vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* Get the dashboard specifications. You can then persist this specification, and use it later in the openDashboard() method.



As an application developer, you can explore this API with the Cognos Dashboard Embedded demo application: [https://ibm-cognos-dashboard-demo.ng.bluemix.net/](https://ibm-cognos-dashboard-demo.ng.bluemix.net/).

![cde_demo_page](https://cloud.ibm.com/docs-content/v1/content/2781097afe16f2d329d7a606ddd260fb1a3e355c/services/cognos-dashboard-embedded/cde_demo_page.jpg)

As a starting point a demonstration project is available on GitHub: [https://github.com/IBM/cognos-dashboard-demo](https://github.com/IBM/cognos-dashboard-demo).





 Step 5: Working with Cognos Dashboard Embedded 

IBM® Cognos Dashboard Embedded uses the powerful IBM Cognos Analytics dashboard experience. To learn more above the Cognos Analytics dashboard experience, please see [IBM Cognos Analytics - Dashboard documentation](https://www.ibm.com/support/knowledgecenter/en/SSEP7J_11.1.0/com.ibm.swg.ba.cognos.ug_ca_dshb.doc/wa_dashboard_discoveryset_intro.html).
A request to restore an object from an archive generates multiple events in COS:



1. A read action of the source object. This action generates an event with action cloud-object-storage.object-restore.read.
2. A create action of the object into a bucket. This action generates an event with action cloud-object-storage.object-restore.create.



You can use the responseData.requestId field to identify the events that are generated when you restore an object.





 Getting all events that are generated for copying an object from one bucket to another 

A request to copy an object from one bucket to a different one generates multiple events in COS:



1. A read action of the source object. This action generates an event with action cloud-object-storage.object-copy.read.
2. A create action of the object into the new bucket. This action generates an event with action cloud-object-storage.object-copy.create.



To collect and monitor all events that report on a copy action across buckets, consider configuring each bucket to collect and forward events to the same Activity Tracker instance in your account.



* If one bucket is not enabled to collect management and data events, you will not receive the event that reports any copy action on that bucket.
* If you configure different Activity Tracker instances for each bucket, you will have one event in 1 instance and the other event in a different instance.



You can use the responseData.requestId field to identify the events that are generated when you copy an object from one bucket to another.





 Getting the details of a firewall update 

Updating a bucket's firewall will generate a cloud-object-storage.resource-configuration.update event.

To get the details of what was changed, check for fields requestData.allowedIp, requestData.deniedIp, and requestData.allowedNetworkTypes that appear in the requestData field.
COS_SECRET_KEY: ${COS_SECRET_ACCESS_KEY}
type: Opaque

EOF
Show more

COS_ENDPOINT="<enter_COS_endpoint here>" For e.g. COS_ENDPOINT="https://s3.us.cloud-object-storage.appdomain.cloud"
 See "How to generate a JSON mapping defintion" below for instructions on how to create the next line
JSON_ID_MAPPING='{"instances":[{"source_id":"<instance_id_consumer1>","target_id":"<instance_id_importer1>","assistants":{"source_id":"<draft_or_live_environment_id_consumer1>","target_id":"<draft_or_live_environment_id_importer1>"}],"workspaces":{"source_id":"<action_skill_id_consumer1>","target_id":"<action_skill_id_importer1>"}]}]}'

cat <<EOF | oc apply -f -
apiVersion: assistant.watson.ibm.com/v1
kind: TemporaryPatch
metadata:
name: wa-data-governor
spec:
apiVersion: assistant.watson.ibm.com/v1
kind: WatsonAssistant
name: wa
patchType: patchStrategicMerge
patch:
data-governor:
dataexhaust:
spec:
cos:
endpoint: ${COS_ENDPOINT}
secret:
accessKey: COS_ACCESS_KEY
name: wa-data-governor-cos-credentials
secretKey: COS_SECRET_KEY
cosImporter:
fromBucket: data-exhaust-backup-wa-data-governor-e58d5f4a1344
clearObjectTags: false
filter:
 Modify prefix value.
prefix: "20230322"
fromTenant: ""
Sentinel CPU

oc patch statefulset c-$INSTANCENAME-redis-s --type='json' -p='{"op": "replace", "path": "/spec/template/spec/containers/0/resources/requests/cpu", "value":"50m"},{"op": "replace", "path": "/spec/template/spec/containers/1/resources/requests/cpu", "value":"50m"},{"op": "replace", "path": "/spec/template/spec/containers/2/resources/requests/cpu", "value":"50m"},{"op": "replace", "path": "/spec/template/spec/containers/3/resources/requests/cpu", "value":"50m"}]'

Sentinel memory
logging.root.setLevel(logging.NOTSET)
logging.basicConfig(level=logging.NOTSET)

authenticator = IAMAuthenticator('<ibmcloud-api-key>')

schematics_service = SchematicsV1(authenticator = authenticator)

schematics_service.set_service_url('https://us.schematics.cloud.ibm.com')

logging.info("Started Deletion of Schematic Resources")

workspace_activity_destroy_result = schematics_service.destroy_workspace_command(
    w_id='<workspace-id>',
    refresh_token='<refresh-token>'
).get_result()

print(json.dumps(workspace_activity_destroy_result, indent=2))

logging.info("Completed Deletion of Schematic Resources")





 Example Python response 

INFO:root:Started Deletion of Schematic Resources
DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): iam.cloud.ibm.com:443
DEBUG:urllib3.connectionpool:https://iam.cloud.ibm.com:443 "POST /identity/token HTTP/1.1" 200 985
DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): us.schematics.cloud.ibm.com:443
DEBUG:urllib3.connectionpool:https://us.schematics.cloud.ibm.com:443 "PUT /v1/workspaces/us-south.workspace.Schematic-Sunil-Test-Workspace.5a4cbf11/destroy HTTP/1.1" 202 49
{
  "activityid": "4bc90aac48f7cf9850bddf1ba9407eb5"
}
INFO:root:Completed Deletion of Schematic Resources
Because the terraform.tfvars file contains confidential information, do not push this file to a version control system. Keep this file on your local system only.
4. Edit the input parameter file, input.auto.tfvars, and modify the variables to match your solution. The file is preset with the minimal recommended disk sizes. For using an existing VPC, you must modify:



* VPC - An existing VPC name.
* SECURITYGROUP - Change ic4sap to the VPC name.
* SUBNET - Change ic4sap to the VPC name.
* HOSTNAME - Enter a hostname up to 12 characters. For more information, see the readme file.



You need your 40-digit SSH key ID for this file. The second SSH key is optional.

For more options for profile, see Instance Profiles. For more options for image, see Images. For descriptions of the variables, see the readme file.

REGION = "eu-de"
ZONE = "eu-de-2"
VPC = "ic4sap"
SECURITYGROUP = "ic4sap-securitygroup"
SUBNET = "ic4sap-subnet"
SSH_KEYS = [ "r010-57bfc315-f9e5-46bf-bf61-d87a24a9ce7a" , "r010-3fcd9fe7-d4a7-41ce-8bb3-d96e936b2c7e" , "r010-7945f2b4-06f2-4276-8d8f-d40922a8686d" , "r010-771e15dd-8081-4cca-8844-445a40e6a3b3" , "r010-09325e15-15be-474e-9b3b-21827b260717" ]
 SAP Database VSI variables:
DB-HOSTNAME = "is110db"
DB-PROFILE = "mx2-16x128"
This action allows data to be received from the proxy servers during backup and restore processes.

ufw status
Status: active
To Action From
-- ------ ----
6162/tcp ALLOW 10.38.207.157 Allow Veeam Mgmt from Veeam BUR server
2500/tcp ALLOW Anywhere Veeam rule 876f0752-7209-4e8b-8b34-fa0af7dbced4
2501/tcp ALLOW Anywhere Veeam rule 876f0752-7209-4e8b-8b34-fa0af7dbced4
6162/tcp ALLOW OUT Anywhere Veeam transport rule
2500/tcp ALLOW OUT Anywhere Veeam rule 876f0752-7209-4e8b-8b34-fa0af7dbced4
2501/tcp ALLOW OUT Anywhere Veeam rule 876f0752-7209-4e8b-8b34-fa0af7dbced4

Zoom

![Veeam backup](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/veeam-cr-sa-lhbr-proxy.svg)

Figure 2. Veeam backup



 Best practices for a Linux hardened repository 

The [Compliance assessment report (by Cohasset)](https://www.veeam.com/wp-compliance-assessment-report-cohasset.html) describes the settings that must be configured to become compliant with the following regulations:



* FINRA Rule 4511.
* SEC Rule 17a-4(f).
* CFTC Rule 1 .31 (c)-(d).



The previous assessment report considers the following details as best practice for a Linux hardened repository:



* The Linux hardened repository can be independent or Scale-out backup repository.
To view or generate an infrastructure API key, see [Managing classic infrastructure API keys](https://cloud.ibm.com/docs/account?topic=account-classic_keys).

--region REGION
: Specify a region in Red Hat OpenShift on IBM Cloud: jp-osa, jp-tok, au-syd, eu-de, eu-gb, us-east, or us-south.

-q
: Optional: Do not show the message of the day or update reminders.



 Example credential set classic command 

ibmcloud oc credential set classic --infrastructure-api-key <api_key> --infrastructure-username dbmanager --region us-south







 ibmcloud oc credential unset 

Classic infrastructure

Remove the credentials for a resource group and region to remove access to the IBM Cloud infrastructure portfolio through your IBM Cloud account.

After you remove the credentials, the [IBM Cloud IAM API key](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_api_key_info) is used to order resources in IBM Cloud infrastructure.

ibmcloud oc credential unset --region REGION [-q]

Minimum required permissions
: Administrator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

--region REGION
: Specify a region in Red Hat OpenShift on IBM Cloud: jp-osa, jp-tok, au-syd, eu-de, eu-gb, us-east, or us-south.

-q
: Optional: Do not show the message of the day or update reminders.



 Example credential unset command 

ibmcloud oc credential unset --region us-south









 infra-permissions commands 

Check classic IBM Cloud infrastructure permissions that are used in Red Hat OpenShift on IBM Cloud.

The ibmcloud oc infra-permissions commands check only classic IBM Cloud infrastructure, not VPC permissions.



 ibmcloud oc infra-permissions get 

Classic infrastructure
upload: ./large-dataset.tar.gz to s3://bucket-1/large-dataset-for-project-x





 Copying an object from one bucket to another within the same region: 

$ aws --endpoint-url {endpoint} s3 cp s3://bucket-1/new-file s3://bucket-2/
copy: s3://bucket-1/new-file to s3://bucket-2/new-file





 Delete an object from a bucket 

aws --endpoint-url {endpoint} s3 rm s3://mybucket/argparse-1.2.1.tar.gz
delete: s3://mybucket/argparse-1.2.1.tar.gz





 Remove a bucket 

aws --endpoint-url {endpoint} s3 rb s3://bucket-1
remove_bucket: s3://bucket-1/





 Create presigned URLs 

The CLI can create pre-signed URLs. These URLs allow for temporary public access to objects without changing any existing access controls.

$ aws --endpoint-url {endpoint} s3 presign s3://bucket-1/new-file

It's also possible to set a time-to-live for the URL in seconds (default is 3600):

$ aws --endpoint-url {endpoint} s3 presign s3://bucket-1/new-file --expires-in 600







 Low-level syntax commands 

The AWS CLI also allows direct API calls that provide the same responses as direct HTTP requests by using the s3api command.



 Listing buckets: 

$ aws --endpoint-url {endpoint} s3api list-buckets
{
"Owner": {
"DisplayName": "{storage-account-uuid}",
"ID": "{storage-account-uuid}"
},
"Buckets": [
ComposeGenerator: m2kassets/built-in/transformers/compose/composegenerator/transformer.yaml
ContainerImagesPushScriptGenerator: m2kassets/built-in/transformers/containerimagespushscript/transformer.yaml
DockerfileDetector: m2kassets/built-in/transformers/dockerfile/dockerfiledetector/transformer.yaml
DockerfileImageBuildScript: m2kassets/built-in/transformers/dockerfile/dockerimagebuildscript/transformer.yaml
DockerfileParser: m2kassets/built-in/transformers/dockerfile/dockerfileparser/transformer.yaml
DotNetCore-Dockerfile: m2kassets/built-in/transformers/dockerfilegenerator/dotnetcore/transformer.yaml
EarAnalyser: m2kassets/built-in/transformers/dockerfilegenerator/java/earanalyser/transformer.yaml
EarRouter: m2kassets/built-in/transformers/dockerfilegenerator/java/earrouter/transformer.yaml
Golang-Dockerfile: m2kassets/built-in/transformers/dockerfilegenerator/golang/transformer.yaml
Gradle: m2kassets/built-in/transformers/dockerfilegenerator/java/gradle/transformer.yaml
Jar: m2kassets/built-in/transformers/dockerfilegenerator/java/jar/transformer.yaml
Jboss: m2kassets/built-in/transformers/dockerfilegenerator/java/jboss/transformer.yaml
Knative: m2kassets/built-in/transformers/kubernetes/knative/transformer.yaml
Kubernetes: m2kassets/built-in/transformers/kubernetes/kubernetes/transformer.yaml
Global hot spare 1x 960 GB 5100 hdd6 







 Disk mount points and Partitions 



 Array Partition Name Size (GB) 

 RAID1-A /dev/sda 
 /dev/sda1 /boot 50 
 /dev/sda2 / 150 
 /dev/sda3 /usr/sap 150 
 /dev/sda4 /hana/log remaining capacity 
 RAID1-B /dev/sdb 
 /dev/sdb1 /hana/shared 800 
 /dev/sdb2 /hana/data remaining capacity 









 BI.S4.H2.192 Appliance 

Link to Profile: [BI.S4.H2.192 Appliance](https://cloud.ibm.com/gen1/infrastructure/provision/bm?imageItemId=13475&packageId=1109&presetId=1087)



 Physical Disk and RAID Configuration 



 RAID Components Drives Array Total Capacity 

 RAID 1 2x 960 GB 5100 hdd0, hdd1 RAID1-A 960 GB 
 RAID 1 2x 960 GB 5100 hdd2, hdd3 RAID1-B 960 GB 
 Global hot spare 1x 960 GB 5100 hdd4 







 Disk mount points and Partitions 



 Array Partition Name Size (GB) 

 RAID1-A /dev/sda 
 /dev/sda1 /boot 50 
 /dev/sda2 / 150 
 /dev/sda3 /usr/sap 150 
 /dev/sda4 /hana/log remaining capacity 
 RAID1-B /dev/sdb 
 /dev/sdb1 /hana/shared 250 
 /dev/sdb2 /hana/data remaining capacity 









 BI.S4.H2.384 Appliance 

Link to Profile: [BI.S4.H2.384 Appliance](https://cloud.ibm.com/gen1/infrastructure/provision/bm?imageItemId=13475&packageId=1109&presetId=1091)



 Physical Disk and RAID Configuration 



 RAID Components Drives Array Total Capacity 

 RAID 1 2x 960 GB 5100 hdd0, hdd1 RAID1-A 960 GB
For the cluster that you want to stop collecting API server audit logs from: [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)
2. Disable the webhook back-end configuration for the cluster's API server.

ibmcloud ks cluster master audit-webhook unset --cluster <cluster_name_or_ID>
3. Apply the configuration update by restarting the Kubernetes master.

ibmcloud ks cluster master refresh --cluster <cluster_name_or_ID>









 Managing API server log forwarding 

See [Verifying, updating, and deleting log forwarding](https://cloud.ibm.com/docs/containers?topic=containers-healthverifying-log-forwarding).







 Service audit logs 

By default, IBM Cloud Kubernetes Service generates and sends events to IBM Cloud Activity Tracker. To see these events, you must create an IBM Cloud Activity Tracker instance. For more information, see [IBM Cloud Activity Tracker events](https://cloud.ibm.com/docs/containers?topic=containers-at_events).
Traffic directed to COS can come from one of three networks: Public, Private, or Direct. The network that is targeted is defined by the COS service endpoint used to access a bucket. While a bucket is created in a single location (be that Cross Region, Regional, or Single Site) it is still possible to access that same bucket via any of the three network types described.

Public traffic traverses the public Internet until it reaches the IBM Cloud and is routed to a load balancer that directs traffic into the COS distributed storage network. Private traffic originates within the IBM Cloud and never touches the public Internet. Direct traffic originates in a Virtual Private Cloud that could contain both local data centers and IBM Cloud resources. This architecture requires IBM Direct Link, and allows users to connect directly to the Private IBM Cloud network from a user's data center (using a reverse proxy) without ever touching the public Internet.

Because the Private network eliminates any variances, congestion, or vulnerabilities found in the Public Internet, it is recommended that all workloads use the Private network whenever possible.
Sentinel memory

oc patch statefulset c-$INSTANCENAME-redis-s --type='json' -p='{"op": "replace", "path": "/spec/template/spec/containers/0/resources/limits/memory", "value":"256Mi"},{"op": "replace", "path": "/spec/template/spec/containers/1/resources/limits/memory", "value":"256Mi"},{"op": "replace", "path": "/spec/template/spec/containers/2/resources/limits/memory", "value":"256Mi"},{"op": "replace", "path": "/spec/template/spec/containers/3/resources/limits/memory", "value":"256Mi"},{"op": "replace", "path": "/spec/template/spec/containers/0/resources/requests/memory", "value":"256Mi"},{"op": "replace", "path": "/spec/template/spec/containers/1/resources/requests/memory", "value":"256Mi"},{"op": "replace", "path": "/spec/template/spec/containers/2/resources/requests/memory", "value":"256Mi"},{"op": "replace", "path": "/spec/template/spec/containers/3/resources/requests/memory", "value":"256Mi"}] ! ! ! !! ! ! ! ! !
Policy ID: 140555ce-93ac-4fb2-b15d-6ad726795d90
Roles: Administrator
Resources:
Service Name containers-kubernetes
Service Instance df253b6025d64944ab99ed63bb4567b6
Region
Resource Type
Resource
3. If you have either of these policies, skip to the second bullet point of step 4. If you don't have either of these policies, skip to the third bullet point of step 4.



4. Depending on your access policies, choose one of the following options.



* If you have access to the cluster and to the resource group that the cluster is in:



1. Target the resource group. Note: You can't work with clusters in other resource groups until you change this resource group.

ibmcloud target -g <resource_group>
2. Target the cluster.

ibmcloud ks cluster config --cluster <cluster_name_or_ID>



* If you have access to the cluster but not to the resource group that the cluster is in:



1. Do not target a resource group. If you already targeted a resource group, remove the target.

ibmcloud target --unset-resource-group
2. Target the cluster.

ibmcloud ks cluster config --cluster <cluster_name_or_ID>



* If you don't have access to the cluster:



1. Ask your account owner to assign an [IBM Cloud IAM platform access role](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-perms) to you for that cluster.
2. Do not target a resource group. If you already targeted a resource group, remove the target.

ibmcloud target --unset-resource-group
3. Target the cluster.

ibmcloud ks cluster config --cluster <cluster_name_or_ID>
Member memory

oc patch statefulset c-$INSTANCENAME-redis-m --type='json' -p='{"op": "replace", "path": "/spec/template/spec/containers/0/resources/limits/memory", "value":"256Mi"},{"op": "replace", "path": "/spec/template/spec/containers/1/resources/limits/memory", "value":"256Mi"},{"op": "replace", "path": "/spec/template/spec/containers/2/resources/limits/memory", "value":"256Mi"},{"op": "replace", "path": "/spec/template/spec/containers/3/resources/limits/memory", "value":"256Mi"},{"op": "replace", "path": "/spec/template/spec/containers/0/resources/requests/memory", "value":"256Mi"},{"op": "replace", "path": "/spec/template/spec/containers/1/resources/requests/memory", "value":"256Mi"},{"op": "replace", "path": "/spec/template/spec/containers/2/resources/requests/memory", "value":"256Mi"},{"op": "replace", "path": "/spec/template/spec/containers/3/resources/requests/memory", "value":"256Mi"}]'

Sentinel CPU
Save the following DaemonSet to a file called customize.yaml

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: ibm-user-custom-configurator-privileged
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: system:openshift:scc:privileged
subjects:
- kind: ServiceAccount
name: ibm-user-custom-configurator
namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: ibm-user-custom-configurator
namespace: kube-system
---
apiVersion: v1
kind: ConfigMap
metadata:
name: ibm-user-custom-configurator
namespace: kube-system
data:
89-hugepages.conf: 
vm.nr_hugepages=<<NUMBER_OF_HUGEPAGES>>
configure.sh: 
!/usr/bin/env bash
set -x
cp -f /scripts/ibm-user-custom-configuration.sh /host-usr-local-bin/ibm-user-custom-configuration.sh
chmod 0755 /host-usr-local-bin/ibm-user-custom-configuration.sh
cp -f /scripts/ibm-user-custom-configuration.service /host-etc-systemd-dir/ibm-user-custom-configuration.service
chmod 0644 /host-etc-systemd-dir/ibm-user-custom-configuration.service
if [ -f /scripts/89-hugepages.conf ]]; then
cp -f /scripts/89-hugepages.conf /host-etc-systctld-dir/89-hugepages.conf
fi
Modify the input.auto.tfvars file to specify your zone, VPC component names, profile, and image. The file is preset with the minimal recommended disk sizes. You need your 40-digit SSH key ID for this file. The second SSH key is optional. For more options for profile, see [Instance Profiles](https://cloud.ibm.com/docs/vpc?topic=vpc-profiles). For more options for image, see [Images](https://cloud.ibm.com/docs/vpc?topic=vpc-about-images). For descriptions of the variables, see the [JAVA README file](https://github.com/IBM-Cloud/sap-netweaver-java-hana) or the [ABAP README file](https://github.com/IBM-Cloud/sap-netweaver-abap-hana/blob/main/cli/README.md).

You must modify:



* VPC - Existing VPC name.
* SECURITYGROUP - Change ic4sap-securitygroup to the existing securitygroup name.
* SUBNET - Change ic4sap-subnet to the existing subnet name.
* DB-HOSTNAME - enter a hostname up to 13 characters. For more information, see the readme file.
* APP-HOSTNAME - enter a hostname up to 13 characters. For more information, see the readme file.



Replace the SSH key with your 40-digit SSH key.

For JAVA:

General VPC variables for JAVA stack
REGION = "ed-de"
ZONE			= "eu-de-2"
VPC				= "ic4sap"
SECURITYGROUP	= "ic4sap-securitygroup"
SUBNET			= "ic4sap-subnet"
SSH_KEYS		= [ "ssh key1" , "ssh key2" ]

 SAP Database VSI variables:
DB-HOSTNAME = "sapjavadb"
DB-PROFILE = "mx2-16x128"
For example, if 52.137.182.166 is currently registered to your domain and you want to add 52.137.182.270, you must specify --ip 52.137.182.166, 52.137.182.270 in the command.

Minimum required permissions
: Editor platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster where the domain is applied.

--domain DOMAIN
: Required. The domain you want to update.

--hostname HOSTNAME
: For VPC clusters. The hostname to register for the domain.

--ip IP
: The IP addresses to register for the domain. The IP addresses passed in fully replace those that are currently associated with the domain. If you want to keep the current IP addresses, you must include them. Specifying this flag with no values unregisters the current IP addresses from the domain.

-q
: Optional: Do not show the message of the day or update reminders.



 Example ingress domain update command 

ibmcloud ks ingress domain update --cluster CLUSTER --domain DOMAIN [--hostname HOSTNAME] [--ip IP] [-q]







 ibmcloud ks ingress instance default set 

Virtual Private Cloud

Classic infrastructure

Set a registered an IBM Cloud Secrets Manager instance to default. If an existing default instance exists, it will be unset from default.

When you set a new default Secrets Manager instance, any existing secrets that are not managed by IBM Cloud must have their certificate CRN manually updated to match the CRN of the new default instance. To update the CRN, use the ibmcloud ks ingress secret update command. If you do not update the CRN, these secrets do not update at the next scheduled certificate renewal.

ibmcloud ks ingress instance default set --cluster CLUSTER --crn CRN --name NAME [-q] [--secret-group GROUP]

Minimum required permissions
: Administrator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

--c, --cluster CLUSTER