vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Administering a queue manager using IBM MQ Console 

The MQ Web Console is an administration tool for IBM MQ that you access using a web browser running on your own machine. With the MQ Web Console, you can create a new queue, put a message onto the queue, browse the queue to view the message, and delete the queue.



 Before you begin 



* An existing queue manager (for instructions, follow the [creating a queue manager](https://cloud.ibm.com/docs/services/mqcloud?topic=mqcloud-mqoc_create_qm) guide).
* You have permission to access queue managers within your IBM MQ service instance (for instructions, follow the [configuring administrator access for a queue manager](https://cloud.ibm.com/docs/services/mqcloud?topic=mqcloud-tutorial-configure-admin-access) guide).







 Login to the IBM Web Console for your queue manager 



1. Log in to the IBM Cloud console.
2. Find your existing Service Instance, by entering part of its name in the search box and selecting your Service Instance, or:



* Click the 'Hamburger menu'
* Click 'Resource List'
* Expand 'Services'
* Click on your Service Instance



3. From the list of your queue managers, click on the queue manager you wish to administer.
4. Click the Administration tab.

![Image showing the Administration tab](https://cloud.ibm.com/docs-content/v1/content/3a120b16db5fdc3e70d071af8a63ce5515c1b096/mqcloud/images/mqoc_administration_tab.png)
5. Click Launch MQ Console, this will open the 'IBM MQ Web Console' in a new browser tab.

The Launch MQ Console button will only be available when the queue manager is running.
6. Click on Manage in the side menu to view your MQ objects

!
Click your name and review your Access for assigned IAM roles and Cloud Foundry to see which orgs you have access to and your assigned Cloud Foundry roles.





 Required access for App Service apps 

Any user who can access an App Service app can migrate it. However, migrating an app doesn't migrate services that are associated with the app. Service instances must be migrated separately.







 How does migration work? 



 Migrating service instances 

When you migrate a service instance from a Cloud Foundry org and space to a resource group, a new linked service instance is created in the resource group. The original instance in the Cloud Foundry org and space becomes an [alias](https://cloud.ibm.com/docs/account?topic=account-connect_appwhat_is_alias). The alias counts towards the quota for your organization, but you're billed for your usage of the service instance in the resource group.

Your browser does not support the video tag.

Service instances are migrated one at a time when you're notified on the Resource list page by the ![Migrate this service instance to a resource group](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/account/images/migrate.svg) icon that is associated with your Cloud Foundry service instance.

Before you start the migration process, review your service documentation to see whether any additional, service-specific changes that you might have to make when you migrate your service instance to a resource group. For example, you might need to migrate data from old instances to new instances or update the credentials that are used for your app if you delete the Cloud Foundry alias. Applications that make a direct call to the API of a service that is migrated need to update the API call to use either an IAM API key or access token.



1. Open the More actions menu.
2. Select Migrate to a resource group to get started.
3. Select a resource group.
4. Click Migrate and the instance is migrated for you.
5.
This rule can be modified over time until eventually all traffic is directed to the newer version of the service.
2. View the bookinfo application again in your browser tab. Ensure that you are using a hard refresh (command + Shift + R on Mac or Ctrl + F5 on windows) to remove any browser caching. You should notice that the bookinfo application should swap between V1 or V2 at about the weight you specified.
3. To route all traffic to reviews v3,

oc replace -f https://raw.githubusercontent.com/Maistra/istio/maistra-2.2/samples/bookinfo/networking/virtual-service-reviews-v3.yaml









 Step 7: Secure your services 

Istio can secure the communication between microservices without requiring application code changes. Security is provided by authenticating and encrypting communication paths within the cluster. This is becoming a common security and compliance requirement. Delegating communication security to Istio (as opposed to implementing TLS in each microservice), ensures that your application will be deployed with consistent and manageable security policies.



1. To configure mTLS, you need to modify your previous destination rules to use ISTIO_MUTUAL.

oc replace -f https://raw.githubusercontent.com/Maistra/istio/maistra-2.2/samples/bookinfo/networking/destination-rule-all-mtls.yaml
2. Send more traffic to your application. Everything should still continue to work as expected.
3. Launch Kiali again and go to Graph.
4. Select bookinfo from the top Namespace bar.
5. Under Display, select Security. You should see lock icon on all the arrows(traffic).
6. To confirm your traffic is secure, click on the arrow from productpage to v1 and you should see mTLS Enabled with lock icon on the right pane.







 Step 8: Enable SSL for traffic coming in to your cluster (HTTPS)
If more service instances are created in a resource group, all users that have access to the resource group see them automatically without updating access groups. If you choose to use resource groups, you will create access groups and then assign them to resource groups.



A service instance can belong to only one resource group, and after instances are assigned into resource groups, they cannot be changed. This also means that the resource group assignment can happen only at service instance creation. Therefore, resource groups might not provide enough flexibility if assignments of service instances to resource groups might need to change.







 Next steps 



* See [Configure Qiskit Runtime for an organization](https://cloud.ibm.com/docs/quantum-computing?topic=quantum-computing-quickstart-steps-org) for the steps to set up Qiskit Runtime.
* See [Additional considerations](https://cloud.ibm.com/docs/quantum-computing?topic=quantum-computing-considerations-org) for more information.
Operator As an operator, you can perform platform actions required to configure and operate service instances, such as viewing a service's dashboard. 







 API Connect 

Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use apiconnect for the service name.

Platform roles

Service roles

Actions



Table 8. Platform roles - API Connect
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the platform role name and the column headers identify the specific information available about each role.

 Role Description 

 Administrator As an administrator, you can perform all platform actions based on the resource this role is being assigned, including assigning access policies to other users. 
 Editor As an editor, you can perform all platform actions except for managing the account and assigning access policies. 
 Operator As an operator, you can perform platform actions required to configure and operate service instances, such as viewing a service's dashboard. 
 Viewer As a viewer, you can view service instances, but you can't modify them. 







 App ID 

Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use appid for the service name.

Service roles

Actions



Table 9. Service roles - App ID
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the service role name and the column headers identify the specific information available about each role.

 Role Description 

 Manager As a manager, you have permissions beyond the writer role to complete privileged actions as defined by the service. In addition, you can create and edit service-specific resources. 
 Reader As a reader, you can perform read-only actions within a service such as viewing service-specific resources. 
 Writer As a writer, you have permissions beyond the reader role, including creating and editing service-specific resources. 







 App Configuration 

Review the available platform and service roles and the actions mapped to each to help you assign access.
This table has row and column headers. The row headers provide the service role name and the column headers identify the specific information available about each role.

 Role Description 

 Manager As a manager, you have permissions beyond the writer role to complete privileged actions as defined by the service. In addition, you can create and edit service-specific resources. 
 Reader As a reader, you can perform read-only actions within a service such as viewing service-specific resources. 
 Writer As a writer, you have permissions beyond the reader role, including creating and editing service-specific resources. 







 Kubernetes Service 

Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use containers-kubernetes for the service name.

Platform roles

Service roles

Actions



Table 25. Platform roles - Kubernetes Service
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the platform role name and the column headers identify the specific information available about each role.

 Role Description 

 Administrator As an administrator, you can perform all platform actions based on the resource this role is being assigned, including assigning access policies to other users. 
 Editor As an editor, you can perform all platform actions except for managing the account and assigning access policies. 
 Operator As an operator, you can perform platform actions required to configure and operate service instances, such as viewing a service's dashboard. 
 Viewer As a viewer, you can view service instances, but you can't modify them. 







 Context-Based Restrictions 

Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use context-based-restrictions for the service name.

Platform roles

Actions



Table 26. Platform roles - Context-Based Restrictions
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the platform role name and the column headers identify the specific information available about each role.

 Role Description
* UI
* Terraform







 Creating custom roles 

Each service maps specific actions that you can perform within the context of the service to platform or service roles. From the Roles page, you can view all of the available roles in the account and all roles for a specific service, including the actions that are mapped to each. You can pick and choose actions from all of the roles for a specific service to combine into a custom role of your choice.

Many services map different sets of actions to different platform or service roles. However, you might want to combine some of the actions that are currently spread across multiple roles for a service to make assigning meet your custom use case. With a custom role, you can pick and choose actions that are mapped to different roles so that next time you assign access to the service, you don't have to select three different roles, for example.

As a unique usage scenario, you can create your own custom roles for controlling access management tags. It is possible to separate the permissions for attaching and detaching access management tags on the resources. For example, you can create a custom role where a user can attach access management tags to resources, but it does not allow them to remove those tags from them and vice versa.



 Required access 

Anyone can view the available roles in the account on Roles page, but to create, edit, or delete a custom role, you must be assigned specific access for the Role management account management service.



Table 1. Actions for Role management service

 Role Actions 

 Editor Can edit and update the role display name, description, and the actions mapped to it. 
 Administrator Create, edit, update, and delete custom roles and assign other users in the account access to the Role management service 







 Creating custom roles 

You can create new roles that are scoped to single services. This means that you can't combine actions for two different services in a custom role, but you can combine as many actions that you want into a new role for a single service. After you create a custom role with a name of your choosing, anyone in the account who can assign access to a particular service can use that role when assigning access.

Custom roles can be created only for individual IAM-enabled services.
Step 6: Create a NeuralSeek service instance 

You can use a search extension in Watson Assistant to connect your assistant directly to Discovery and return passages straight from the data source. However, we will add the NeuralSeek service between Watson Assistant and Discovery in this tutorial. NeuralSeek retrieves the passages from Discovery and then converts them into answers that sound more conversational.



1. From a new web browser tab, return to the IBM Cloud catalog.

Keep the pages to the other services open in separate tabs so you can switch easiily among the different service instances.
2. From the [NeuralSeek](https://cloud.ibm.com/catalog/services/neuralseek) resource page in the IBM Cloud catalog, create a Lite plan service instance.
3. On the Configure page, add details about your Discovery service instance and customize the connection.



* You can get the service URL and API key from the Discovery service instance details page in IBM Cloud.
* The project ID is available from the IBM Cloud user interface. To get it, click Integrate and deploy from the navigation panel. Open the API Information page, and then copy the project ID.
* Set the document score range to 50%.
* Change the snippet character size to 400.
* Specify your company as the company display name.
* Change the minimum confidence percentage to 50.



Click Save.







 Step 7: Split your PDF documents 

Now that subtitles are indexed properly in Discovery, use them as the basis for splitting the PDF files into many smaller documents.



1. Return to the web browser tab where your Discovery project is displayed.
2. Open the Manage fields tab for the current collection.
3. In the Split document on each occurrence of field, choose subtitle, and then click Apply changes and reprocess.

Zoom

!
By defining an identity provider's service configuration and a policy that outlines when a particular flow must be used, you can control access to any resource in your service mesh. To see example CRDs, check out the [samples directory](https://github.com/ibm-cloud-security/app-identity-and-access-Adapter/tree/master/samples/crds).

To create a policy:



1. Define a configuration.
2. Register the endpoint.





 Defining a configuration 

Depending on whether you're protecting front end or backend applications, create a policy configuration with one of the following options.



* For front-end applications: Browser-based applications that require user authentication can be configured to use the OIDC / OAuth 2.0 authentication flow. To define an OidcConfig CRD containing the client used to facilitate the authentication flow with the Identity provider, use the following example as a guide.

apiVersion: "security.cloud.ibm.com/v1"
kind: OidcConfig
metadata:
name: oidc-provider-config
namespace: sample-namespace
spec:
discoveryUrl: https://us-south.appid.cloud.ibm.com/oauth/v4/<tenantID>/.well-known/openid-configuration
clientId: <clientID>
clientSecret: <randomlyGeneratedClientSecret>
clientSecretRef:
name: <nameOfKubeSecret>
key: <keyInKubeSecret>



Table 1. YAML configuration file components explained

 Field Type Required Description 

 discoveryUrl string Yes A well-known endpoint that provides a JSON document of OIDC/OAuth 2.0 configuration information. 
 clientId string Yes An identifier for the client that is used for authentication. 
 clientSecret string *No A plain text secret that is used to authenticate the client. If not provided, a clientSecretRef must exist. 
 clientSecretRef object No A reference secret that is used to authenticate the client.
Not all IBM Cloud services can be managed with IAM. If you use one of these services, you can continue to use Cloud Foundry user roles to control access to those services.

Cloud Foundry roles grant access to organizations and spaces within the account. To see the list of Cloud Foundry-based services in IBM Cloud, run ibmcloud service list.

Example actions that are permitted by Cloud Foundry roles are creating a new Cloud Foundry service instance or binding a Cloud Foundry service instance to a cluster. To learn more, see the available [org and space roles](https://cloud.ibm.com/docs/account?topic=account-mngcf) or the steps for [managing Cloud Foundry access](https://cloud.ibm.com/docs/account?topic=account-mngcf) in the IBM Cloud IAM documentation.







 Assign access roles to individual or groups of users in IBM Cloud IAM 

When you set IBM Cloud IAM policies, you can assign roles to an individual user or to a group of users.

Individual users
: You might have a specific user that needs more or less permissions than the rest of your team. You can customize permissions on an individual basis so that each person has the permissions that they need to complete their tasks. You can assign more than one IBM Cloud IAM role to each user.

Multiple users in an access group
: You can create a group of users and then assign permissions to that group. For example, you can group all team leaders and assign administrator access to the group. Then, you can group all developers and assign only write access to that group. You can assign more than one IBM Cloud IAM role to each access group. When you assign permissions to a group, any user that is added or removed from that group is affected. If you add a user to the group, then they also have the additional access. If they are removed, their access is revoked.

You can't scope IBM Cloud IAM service access roles to an IAM access group because the roles are not synced to the RBAC roles within the cluster.
Notifications about functional changes 

In addition to the release notes published for each service, IBM Cloud® publishes release notes for most services in a single location. You can set up an RSS feed to be notified when new release notes are published to this page.



  Accessing the IBM Cloud release notes 

Do the following to access release notes for IBM Cloud services.



1.  [Log in to your IBM Cloud account](https://cloud.ibm.com/login).
2.  Go to the Notifications icon ![Notifications icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/icons/Notification.svg) > View cloud status.
3.  Click Release notes.



You can search for a string within the published release notes. Filter by component will let you filter the list by selected services. You can also filter the results by the past year or specific months.





  Setting up an RSS feed 

Set up an RSS feed to be alerted when the IBM Cloud page is updated.

You will need an RSS reader browser extension or app installed to configure an RSS feed.



1.  [Log in to your IBM Cloud account](https://cloud.ibm.com/login).
2.  Go to the Notifications icon ![Notifications icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/icons/Notification.svg) > View cloud status.
3.  Click Release notes.
4.  Click RSS Feed and follow the instructions for your RSS reader app or browser extension to configure notification of changes to the Release Notes page.
* Does the SSL VPN also perform IPsec or other VPN protocols?

Currently, the SSL VPN gateway uses a browser-based SSL VPN plug-in or a proprietary client for creating connections. We continue to bring more VPN connectivity options to the private network. The SSL VPN was selected for ease of use and compatibility.
* Can I mount the NAS/FTP server from my remote location over the SSL VPN gateway?

No. You have access to your private VLAN and servers only from the SSL VPN gateway. If you want to download data from your NAS/FTP volume, you must move the data to your server then out through the VPN to the remote location.

For security reasons, only servers that are located inside the data center are allowed access to the servers, which provide services (DNS, Update, NAS, Lockbox).
* How does VPN access work?

First, an account administrator must enable SSL VPN permissions for users. As a user, you can log in to the VPN through [the web interface](https://www.ibm.com/cloud/vpn-access) or use a [stand-alone VPN client](https://cloud.ibm.com/docs/iaas-vpn?topic=iaas-vpn-standalone-vpn-clients) for Linux, MacOS, or Windows. For more information, see [Logging in to the VPN](https://cloud.ibm.com/docs/iaas-vpn?topic=iaas-vpn-getting-startedlogin-to-the-vpn).
* What are the available categories for a user's VPN management status within the customer portal?



* Active - The user has access to the [IBM Cloud infrastructure customer portal](https://control.softlayer.com/) and VPN based on permissions set by the account administrator. This status can be manually selected and changed at any time.
* Disabled - The user does not have access to any permissions or subscriptions on the account, including [customer portal](https://control.softlayer.com/) and VPN.