vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* Before you can attach your access management tags to individual resources or service IDs, you need to create them first. To create access management tags, you need to have administrator role on either the Tagging Service that is listed under the Account management services or on all Account management services.



IBM Cloud® allows up to 250 access management tags per account.

Use the following steps to create access management tags by using Terraform:



1. Create an argument in your main.tf file. The following example creates the access management tag ibm_tag to the ibm resource for the resource ID ibm_satellite_location.location.crn.

resource "ibm_resource" "ibm" {
resource_id = ibm_satellite_location.location.crn
tags = [ "ibm_tag" ]
}
2. After you finish building your configuration file, initialize the Terraform CLI. For more information, see [Initializing Working Directories](https://www.terraform.io/cli/init).

terraform init
3. Provision the resources from the main.tf file. For more information, see [Provisioning Infrastructure with Terraform](https://www.terraform.io/cli/run).



1. Run terraform plan to generate a Terraform execution plan to preview the proposed actions.

terraform plan
2. Run terraform apply to create the resources that are defined in the plan.

terraform apply











 Searching for tags in the console 

You can search for tags and tag related resources by using any of the following methods:



* Try the search bar that is located in the IBM Cloud® console menu bar.
* You can filter your resource list by the tag you are searching for.
* From the application detail page, you can locate the tags that are associated with that resource.



The same tag can be attached to multiple resources and service IDs by different users in the same billing account, and not all users have visibility on all resources on the account.





 Searching for tags by using the CLI
For more information, see [Add user tags to file shares](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-managing&interface=uifs-add-user-tags) and [Working with tags](https://cloud.ibm.com/docs/account?topic=account-tag&interface=ui).





 Access management tags for file shares 

Access management tags help organize access control by creating flexible resource groupings, enabling your file storage resources to grow without requiring updates to IAM policies.

You can create access management tags and then apply them to new or existing file shares and replica file shares. Use the IAM UI or the Global Search and Tagging API to create the access management tag. Then, from the VPC UI or API, add the tags to a file share. After the tags are added, you can manage access to them using the IAM policies. For more information, see [Add access management tags to a file share](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-managing&interface=uifs-add-access-mgt-tags).







 File storage data eradication 

When you delete a file share, that data immediately becomes inaccessible. All pointers to the data on the physical disk are removed. If you later create a file share in the same or another account, a new set of pointers is assigned. The account can't access any data that was on the physical storage because those pointers are deleted. When new data is written to the disk, any inaccessible data from the deleted file storage is overwritten.

IBM guarantees that data deleted cannot be accessed and that deleted data is eventually overwritten and eradicated. When you delete a file share, those blocks must be overwritten before that file storage is made available again, either to you or to another customer.

Further, when IBM decommissions a physical drive, the drive is destroyed before their disposal. Decommissioned physical drives are unusable and any data on them is inaccessible.





 File share lifecycle states 

Table 1 describes the states in the file share lifecycle.



Table 1. File storage lifecycle states

 Status Explanation
You create access management tags in IAM or with the Global Search and Tagging API, and then [add them to new or existing snapshots](https://cloud.ibm.com/docs/vpc?topic=vpc-snapshots-vpc-manage&interface=uisnapshots-vpc-add-tags-ui).

For more information about managing tags for your account, see [Working with tags](https://cloud.ibm.com/docs/account?topic=account-tag&interface=ui).







 Next steps 

Review [creating snapshots](https://cloud.ibm.com/docs/vpc?topic=vpc-snapshots-vpc-createsnapshots-vpc-create).
latest Tags the current, successfully deployed, and concluded state of the inventory on a branch. 
 pipeline run id Tags the current inventory state in the branch, with the pipeline run ID or build number of the actual deployment. To avoid inventory content overlap when parallel deployments are triggered, use this tag to refer to the actual inventory point hash in the branch history. 
 change request id [optional] Tags the current state of a change request ID to track the change request IDs in the inventory, in a historical representation. 









 Setup for a single target with multiple regions 

Multiple latest tags are introduced for a single target environment so that multiple continuous deployment pipelines can work on the same target, for different types of use cases. You can use, for example, the same target environment (such as us-south or eu-de) for multiple regions in the prod target environment and the inventory branch.

You do not need to set up a different branch for each region, such as prod-us-south and prod-eu-de, and run the promotion redundantly. Instead, specify these additional targets for the same inventory branch, and then use them as Git tags.

In this setup, the prod branch has multiple latest tags on the same branch, such as prod-latest:us-south and prod-latest:eu-de. Each continuous deployment pipeline that is responsible for each region can use those tags to deploy.

Zoom

![Prod branch with multiple latest tags per region](https://cloud.ibm.com/docs-content/v1/content/5eb88a2575e30e316dbb83829c7f4c8b1ddbc67c/devsecops/images/inventory-7.svg)

Figure 7. Prod branch with multiple latest tags per region

For example, a set of changes that you plan to deploy everywhere might be released to a single region first, and then gradually deployed to other regions by using continuous deployment pipelines to target those regions.







 Inventory operations 

The Inventory contains some basic operations that run by using the CLI or by using pure Git and the GitHub CLI.



 CLI commands 



1. Create a promotion pull request from master to the target branch in staging.
The delta is identified by the <target-environment>_latest tag, where target-environment is the value that is set in your continuous deployment pipeline properties, such as prod_latest.

The pipeline attempts to deploy the content. During the deployment, the change request ID is attached to the commit that the pipeline works with as a tag. A successful deployment concludes by attaching the <target-environment>_latest tag to the commit that you promoted.

Zoom

![Git Repos and Issue Tracking repo tags](https://cloud.ibm.com/docs-content/v1/content/5eb88a2575e30e316dbb83829c7f4c8b1ddbc67c/devsecops/images/grit-repo-tags.png)

Figure 4. Git Repos and Issue Tracking repo tags

For more information about the inventory workflow, see [Understanding DevSecOps pipelines](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-pipelinescd-devsecops-pipelines-inventory-workflow).
* Check public endpoints are enabled if you plan to install image-analyzer, host-analyzer, and benchmark runner. For example, to deploy these components in a cluster in your Virtual Private Cloud (VPC), check that a public gateway is attached to the subnet configured for the cluster.





 Deploying an agent by using a script 

In order to use this script, you must have a minimum of Viewer and Manager IAM permissions assigned for the Kubernetes cluster.

To deploy the agent, run the following command:

curl -sL https://ibm.biz/install-sysdig-k8s-agent | bash -s -- -a ACCESS_KEY -c COLLECTOR_ENDPOINT -t TAG_DATA -ac 'sysdig_capture_enabled: false' --nodeanalyzer --analysismanager https://<COLLECTOR ENDPOINT>/internal/scanning/scanning-analysis-collector --collector_port 6443 --api_endpoint <API-ENDPOINT> [-as] [-af]

Where



* ACCESS_KEY is the ingestion key for the instance.
* COLLECTOR_ENDPOINT is the public or private ingestion URL for the region where the instance is available. To get an endpoint, see [Collector endpoints](https://cloud.ibm.com/docs/monitoring?topic=monitoring-endpointsendpoints_ingestion).
* TAG_DATA are comma-separated tags that are formatted as TAG_NAME:TAG_VALUE. You can associate one or more tags to your agent. For example: role:serviceX,location:us-south.
* Set sysdig_capture_enabled to false to disable the capture feature. By default is set to true. For more information, see [Working with captures](https://cloud.ibm.com/docs/monitoring?topic=monitoring-capturescaptures).
* Add --imageanalyzer --analysismanager https://<COLLECTOR ENDPOINT>/internal/scanning/scanning-analysis-collector to install the image analyzer component. Configure this component when you have images that are hosted in the Container Registry.
Enter the ibmcloud resource tag-create command to create an access management tag in your account. This example creates a tag that is called project:myproject:

ibmcloud resource tag-create --tag-names project:myproject



For more information, see the [ibmcloud resource command reference](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_resource).

Next, see [Attaching and detaching tags](https://cloud.ibm.com/docs/account?topic=account-attaching-and-detaching-tags-on-a-resource&interface=cliattach-cli).





 Creating access management tags by using the API 

Before you can attach your access management tags to individual resources or service IDs, you need to create them first. To create access management tags, you need to have administrator role on either the Tagging Service that is listed under the Account management services or on all Account management services.

IBM Cloud® allows up to 250 access management tags per account.

You can programmatically create access management tags by calling the [Global Search and Tagging - Tagging API](https://cloud.ibm.com/apidocs/taggingcreate-tag) as shown in the following sample request. The example creates a tag that is called project:myproject.



* Curl
* Java
* Python
* Go
* Node



curl -X POST -H "Authorization: {iam_token}" -H "Accept: application/json" -H "Content-Type: application/json" -d '{ "tag_names": ["project:myproject"] }' "tags.global-search-tagging.cloud.ibm.com/v3/tags?tag_type=access"

CreateTagOptions createTagOptions = new CreateTagOptions.Builder()
.addTagNames("project:myproject")
.tagType("access")
.build();

Response<CreateTagResults> response = service.createTag(createTagOptions).execute();
Environment specific tags can be specified at config create time, to uniquely identify the instance of environment deployed, e.g dev, stage, prod.

An immutable service tag with the blueprint_id for an environment is attached to all deployed resources and can be used to identify all resources associated with the environment.

Example

tags:
- "blueprint:trial_dev"





 inputs 

Type: list

Default: []

A list defining all the inputs that are required to configure the template. Inputs are specified in the [input file](https://cloud.ibm.com/docs/schematics?topic=schematics-bp-input-schema-yaml) file or as dynamic input values when the blueprint is created. Inputs are defined with a name key. To understand how Blueprints determines the value for a template input, review the section on [input precedence](https://cloud.ibm.com/docs/schematics?topic=schematics-blueprint-reuseblueprint-input-precedence).

Example

inputs:
- name: resource_group
type: string
- name: region
type: string
- name: api_key
type: string



 inputs.type 

Type: YAML flow or block scalar

Default: string

As templates work with Terraform configs and modules, Terraform variable [type constraints](https://developer.hashicorp.com/terraform/language/expressions/type-constraintstype-constraints) are used to set the type validation for blueprints inputs.

Type definitions are required to set the variable type of inputs passed to modules at runtime.

Complex Terraform types are typically represented as multi-line strings, as they are in HCL. They can be similarly rendered in YAML block syntax, using either the literal style is denoted by the “|” indicator, or the folded style is denoted by the “>” indicator.
Applying tags to volumes from the CLI 

Issue the ibmcloud is volume-update VOLUME command with the --tags option to update the user tags of a volume. The volume argument can be defined by either the volume ID or the volume name.

Use the same option to add tags to a volume when you create a volume by using ibmcloud is volume-create.

The following example adds user tags env:test and bkp:test to a volume identified by ID. The output shows information such as name, status, capacity, performance profile, and location. The updated tags appear at the end of the response.

cloudshell:$ ibmcloud is volume-update r010-bdb8fc70-8afb-4622-826a-d65a9fc477a4 --tags env:test,bkp:test,bcp:test
Updating volume r010-bdb8fc70-8afb-4622-826a-d65a9fc477a4 under account Test Account as user test.user@ibm.com...

ID r010-bdb8fc70-8afb-4622-826a-d65a9fc477a4
Name my-bootable-snapshot-restore-21
CRN crn:v1:bluemix:public:is:eu-de-2:a/a10d63fa66daffc9b9b5286ce1533080::volume:r010-bdb8fc70-8afb-4622-826a-d65a9fc477a4
Status available
Capacity 100
IOPS 3000
Bandwidth(Mbps) 393
Profile general-purpose
Encryption key -
Encryption provider_managed
Resource group defaults
Created 2023-02-23T18:52:00+00:00
Zone eu-de-2
Health State ok
Volume Attachment Instance Reference -
Source snapshot ID Name
r138-92c3efcb-4588-4c9c-828b-c52836629954 my-bootable-snapshot
* Usage:ibmcloud cos download --bucket BUCKET_NAME --key KEY [--concurrency value] [--part-size SIZE] [--if-match ETAG] [--if-modified-since TIMESTAMP] [--if-none-match ETAG] [--if-unmodified-since TIMESTAMP] [--range RANGE] [--response-cache-control HEADER] [--response-content-disposition HEADER] [--response-content-encoding HEADER] [--response-content-language HEADER] [--response-content-type HEADER] [--response-expires HEADER] [--region REGION] [--output FORMAT] [OUTFILE]
* Parameters to provide:



* The name (BUCKET_NAME) of the bucket.



* Flag: --bucket BUCKET_NAME



* The KEY of the object.



* Flag: --key KEY



* Optional: The number of goroutines to spin up in parallel per call to download when sending parts. Default value is 5.



* Flag: --concurrency value



* Optional: The buffer SIZE (in bytes) to use when buffering data into chunks and ending them as parts to S3. The minimum allowed part size is 5MB.



* Flag: --part-size SIZE



* Optional: Return the object only if its entitytag (ETag) is the same as the ETAG specified, otherwise return a 412 (precondition failed).



* Flag: --if-match ETAG



* Optional: Return the object only if it has been modified since the specified TIMESTAMP, otherwise return a 304 (not modified).



* Flag: --if-modified-since TIMESTAMP



* Optional: Return the object only if its entity tag(ETag) is different from the ETAG specified, otherwise return a 304 (not modified).



* Flag: --if-none-match ETAG



* Optional: Return the object only if it has not been modified since the specified TIMESTAMP, otherwise return a 412 (precondition failed).



* Flag: --if-unmodified-since TIMESTAMP
Next, see [Attaching and detaching tags](https://cloud.ibm.com/docs/account?topic=account-attaching-and-detaching-tags-on-a-resource). For a full tutorial, see [Controlling access to resources by using tags](https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial).





 Creating access management tags by using the CLI 

Before you can attach your access management tags to individual resources or service IDs, you need to create them first. To create access management tags, you need to have administrator role on either the Tagging Service that is listed under the Account management services or on all Account management services.

IBM Cloud® allows up to 250 access management tags per account.



1. Log in to IBM Cloud CLI. If you have multiple accounts, you are prompted to select which account to use. If you do not specify a region with the -r flag, you must also select a region.

ibmcloud login

If your credentials are rejected, you might be using a federated ID. To log in with a federated ID, use the --sso flag. See [Logging in with a federated ID](https://cloud.ibm.com/docs/account?topic=account-federated_id) for more details.

If it's your first time using the IBM Cloud CLI, check out the [getting started tutorial](https://cloud.ibm.com/docs/cli?topic=cli-getting-started).
2. Enter the ibmcloud resource tag-create command to create an access management tag in your account. This example creates a tag that is called project:myproject:

ibmcloud resource tag-create --tag-names project:myproject



For more information, see the [ibmcloud resource command reference](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_resource).
Select a file share from the [list of file shares](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-view).
2. Click the overflow menu at the end of the row and select Delete.











 Add user tags to a file share 

You can add user tags to new or existing file shares, modify, and delete tags for a file share with the UI, CLI, API, and Terraform. You can view tags throughout your account by filtering by tags from your resource list. You can also add user tags to replica file shares.

You can create as many user tags as you like for a file share. However, to keep tags manageable, create only as many user tags as you require to effectively manage the resource.

You can manage your tags in the IBM Cloud with the [Global Tagging API](https://cloud.ibm.com/apidocs/tagging). With this API, you can create, delete, search, attach, or detach tags. For more information about managing tags for your account, see [Working with tags](https://cloud.ibm.com/docs/account?topic=account-tag).



 Add user tags to file share in the UI 

You can add user tags to a file share in the UI.



1. Go to the list of file shares. In the [IBM Cloud console](https://cloud.ibm.com/login), go to the menu ![menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) > VPC Infrastructure > Storage > File Shares.
2. Select a file share to view its details.
3. On the file share details page, user tags appear next to the file share name. Click the pencil icon to edit tags.
4. In the Edit tags window, type a tag in the User tags text box.
5. Click Save.







 Add or modify file share user tags from the CLI
For more information about resources group, see [Resource groups](https://cloud.ibm.com/docs/account?topic=account-rgs).





 Access management tags 

[Access management tags](https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial) are metadata that is added to resources to help organize access control relationships. Tags create flexible resource groupings for you to administer.

When you use tags to control access to your resources, your team's projects can grow without requiring updates to IAM policies. You can attach Access Management Tags to VPC Infrastructure Resources and you can define access level to those resources based on tags.

VPC Infrastructure resources have a complex authorization model where a single API call might check authorizations on multiple resources. For such APIs, tags must be attached to all resources that an API needs access to. For more information about required API authorizations, see the [VPC API Reference](https://cloud.ibm.com/apidocs/vpc/latest).

If the API call returns UNKNOWN for a resource group name, add Viewer access to resource groups when you create the access management tags policy.

For more information about using access management tags, see the following resources:



* [Controlling access to resources by using tags](https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial) UI tutorial
* For UI, CLI, API, and Terraform information on using tags, see [Working with tags](https://cloud.ibm.com/docs/account?topic=account-tag).





 Limitations 



1. Some gaps exist between current implementation and the API Spec, which are documented [here](https://cloud.ibm.com/docs/vpc?topic=vpc-known-issues).
2. Instance templates and dedicated host groups don't support access management tags.
For more information, see [Working with tags](https://cloud.ibm.com/docs/account?topic=account-tag).
* Access management tags: (Optional) Add access management tags to resources to help organize access control relationships. The only supported format for access management tags is key:value. For more information, see [Controlling access to resources by using tags](https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial).
* Select the Application Load Balancer (ALB) tile.
* Virtual private cloud: Select your VPC.
* Type: Select the load balancer type.



* A public load balancer has a public IP address, which means that it can route requests from clients over the internet.
* A private load balancer has a private IP address, which means that it is accessible only to internal clients on your private subnets, within the same region and VPC.



* Subnets: Select the subnets in which to create your load balancer. To maximize the availability of your application, select subnets in different zones.

You cannot assign more than 15 subnets per ALB.



6. In the Back-end pools section, click Create pool and specify the following information to create a back-end pool. You can create one or more pools.



* Name: Enter a name for the pool, such as my-pool.
* Protocol: Select the protocol for your instances in this pool. The protocol of the pool must match the protocol of its associated listener. For example, if an HTTPS or HTTP protocol is selected for the listener, the protocol of the pool must be HTTP. Similarly, if the listener protocol is TCP, the protocol of the pool must be TCP.
* Method: Select how you want the load balancer to distribute traffic across the instances in the pool:



* Round robin: Forward requests to each instance in turn. All instances receive approximately an equal number of client connections.
* Weighted round robin: Forward requests to each instance in proportion to its assigned weight. For example, you have instances A, B, and C, and their weights are set to 60, 60 and 30.
Accounts that have been granted special approval to preview this feature can now specify user_tags when [creating a new file share](https://cloud.ibm.com/apidocs/vpc-betacreate-share) or [updating an existing file share](https://cloud.ibm.com/apidocs/vpc-betaupdate-share). Adding user tags to a file share helps you organize your resources. For details, see [Add user tags to a file share](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-managing&interface=apifs-add-user-tags).







 22 March 2022 



 For all version dates 

VPN client-to-site servers update. You can now [update the subnets for a VPN server](https://cloud.ibm.com/apidocs/vpc-betaupdate-vpn-server) after the VPN is provisioned. For example, you can upgrade a stand-alone VPN server (one subnet) to a High Availability (HA) VPN server (two subnets in different zones). You can also detach a subnet to downgrade an HA VPN server to a stand-alone deployment, or change an attached subnet after your VPN server is provisioned. For more information, see [Upgrading to an HA VPN server](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-client-to-site-change-server-types&interface=api).







 8 March 2022 



 For all version dates 

Backup for VPC. Accounts that have been granted special approval to preview this feature can now create backup policies to automatically back up block storage volumes. Use the new [backup service APIs](https://cloud.ibm.com/apidocs/vpc-betalist-backup-policies) to create, list, and manage backup policies.