vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Valid values between 1800, 604800. Default is 82800.
* Session Affinity Attributes are cookie attributes for session affinity cookie.



* Samesite: Valid values are Auto, None, Lax, Strict.
* Secure: Valid values are Auto, Always, Never.
* Drain Duration (optional): Configures the drain duration in seconds. This field is only used when session affinity is enabled on the load balancer.







For example:

ibmcloud cis glb-update fc72db47cee8290eaef292cda6e1619a 12b68758126546e0d129c7bbadfa87f0 -s '{
"name": "lbtest-updated.cindyuitest01.alan501.cns-foo.com",
"fallback_pool": "c7e717109b7cf9240dd10fffc0bd146f",
"default_pools": [
"c7e717109b7cf9240dd10fffc0bd146f"
],
"description": "Load Balancer for www.example.com",
"ttl": 30,
"region_pools": {
"WNAM": [
"c7e717109b7cf9240dd10fffc0bd146f"
],
"ENAM": [
"c7e717109b7cf9240dd10fffc0bd146f"
]
},
"proxied": true,
"enabled": true,
"session_affinity": "ip_cookie",
"session_affinity_attributes": {
"samesite": "None",
"secure": "Always",
"drain_duration": 100
}
}'
Show more





 Setting session affinity using the API 

When you create a global load balancer using the API, take the following steps to set the session affinity:



1.
Audio transmission and timeouts 

The IBM Watson® Speech to Text service lets you pass audio to the service all at once or stream audio to the service. For audio streaming, the service enforces timeouts to ensure ongoing session activity.



 Audio transmission 

With the WebSocket interface, audio data is always streamed to the service over the connection. You can pass data through the socket all at once, or you can pass data for the live-use case as it becomes available. The service returns results as they become available.

With the HTTP interfaces, you can transmit audio to the service in either of the following ways:



* One-shot delivery. You omit the Transfer-Encoding request header and pass all of the audio data to the service at one time as a single delivery.
* Streaming. You set the Transfer-Encoding request header to the value chunked and stream the data over a persistent connection. The data does not need to exist fully before you stream it to the service. You can stream the data as it becomes available. The service sends results only when it receives the final chunk, which you indicate by sending an empty chunk.

For more information about streaming chunked audio with the Transfer-Encoding header, see



* [Chunked transfer encoding](https://wikipedia.org/wiki/Chunked_transfer_encoding)
* [Transfer Codings](https://tools.ietf.org/html/rfc7230section-4) in IETF RFC 7320 HTTP/1.1: Message Syntax and Routing





With the HTTP interfaces, the service always transcribes the entire audio stream before sending any results. The results can include multiple transcript elements to indicate phrases that are separated by pauses. Concatenate the transcript elements to assemble the complete transcript.

The service enforces timeouts on a streaming session. It can terminate a streaming session if it detects an extended period of silence or receives no audio during a 30-second period. For more information about timeouts and how to avoid them, see [Timeouts](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-inputtimeouts).



 Audio transmission example
Why don't my pods restart after my workers were down? 

When you are using IBM Cloud® Container Registry, the

Podsdo not restart after your cluster workers were down.

 What’s happening 

Portieris is deployed. The cluster workers are showing as working correctly, but nothing is scheduled.

 Why it’s happening 

By default, Portieris adds a fail closed admission webhook. If all Portieris pods are down, the pods are not available to approve their own recovery.

 How to fix it 

To recover the cluster when it's in this state, you must change the webhook configuration to make it fail open instead of closed.

You must have sufficient role-based access control (RBAC) privileges to use the GET and PATCH verbs on the following resources:



* admissionregistration.k8s.io/v1/MutatingWebhookConfiguration
* admissionregistration.k8s.io/v1/ValidatingWebhookConfiguration



For more information about RBAC, see [Understanding RBAC permissions](https://cloud.ibm.com/docs/containers?topic=containers-usersunderstand-rbac), [Creating custom RBAC permissions for users, groups, or service accounts](https://cloud.ibm.com/docs/containers?topic=containers-usersrbac), and [Kubernetes - Using RBAC Authorization](https://kubernetes.io/docs/reference/access-authn-authz/rbac/).

To change the webhook configuration so that it fails open, and, when at least one Portieris pod is running, restore the webhook configuration so that it fails closed, complete the following steps:



1. Update MutatingWebhookConfiguration by running the following command.

kubectl edit MutatingWebhookConfiguration image-admission-config

Change failurePolicy to Ignore, save, and close.
2. Update ValidatingWebhookConfiguration by running the following command.
Users who have access to “All Identity and Access Enabled Services” will now have access to Security and Compliance Center. Additionally, if you are working with private catalogs, Security and Compliance Center must be added to the private catalog as an approved service in order for members of your organization to create an instance.

If users have a quota on the number of resources for their account that has already been met, instances of the service will not be able to be created.





 1 July 2023 

Support removed for the collector-based architecture
: The collector-based architecture has been removed from the product in preparation for an upcoming architectural change to a regional offering.

The events related to collector-based evaluations have also been removed. To continue to receive events for your evaluations you must [update your topics in Event Notifications](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-event-notifications).





 23 June 2023 

New rules available
: The Global Search and Tagging platform service is now available for you to create custom rules. Rules can be written to evalaute resources that have been assigned specific tags. For more information about rules, see [Defining custom rules](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-rules-define).

Attachment details available
: The create attachment flow has been updated to include details as an input. Profiles that were previously created will now see a name comprised of the combination of a scope-type and scope ID in the profiles table.. You can add a custom name at any time by editing your profile.





 20 June 2023 

IBM Cloud for Financial Services profile version 1.3.0
: Version 1.3.0 of the IBM Cloud for Financial Services profile is now available. For more information, see the [Change log](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-fs-change-log).

IBM Cloud Security Best Practices profile version 1.2.0
: Updates to version 1.2.0 of the IBM Cloud Security Best Practices library and profile are now available.
For example, https://w3id.sso.ibm.com/auth/sps/samlidp2/saml20. You can also view th IdP by clicking View identity provider (IdP) data. For IBMid, the IdP is the SAML "entityId" field, sometimes referred to as the issuer ID, and is part of the federation configuration when you are onboarding with IBMid. For AppID, equivalent syntax is the "realm ID". For more information, see [Enabling authentication from an external identity provider](https://cloud.ibm.com/docs/account?topic=account-idp-integration)

Session duration
: The dynamic access group membership or trusted profile session expires after the number of hours that are specified in this property. For example, if the property is set to 24 hours, the user’s dynamic or trusted profile session ends one day (24 hours) after they log in.





 Condition statement properties 

Additionally, each dynamic rule and trusted profile trust relationship has one or more conditions that consist of the following properties. Users need to satisfy all conditions for the overall dynamic rule or trusted profile authentication to evaluate to true:

Allow users when
: An attribute name that is part your identity provider data. To learn more about how attribute names are created from your enterprise identity provider to the condition evaluation, see [Mapping of enterprise identity provider attributes](https://developer.ibm.com/tutorials/use-iam-access-groups-to-effectively-manage-access-to-your-cloud-resources/mapping-of-enterprise-identity-provider-attributes).

Comparator
: Compares the attribute that is specified in the Allow users when field with the Values property. You can choose from Equals, Not Equals, Equals Ignore Case, Not Equals Ignore Case, In, and Contains. Use the Contains option when the attribute statement has an array type. You can enter more than one value to be matched by using the In option.

Values
: An attribute value that is used by the comparator to evaluate against the Allow users when attribute name.

You can think of a dynamic rule or trusted profile condition as a key:value pair.
IA-8 - Identification and Authentication (non-organizational Users) 



  Control requirements 

IA-8 - 0
:   The information system uniquely identifies and authenticates non-organizational users (or processes acting on behalf of non-organizational users).





  NIST supplemental guidance 

Non-organizational users include information system users other than organizational users explicitly covered by IA-2. These individuals are uniquely identified and authenticated for accesses other than those accesses explicitly identified and documented in AC-14. In accordance with the E-Authentication E-Government initiative, authentication of non-organizational users accessing federal information systems may be required to protect federal, proprietary, or privacy-related information (with exceptions noted for national security systems). Organizations use risk assessments to determine authentication needs and consider scalability, practicality, and security in balancing the need to ensure ease of use for access to federal information and information systems with the need to protect and adequately mitigate risk. IA-2 addresses identification and authentication requirements for access to information systems by organizational users.
Importing a CA allows you to register new users and [enroll identities](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-enroll).



 Before you begin 

Before you can import a CA, you need to decide on the method you will use to become an admin of the CA (there is little that can be accomplished with an imported CA unless you also are an admin of the CA). See, [Gathering certificates or credentials](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-import-nodesibp-console-import-start-here) and follow the path that best suits your use case. Also, ensure that the JSON representing the CA is available.





 How to import a CA 

Navigate to the Nodes tab.



1. Click Add Certificate Authority, followed by Import an existing Certificate Authority, and click Next.
2. Click Add file to upload the CA JSON file that was exported from the console where it was originally deployed.
3. If you want to operate the CA, after it has been added, click on it in the Nodes panel. Then click Associate identity and select the CA admin identity from your Wallet.



If you see the location field, you can choose whether to specify the location where the CA was created or to have the CA re-exported, in which case the console will not ask for this information.

After you have imported the CA into the console, you can use your CA to create new identities and generate the necessary certificates to operate your components and submit transactions to the network. To do this, you will need to associate an admin identity with the CA. To learn more, see [Managing certificate authorities](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-manage-ca).







 Importing an ordering service 

An ordering service is the blockchain component that collects transactions from network members, orders the transactions, and bundles them into blocks.
.name("serviceType")
.value("iam-identity")
.operator("stringEquals")
.build();
PolicyResource policyResources = new PolicyResource.Builder()
.addAttributes(accountIdResourceAttribute)
.addAttributes(serviceNameResourceAttribute)
.build();
CreatePolicyOptions options = new CreatePolicyOptions.Builder()
.type("access")
.subjects(Arrays.asList(policySubjects))
.roles(Arrays.asList(policyRoles))
.resources(Arrays.asList(policyResources))
.build();
Response<Policy> response = service.createPolicy(options).execute();
Policy policy = response.getResult();
System.out.println(policy);

policy_subjects = PolicySubject(
attributes=[SubjectAttribute(name='iam_id', value=example_user_id)])
policy_roles = PolicyRole(
role_id='crn:v1:bluemix:public:iam::::role:Administrator')
account_id_resource_attribute = ResourceAttribute(
name='accountId', value=example_account_id)
service_name_resource_attribute = ResourceAttribute(
name='serviceType', value='iam-identity')
policy_resources = PolicyResource(
attributes=[account_id_resource_attribute,
service_name_resource_attribute])
policy = iam_policy_management_service.create_policy(
type='access',
subjects=[policy_subjects],
roles=[policy_roles],
resources=[policy_resources]
).get_result()
print(json.dumps(policy, indent=2))
User-specific information <br><br> * API key<br> * SSH key or keys<br> * Resource Group<br> * IP address or addresses<br> * Your local machine OS<br> * Prefix to add to the resource names<br><br><br> 
 Supported OS type <br><br> * Linux<br><br><br> 
 Zone The zone where resources are deployed 
 Image to use for region VSIs <br><br> * Bastion Server<br> * App Server<br> * Web Server <br> Images are region-specific. To find the image IDs for your region, open the IBM Cloud shell and enter ibmcloud target -r < region_name > to set your region, then ibmcloud is images to see a list of images for that region.<br><br><br> 
 Auto scale App VSI parameters <br><br> * Min server<br> * Max servers<br> * CPU threshold<br><br><br> 
 Auto scale web VSI parameters <br><br> * Min server<br> * Max servers<br> * CPU threshold<br><br><br> 
 Anti-Affinity VSI parameters <br><br> * app and web - Host spread<br><br><br> 



* For DBaaS configuration, you modify parameters in two different files, one for required variables and one for optional parameters:



* DBaaS information entered in the user inputs file includes:



* enable_dbaas - true or false, whether to enable DBaaS or use virtual server instance db
* Admin password - minimum 10 characters, A-Z, a-z, 0-9, password is used for virtual server instance db and DBaaS
* (DBaaS only) The DB endpoint access - either 'private', 'public' or 'public-and-private' (for mysql databases), default is 'private'
* (DBaaS only) Whether to enable auto-scaling in DBaaS - true or false, default is false



* DBaaS has optional variables in the database variables file, that you can modify for your solution:



 Parameter Description
curl --tlsv1.2 "https://<IPaddress>/dbapi/v3/users" -H "Authorization: Bearer <access_token>" -H "accept: application/json" -H "Content-Type: application/json" -d "{"id":"<userid1>","ibmid":"<userid1>@<email_address_domain>","role":"bluadmin","locked":"no","iam":true}"
curl --tlsv1.2 "https://<IPaddress>/dbapi/v3/users" -H "Authorization: Bearer <access_token>" -H "accept: application/json" -H "Content-Type: application/json" -d "{"id":"<userid2>","ibmid":"<userid2>@<email_address_domain>","role":"bluadmin","locked":"no","iam":true}"
.
.
.



For more details about your service's API, see: [Db2 Warehouse on Cloud REST API](https://cloud.ibm.com/apidocs/db2-warehouse-on-cloud/db2-warehouse-on-cloud-v4).





 IBMid federation 

To use your own identity provider such as LDAP, you must first federate your LDAP server with IBMid. For instructions about federating your LDAP server with IBMid, see: [IBMid Enterprise Federation Adoption Guide](https://ibm.ent.box.com/notes/78040808400?v=IBMid-Federation-Guide). After IBMid federation is completed and the allowed users are added to the database service instance by the database administrator, these users can log in to the console with their company user ID and password. Alternatively, these users can use an access token or API key that represents their user ID to connect to the database service instance through one of the supported database client interfaces.





 Restrictions 

The following restrictions are regarding IAM authentication:
[Actions icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/action-menu-icon.svg) > Add tags.
3. Type project:analysis and press Enter.







 Step 3: Create an access group 

You'll define the level of access that users have to your Object Storage based on the tags that you previously created. See the following examples for each access level:



* With reader role, users can list and download objects in buckets.
* With writer role, users can create and delete buckets.
* With manager role, users can control all aspects of data storage, like adding a retention policy and bucket firewall.



First, create an access group to streamline the task of assigning access to multiple users:



1. Click Manage > Access (IAM) in the IBM Cloud console, and select Access groups.
2. Click Create.
3. Enter a unique name to identify your access group, an optional description, and click Create.







 Step 4: Assign a policy 

Next, assign a policy to the group:



1. Click Access > Assign access.
2. Select All Identity and Access enabled services as the service.
3. Scope the access to Specific resources > Access management tags to grant access based on the attached access management tag.
4. Type project:analysis or select it from the list of options.
5. Select the resource group access.
6. Select all roles that apply. To view a list of all actions that are mapped to a specific role, click the numbers listed next to each role.
7. Click Review.
8. Click Add to add your policy configuration to your policy summary.
9. Click Assign.







 Step 5: Add users to your access group 

Then, add users to your access group:



1. Click Users > Add users.
2. Select the members of the project from the list, and click Add to group.
When you enable the identity at source firewall functionality of the identity firewall in your VMware deployment, you must enable the Guest Introspection service. This service reports information about the login of users, the directory groups the users are a member of, and sends the IPs of the users to the Service Virtual Machine (SVM). The SVM updates the NSX Manager that uses this information to apply the firewall policies.

The following table lists common logs that are generated by the Guest Introspection service:



Table 5. Guest introspection service logs

 Component Description 

 Guest VM Thin Agent Logs that report VM file and OS events such as logon details. 
 Service Virtual Machine (SVM) Logs that are generated by the SVM. 
 ESX Guest VM Module (MUX) Logs that are generated by the MUX component. This component passes information from the Thin Agent to the SVM. 









 Step 1. Configure the centralized syslog server to send logs to an external system 

You must configure rsyslog to receive logs from the vCenter hosts and components and to send them to a Log Analysis instance.



 Prereqs 



* You must have access to a server that has rsyslog installed. For example, you can use a Linux server such as a Red Hat VSI.
* Check that rsyslog traffic on port 514, or a custom port configured for rsyslog, is allowed.







 Configure the centralized syslog server to receive logs from the vCenter hosts and components 

Modify the /etc/rsyslog.conf file to collect logs from your vCenter hosts and components by using the default port 514.

Add the following lines:

 Provides TCP syslog reception
module(load="imtcp")
input(type="imtcp" port="514")

You can also choose a custom port. Make sure the port is enabled to allow traffic through the firewall.

Then, restart syslog. Run systemctl restart rsyslog.





 Configure a syslog server to send logs to an external system
Make a GET "http://169.254.169.254/metadata/v1/instance/initialization" call to retrieve initialization information for the instance.

This request:



* Calls the API to retrieve the instance identity access token.
* Uses the token to access the metadata service.
* Extracts the user data from the JSON payload by using jq.



You're making an unsecured request that is then secured by a proxy. The proxy intercepts the request by watching for the instance IP.

In the example, the return value of the cURL command is the user data, which is extracted by jq and placed in the user_data environment variable.

curl -X GET "http://169.254.169.254/metadata/v1/instance/initialization?version=2021-10-12" -H "Accept: application/json" -H "Authorization: Bearer $access_token" | jq -r

The response lists public SSH keys that were used at instance initialization and extracts any other user data made available when the instance was provisioned. The response includes the SHA256 value that identifies the SSH key.

{
"keys": [
{
"crn": "crn:...]",
"fingerprint": "SHA256:RJ+YWs3rupwGFiJuLqY43tvmdeLOUjcIc9cA6IR8n8E",
"id": "dadae729-1d81-4a13-966e-f5d92699f103",
"name": "my-key1",
"resource_type": "key"
}
],
],
"roles":[
{
"role_id": "crn:v1:bluemix:public:iam::::role:Administrator"
}
],
"resources":[
{
"attributes":
{
"name": "accountId",
"value": "$ACCOUNT_ID"
},
{
"name": "serviceName",
"value": "iam-identity"
}
]
}
]
}'

SubjectAttribute subjectAttribute = new SubjectAttribute.Builder()
.name("iam_id")
.value(EXAMPLE_USER_ID)
.build();
PolicySubject policySubjects = new PolicySubject.Builder()
.addAttributes(subjectAttribute)
.build();
PolicyRole policyRoles = new PolicyRole.Builder()
.roleId("crn:v1:bluemix:public:iam::::role:Administrator")
.build();
ResourceAttribute accountIdResourceAttribute = new ResourceAttribute.Builder()
.name("accountId")
.value(exampleAccountId)
.operator("stringEquals")
.build();
ResourceAttribute serviceNameResourceAttribute = new ResourceAttribute.Builder()
.name("serviceType")
.value("iam-identity")
.operator("stringEquals")
.build();
PolicyResource policyResources = new PolicyResource.Builder()
.addAttributes(accountIdResourceAttribute)
.addAttributes(serviceNameResourceAttribute)
.build();
CreatePolicyOptions options = new CreatePolicyOptions.Builder()