vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Specify akamai-ext for Akamai or cloudflare-ext for Cloudflare.

--secret-namespace NAMESPACE
: Optional. The namespace that the domain TLS secret is created in. If no namespace is specified, the secret is created in the default namespace.







 Managing domains 

Learn how to manage the domains that exist in your cluster.



 Viewing domains in a cluster 

You can view the status of all domains in your cluster, or you can view details of a single domain. After you create a new domain or attach an existing domain in your cluster, the domain might remain in a pending state for a few minutes.



 List all domains in a cluster. 

For more details and command options, see the [CLI reference](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-cli&interface=uiingress-domain-ls).

ibmcloud oc ingress domain ls --cluster CLUSTER





 Get the details of a single domain. 

For more details and command options, see the [CLI reference](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-cli&interface=uiingress-domain-get).

ibmcloud oc ingress domain credential get --cluster CLUSTER







 Removing a domain from a cluster 

If you delete a domain from a cluster, the domain cannot be recovered. If you later need the domain, you must reprovision it with the ibmcloud oc ingress domain create command. Note that you cannot delete a cluster's default domain. If you want to delete the domain that is currently registered as the default, you must first [assign a different default domain](https://cloud.ibm.com/docs/openshift?topic=openshift-ingress-domainsingress-domain-manage-default).

If you delete a domain that is registered with the IBM internal provider, you cannot reuse the domain name.
You can set env values for a workspace using the CLI and API. For more information, see [usage of env_values](https://cloud.ibm.com/docs/schematics?topic=schematics-set-parallelism).

Sample payload:

{
"name": "newName",
"template_data": [
{
"type": "<same_as_before>",
"env_values":
{
"env_values_1": "dummy_text"
},
{
"env_values_2": "dummy_text"
}
],
"env_values_metadata":
{
"name": "env_values_1",
"hidden": false,
"secure": false
},
{
"name": "env_values_2",
"hidden": false,
"secure": false
}
]
}
]
}
* Does drift detection run automatically?

No, the drift detection is not an automatic method of detection in the IBM Cloud Schematics. For more information, see [detecting drift in Schematics](https://cloud.ibm.com/docs/schematics?topic=schematics-drift-note&interface=apidrift-in-ibm).
* How can I initiate drift detection?

You can initiate drift detection using the UI and CLI. For more information, see [detecting drift in Schematics](https://cloud.ibm.com/docs/schematics?topic=schematics-drift-note).
* Where can I see the status of a drift detection job ?

To verify the results of a drift detection job, you need to check the drift detection job log. The job log provides the details of the drift detection as in progress or completed with the appropriate status such as failure or success.
Pull request pipeline stages setup, test, detect-secrets, and branch-protection. The detect-secrets and branch-protection stages are not custom stages. They are provided by the pipelines by default. 
 Continuous integration pipeline stages setup, test, static-scan, containerize, sign-artifact, deploy, acceptance-test, scan-artifact, release, detect-secrets, branch-protection, bom-check, cis-check, and vulnerability-scan. The detect-secrets, branch-protection, bom-check, cis-check, and vulnerability-scan stages are not custom stages. They are provided by the pipelines by default. 
 continuous deployment pipeline stages setup, deploy, acceptance-test, create-change-request, change-request-check-approval, change-request-change-state-to-implement, and close-change-request. The create-change-request, change-request-check-approval, change-request-change-state-to-implement, and close-change-request stages are not custom stages. They are provided by the pipelines by default. 
 Continuous compliance pipeline stages setup, test, static-scan, scan-artifact, acceptance-test, detect-secrets, branch-protection, bom-check, cis-check, and vulnerability-scan. The detect-secrets, branch-protection, bom-check, cis-check, and vulnerability-scan stages are not custom stages. They are provided by the pipelines by default. 





 Example usage 

 List saved stage results
$ get_data result
detect-secrets
branch-protection

 Get stage result
$ get_data result detect-secrets
success

For more information about the Stage Results API, see [Using the Stage Results API in custom scripts](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-stage-results).
Prepending an AS path makes a shorter AS path look longer and therefore less preferable to BGP. For more information, see [Using AS prepends to influence route preference](https://cloud.ibm.com/docs/dl?topic=dl-dl-aboutuse-case-1).





 01 April 2022 

Reduced unmetered plan pricing for Direct Link Connect
: IBM is pleased to announce a significant reduction in unmetered pricing for IBM Cloud Direct Link Connect and Direct Link Dedicated. Note that Direct Link also offers a metered pricing plan, allowing you to switch between metered and unmetered pricing plans to suit your bandwidth usage needs.





 27 January 2022 

VLAN mapping
: A Provider can now specify their own VLAN value at the time of gateway creation, or update it later using the [Direct Link Provider API](https://cloud.ibm.com/apidocs/direct_link_provider_api). Previously, the VLAN was selected for you.





 24 September 2021 

Bidirectional Forwarding Detection (BFD)
: Activate BFD to quickly detect faults in a network between two routers or switches that are connected by a link. BFD provides a single, standardized method for detecting link failures at any protocol layer, over any media.

More flexibility in configuring BGP values
: Instead of being able to specify BGP values (ASN and IP addresses) only during initial configuration, you'll now be able to modify BGP values after direct link provisioning.





 30 August 2021 

Direct Link connection support for transit gateways
: Direct Link now supports Transit Gateway connections. A Direct Link connection allows an on-premises network to connect to other networks (for instance, VPC and classic infrastructure) that are connected to the same transit gateway.
: The beta release for this feature has ended. If you participated in this beta, you can continue to use the gateways that you created during the beta period.





 24 June 2021 

BGP Message Digest 5 authentication support
: Border Gateway Protocol (BGP) authentication enables routers to share information only if they can verify that they are talking to a trusted source, based on a key.
The web apps that are deployed as part of the packaged server are accessible under the context root, as determined by the Liberty profile.



 Modification of the server.xml file 

When a packaged server or a Liberty server directory is pushed, the Liberty buildpack detects the server.xml file along with your app. The Liberty buildpack makes the following modifications to the server.xml file.



* The buildpack ensures that there is exactly one httpEndpoint element in the file.
* The buildpack ensures that the httpPort attribute in the httpEndpoint element points to a system variable that is called ${port}. The buildpack also overrides the host attribute.
* The buildpack sets the logDirectory attribute in the logging element to point to a system log directory.
* The buildpack ensures that a runtime-vars.xml file is logically merged with your server.xml file. Specifically, the buildpack appends the line <include location="runtime-vars.xml" /> to your server.xml file.







 Variables that can be referenced 

The following variables are defined in the runtime-vars.xml file, and referenced from a pushed server.xml file. All the variables are case-sensitive.



* ${port}: The HTTP port that the Liberty server is listening on.
* ${vcap_app_port}: Same as ${port}. Not set when running on Diego.
* ${application_name}: The name of the app, as defined by using the options in the ibmcloud cf push command.
* ${application_version}: The version of this instance of the app, which takes the form of a UUID, such as b687ea75-49f0-456e-b69d-e36e8a854caa. This variable changes with each successive push of the app that contains new code or changes to the app artifacts.
* ${host}: The IP address of the app instance.
* ${application_uris}: A JSON-style array of the endpoints that can be used to access this app, for example: myapp.mydomain.com.
* --dead-peer-detection-action: Dead Peer Detection actions. One of: restart, clear, hold, none. (default: restart).
* --dead-peer-detection-interval: Dead Peer Detection interval in seconds (default: 2).
* --dead-peer-detection-timeout: Dead Peer Detection timeout in seconds (default: 10).
* --ike-policy: ID or name of the IKE policy.
* --ipsec-policy: ID or name of the IPsec policy.
* --local-cidr: Local CIDR for the resource.
* --peer-cidr: Peer CIDRs for the resource.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is vpn-gateway-connection-delete 

Delete one or more VPN gateway connections.

ibmcloud is vpn-gateway-connection-delete VPN_GATEWAY (CONNECTION1 CONNECTION2 ...) [--vpc VPC] [--output JSON] [-f, --force] [-q, --quiet]



 Command options 



* VPN_GATEWAY: ID or name of the VPN gateway.
* CONNECTION1: ID or name of the VPN connection.
* CONNECTION2: ID or name of the VPN connection.
* --vpc: ID or name of the VPC. It is only required to specify the unique resource by name inside this VPC.
* --output: Specify output format, only JSON is supported. One of: JSON.
* --force, -f: Force the operation without confirmation.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is vpn-gateway-connection-local-cidr-add 

Add a local CIDR to a VPN gateway connection.
After you attach a host to your location, Satellite disables the ability to log in to the host as root with SSH for security purposes. You might see error messages if you try to SSH as root into a host that is attached successfully to a location. To restore the ability to SSH into the machine, you can [remove the host](https://cloud.ibm.com/docs/satellite?topic=satellite-host-remove) and reload the operating system.





 Attaching on-premises Red Hat CoreOS hosts to your location 

To attach Red Hat CoreOS (RHCOS) hosts that reside in your on-premises data center to your location, follow these general steps to run the host attachment script.



1. [Download the host script](https://cloud.ibm.com/docs/satellite?topic=satellite-attach-hostsattach-hosts) for your location. Note that for RHCOS hosts, the attachment script is a Red Hat CoreOS ignition (.ign) file.
2. Boot your RHCOS host and include the file path to the ignition script as the --user-data. This command varies, depending on the type of host that you are adding. For example, if your hosts are Amazon Web Services (AWS) cloud hosts, then you add --user-data file:///tmp/attach_hypershift.ign to your [launch template](https://docs.aws.amazon.com/cli/latest/reference/ec2/run-instances.html). Consult your provider documentation for more information about how to boot your host and include a file path to the ignition script.
3. As you run the scripts on each machine, check that your hosts are shown in the Hosts tab of your location dashboard. This process might take a few minutes to complete. All hosts show a Health status of Ready when a heartbeat for the machine can be detected, and a Status of Unassigned as the hosts are not yet assigned to your Satellite control plane or a Red Hat OpenShift cluster.
4.
The static code analyzers detect tricky bugs, such as null-pointer dereferences, logic errors, and resource leaks for multiple programming languages.

Default configuration
: Run a SonarQube scan in an isolated Docker-in-Docker container without persisting the SonarQube instance.

Cluster configuration
: A new SonarQube instance is provisioned in the Kubernetes cluster (chosen at the Deploy step) during the first CI pipeline run.

Custom configuration
: Link an existing SonarQube instance with the toolchain.





 Optional tools 



 Slack 

Configure the [Slack Tool](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-slack) to receive notifications about your PR/CI Pipeline events.



* [Slack webhook](https://api.slack.com/incoming-webhooks)
* Preferred: An existing webhook can be imported from a secrets vault by clicking the key icon.
* An existing webhook can be copy and pasted.
* Slack channel: an existing Slack channel to post message to
* Slack team name: the phrase before .slack.com in our team URL. For example, if your team URL [https://team.slack.com](https://team.slack.com), the team name is team.
* Automated Slack Notifications: Customize your selection by choosing the events for which you want to receive notifications.



You can add the Slack Tool after toolchain creation.









 Step 4: Create the CI toolchain 

On the Summary page, click Create, and wait for the toolchain to be created.

Other toolchain integrations can be configured after the pipeline is created.





 Step 5: Explore the CI toolchain 

The DevSecOps CI toolchain looks like this:

Zoom

!
: Separates the elements of array expr into multiple rows, or the elements of map expr into multiple rows and columns.
: Example of an SQL function usage fragment

> SELECT explode(array(10, 20))
: Result value

10 20





 explode_outer 

explode_outer(expr)
: Separates the elements of array expr into multiple rows, or the elements of map expr into multiple rows and columns.
: Example of an SQL function usage fragment

> SELECT explode_outer(array(10, 20))
: Result value

10 20





 expm1 

expm1(expr)
: Returns exp(expr) - 1.
: Example of an SQL function usage fragment

> SELECT expm1(0)
: Result value

0.0





 factorial 

factorial(expr)
: Returns the factorial of expr. expr is [0..20]. Otherwise, null.
: Example of an SQL function usage fragment

> SELECT factorial(5)
: Result value

120





 find_in_set 

find_in_set(str, str_array)
: Returns the index (1-based) of the indicated string (str) in the comma-delimited list (str_array). Returns 0, if the string was not found or if the indicated string (str) contains a comma.
: Example of an SQL function usage fragment

> SELECT find_in_set('ab','abc,b,ab,c,def')
: Result value

3





 first 

first(expr[, isIgnoreNull])
: Returns the first value of expr for a group of rows. If isIgnoreNull is true, returns only nonnull values.





 first_value 

first_value(expr[, isIgnoreNull])
: Returns the first value of expr for a group of rows. If isIgnoreNull is true, returns only nonnull values.





 float 

float(expr)
* If a BGP peering session was established and you enable BGP MD5 authentication (or change the authentication key to a different value), BGP sessions are re-established, which causes BGP session downtime and network disruption until the BGP peer device is configured with the same change.



Complete the following information:



* For the keystore, select either Hyper Protect Crypto Services or Key Protect.
* Select an authentication keystore instance.
* Select an authentication key.



* Detect network failures with Bidirectional Forwarding Detection (BFD) - Activate BFD to quickly detect faults in a network between two routers or switches that are connected by a link. BFD provides a single, standardized method for detecting link failures at any protocol layer, over any media. For more information, see [Setting up bidirectional forwarding detection](https://cloud.ibm.com/docs/dl?topic=dl-dl-bfd).

Activating and deactivating BFD after the BGP session is established causes BGP session downtime and network disruption until the BGP peer device is configured for the same change.

Complete the following information:



* Interval – The interval is the minimum time (in milliseconds) expected to occur between when the local routing device sends BFD hello packets and the reply from its neighbor. This value can range from 300 to 255,000 milliseconds.
* Multiplier – The multiplier is the number of times that a hello packet is missed before BFD declares the neighbor down. This value can range from 1 to 255. The default multiplier value is 3.



* Prioritize direct links with AS prepends - Adjust route preference by lengthening AS paths with multiples of the BGP Autonomous System Number (ASN). When the prefix is matched, the longer AS path becomes a lower priority for the BGP router. For more information, see [Prepending an AS path to influence route priority](https://cloud.ibm.com/docs/dl?topic=dl-prepend-as-paths).
* Filter your import routes - Select a default filter to either permit or deny all routes unmatched by active route filters.
│ └── zsh_autocomplete
├── ibmcloud
└── ibmcloud-analytics

For Windows™:

IBM_Cloud_CLI
├── LICENSE
├── NOTICE
├── ibmcloud-analytics.exe
└── ibmcloud.exe
3. Add to the PATH environment variable and enable shell autocompletion.



* Add the {YOUR_DIRECTORY}/IBM_CLOUD_CLI to the PATH environment variable.
* For shell autocompletion support (Mac and Linux™ only), see [Enabling shell autocompletion for IBM Cloud CLI](https://cloud.ibm.com/docs/cli/reference/ibmcloud?topic=cli-shell-autocompleteshell-autocomplete).









 Updating the IBM Cloud CLI 

You must use the latest version of the CLI. If you aren't using the latest version, run the following command to update your CLI:

ibmcloud update

To determine your IBM Cloud CLI version, run the following command:

ibmcloud -v

If you are running the current release, the following output is displayed:

Checking for updates...
No update required. Your CLI is already up-to-date.

To get notified about new IBM Cloud CLI releases, subscribe to the [IBM Cloud CLI releases repository](https://github.com/IBM-Cloud/ibm-cloud-cli-release/releases/).
Enable Code Risk Analyzer discovery to build the requirements.txt file for Python repos. This parameter is set to false by default. Optional 
 [detect-secrets-baseline-filename](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-pipeline-parmdetect-secrets-baseline-filename) text The name of the baseline file in your app repository. Optional 
 [detect-secrets-exclusion-list](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-pipeline-parmdetect-secrets-exclusion-list) text A regex list of files to be excluded in the detect-secrets scan. Optional 
 [detect-secrets-verbose](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-pipeline-parmdetect-secrets-verbose) text Outputs the name of the file that is currently being scanned. Optional 
 dind-image text Base image to run sidecars. Optional 
 git-token SECRET The Git repo access token. Optional 
 github-token SECRET The GitHub repo access token. Optional 
 grit-token SECRET The Git Repos and Issue Tracking access token. Optional 
 head-branch text The source branch where the PR is raised. If a PR Git trigger is configured, which is typically the case, this parameter is populated from the PR trigger. Required 
 head-repo text The URL of the repo where the PR is raised. If a PR Git trigger is configured, which is typically the case, this parameter is populated from the PR trigger. Required 
 head-sha text The HEAD commit on the head-branch. If a PR Git trigger is configured, which is typically the case, this parameter is populated from the PR trigger. Required 
 iam_retry_count text The number of retries to wait for fetching the IAM token. Optional
The static code analyzers detect tricky bugs, such as null-pointer dereferences, logic errors, and resource leaks for multiple programming languages.

With Default Configuration, the pipeline provisions a new SonarQube instance in the Kubernetes cluster that is configured in the cc-static-scan step. A new instance is provisioned during each CC pipeline run.

If you want the toolchain to use an existing SonarQube Instance that you provisioned on another host, use the Custom Configuration option.

Zoom

![SonarQube configuration](https://cloud.ibm.com/docs-content/v1/content/5eb88a2575e30e316dbb83829c7f4c8b1ddbc67c/devsecops/images/devsecops-cc-toolchain-setup-sonarqube-default-config.png)

Figure 12. SonarQube static scan configuration





 Optional tools 



 Slack 

If you want to receive notifications about your CC Pipeline events, you can configure the [Slack Tool](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-slack) during the setup from the toolchain template, or you can add the Slack Tool later.

You need a Slack webhook URL so that a Slack channel can receive notifications from your tools. To get a webhook URL, see the Incoming Webhooks section of the [Slack API website](https://api.slack.com/messaging/webhooks).





 Delivery Pipeline Private Worker 

The [Delivery Pipeline Private Worker](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-private-workers) tool integration connects with one or more private workers that can run Delivery Pipeline workloads in isolation.





 Security and Compliance 

To integrate the toolchain with Security and Compliance Center, you must provide the following information:



* A project name and the evidence locker repository name for the Security and Compliance Center data collector.
* The evidence namespace for the type of the toolchain, which is either Continuous Deployment or Continuous Compliance.
If Key Protect detects that you're using a retired root key version to unwrap DEKs, the service provides a newly wrapped DEK that's based on the latest key version.



 Rewrapping data after rotating a key 

Because retired key versions can only be used to access older DEKs, to secure your envelope encryption workflow, [rewrap your DEKs](https://cloud.ibm.com/docs/key-protect?topic=key-protect-rewrap-keys) after you rotate a key so that your at rest data is protected by the newest key.

Alternatively, if Key Protect detects that you're using a retired key version to unwrap a DEK, the service automatically re-encrypts the DEK and returns a wrapped data encryption key (WDEK) that is based on the latest root key.

Store and use the new WDEK for future unwrap operations so that the DEKs are protected with the newest key version.

To learn how to use the Key Protect API to rewrap data encryption keys, see [Rewrapping keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-rewrap-keys).







 Understanding the key rotation process 

Behind the scenes, the Key Protect API drives the key rotation process. To learn how to use the Key Protect API to rotate your keys, see [Rotating keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-rotate-keys).

The following diagram shows a contextual view of how keys are rotated.

Zoom

![The diagram shows a contextual view of key rotation.](https://cloud.ibm.com/docs-content/v1/content/0bc8db34a3d90b2a5103c9c71b08a96de9525bbc/key-protect/images/key-rotation.svg)

Figure 1. Contextual view of key rotation.

With each rotation request, Key Protect creates a new root key version by associating new key material with your key.

Zoom

!