vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Instead, use the notify ipsec configuration line in the VRA configuration file that replaced that command for the Vyatta 5600.
: This issue can also be caused by AES-NI not being enabled, per the previous issue.
: This example illustrates the old version:

set interfaces bonding dp0bond1 vrrp vrrp-group 1 run-transition-scripts backup /config/scripts/ipsec-stop
set interfaces bonding dp0bond1 vrrp vrrp-group 1 run-transition-scripts fault /config/scripts/ipsec-stop
set interfaces bonding dp0bond1 vrrp vrrp-group 1 run-transition-scripts master /config/scripts/ipsec-restart
: Switch to this type of configuration, making sure to match the correct outside interface and vrrp-group:

set interfaces bonding dp0bond1 vrrp vrrp-group 1 notify ipsec

Failures with multiple IPsec tunnels
: VRA versions 2012h and earlier have a bug where IPsec tunnels fail when there are many of them. When this occurs, errors similar to the following occur in your IPsec and system logs:

2022-04-28T10:15:28+0000 dataplane[4551]: CRYPTODEV: rte_cryptodev_pmd_allocate() line 726: Reached maximum number of crypto devices
2022-04-28T10:15:28+0000 dataplane[4551]: CRYPTODEV: rte_cryptodev_pmd_create() line 110: Fail
: This issue was fixed in version 2012k. Update to version 2012k or later.

After Vyatta failover, traffic through Netscaler VPX goes down
: When VRRP failover occurs on the Vyatta, the new VRRP primary sends GARP. As a specification, when NetScaler VPX receives GARP, it sends an ARP request to validate rather than updating the ARP table by using GARP. Manually clearing the ARP for the specific IP address on the Netscaler VPX is a temporary workaround.
: This issue was fixed in version 2012m.
Debugging Ingress 

Virtual Private Cloud

Classic infrastructure

 What’s happening 

You exposed your app by creating an Ingress resource for your app in your cluster. However, when you try to connect to your app through the Ingress subdomain or the ALBs' IP addresses, the connection fails or times out.

 How to fix it 

The steps in the following sections can help you debug your Ingress setup.

Before you begin, ensure you have the following [IBM Cloud IAM access policies](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-perms) for IBM Cloud Kubernetes Service: - Editor or Administrator platform access role for the cluster - Writer or Manager service access role



 Step 1: Check your app deployment 

Before you debug Ingress, first check out [Debugging app deployments](https://cloud.ibm.com/docs/containers?topic=containers-debug_apps).

Ingress issues are often caused by underlying issues in your app deployment or in the ClusterIP service that exposes your app. For example, your app label and service selector might not match, or your app and service target ports might not match.





 Step 2: Run Ingress tests in the Diagnostics and Debug Tool 

While you troubleshoot, you can use the IBM Cloud Kubernetes Service Diagnostics and Debug Tool to run Ingress tests and gather pertinent Ingress information from your cluster. To use the debug tool, you can enable the add-on in your cluster.



1. In your [cluster dashboard](https://cloud.ibm.com/kubernetes/clusters), click the name of the cluster where you want to install the debug tool add-on.
2. On the Diagnostics and Debug Tool card, click Install.
3. In the dialog box, click Install. Note that it can take a few minutes for the add-on to be installed.
ETHTOOL_OPTS='-K envX tso on ' choose correct name of ethernet device used for communication between SAP instances (instead of envX)
config fileBOOTPROTO='static'
IPADDR='xx.xx.xx.xx/xx'
NAME='Virtual Ethernet card 0' NETWORK=''
REMOTE_IPADDR=''
STARTMODE='auto'
USERCONTROL='no'
MTU='9000'
To activate the changes, restart your network (ifdown envX; nmcli con down 'System envX'; nmcli con up 'System envX'), or set the MTU for the current configuration (with ip link set dev <envX> mtu 9000 and ethtool -K <envX> tso on).<-- </section "id="section-power-vs-network-configurations-rhel" "> --><-- <section "id="section-power-vs-numa-layout" "> --> NUMA layout Check that the balance of CPU and memory placement is optimized for SAP HANA by running the chk_numa_lpm.py script. The chk_numa_lpm.py script does the following actions.<-- <ul> --> * Checks the nonuniform memory access (NUMA) layout according to SAP HANA rules. The script verifies that no cores without memory exist and that the memory distribution among the cores doesn't exceed a 50% margin. In the first case, the script generates an error; in the latter case, the script generates a warning. * Checks whether a Live Partition Mobility (LPM) operation occurred. After LPM, the NUMA layout might differ from the configuration at boot time. The script scans the system log for the last LPM. A warning is generated if an LPM operation occurred since the last system boot.<-- </ul> --><-- <ol> -->1. Download the chk_numa_lpm.py script from the SAP Note 2923962]] ! ! .
If the incoming notifications satisfy the condition written for Topic (T), it routes the notification to all the destinations subscribed or connected to Topic (T) irrespective of the type of destinations.

For example, ACME Bank wants to route maintenance event notifications to customers by using android and iOS devices. Acme Bank is following these steps:



1. Create a topic named ACME-Maintenance.
2. Write Advance condition $.notification-type == 'maintenance'.
3. Subscribe push android and push iOS destinations to the above topic.
4. Next, send an event notification with payload containing attribute "notification-type":"maintenance"and "ibmenpushto": "{"platforms":["push_android","push_ios"]]}", notification-type attribute is added so that it matches against the topic condition and ibmenpushto for targeting customers with android and iOS devices.
5. Event Notifications will get routed to customers with android and iOS devices, since its payload contains "notification-type":"maintenance" which matches the condition for Topic ACME-Maintenance and "ibmenpushto": "{"platforms":["push_android","push_ios"]]}" as ibmenpushto is mandatory for push type Event Notifications destinations.



All push devices will get registered under Event Notifications destination of type push. For example, push-android, push-ios, and others.
* Event Notifications Tag subscriptions to push devices

For example, ACME Bank wants to route maintenance event notifications to customers by using android and iOS devices. ACME Bank maintenance usually takes place in one region at a time.

ACME Bank wants to register each of their customer's android and iOS devices under region-specific tags.



1. To achieve this the bank can use Event Notifications Android Client SDK and iOS Client SDK to subscribe to Asia Pacific customers' android and iOS devices under the AP tag.



Follow the below links on how to subscribe tag to push devices by using Event Notifications client SDKs:
controllerPodStatus=$(kubectl get pods -n kube-system | grep ibm-vpc-block-csi-controller | awk '{print $3}')
if [ "$controllerPodStatus" == "Running" ]]; then
echo "$(date +"%b %d %G %H:%M:%S"): VPC Block CSI Driver is now using ibm-cloud-credentials secret"
rm ibm-cloud-credentials.yaml
error "Error deleting ibm-cloud-credentials.yaml."
exit 0
fi
done

error "$(date +"%b %d %G %H:%M:%S"): Error - ibm-vpc-block-csi-controller is in $controllerPodStatus state"
}

main "$@"
Show more
2. Run the generate-secret.sh script and specify iam or pod-identity as the IBMCLOUD_AUTHTYPE and your PROFILE-ID or API-KEY.

Example command to run generate-secret.sh by using pod-identity with your trusted profiled ID.

sh ./generate-secret.sh pod-identity PROFILE-ID

Example command to run generate-secret.sh by using iam with an API key.

sh ./generate-secret.sh iam API-KEY
3. After the secret is created in your your cluster, disable and re-enable the add-on.

ibmcloud ks cluster addon disable vpc-block-csi-driver --cluster CLUSTER-ID

ibmcloud ks cluster addon enable vpc-block-csi-driver --version 4.4 --cluster CLUSTER-ID
4. Get the logs of the driver pod to verify the driver is using the correct credentials by looking for the secret type in the output. For example,"secret-used":"ibm-cloud-credentials","type":"pod-identity"}.

kubectl logs ibm-vpc-block-csi-controller-0 -c storage-secret-sidecar -n kube-system
The Space ID is a 128-bit UUID and can be chosen freely.
 The UUID can be generated by third-party tools, such as 'https://www.uuidgenerator.net/'.
 For example: "ca22be26-b798-4fdf-8c83-3e3a492dc215".
 'tokenspaceID' under the anonymous user is to identify the public keystore.
tokenspaceID: "ca22be26-b798-4fdf-8c83-3e3a492dc215"
iamauth:
<<: defaultiamcredential
 This API key for the Anonymous user must be provided.
 It will overide the 'apikey' in the previous defaultcredentials.iamauth.apikey field
apikey: "<your_api_key>"
logging:
 Set the logging level.
 The supported levels, in an increasing order of verboseness, are:
 'panic', 'fatal', 'error', 'warning'/'warn', 'info', 'debug', 'trace'.
 The Default value is 'debug'.
loglevel: debug
 The full path of your logging file.
 For example: /tmp/grep11client.log
logpath: /tmp/grep11client.log

Show more





 3. Install the Hyper Protect Crypto Services PKCS 11 library 



1.

[Download the latest PKCS #11 library](https://github.com/IBM-Cloud/hpcs-pkcs11/releases).
2. Copy the created configuration file grep11client.yaml and the PKCS #11 library pkcs11-grep11-<platform>.so.<version> into the home folder in your Oracle Database container.
3. Run the following commands as root to install the Hyper Protect Crypto Services PKCS #11 library in your Oracle Database setup.

mkdir /etc/ep11client
If you are using a similar configuration, it is recommended that you either install the CSB license and the application signature database or remove the dynamic-application any rule.





 Correcting warning 1179 

The vSRX version running on the Gateway is not certified on IBM Cloud and is unsupported. Operations such as OS Reload and Rebuild Cluster will overwrite the current unsupported vSRX version with the version currently listed on the Gateway Details page. Because the vSRX version is not certified on IBM Cloud, it is strongly recommended you contact [IBM Support](https://cloud.ibm.com/docs/vsrx?topic=gateway-appliance-getting-help) to migrate to the certified version found here: [IBM Cloud Juniper vSRX supported versions](https://cloud.ibm.com/docs/vsrx?topic=vsrx-vsrx-versions).





 Correcting warning 1180 

The vSRX license found on the Gateway was not procured through IBM Cloud and is unsupported. Operations such as OS Reload and Rebuild Cluster will overwrite the current license with the version currently listed on the Gateway Details page. Supported vSRX licenses can be found here: [Viewing and changing vSRX licenses](https://cloud.ibm.com/docs/vsrx?topic=vsrx-getting-startedchoosing-license). If the license was procured outside of IBM Cloud, please work with that procurement source for support. Otherwise, is is strongly recommended you contact [IBM Support](https://cloud.ibm.com/docs/vsrx?topic=gateway-appliance-getting-help) to migrate to a supported vSRX license.





 Correcting warning 1181 

The vSRX license and version on the Gateway are both unsupported.
{"level":"info","ts":1614089509.0128207,"caller":"git/git.go:203","msg":"Successfully initialized and updated submodules in path /workspace/source"}

mybuildrun-v2mb8-pod-tlzdx/step-build-and-push:
INFO[0000] Retrieving image manifest node:12-alpine
INFO[0000] Retrieving image node:12-alpine
INFO[0001] Retrieving image manifest node:12-alpine
INFO[0001] Retrieving image node:12-alpine
INFO[0001] Built cross stage deps: map[]
INFO[0001] Retrieving image manifest node:12-alpine
INFO[0001] Retrieving image node:12-alpine
INFO[0002] Retrieving image manifest node:12-alpine
INFO[0002] Retrieving image node:12-alpine
INFO[0002] Executing 0 build triggers
INFO[0002] Unpacking rootfs as cmd RUN npm install requires it.
INFO[0006] RUN npm install
INFO[0006] Taking snapshot of full filesystem...
INFO[0008] cmd: /bin/sh
INFO[0008] args: [-c npm install]
INFO[0008] Running: [/bin/sh -c npm install]
npm WARN saveError ENOENT: no such file or directory, open '/package.json'
npm notice created a lockfile as package-lock.json. You should commit this file.
npm WARN enoent ENOENT: no such file or directory, open '/package.json'
npm WARN !invalid2 No description
npm WARN !invalid2 No repository field.
npm WARN !invalid2 No README data
npm WARN !invalid2 No license field.

up to date in 0.27s
found 0 vulnerabilities
1. Navigate to the Service Credentials tab of the App ID dashboard.
2. If you don't already have a set of credentials, click New credential and then click Add to create a new set. If you do, skip this step.
3. Click the View credentials toggle to see your information.
4. Copy your oauth server url to use in the next step.



2. Initialize the App ID passport strategy as shown in the following example.

var express = require('express'); 
var passport = require('passport');
var APIStrategy = require('ibmcloud-appid').APIStrategy; 
passport.use(new APIStrategy({ oauthServerUrl: "<oauthServerUrl>" })); 
var app = express();
app.use(passport.initialize());







 Securing the API with the API Strategy 

The following snippet demonstrates how to use ApiStrategy in an Express app to protect the /protected GET API.

If your Node.js app runs on IBM Cloud and is bound to your instance of App ID, there's no need to provide the API strategy configuration. The App ID configuration obtains the information by using the VCAP_SERVICES environment variable.

 app.get('/protected_resource', passport.authenticate('APIStrategy.STRATEGY_NAME', { session: false }), function(request, response){
console.log("Security context", request.appIdAuthorizationContext);
response.send(200, "Success!");
}
);

When the tokens are valid, the next middleware in the request chain is called and the appIdAuthorizationContext property is added to the request object. The property contains the original access and identity tokens and the decoded payload information of the tokens.







 Protecting resources by using the Swift SDK 

The App ID server-side Swift SDK provides an API protection middleware plug-in that is used to protect your backend apps.
[Java SDK Version 1.4](https://github.com/hyperledger/fabric-gateway-java/tree/release-2.2) 1.4 Java 8 <br> <br>Java 11 







 Smart contracts 

Click the Java Smart contract or Node Smart contract tab for details.

Java Smart contract

Node Smart contract



Table 2. Java Smart contract

 Contract API Peer Fabric image Java runtime 

 [v1.4](https://github.com/hyperledger/fabric-chaincode-java/tree/release-1.4), [v2.2](https://github.com/hyperledger/fabric-chaincode-java/tree/release-2.2) v2.2 Java 11 runtime 
 [v1.4](https://github.com/hyperledger/fabric-chaincode-java/tree/release-1.4), [v2.2](https://github.com/hyperledger/fabric-chaincode-java/tree/release-2.2) v1.4 Java 11 runtime 



Java and Node runtime versions are determined by IBM Blockchain Platform peer Fabric image and cannot be changed. These runtimes are different from the default Hyperledger Fabric runtimes.

For more details on smart contract-API compatibility, see:



* [Java smart contract-API compatibility](https://github.com/hyperledger/fabric-chaincode-java/blob/main/COMPATIBILITY.md)
* [Node smart contract-API compatibility](https://github.com/hyperledger/fabric-chaincode-node/blob/main/COMPATIBILITY.md)









 Registering an application identity 

Applications need to sign the transactions they submit to IBM Blockchain nodes, and attach a signing certificate that is used by nodes to verify that the transactions are being sent by the proper party. This ensures that transactions are submitted by the organizations that have permission to participate.
encodedValue=$(echo -e "$auth_typen$secret" | base64)
on certain os, base64 encoding introduces newline, removing the same here.
encodedValue=${encodedValue//$'n'/}

fetch the controller pod name
controllerPodName=$(kubectl get pods -n kube-system | grep ibm-vpc-block-csi-controller | awk '{print $1}')
error "$(date +"%b %d %G %H:%M:%S"): Unable to fetch controller pod."
if [ "$controllerPodName" == "" ]]; then
echo "$(date +"%b %d %G %H:%M:%S"): VPC Block CSI Driver addon is not enabled"
exit 1
fi

echo "apiVersion: v1
data:
ibm-credentials.env: $encodedValue
kind: Secret
metadata:
name: ibm-cloud-credentials
namespace: kube-system
type: Opaque" > ibm-cloud-credentials.yaml

create the k8s secret
kubectl apply -f ibm-cloud-credentials.yaml &> /dev/null
error "$(date +"%b %d %G %H:%M:%S"): Error creating ibm-cloud-credentials secret."
echo "$(date +"%b %d %G %H:%M:%S"): Created ibm-cloud-credentials secret"

restart the controller pod
echo "$(date +"%b %d %G %H:%M:%S"): Restarting $controllerPodName pod"
kubectl delete pod $controllerPodName -n kube-system &> /dev/null
error "$(date +"%b %d %G %H:%M:%S"): Error restarting $controllerPodName pod in kube-system namespace."

controllerPodStatus=
for i in {1..12}
do
sleep 5
* Add support for .NET Core SDK 2.0.0
* Remove support for .NET Core SDK 1.1.0-preview1-005051
* Remove support for .NET Core SDK 2.0.0-preview1-005977
* Remove support for .NET Core runtime 1.0.3
* Remove support for .NET Core runtime 1.1.0
* Update Node version to 6.11.2
* Change default .NET Core SDK to 2.0.0
* Change default .NET Core SDK for F# projects to 1.1.0







 5 October 2017 

Updated Liberty buildpack v3.13-20170919-1721
: The monthly Liberty runtime version was updated to 2017.9.0.0.



* The IBM JRE version was updated to 8 SR4 FP11.
* The auto-scaling agent was updated.







 20 September 2017 

Updated Node.js buildpack v3.14
: The SDK for Node.js buildpack v3.14 provides IBM SDK for Node.js versions 4.8.3, 4.8.4, 6.11.2, 6.11.3, 8.1.4 and 8.3.0. The default is latest 6.x, so it is currently 6.11.3. A buildpack bug that prevented Node.js apps from [shutting down gracefully](https://docs.cloudfoundry.org/devguide/deploy-apps/app-lifecycle.htmlshutdown) was fixed in this release.





 14 August 2017 

Updated Liberty buildpack v3.12-20170814-1322
: The monthly Liberty runtime version was updated to the [2017.8.0.0](https://developer.ibm.com/wasdev/blog/2017/08/04/beta-websphere-liberty-tools-august-2017/) release.



* The buildpack also contains updated IBM JREs: version 8 SR4 FP10 and version 7.1 SR4 FP10.
* JRE 8 includes Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files.
oc exec -it mypod /bin/bash
5. Verify that the permissions to the mount path are root.

root@mypod:/ ls -al /mnt/myvol/
total 8
drwxr-xr-x 2 root root 4096 Feb 7 20:49 .
drwxr-xr-x 1 root root 4096 Feb 20 18:19 .

This output shows that the UID in the first row is now owned by root (instead of previously nobody).
6. If the UID is owned by nobody, exit the pod and reboot your cluster's worker nodes. Wait for the nodes to reboot.

ibmcloud oc worker reboot --cluster <my_cluster> --worker <my_worker1>,<my_worker2>
7. Repeat Steps 4 and 5 to verify the permissions.
If you can then restart the gateway pod, everything should resume normally.





 Environment variable settings for Smart Document Understanding 

There are two environment variables that need to be adjusted for Smart Document Understanding in IBM Watson® Discovery version 2.1.0. This was resolved in version 2.1.1, see [2.1.1 release, 24 Jan 2020](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-release-notes24jan2020).

SDU_PYTHON_REST_RESPONSE_TIMEOUT_MS
SDU_YOLO_TIMEOUT_SEC

Both of these should be set to their respective hour value. These values must be set in the <release-name>-watson-discovery-hdp ConfigMap.

The values should be:

SDU_PYTHON_REST_RESPONSE_TIMEOUT_MS should be set to 3600000

SDU_YOLO_TIMEOUT_SEC should be set to 3600

These values should be set when the software is installed or reinstalled.





 Troubleshooting error messages 

If you receive error messages that are related to timeouts and insufficient memory for your enrichments, you can enter the following commands to change timeout and memory settings to potentially resolve these error messages:



* Notice message: <enrichment_name>: Document enrichment timed out

Suggested action: Increase the document processing timeout. Enter the following command to increase the default timeout from 10 to 20 minutes:

oc patch wd wd --type=merge --patch='{"spec": {"orchestrator": {"docproc": {"defaultTimeoutSeconds": 1200 } } } }'
* Notice message: <enrichment_name>: Document enrichment failed due to lack of memory

Suggested action: Increase the orchestrator container memory limit. Enter the following command to increase the memory limit from 4 Gi to 6 Gi:

oc patch wd wd --type=merge --patch='{"spec": {"orchestrator": {"resources": {"limits": {"memory": "6Gi"} } } } }'
* Notice messsage: Indexing request timed out
Configure your Cloud Directory [settings](https://cloud.ibm.com/docs/appid?topic=appid-cloud-directorycd-settings) in the GUI.
2. Place the following code in your application. When a user attempts to sign in, your customized screen is called and the authorization and authentication process starts with your customized sign-in page.

class delegate : TokenResponseDelegate {
public func onAuthorizationSuccess(accessToken: AccessToken?, identityToken: IdentityToken?, response:Response?) {
//User authenticated
}

public func onAuthorizationFailure(error: AuthorizationError) {
//Exception occurred
}
}

AppID.sharedInstance.signinWithResourceOwnerPassword(username: username, password: password, delegate: delegate())









 Branding your app with the Node.js SDK 

With Cloud Directory enabled, you can call customized screens with the Node.js SDK.



 Sign in 

By using WebAppStrategy, users can sign in to your web apps with their username and a password. After a user successfully signs in to your app, their access token is persisted in an HTTP session while it is kept alive. After the HTTP session is closed or expired, the access token is also destroyed.



1. Configure your Cloud Directory [settings](https://cloud.ibm.com/docs/appid?topic=appid-cloud-directorycd-settings) in the GUI.
2. Place the following code in your application. When a user attempts to sign in, your customized screen is called and the authorization and authentication process starts.

app.post("/form/submit", bodyParser.urlencoded({extended: false}), passport.authenticate(WebAppStrategy.STRATEGY_NAME, {
successRedirect: LANDING_PAGE_URL,
failureRedirect: ROP_LOGIN_PAGE_URL,
failureFlash : true // allow flash messages
}));
For more information about Kustomize such as a glossary and FAQs, check out the [Kustomize docs](https://kubectl.docs.kubernetes.io/references/kustomize/).

Before you begin: [Access your Red Hat OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-access_cluster).

To set up configuration files with Kustomize:



1. [Install the kustomize tool](https://kubectl.docs.kubernetes.io/installation/kustomize/).



* For macOS, you can use the brew package manager.

brew install kustomize
* For Windows, you can use the chocolatey package manager.

choco install kustomize



2. Create a directory for your app in a version control system, such as Git.

git init /<my_app>
3. Create your repo structure for your kustomize[base](https://kubectl.docs.kubernetes.io/references/kustomize/glossary/base) directory, [overlay](https://kubectl.docs.kubernetes.io/references/kustomize/glossary/overlay) directory, and environment directories such as staging and production. In the subsequent steps, you set up these repos for use with kustomize.

mkdir -p /<my_app>/base &&
mkdir -p /<my_app>/overlay &&
mkdir -p /<my_app>/overlay/staging &&
mkdir -p /<my_app>/overlay/prod

Example repo structure

.
├── base
└── overlay
├── prod
└── staging
4. Set up the base repo.



1. Navigate to the base repo.

cd /<my_app>/base
2.