6.7/dse-admin/datastax_enterprise/config/aboutNodesync.html) is a continuous repair service that runs automatically in the background to validate that your data is in sync on all replicas and reduces the need for manual repairs. For operational simplicity and performance, Databases for DataStax enables the NodeSync service on all key spaces and tables to handle node repairs.