vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Review the following limitations of dynamic inventories in Schematics:



* You can choose among the [supported queries](https://cloud.ibm.com/docs/schematics?topic=schematics-inventories-setupsupported-queries) to select the target virtual server instances to include in your resource inventory.
* Schematics retrieves the IP address of a target Virtual Servers for VPCs and adds the IP address to the resource inventory. Hostname cannot be added, if a public IP address is assigned to the target Virtual Servers for VPC, the public IP address is added to the resource inventory. If public IP address do not exists, the private IP address is added to the resource inventory.
* All target hosts must be configured with the same public SSH key. When you use the static inventory file in your Schematics action, you can specify one SSH key to authenticate with all target hosts that are included in your resource inventory. The SSH key should contain n at the end of the key details in case of command-line or API calls. For more information about SSH keys, see [Adding an SSH key](https://cloud.ibm.com/docs/ssh-keys?topic=ssh-keys-adding-an-ssh-key).
Access your files with http://<static.example.com>/index.html.



You can demonstrate the performance improvement. Access via the CDN. Check the output of the first curl to verify successful connection:

SUBDOMAIN=static.example.com
curl http://$SUBDOMAIN/index.html
while sleep 1; do curl --output /tmp/fast http://$SUBDOMAIN/a-video.mp4; done

Access via COS:

curl http://$PUBLIC_ENDPOINT/$BUCKET_NAME/index.html
while sleep 1; do curl --output /tmp/slow http://$PUBLIC_ENDPOINT/$BUCKET_NAME/a-video.mp4 ; done

If you are using Cloud Shell you can change the location to a region with more distance from the bucket to see a more substantial performance change.





 Access index.html through COS and other content through CDN 

All of the content is now distributed through the CDN. Website content can be broken into static content and dynamic content. To demonstrate this a file cdn.html has references to the CDN related files through the prefix CDN/. Edit cdn.html and replace the occurrences of CDN with your CNAME, http://static.example.com, in the example above. If you open the file in the vim editor the command :%sCDNhttp://static.yourwebsite.com will do the trick.

Upload cdn.html by replacing the file index.html:

ibmcloud cos upload --bucket $BUCKET_NAME --key index.html --file cdn.html

Back in the IBM Cloud console in the bucket Configuration panel scroll down to the Static website hosting endpoints section and copy the Public URL into a browser tab. Since you configured this earlier to redirect to index.html the web application will be displayed and content will be delivered through the CDN. For me the URL was fredflinstone-mywebsite.s3-web.us-south.cloud-object-storage.appdomain.cloud notice the s3-web.
Changes since version 1.10.12_1541

 Component Previous Current Description 

 etcd v3.3.1 v3.3.11 See the [etcd release notes](https://github.com/etcd-io/etcd/releases/v3.3.11). Additionally, the supported cipher suites to etcd are now restricted to a subset with high strength encryption (128 bits or more). 
 GPU device plug-in and installer 13fdc0d eb3a259 Updated images for [CVE-2019-3462](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3462) and [CVE-2019-6486](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6486). 
 IBM Cloud File Storage for Classic plug-in 338 342 The file storage plug-in is updated as follows:<br><br><br><br> * Supports dynamic provisioning with [volume topology-aware scheduling](https://cloud.ibm.com/docs/containers?topic=containers-file_storagefile-topology).<br> * Ignores persistent volume claim (PVC) delete errors if the storage is already deleted.<br> * Adds a failure message annotation to failed PVCs.<br> * Optimizes the storage provisioner controller's leader election and resync period settings, and increases the provisioning timeout from 30 minutes to 1 hour.<br> * Checks user permissions before starting the provisioning.<br><br><br> 
 Key Management Service provider 111 122 Added retry logic to avoid temporary failures when Kubernetes secrets are managed by IBM Key Protect for IBM Cloud. 
 Kubernetes configuration N/A N/A The Kubernetes API server audit policy configuration is updated to include logging metadata for cluster-admin requests and logging the request body of workload create, update, and patch requests.
}

You can substitute the hard-coded time zone value with a context variable to dynamically change the time based on a time zone that is passed to the expression. For example: <? now('$myzone') ?>. The $myzone context variable might be set to 'Australia/Sydney' in one conversation and to 'Mexico/BajaNorte' in another.





 .reformatDateTime(String format) 

Formats date and time strings to the format desired for user output.

Returns a formatted string according to the specified format:



* MM/dd/yyyy for 12/31/2016
* h a for 10pm



To return the day of the week:



* EEEE for Tuesday
* E for Tue
* u for day index (1 = Monday, ..., 7 = Sunday)



For example, this context variable definition creates a $time variable that saves the value 17:30:00 as 5:30 PM.

{
"context": {
"time": "<? @sys-time.reformatDateTime('h:mm a') ?>"
}
}

Format follows the Java [SimpleDateFormat](https://docs.oracle.com/javase/6/docs/api/java/text/SimpleDateFormat.html) rules.

Note: When trying to format time only, the date is treated as 1970-01-01.





 .sameMoment(String date/time) 



* Determines whether the date/time value is the same as the date/time argument.







 .sameOrAfter(String date/time) 



* Determines whether the date/time value is after or the same as the date/time argument.
* Analogous to .after().







 .sameOrBefore(String date/time) 



* Determines whether the date/time value is before or the same as the date/time argument.







 today() 

Returns a string with the current date in the format yyyy-MM-dd.



* Static function.
Your T0's private interface is attached to the Private VLAN and uses IBM Cloud portable private IP.
3. If vCenter Server gateway cluster with vSRX (or other third-party device) or IBM Cloud Gateway Appliance is deployed to your classic infrastructure, you must configure your vCenter Server instance Private Primary VLAN. It must be routed through the vSRX or Gateway Appliance. Also, establish routing between your NSX-T T0 and vSRX, such as BGP.
4. Create a Direct Link at your IBM Cloud data center or zone location and attach your classic network as a connection. All your classic networks in the Region will be advertised with Local routing option (or all with Global option).
5. Configure a Policy or Route Based IPsec connection between your customer router to vSRX or Gateway Appliance private IP (IBM Cloud private portable). Ensure that your T0, vSRX, or Gateway Appliance has a route to this tunnel end point. Large MTU is supported in IBM Cloud private network and Direct Link.
6. You can exchange routes through BGP, or static between your overlay and the on-premises customer router through the tunnel.
7. You can attach any other required VPC connections to the Direct Link, for example, VPCs. Your VPC IP address allocation design must ensure that you do not overlap with the attached classic network nor with the NSX-T overlay networks.



Direct Link does not provide direct connectivity between the VPC and classic. But, depending on your routing setup, it is possible to do a hair pinning on the customer router. Alternatively, use transit gateway for this use case.





 Considerations 

When you design or deploy this architecture pattern, consider the following steps:



* Route based IPsec VPN is recommended for dynamic routing.
* IPsec tunnels can also be terminated to Tier-1 gateways. In this case, only policy based VPNs are supported. Also, ensure that the VPN endpoint is known and routed in IBM Cloud classic network (for example, use a /32 from the private portable subnet for the T1 VPN endpoint).







 Related links
6. Alter the automation-deployed routes if you need to customize the routing behavior, or establish dynamic routing between your T0 and the vSRX (or third-party device).







 Ordering new VLAN for gateway cluster with NSX-T 

In some designs, extra VLANs might be preferred or needed, especially with a gateway cluster. In IBM Cloud, you can provision extra VLANs for your classic NSX-T network deployment. While the new VLAN can be ordered through IBM Cloud, the VMware vSphere® networking and NSX-T configuration must be done by you, manually or though scripting.

This architecture pattern shows an example for using a new VLAN for NSX-T T0 gateway's private uplinks. VLAN tagging design and configuration are important to get the VLAN IDs correctly through the vSphere distributed virtual switches, NSX-T edge transport nodes, and edge cluster up to the T0 gateways that are running on these components.

Zoom

![Adding VLANs with gateway cluster](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/arch-pattern-nsx-t-edge-services-cluster-vlans.svg)

Figure 2. Adding VLANs with gateway cluster



1. In this example, you deployed an optional gateway cluster to host Juniper vSRX (or your own routing or firewall device). This cluster is attached to both IBM Cloud private and public networks through untagged transit networks. These transit networks are used for static routes to route public and private traffic through the firewall that is hosted on the gateway cluster.
2. You can associate and route traffic through vSRX (or the third-party device) by assigning VLANs to the gateway cluster. You can choose the VLANs to be assigned and routed through it by using IBM Cloud classic portal.
2. Based on the storage details in the PV, the storage plug-in connects the PV with the storage device in your IBM Cloud infrastructure account.
3. The cluster admin or a developer creates a PVC. Because the PV and the storage device already exist, no storage class is specified in the PVC.
4. After the PVC is created, the storage plug-in tries to match the PVC to an existing PV. The PVC and the PV match when the same values for the size, IOPS, and access mode are used in the PVC and the PV. When PVC and PV match, the status of the PVC and the PV changes to Bound. You can now use the PVC to mount persistent storage to your app. When you delete the PVC, the PV and the physical storage instance are not removed. You must remove the PVC, PV, and the physical storage instance separately.



Review the following common use cases for static provisioning of persistent storage.



1. Make retained data available to the cluster: You provisioned persistent storage with a retain storage class by using dynamic provisioning. You removed the PVC, but the PV, the physical storage in IBM Cloud infrastructure, and the data still exist. You want to access the retained data from an app in your cluster.
2. Use an existing storage device: You provisioned persistent storage directly in your IBM Cloud infrastructure account and want to use this storage device in your cluster.
3. Share persistent storage across clusters in the same zone: You provisioned persistent storage for your cluster. To share the same persistent storage instance with other clusters in the same zone, you must manually create the PV and matching PVC in the other cluster. Note: Sharing persistent storage across clusters is available only if the cluster and the storage instance are located in the same zone.
4. Share persistent storage across namespaces in the same cluster: You provisioned persistent storage in a namespace of your cluster. You want to use the same storage instance for an app pod that is deployed to a different namespace in your cluster.







 Storage classes 

To dynamically provision persistent storage, you must define the type and configuration of the storage that you want.
oc get secrets | grep my-cos

Example output.

my-cos-secret ibm/ibmc-s3fs 3 11m







 Step 3: Installing the plug-in 

When you install the plug-in in your cluster, make sure to specify the --set quotaLimit=true option. Specifying this option means any buckets you create with PVCs have a quota limit equal to the storage size in the PVC.



1. Follow the steps to [install the plug-in and enable quota limits](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_cos_install). If you've already installed the plug-in in your cluster, you can skip this step. To see if the plug-in is already installed, follow the next step.
2. Verify the plug-in is installed by listing the driver pods.

oc get pods -n ibm-object-s3fs | grep object

Example output.

ibmcloud-object-storage-driver-k9x4l 1/1 Running 0 6m52s
ibmcloud-object-storage-driver-kj9m6 1/1 Running 0 6m52s
ibmcloud-object-storage-driver-l8gqk 1/1 Running 0 6m52s
ibmcloud-object-storage-plugin-576fb8bd7-sxlkb 1/1 Running 0 6m52s







 Step 4: Dynamically provisioning a bucket with a quota 

You can use dynamic provisioning to automatically create a Object Storage bucket when you a create a PVC.



1. Copy the following PVC configuration and save it to a file called pvc.yaml. This example PVC automatically creates a bucket with a quota equal to 20Gi.

kind: PersistentVolumeClaim
apiVersion: v1
metadata:
name: my-cos-pvc
namespace: default
annotations:
ibm.io/auto-create-bucket: "true"
ibm.io/auto-delete-bucket: "true"
The secret name follows a truncated format of the subdomain, such as mycluster-a1b2cdef345678g9hi012j3kl4567890-0003.









 Step 3: Create and configure a public Ingress controller 

After you get your domain and TLS certificate ready, you must create a public Ingress controller and configure the controller with your domain.



1. Create a configuration file for a public Ingress controller.

apiVersion: operator.openshift.io/v1
kind: IngressController
metadata:
name: public-ingress-controller
namespace: openshift-ingress-operator
spec:
replicas: 2
domain: <domain>
endpointPublishingStrategy:
loadBalancer:
scope: External
type: LoadBalancerService
2. Create the IngressController resource in the openshift-ingress-operator project of your cluster. When you create the IngressController, a public Ingress controller is automatically created and deployed in the openshift-ingress project based on the IngressController settings. Additionally, a Ingress controller service is created to expose the Ingress controller.

oc create -f public-ingress-controller.yaml -n openshift-ingress-operator
3. Run the oc get command and find the VPC hostname in the EXTERNAL IP field of the router-public-ingress-controller service. In VPC clusters, services' external IP addresses are non-static, and are instead kept behind a VPC-assigned hostname.

oc get svc router-public-ingress-controller -n openshift-ingress

Example output

NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
router-public-ingress-controller LoadBalancer 172.21.57.132 1234abcd-us-south.lb.appdomain.cloud 80/TCP,443/TCP,1940/TCP 3m
4.
export SECRET_GROUP_ID=ibmcloud secrets-manager secret-group-create --resources '[{"name":"cloud-object-storage-writers","description":"Read and write to Cloud Object storage buckets."}]' --output json | jq -r ".resources[].id"; echo $SECRET_GROUP_ID

Using a Windows™ command prompt (cmd.exe) or PowerShell? If you encounter errors with passing JSON content on the command line, you might need to adjust the strings for quotation-escaping requirements that are specific to your operating system. For more information, see [Using quotation marks with strings in the IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-quote-strings).

If you run into the following error: Error processing the response received, most likely an error response: Get "https://secrets-manager.cloud.ibm.com/api/v1/secret_groups": dial tcp: lookup secrets-manager.cloud.ibm.com on 1.1.1.1:53: no such host, be sure that you export an environment variable with your unique Secrets Manager API endpoint URL as shown in the previous step.
4. Enable the IAM secrets engine for your instance.

Secret engines are components in Secrets Manager that are used to process operations for secrets of different types. These engines serve as backends for those secrets. By enabling the IAM secrets engine, you can create an API key for a service ID dynamically, and then lease it to a user based on the lease duration that you specify.

To configure the IAM secrets engine from the IBM Cloud CLI, run the [ibmcloud secrets-manager config-update](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-cli-plugin-secrets-manager-clisecrets-manager-cli-configuration-update-command) command.

ibmcloud secrets-manager config-update --engine-config '{"api_key": "$API_KEY"}'

Success!
curl -X GET "https://s3.us-south.cloud-object-storage.appdomain.cloud/test-secrets-tutorial/sample.txt" -H "Authorization: Bearer $IAM_TOKEN" -H "ibm-service-instance-id: $COS_INSTANCE_ID" -H "Accept: application/json"

Replace sample.txt with the name of the file that you uploaded to your bucket. The following screen shows an example response.

A quick brown fox jumps over the lazy dog.





 Step 6: (Optional) Clean up resources 

If you no longer need the resources that you created in this tutorial, you can complete the following steps to remove them from your account.



1. Delete your test Cloud Object Storage instance.

ibmcloud resource service-instance-delete test-cos-instance-tutorial
2. Delete your test Secrets Manager instance.

ibmcloud resource service-instance-delete test-sm-instance-tutorial
3. Delete your test access group.

ibmcloud resource access-group-delete $ACCESS_GROUP
4. Delete your test service ID.

ibmcloud resource service-id-delete $SERVICE_ID







 Next steps 

Great job! In this tutorial, you learned how to set up Secrets Manager to access a Cloud Object Storage bucket with a dynamic secret. Check out more resources to help you get started with Secrets Manager.



* Learn more about [secret types](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-what-is-secret).
* Design an access strategy with [secret groups](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-secret-groups).
* Learn more about the [Secrets Manager API](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2).
* If you use vSAN, a subnet is assigned to kernel port groups that are used for vSAN traffic.
* If you use NFS attached NAS, a subnet is assigned to a port group that is dedicated to NFS traffic.





All subnets that are configured as part of a vCenter Server automated deployment use IBM Cloud managed ranges, which ensure that any IP address can be routed to any data center within the IBM Cloud account when you need the connection.

Review the following table for a summary.



Table 1. VLAN and subnet summary

 VLAN Type Description 

 Public Primary Assigned to physical hosts for public network access. The hosts are assigned a public IP address but this IP address is not configured on the hosts, so they are not directly accessible on the public network. Instead, the public VLAN is intended to provide public internet access for other components, such as NSX-T edges. 
 Private A Primary Single subnet assigned to physical hosts assigned by IBM Cloud. Used by the management interface for vSphere management traffic and for IPMI interfaces. 
 Private A Portable Single subnet that is assigned to VMs that function as management components 
 Private A Portable Single subnet that is assigned to NSX-T™ VTEP 
 Private A Portable Single subnet that is assigned for NSX edge egress 
 Private B Portable Single subnet that is assigned for vSAN, if in use 
 Private B Portable Single subnet assigned for NAS, if in use 
 Private B Portable Single subnet assigned for vMotion 



In this design, all VLAN-backed hosts and VMs are configured to point to the IBM Cloud back-end “private network” customer router (BCR) as the default route. While the vCenter Server instances enable the use of Software-Defined Networking (SDN), network overlays created within a VMware instance that include routing to internal subnets are not known by the IBM Cloud managed routers.

If you want to route between the overlay and underlay, you must deploy an IBM firewall device for the particular default private VLAN when the vCenter Server instance is deployed. This device allows the insertion of static routes and dynamic routing protocol peering with the overlay networking devices to allow routing between the underlay and overlay.
When you configure a listener with a [range of ports](https://cloud.ibm.com/docs/vpc?topic=vpc-nlb-port-ranges), the instance group's application port is only used for checking the health status of back-end members.



 Creating managed pools and instance groups 

To create a managed pool and attach an instance group, perform the following procedure:



1. [Create an instance group template](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-auto-scale-instance-groupcreating-instance-template).

This template defines your back-end member instance configurations.
2. [Create an instance group](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-auto-scale-instance-group). When creating your instance group, specify the application port, load balancer, and pool identities.

For an existing instance group, you can update it with the load balancer pool ID. You must also choose a scaling method from the following options:



* A static method that allows a fixed number of back-end members
* A dynamic method for utilization based scaling



3. [Create your instance group scaling policies](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-auto-scale-instance-groupcreating-scaling-policies).

Configure scaling policies only if you are using a dynamic scaling method.

When you configure these policies, you define certain metrics (such as the CPU utilization percentage) and the target utilization you want for that metric. Together, the metric and the average target utilization determine when your instance group dynamically adds or removes virtual server instances to or from the group.







 Related links 



* [Creating an instance group template](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-auto-scale-instance-groupcreating-instance-template)
IBM_KP_CUSTOMER_ROOT_KEY: AaAAAaZAAAAy11AAAyAAkaAaQtAAk0AAA2AzY5AjYaaa67aa your base64 encoded root key ID
  IBM_KP_SERVICE_API_KEY: AAAaaajAAAAAncmAAaaaaAAAAdAAId1AtVjBJRU1aAAaAeTh1aEw=AaaaA your base64 encoded API
kind: Secret
metadata:
  name: ibm-hpcs-secret
  namespace: openshift-storage
type: Opaque
2. Create the secret in your cluster.

oc apply -f ibm-hpcs-secret.yaml



4. Verify that your secret is created.

oc get secrets -A | grep ibm-hpcs-secret









 Installing the OpenShift Data Foundation add-on from the console 

To install ODF in your cluster, complete the following steps.



1. Before you enable the add-on, review the [change log](https://cloud.ibm.com/docs/openshift?topic=openshift-odf_addon_changelog) for the latest version information.
2. [Review the parameter reference](https://cloud.ibm.com/docs/openshift?topic=openshift-deploy-odf-vpcodf-vpc-param-ref).
3. From the [Red Hat OpenShift clusters console](https://cloud.ibm.com/kubernetes/clusters?platformType=openshift), select the cluster where you want to install the add-on.
4. On the cluster Overview page, on the OpenShift Data Foundation card, click Install. The Install ODF panel opens.
5. In the Install ODF panel, enter the configuration parameters that you want to use for your ODF deployment.
6. Select either Essentials or Advanced as your billing plan.
7. For VPC clusters, select Remote provisioning to dynamically provision volumes for ODF by using the Block Storage for VPC.
8.