vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* Select your MSP, Multiregion OS MSP from the drop-down list.
* As before, skip the TLS CSR hostname option.
* In the Fabric version drop-down list, select the latest available version, as it will contain the latest bug fixes.
* Click Next.



8. Review the Summary page and click Add another node.





 Task: Add second ordering node 



Table 7. Create second ordering node

 Display name MSP Enroll ID Secret 

 Create ordering node OS2-Region1 Multiregion OS MSP 
 CA Multiregion OS CA 
 Ordering Service Identity os1 os1pw 









 Add the OS2-Region1 node to the orderer system channel 

If your cluster does not use a system channel, skip this step. To verify if a cluster uses a system channel, click the cluster tile and check the Orderer Type.

To complete the process of adding the node, you need to add it to the consenter set of the system channel. After the ordering node has been successfully added, a new tile with the name of OS2-Region1 appears on the Multiregion Ordering Service page with the label "Requires attention". This state reflects the fact that, while the node creation process has been successful, the node is not yet part of the consenter set of the system channel. The node must be added to the system channel before it can be added to any of the application channels.

Recall that the "consenter set" refers to the ordering service nodes actively participating in the ordering process on a channel, while the "system channel", which is managed by the ordering service, forms the template for application channels.

To add the node you created to the system channel, click the OS2-Region1 node. You will see an Add node to ordering service button. Click this button. After the node has been added to the ordering service, the node is now part of the system channel.

Note that it will take a few minutes for the new node to sync with ordering service in the system channel. During this time, you may see a message that your ordering service is down. This is normal --- the ordering service must come down while the new node is syncing.
[-d, --dual-auth-delete-policy-enabled KEY_RING_ID]
[--key-ring KEY_RING_ID]
[-k, --key-material KEY_MATERIAL]
[-m, --rotation-interval-month VALUE]
[-n, --encrypted-nonce NONCE]
[-o, --output OUTPUT]
[-s, --standard-key]
[-v, --iv IV]



 Example 

Create a root key that enables a rotation policy with an interval of 2 months (each "month" is valued at 30 days, resulting in a 60-day rotation interval).

% ibmcloud kp key create-key-with-policy-overrides test-key -m 2 -r
Creating key with policy overrides: 'test-key', in instance: '47377f07-8721-2O47-f396-ef1982c1e96e'...

OK
Key ID Key Name
076df396-4c90-e008-bf20-f1bb672d465b test-key

 List policies
% ibmcloud kp key policies 076df396-4c90-e008-bf20-f1bb672d465b
Retrieving policy details for key ID: 076df396-4c90-e008-bf20-f1bb672d465b...
OK

Created By IBMid-xxxxnnnnnxxx
Creation Date 2022-10-27T17:48:20Z
Last Updated 2022-10-27T17:48:20Z
Updated By IBMid-xxxxnnnnnxxx
Policy Type Rotation
Interval 2
Enabled true





 Required parameters 



* KEY_NAME

A unique, human-readable identifier to assign to your key.
* -i, --instance-ID

The IBM Cloud instance ID that identifies your Key Protect instance.
Update any import declarations from boto3 to ibm_boto3.
3. If needed, reinstall the original boto3 by updating the requirements.txt, or from PyPI via pip install boto3.





 Creating a client and sourcing credentials 

To connect to COS, a client is created and configured using credential information (API key and service instance ID). These values can also be automatically sourced from a credentials file or from environment variables.

After generating a [Service Credential](https://cloud.ibm.com/docs/cloud-object-storage/iam?topic=cloud-object-storage-service-credentials), the resulting JSON document can be saved to /.bluemix/cos_credentials. The SDK will automatically source credentials from this file unless other credentials are explicitly set during client creation. If the cos_credentials file contains HMAC keys the client authenticates with a signature, otherwise the client uses the provided API key to authenticate by using a bearer token (using an API key still requires the config=Config(signature_version="oauth") to be included during client creation).

If migrating from AWS S3, you can also source credentials data from /.aws/credentials in the format:

[default]
aws_access_key_id = {API_KEY}
aws_secret_access_key = {SERVICE_INSTANCE_ID}

If both /.bluemix/cos_credentials and /.aws/credentials exist, cos_credentials takes preference.



 Gather required information 

The following variables appear in the examples:



* bucket_name must be a [unique and DNS-safe](https://cloud.ibm.com/docs/cloud-object-storage/api-reference?topic=cloud-object-storage-compatibility-api-bucket-operationscompatibility-api-new-bucket) string. Because bucket names are unique across the entire system, these values need to be changed if this example is run multiple times. Note that names are reserved for 10 - 15 minutes after deletion.
OK
Service instance MyServiceInstance was created.

Name: MyServiceInstance
ID: crn:v1:staging:public:ibmanalyticsengine:us-south:a/d628eae2cc7e4373bb0c9d2229f2ece5:1e32e-afd9-483a-b1-724ba5cf4::
GUID: 1e32e-afd9-483a-b1-724ba5cf4
Location: us-south
State: provisioning
Type: service_instance
Sub Type:
Service Endpoints: public
Allow Cleanup: false
Locked: false
Created at: 2021-11-29T07:20:40Z
Updated at: 2021-11-29T07:20:42Z
Last Operation:
Status create in progress
Message Started create instance operation
Show more

The sample response to the create instance command is:

Creating service instance MyServiceInstance in resource group Default of account <your account name> as <your user name>...
OK
Service instance MyServiceInstance was created.

Name: MyServiceInstance
ID: crn:v1:staging:public:ibmanalyticsengine:us-south:a/d628eae2cc7e4373bb0c9d2229f2ece5:1e32e-afd9-483a-b1-724ba5cf4::
GUID: 1e32e-afd9-483a-b1-724ba5cf4
Location: us-south
State: provisioning
Type: service_instance
Sub Type:
Service Endpoints: public
Allow Cleanup: false
Locked: false
Created at: 2021-11-29T07:20:40Z
Updated at: 2021-11-29T07:20:42Z
Last Operation:
Status create in progress
Message Started create instance operation
Show more
First, create a root key from a [base64 value](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-create-example-3) or an [imported token](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-create-example-4).

 create a random, base64-encoded, 32-byte key material
$ KEY_MATERIAL=$(openssl rand -base64 32)

 create a root key from a base64-encoded value
$ ibmcloud kp key create my-base64-root-key -k $KEY_MATERIAL

Creating key: 'my-base64-root-key', in instance: '390086ac-76fa-4094-8cf3-c0829bd69526'...
OK
Key ID Key Name
e55f86ab-6984-4594-ad23-3024f6440a58 my-base64-root-key

 create a new key material
$ NEW_KEY_MATERIAL=$(openssl rand -base64 32)

 rotate the key
$ ibmcloud kp key rotate e55f86ab-6984-4594-ad23-3024f6440a58 -k $NEW_KEY_MATERIAL

Rotating root key...
OK

 the key was created from a key material, NOT providing a new key material will fail
$ ibmcloud kp key rotate e55f86ab-6984-4594-ad23-3024f6440a58

Rotating root key...
FAILED





 Example 3 

This examples shows how to...



1. Create a root key
2. Create a data encryption key (DEK), this is the plaintext
3. Wrap the DEK with the root key, this creates a ciphertext
4. Rotate the root key
5.
In addition, to ensure successful Day 2 operations, improve the core VMware NSX-T™ skills by using the available [VMware Learning for NSX-T education](https://www.vmware.com/learning.html).





 Engage a migration services provider 

You can engage PrimaryIO’s experienced Professional Services team through the IBM Catalog. For more information, see [HDM Cloud Connect NSX-V to NSX-T](https://cloud.ibm.com/catalog/services/hdm-cloud-connect-nsx-v-to-nsx-t).

PrimaryIO’s Fasttrack Migration Service is optimized to move customers away from NSX-V and onto NSX-T through short form engagements that continually drive progress by focusing on critical path objectives.





 Source environment complexity patterns 

The output of the [Assess migration complexity](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-v2t-complexity) step is a complexity status of low, medium, or high.

This status can be used to help the selection as follows:



* A target platform.
* A configuration migration pattern.
* A workload migration pattern.
* A network L2 extension pattern.



You are not able to neatly classify every source environment due to the multiple number of variations. Also, client requirements into one of these three categories by a set of rules or a defined set of parameters. Therefore, an analytical approach is required with a consensus gained across your team.





 Target platforms 

Based on the source environment complexity, you must consider the following target platform:



* Single site VMware vCenter Server® instance - An automated provisioning offering that deploys hardware and software in a defined pattern. After initial deployment, you must add capacity and additional services to a number of automated workflows as needed. For more information, see [vCenter Server overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_vcenterserveroverview). The types of vCenter Server instances include:



* Regulated Workloads.
* Percentage-based: greater than X% of requests return a non-200 response code
* Consecutive-based: X calls in a row return a non-200 response code
* Limit-based: X calls return a non-200 response in a given timeframe



To avoid an unnecessary failover between regions, make sure a robust retry mechanism is present when calling the /message endpoint.





 Failover for v1 and v2 stateless API 

For a successful failover, ensure the following:



* Training data changes should be synchronized across regions. Avoid pushing changes delayed over a large window of time (such as days) to mitigate risk of algorithm changes being deployed by Watson Assistant in between regions being updated.
* The same IBM Cloud account should be used for the service instances across regions to maintain a single overall bill for services.
* The client applications should support:



* Watson Assistant API hostname
* Service instance credentials
* v1: workspace_id
* v2: assistant_id





Although it does not affect the runtime flow of calling /message, if you are using fine-grained access control using IBM Access Control (IAM), make sure the IAM policies are appropriately synchronized across the regions.

Note that IAM is a global service, but the custom resources (assistants and skills) used by Watson Assistant access control means each region, which has specific resources, requires specific policies.

For an active/passive topology, some form of a [circuit break pattern](https://martinfowler.com/bliki/CircuitBreaker.html) can be used. A single service instance in a given region is used exclusively unless errors are detected. At that point, the system can respond by updating the relevant failover metadata to route traffic to the service instance in the other region. Once a failover happens, you can decide to continue using the new region as the active instance, or if you want to resume using the initial region once it has stabilized.

For an active/active topology, some form of a load balancing can be used, where two or more service instances in unique regions always receive a percentage of traffic. Additional logic would need to be established to determine when to pull a region out of rotation.
The JSONElement that is returned by this method is the JSONElement that is being removed.

For this Dialog runtime context:

{
"context": {
"user": {
"first_name": "John",
"last_name": "Snow"
}
}
}

Dialog node output:

{
"context": {
"attribute_removed": "<? $user.remove('first_name') ?>"
}
}

Result:

{
"context": {
"user": {
"last_name": "Snow"
},
"attribute_removed": {
"first_name": "John"
}
}
}





 com.google.gson.JsonObject support 

In addition to the built-in methods, some of the standard methods of the com.google.gson.JsonObject class are also supported.







 Strings 

There methods help you work with text.

For information about how to recognize and extract certain types of Strings, such as people names and locations, from user input, see [System entities](https://cloud.ibm.com/docs/assistant?topic=assistant-system-entities).

Note: For methods that involve regular expressions, see [RE2 Syntax reference](https://github.com/google/re2/wiki/Syntax) for details about the syntax to use when you specify the regular expression.



 String.append(Object) 

This method appends an input object to the string as a string and returns a modified string.

For this Dialog runtime context:

{
"context": {
"my_text": "This is a text."
}
}

This syntax:

{
"context": {
"my_text": "<? $my_text.append(' More text.') ?>"
}
}

Results in this output:

{
"context": {
* [Date and Time](https://cloud.ibm.com/docs/assistant-data?topic=assistant-data-dialog-methodsdialog-methods-date-time)
* [Numbers](https://cloud.ibm.com/docs/assistant-data?topic=assistant-data-dialog-methodsdialog-methods-numbers)
* [Objects](https://cloud.ibm.com/docs/assistant-data?topic=assistant-data-dialog-methodsdialog-methods-objects)
* [Strings](https://cloud.ibm.com/docs/assistant-data?topic=assistant-data-dialog-methodsdialog-methods-strings)







 Arrays 

You cannot use these methods to check for a value in an array in a node condition or response condition within the same node in which you set the array values.



 JSONArray.append(object) 

This method appends a new value to the JSONArray and returns the modified JSONArray.

For this Dialog runtime context:

{
"context": {
"toppings_array": ["onion", "olives"]
}
}

Make this update:

{
"context": {
"toppings_array": "<? $toppings_array.append('ketchup', 'tomatoes') ?>"
}
}

Result:

{
"context": {
"toppings_array": ["onion", "olives", "ketchup", "tomatoes"]
}
}





 JSONArray.contains(Object value) 

This method returns true if the input JSONArray contains the input value.

For this Dialog runtime context which is set by a previous node or external application:

{
"context": {
"toppings_array": ["onion", "olives", "ham"]
}
}

Dialog node or response condition:

$toppings_array.contains('ham')
In the [IBM Cloud console ![External link icon](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/icons/launch-glyph.svg)](https://cloud.ibm.com/login), you can go to menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/icons/icon_hamburger.svg) > VPC Infrastructure > Compute > SSH keys to manage your SSH keys. From here you can create, rename, or delete keys. If you select to create a key, that key must be an RSA SSH key type. You can upload an Ed25519 SSH key type, you just can't generate one within VPC.



* For Windows or VMware images, you must use the RSA SSH key type. The Ed25519 SSH key type can't be used with Windows or VMware images.
* For Linux images, the Ed25519 SSH key type can be used only if the SSH server for the operating system supports that key type.



You can create an RSA SSH key from the UI, but Ed25519 SSH keys must be imported.





 SSH key types: RSA and Ed25519 in the CLI 

IBM Cloud® Virtual Private Cloud supports two different types of public SSH keys.



* RSA
* Ed25519



On IBM Cloud VPC, RSA is the default SSH key type. You can select to change the key type to Ed25519. The Ed25519 SSH key type enables a slightly higher performance benefit because it can give the same level of security as the RSA SSH key type with a smaller key. You can create virtual server instances and bare metal servers with a mix of RSA and Ed25519 SSH keys.
"renewable": false,
"lease_duration": 0,
"data": {
"policies": [
{
"created_by": "iam-ServiceId-c0c7cfa4-b24e-4917-ad74-278f2fee5ba0",
"creation_date": "2021-06-21T14:30:17Z",
"crn": "crn:v1:bluemix:public:secrets-manager:us-south:a/a5ebf2570dcaedf18d7ed78e216c263a:0f4c764e-dc3d-44d1-bd60-a2f7cd91e0c0:policy:ea1907c8-8c8e-6b83-3c20-05f2015b80d8",
"id": "ea1907c8-8c8e-6b83-3c20-05f2015b80d8",
"last_update_date": "2021-06-21T14:33:41Z",
"rotation": {
"interval": 10,
"unit": "day"
},
"type": "application/vnd.ibm.secrets-manager.secret.policy+json",
"updated_by": "iam-ServiceId-c0c7cfa4-b24e-4917-ad74-278f2fee5ba0"
}
]
},
"wrap_info": null,
"warnings": null,
"auth": null
}









 Config 



 Set the configuration of a secret type 

Configures a secrets engine that serves as the backend for a specific type of secret. You can set the configuration for the following secret types: iam_credentials

IAM credentials



Table 10. IAM secrets engine request parameters

 Request parameters Description 

 api_key An IBM Cloud API key that can create and manage service IDs.
The functions are of the following types:

Artifact creation
Create time series, TRSs, and other artifacts that are used during the processing of time series data.

Exploding and flattening
Convert time series data to tabular data.

Summary
Retrieve information about a time series.

Statistical
Derive statistical insight from time series data. Each statistical function is of one of the following types:



* A transform produces, as output, a new time series.
* A reducer produces, as output, a single value per time series or segment, such as a distance or average.



Forecasting
Use [forecasting models](https://cloud.ibm.com/docs/services/sql-query?topic=sql-query-artifactforecasting_model_creation) to detect anomalies or predict future behavior based on past events.

Filtering
Return the subset of a time series that satisfies the filter criteria.

Cleaning
Remove null values from time series.

Segmentation
Create, as output, a segmented version of a time series.

Temporal join and align
Match two time series that have different timestamps (for example, because they have different periodicity) so that they both have the same timestamps. A temporal join produces a single array time series based on the timestamps and values of the two input time series. A temporal align produces two output time series with identical timestamps. In both cases, an [interpolator](https://cloud.ibm.com/docs/services/sql-query?topic=sql-query-artifactinterpolator_creation) is used to complete missing values.

Interpolation
Use interpolation either to fill missing values or to resample a time series at a different periodicity.

String matching
Match the values of a string time series against a string sequence (sequence matching) or a set of strings (item set matching).

Time functions
Convert a string or timestamp into a value of type Long.



* [Time reference systems](https://cloud.ibm.com/docs/services/sql-query?topic=sql-query-TRS)
$ ibmcloud kp key show 8635b804-9966-4918-a16b-d561fdbf181f --output json

{
"id": "8635b804-9966-4918-a16b-d561fdbf181f",
"name": "my-root-key",
"type": "application/vnd.ibm.kms.key+json",
"algorithmType": "AES",
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-05-05T19:58:02Z",
"lastUpdateDate": "2020-05-05T19:58:24Z",
"lastRotateDate": "2020-05-05T19:58:24Z",
"keyVersion": {
"id": "85b65b20-4165-4da3-8ba9-880e72390461",
"creationDate": "2020-05-05T19:58:24Z"
},
"extractable": false,
"state": 1,
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:390086ac-76fa-4094-8cf3-c0829bd69526:key:8635b804-9966-4918-a16b-d561fdbf181f"
}



 Key Description 

 id This is the KEY_ID, it is unique and is used whenever the CLI specifies a KEY_ID 
 name The name provided when the key was created 
 type Used by the API to set the content-type in a REST call 
 algorithmType Algorithm types are advanced encryption standard (AES) or cipher block chaining (CBC) 
 createdBy The user id that created the key
ibmcloud pi volume-multi-create 



 Create multiple volume 

ibmcloud pi volume-multi-create VOLUME_BASE_NAME --type TYPE --volume-count COUNT --size SIZE [--shareable] [--json]

ibmcloud pi volume-multi-create VOLUME_BASE_NAME --storage-pool POOL --volume-count COUNT --size SIZE [--shareable] [--json]

ibmcloud pi volume-multi-create VOLUME_BASE_NAME --affinity-policy affinity --volume-count COUNT --size SIZE [--shareable] (--affinity-volume VOLUME | --affinity-instance INSTANCE) [--json]

ibmcloud pi volume-multi-create VOLUME_BASE_NAME --affinity-policy anti-affinity --volume-count COUNT --size SIZE [--shareable] (--anti-affinity-volumes "VOLUME1 [VOLUMEn]" | --anti-affinity-instances "INSTANCE1 [INSTANCEn]") [--json]



* VOLUME_NAME: The base name of the volumes.



Options



* --type value: Type of the volume (use "ibmcloud pi storage-types" to see available storage types in the targeted region); required if --affinity-policy and --storage-pool are not provided
* --volume-count value: Number of volumes to create.
* --size value: Size of the volume (in GB)
* --shareable: Whether the volume can be attached to multiple VMs
* --storage-pool value: Volume pool where the volume will be created. If --storage-pool is provided then --type and --affinity-policy values cannot be specified
* --affinity-policy value: Affinity policy for data volume being created. Valid values are "affinity" and "anti-affinity". If --storage-pool is provided then this cannot be specified
* --affinity-instance value: PVM instance identifier or name to base volume affinity policy against; required if "--affinity-policy affinity" is specified and --affinity-volume is not provided
Under Keystore type, select one of the following keystore types depending on which type of keystore you want to create the key in. And then, click Next.



* AWS Key Management Service: Create a key to be used and stored in an AWS Key Management Service instance.
* Azure Key Vault: Create a key to be used and stored in an Azure Key Vault.
* Google Cloud KMS: Create a key to be used and stored in a Google Cloud KMS keystore.
* IBM Cloud KMS: Create a key to be used and stored in an IBM Cloud Hyper Protect Crypto Services keystore.
* IBM Key Protect: Create a key to be used and stored in an IBM Key Protect key ring.



After a keystore type is selected, you can activate the key in keystores of this type only. If you select IBM Cloud KMS, the created key is a root key that can be used for [envelope encryption](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-envelope-encryption).
6. Under Key properties, specify the following details of the key. Click Next to continue when you are done.

AWS Key Management Service keys

Azure Key Vault keys

Google Cloud KMS keys



Table 1. AWS Key Management Service keys properties

 Property Description 

 Key name A unique, human-readable name for easy identification of your key. It must be 1–255 characters in length. The characters can be letters (case-sensitive), digits (0–9), or symbols (/_-). However, do not start the name with AWS/. 
 Description (Optional) An extended description for your key, with up to 200 characters in length. 
 Algorithm The encryption algorithm to encrypt data for the key. 
 Length The number of bits that represents the encryption strength of the key. 
 State The initial state of the key, including Pre-active and Active. Pre-active keys are not activated in keystores for encryption. Active keys are automatically activated in the target keystores.