vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Use the default for all others as default.
11. Select Add.
12. Repeat steps 2-11 for resource types:



1. Block Storage Snapshots for VPC
2. Virtual Server for VPC



13. Check the Access Summary in the right panel and select Assign.







 Step 3: Create API keys 



1. Click the Service ID and then API Keys. Provide a name and description, create the API key and then download or copy the API key created. This key is used to retrieve the token later.



This Service ID API key has authorization to create snapshots on block storage volumes based on your selection of Resource Types. A further fine-grained policy can be set up to limit access only to selected virtual servers or storage volumes by providing the instance ID or volume ID under resource types if wanted.





 Step 4: Setting up the Cron Script: 



 Identify the VPC end point. 

The endpoint depends on the region you are running VSIs. For example, if you are running the API from Sydney region, it is [https://au-syd.iaas.cloud.ibm.com](https://au-syd.iaas.cloud.ibm.com).





 Identify the source volume IDs. The source volume IDs can be retrieved either through CLI or UI. 



1. Log in to the [IBM Cloud console](https://cloud.ibm.com/login).
2. Select VPC Infrastructure > Virtual Server Instances.
3. Select your VSI Instance.
4. Scroll down to storage volumes and select the boot or data volume that you want to take a snapshot of.
5. Make a note of the Volume ID on the page.







 Identify your resource group ID 



1. Log in to the [IBM Cloud console](https://cloud.ibm.com/login).
2. Select Resource groups and identify your resource group ID.







 Copy the script 

Copy the script and schedule it through a cron.
* INSTANCE_ID: The unique identifier or name of the instance.



--------------------







 ibmcloud pi instance-list-volumes 



 Get a list of volumes attached to an instance 

ibmcloud pi volume INSTANCE [--long] [--json]

Options



* --long: Retrieve all volume details.
* --json: Format output in JSON.



--------------------







 ibmcloud pi volume-create 



 Create a volume 

ibmcloud pi volume-create VOLUME_NAME --type TYPE --size SIZE [--shareable] [--json]

ibmcloud pi volume-create VOLUME_NAME --storage-pool POOL --size SIZE [--shareable] [--json]

ibmcloud pi volume-create VOLUME_NAME --affinity-policy affinity --size SIZE [--shareable] (--affinity-instance INSTANCE | --affinity-volume VOLUME) [--json]

ibmcloud pi volume-create VOLUME_NAME --affinity-policy anti-affinity --size SIZE [--shareable] (--anti-affinity-instances "INSTANCE1 [INSTANCEn]" | --anti-affinity-volumes "VOLUME1 [VOLUMEn]") [--json]



* VOLUME_NAME: The name of the volume.



Options



* --type value: Type of the volume (use "ibmcloud pi storage-types" to see available storage types in the targeted region); required if --affinity-policy and --storage-pool are not provided
* --size value: Size of the volume (in GB)
* --shareable: Whether volume can be attached to multiple VMs
* --affinity-policy value: Affinity policy for data volume being created. Valid values are "affinity" and "anti-affinity". If --storage-pool is provided then this cannot be specified
Before file share can be created and encrypted with a root key from another account, the key-owner account must create an IAM policy to authorize the second account to use the CRK.

To create the IAM policy, Account A must make a POST /policies call to the IAM API. In the following example,



* Account A, which owns the CRK, grants AuthorizationDelegator and Reader roles to Account B's file service that is to create the encrypted file share.
* The resources section specifies information about Account A that owns the root key and the target key management service (KMS). The kms property indicates a Key Protect instance. If you use a Hyper Protect Crypto Services instance, specify hs-crypto.
* The subjects section specifies Account B and the file share service that is to access Account A's Key Protect instance and use the CRK.



curl -X "POST" "https://iam.cloud.ibm.com/v1/policies" -H "Authorization: <Auth Token>" -H 'Content-Type: application/json' -d $'{
"roles": [
{
"role_id": "crn:v1:bluemix:public:iam::::role:AuthorizationDelegator"
},
{
"role_id": "crn:v1:bluemix:public:iam::::serviceRole:Reader"
}
],
"resources": [
{
"attributes":
{
"name": "Account-A",
"operator": "stringEquals",
"value": "<CRK-Account-A-ID>"
},
{
"name": "Key-Protect",
"operator": "stringEquals",
"value": "kms" // For HPCS use hs-crypto
}
]
}
],
"type": "authorization",
"description": "Reader and Delegator role for KeyProtect Service instance",
Repeat the previous steps to add access policies for the remaining three access groups.



Table 2. Access policies for the remaining access groups

 Access group Resource group Resource type Platform access role Service access role 

 test_team_view_vpcs test_team All resource types Viewer 
 test_team_view_vpcs Default Block Storage for VPC Viewer 
 test_team_view_vpcs Default Floating IP for VPC Viewer 
 production_team_manage_vpcs production_team All resource types Editor Console Administrator 
 production_team_manage_vpcs Default Block Storage for VPC Editor 
 production_team_manage_vpcs Default Floating IP for VPC Editor 
 production_team_view_vpcs production_team All resource types Viewer 
 production_team_view_vpcs Default Block Storage for VPC Viewer 
 production_team_view_vpcs Default Floating IP for VPC Viewer 



The teams are now set up to use VPCs. Members of the test_team_manage_vpcs and production_team_manage_vpcs access groups can now create VPCs in their assigned resource groups (that is, in the test_team and production_team resource groups).

When you create a VPC or other resources, make sure that you specify the resource group in which to create the resource. If you don't specify a resource group, the resource is created in the Default resource group.







 Viewing user's permissions 

Policies can be viewed in the user's Access policies tab.

You can use the following CLI commands to validate the resource group permissions that are assigned to your user, by policy or by access group:



 Validate By policy 

ibmcloud iam user-policies <username>





 Validate by access group 

ibmcloud iam access-groups -u <username>

Changes to IAM access policies for VPC can take up to 10 minutes to take effect.







 Related links 



* [Managing identity and access](https://cloud.ibm.com/docs/vpc?topic=vpc-iam-getting-startediam-roles)
* [Managing users and access](https://cloud.ibm.com/docs/account?topic=account-iamuserinv)
List available storage classes and choose the storage class that you want to use.

oc get sc | grep ebs

To see details for a storage class, use the oc describe sc <sc-name> command or review the [storage class reference](https://cloud.ibm.com/docs/satellite?topic=satellite-storage-aws-ebs-csi-driversat-ebs-sc-reference).
2. Create a PVC that provisions an AWS EBS storage instance with the characteristics that are described in the storage class that you selected. The following example uses the sat-aws-block-bronze storage class to create an st1 HDD AWS EBS storage instance with a size of 125 GB. For more information about this volume type, see [Hard disk drives (HDD)](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-volume-types.htmlhard-disk-drives).

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: sat-aws-block-bronze
spec:
accessModes:
- ReadWriteOnce
storageClassName: sat-aws-block-bronze
resources:
requests:
storage: 125Gi
3. Create the PVC in your cluster.

oc apply -f pvc.yaml
4. Verify that your PVC is created. Because all IBM-provided storage classes are configured as WaitForFirstConsumer, the status of your PVC remains Pending until you provision an app that mounts your PVC.

oc get pvc

Example output

NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS AGE
sat-aws-block-bronze Pending sat-aws-block-bronze 17s
5. Create a YAML configuration file for your pod that mounts the PVC that you created. When you create this pod, the AWS EBS driver starts to fulfill your storage request by dynamically creating an AWS EBS instance in your AWS account.
For more information, see the documentation for the ibmcloud oc flavors (machine-types)[command](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_machine_types).

--name NAME
: Required: The name for the cluster. The name must start with a letter, can contain letters, numbers, periods (.), and hyphen (-), and must be 35 characters or fewer. Use a name that is unique across regions. The cluster name and the region in which the cluster is deployed form the fully qualified domain name for the Ingress subdomain. To ensure that the Ingress subdomain is unique within a region, the cluster name might be truncated and appended with a random value within the Ingress domain name.

--operating-system SYSTEM
: Optional. The operating system of the worker nodes you want to provision in your cluster. For a list of available operating systems by cluster version, see [Red Hat OpenShift on IBM Cloud version information](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_versions).

--version MAJOR.MINOR.PATCH
: Optional: The Kubernetes version for the cluster master node. When the version is not specified, the cluster is created with the default of supported Kubernetes versions. To see available versions, run ibmcloud oc versions.

--no-subnet
: By default, a public and a private portable subnet are created on the VLAN associated with the cluster. Include the --no-subnet option to avoid creating subnets with the cluster. You can [create](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_cluster_subnet_create) or [add](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_cluster_subnet_add) subnets to a cluster later.

--sm-group GROUP
You can later use the [ibmcloud sat subscription create](https://cloud.ibm.com/docs/satellite?topic=satellite-satellite-cli-referencecli-config-subscription-create) command to specify the clusters where you want to deploy the version.

ibmcloud sat config version create --name NAME --read-config FILEPATH --config CONFIG --file-format TYPE [--description DESCRIPTION] [-q]



 Minimum required permissions 

IBM Cloud IAM Editor platform role for the Configuration resource in Satellite. For more information, see [Checking user permissions](https://cloud.ibm.com/docs/satellite?topic=satellite-iam-assign-accesschecking-perms).





 Command options 

--name NAME
: Required. A name for your version, such as 1.0 or black friday.

--read-config FILEPATH
: Required. The file path to the Kubernetes resource configuration file that you want to upload as a version. You can upload only one configuration file, but the configuration file can have multiple Kubernetes resource definitions, such as a deployment, service, and security context constraint. Supported file types are YAML. Files must not exceed 3MB in size.

--config CONFIG
: Required. The name of the configuration to add the version to. To list available configurations, run ibmcloud sat config ls.

--file-format TYPE
: Required. The file extension of the Kubernetes resource file that you want to add. Supported file types are yaml.

--description DESCRIPTION
: Optional. A description for your version, such as the purpose of the Kubernetes resources that the version contains. For example, Added replicas and zone affinity for HA version of app for multizone clusters.

--q
: Optional. Do not show the message of the day or update reminders.





 Example
* [Create a console access token for an instance](https://cloud.ibm.com/apidocs/vpccreate-instance-console-access-token) (POST /instances/{instance_id}/console_access_token)
* [Retrieve the console WebSocket for an instance](https://cloud.ibm.com/apidocs/vpcget-instance-console) (GET /instances/{instance_id}/console)



Instance resize. You can now resize an instance by providing the profile property in the API method PATCH /instances/{id} ([Update an instance](https://cloud.ibm.com/apidocs/vpcupdate-instance)). For more information, see [Resizing a virtual server instance](https://cloud.ibm.com/docs/vpc?topic=vpc-resizing-an-instance&interface=api).







 23 March 2021 



 For all version dates 

New parameter-based rule types for an application load balancer. When creating a load balancer listener policy rule, the field property may now be set to query or body to perform additional forms of layer 7 load balancing:



* query - Write layer 7 rules that use the query string to route traffic to a specific target. For a query type rule, field and value must be percent-encoded, same as the query string in the URL.
* body - If the body of the POST request uses form encoding (UTF-8), then you can create layer 7 rules to route traffic based on the parameter name and value in the body. The Content-Type in the request is ignored.



If you use these new rule types, be aware that existing client applications will be exposed to those new values in the existing properties. To avoid disruption, check that client applications are written to gracefully handle unexpected values for these properties before using these new rule types for an application load balancer.







 19 March 2021 



 For all version dates 

Bring your own license.
Generating SSH keys 

Before you can create a virtual server, you must have a pair of private and public SSH keys available. You can either reuse an existing SSH key pair or generate a new one. You can also reuse an existing OpenSSH key pair for use in PuTTY.



* You need the public key as input during the creation of a new virtual server.
* You need the private key when you log in to the virtual server. Keep it as a secret on your client workstation.



This pair of SSH keys is then used for authentication between your client and your new server.

The following cryptographic algorithms are supported by Hyper Protect Virtual Servers for generating SSH keys:



* ssh-rsa (the default)
* ssh-ed25519
* ecdsa-sha2-nistp256
* ecdsa-sha2-nistp384
* ecdsa-sha2-nistp521





 Generating SSH keys with a command 

The method of creating an SSH key pair from the command line of the listed operating systems is nearly the same in all such operating systems:



* Linux
* Windows Subsystem for Linux (WSL)
* Windows by using Git Bash
* Windows 10
* macOS



If you need or want to use a new authentication key pair for SSH, run the ssh-keygen tool from the command line. You are prompted to optionally choose a key file name and a passphrase.

The shown sample instructions can be entered from either



* A Git Bash session under Windows
* A Windows 10 session
* A Linux session



ssh-keygen

ssh-keygen -t rsa

ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

The -t, -b, and -C parameters are optional.



* -t Specifies the key type. The default is -t rsa.
* -b Designates the key size in bits. The default size is 2048 bits.
* -C Adds a comment.
ibmcloud is share-create --name p-share-3 --zone us-south-1 --profile tier-5iops --replica-share-profile tier-5iops --replica-cron-spec '55 09 * * ' --replica-zone us-south-3 --replica-share-name replica-p-share-3 --replica-target '[{"name": "my-target1", "vpc": {"id": "af7c3b16-8a59-4434-8c2c-3230e916d441"}}]' --size 40
Creating file share p-share-3 under account VPC as user myuser@mycompany.com...

ID 8b08129c-e376-4572-9ef3-68c729b315d5
Name p-share-3
CRN crn:v1:staging:public:is:us-south-1:a/efe5afc483594adaa8325e2b4d1290df::share:8b08129c-e376-4572-9ef3-68c729b315d5
Lifecycle state pending
Zone us-south-1
Profile tier-5iops
Size(GB) 40
IOPS 3000
Encryption provider_managed
Mount targets ID Name VPC ID VPC Name
No mounted targets found.

Resource group ID Name
11caaa983d9c4beb82690daab08717e9 Default

Created 2022-09-26T03:19:58+05:30
Last sync at 2022-09-21T05:53:28+05:53
Replication share ID Name Resource type
ID de1e70af-c3cb-44c6-a96d-2ece09b51ae3
Name replica-p-share-3
Resource type share

Replication role source
Replication status none
Source share ID Name Resource type





 Update an existing file share for replication from the CLI
--type=LoadBalancer The Kubernetes service type to create. In this lesson, you create a LoadBalancer service. 
 --port=<8080> The port on which the service listens for external network traffic. 
 --target-port=<8080> The port that your app listens on and to which the service directs incoming network traffic. In this example, the target-port is the same as the port, but other apps that you create might use a different port. 



2. Verify that the Kubernetes LoadBalancer service is created successfully in your cluster. When you create the Kubernetes LoadBalancer service, a VPC load balancer is automatically created for you. The VPC load balancer assigns a hostname to your Kubernetes LoadBalancer service that you can see in the LoadBalancer Ingress field of your CLI output. The VPC load balancer takes a few minutes to provision in your VPC. Until the VPC load balancer is ready, you can't access the Kubernetes LoadBalancer service through its hostname.

kubectl describe service hw-lb-svc

Example CLI output

NAME: hw-lb-svc
Namespace: default
Labels: app=hello-world-deployment
Annotations: <none>
Selector: app=hello-world-deployment
Type: LoadBalancer
IP: 172.21.xxx.xxx
LoadBalancer Ingress: 1234abcd-us-south.lb.appdomain.cloud
Port: <unset> 8080/TCP
TargetPort: 8080/TCP
NodePort: <unset> 32040/TCP
Endpoints:
Session Affinity: None
External Traffic Policy: Cluster
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal EnsuringLoadBalancer 1m service-controller Ensuring load balancer
Normal EnsuredLoadBalancer 1m service-controller Ensured load balancer
3.
For more information, see [Bare metal servers profiles](https://cloud.ibm.com/docs/vpc?topic=vpc-bare-metal-servers-profile) or [s390x bare metal server profiles](https://cloud.ibm.com/docs/vpc?topic=vpc-s390x-bare-metal-servers-profile). 
 SSH key Select an existing public SSH key or click Create an SSH key to create a new one. For more information about creating an SSH key, see [Creating your SSH key by using the UI](https://cloud.ibm.com/docs/vpc?topic=vpc-ssh-keys&interface=uigenerate-ssh-keys-ui). You must specify at least one SSH key.<br><br><br><br> * For x86 architecture, the SSH key is used to automatically generate a password that is required for accessing VMware® ESXi Direct Console User Interface (DCUI) and the ESXi web client.<br><br><br><br>Note: RSA and Ed25519 are the two types of SSH keys that you can use. However, you can't use the Ed25519 SSH key type with Windows or VMware images. You can use only RSA SSH keys for these images.<br><br><br><br> * For s390x architecture, SSH keys are used to securely connect to the server after it's running. For more information, see [Getting started with SSH keys](https://cloud.ibm.com/docs/vpc?topic=vpc-ssh-keys).<br><br><br> 
 Virtual private cloud Specify the VPC where you want to create your server. You can use the default VPC, another existing VPC, or you can create a new VPC. 
 Network interfaces By default the bare metal server is created with a single primary network interface. You can click the pencil icon to edit the details of the network interface. For example, the subnet or security group that's associated with the interface.
Similar to the previous scenario, in this scenario you allow different IP addresses to access the respective public or private service endpoint for Red Hat OpenShift on IBM Cloud clusters. However, in this scenario, access is further restricted by specific API types for the cluster and management APIs. For more information about the API types, see [Protecting specific APIs](https://cloud.ibm.com/docs/containers?topic=containers-cbr&interface=cliprotect-api-types-cbr).



1. Create four network zones, one for each of the IP addresses you want to allow to access either the public or private cluster APIs or the public or private management APIs. Note that you can include multiple IP addresses or CIDRs, separated by a comma, that you want to allow to access your clusters.

ibmcloud cbr zone-create --addresses 1.2.3.4,12.12.12.0/24 --description "Allowed Public IP Addresses for IKS and ROKS APIs" --name "public-mgmt-zone"

ibmcloud cbr zone-create --addresses 10.20.20.20,10.10.10.0/24 --description "Allowed Private IP Addresses IKS and ROKS APIs" --name "private-mgmt-zone"

ibmcloud cbr zone-create --addresses 11.11.11.0/24 --description "Allowed Public IP Addresses for cluster apiserver" --name "public-cluster-zone"

ibmcloud cbr zone-create --addresses 10.30.30.30 --description "Allowed Private IP Addresses for cluster apiserver" --name "private-cluster-zone"
2. Get the IDs of the zones you created in the previous step.

ibmcloud cbr zones

Example output

OK
id name address_count
c14c0839c13d8aa0afa8383e2be2e124 public-mgmt-zone 2
f9676ca6ef37685315fa254b89d73159 public-cluster-zone 1
"lastRotateDate": "2020-05-05T19:58:24Z",
"keyVersion": {
"id": "85b65b20-4165-4da3-8ba9-880e72390461",
"creationDate": "2020-05-05T19:58:24Z"
},
"extractable": false,
"state": 1,
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:390086ac-76fa-4094-8cf3-c0829bd69526:key:8635b804-9966-4918-a16b-d561fdbf181f"
}



 Key Description 

 id This is the KEY_ID, it is unique and is used whenever the CLI specifies a KEY_ID 
 name The name provided when the key was created 
 type Used by the API to set the content-type in a REST call 
 algorithmType Algorithm types are advanced encryption standard (AES) or cipher block chaining (CBC) 
 createdBy The user id that created the key 
 creationDate Date and time the key was created 
 lastUpdateDate Date and time the key was last updated 
 lastRotateDate Date and time the key was last rotated; this entry only exists if the key has been rotated 
 keyVersion / id This identifies the latest version of the root key 
 keyVersion / creationDate Date and time the key material was last updated 
 extractable A boolean that determines whether the key material can leave the service. If set to false, Key Protect designates the key as a nonextractable root key used for wrap and unwrap actions. If set to true, Key Protect designates the key as a standard key that you can store in your apps and services. Once set to false it cannot be changed to true.
"type": "ibm_cloud_kms",
"created_at": "2022-03-09T11:00:11Z",
"updated_at": "2022-03-09T11:00:11Z",
"created_by": "IBMid-1308197YB4",
"updated_by": "IBMid-1308197YB4",
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/keystores/f6a5ccc1-7fc3-435e-9637-482e470ba8e8",
"ibm_api_endpoint": "https://us-south.kms.cloud.ibm.com",
"ibm_iam_endpoint": "https://iam.bluemix.net/identity/token",
"ibm_api_key": "",
"ibm_instance_id": "d139ea58-a073-441b-ba4e-dcc8bae58be4",
"ibm_variant": "hpcs",
"ibm_key_ring": "IBM-Cloud-KMS-Internal"
}
]
}







 ibmcloud hpcs uko keystore-create 

Create an internal keystore or connect to an external keystore of the requested type. If the dry_run query parameter is used, no keystores are created in the database and only a test is performed to verify whether the connection information is correct. It is possible to sort by the following parameters: name, created_at, updated_at, vault.id.

ibmcloud hpcs uko keystore-create --uko-vault UKO-VAULT --keystore-body KEYSTORE-BODY [--dry-run DRY-RUN]



* Command options

--uko-vault (string)
: Required. The UUID of the vault where the update is to take place.