vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Why can't my app connect via a network load balancer (NLB) service? 

Classic infrastructure

 What’s happening 

You exposed your app by creating an NLB service in your classic cluster.

When you tried to connect to your app by using the public IP address of the NLB, the connection failed or timed out.

 Why it’s happening 

Your NLB service might not be working properly for one of the following reasons:



* The cluster is not fully deployed yet.
* The configuration script for your NLB service includes errors.



 How to fix it 

Check that you set up a standard cluster that is fully deployed and has at least two worker nodes to ensure high availability for your NLB service.



1. List your worker nodes. In your CLI output, make sure that the Status of your worker nodes displays Ready and that the Machine Type shows a flavor other than free.

ibmcloud oc worker ls --cluster <cluster_name_or_ID>
2. For version 2.0 NLBs: Ensure that you complete the [NLB 2.0 prerequisites](https://cloud.ibm.com/docs/openshift?topic=openshift-loadbalancer-v2ipvs_provision).
3. Check the accuracy of the configuration file for your NLB service.



* Version 2.0 NLBs

apiVersion: v1
kind: Service
metadata:
name: myservice
annotations:
service.kubernetes.io/ibm-load-balancer-cloud-provider-enable-features: "ipvs"
spec:
type: LoadBalancer
selector:
<selector_key>:<selector_value>
ports:
- protocol: TCP
port: 8080
targetPort: 8080 Optional. By default, the targetPort is set to match the port value unless specified otherwise.
externalTrafficPolicy: Local



1. Check that you defined LoadBalancer as the type for your service.
2.
The property is a configuration variable that applies to a specific resource and the options available depend on the service and resource type that you want to target. The value is the variable that is used during the evaluation of your property. An operator is how the property is compared to the value. Sometimes you don't need to provide a value - for example, when an operator is a boolean.

"required_config": {
"and": [
{
"property": "firewall.allowed_ip",
"operator": "ips_in_range",
"value":
"10.0.0.0/8",
"172.16.0.0/12",
"192.168.0.0/16"
]
}
]
}



 Available operators 

An operator is the type of comparison that you want to make between a property and its value. Check out the following table to learn more about each type.

String-based operators are case-sensitive.



Table 3. Supported operator types

 Operator Type Description Requires value parameter 

 is_empty General The property value is not specified, null, or an empty string No 
 is_not_empty General The property value is specified, not null, and not an empty string (any value). No 
 is_true Boolean The property value is true. No 
 is_false Boolean The property value is false. No 
 string_equals<br><br>[1] String The property value is an exact match to the condition value. Yes 
 string_not_equals<br><br>[2] String The property value is not an exact match to the condition value. Yes 
 string_match String The property value matches the condition value by using the [Krauss wildcarding algorithm](https://en.wikipedia.org/wiki/Krauss_wildcard-matching_algorithm). Yes
Maintenance is simplified for you because IBM provides the installation and updates for the managed add-ons.<br> * Provide cluster integration with Activity Tracker and send Red Hat OpenShift on IBM Cloud API events for auditability.<br><br><br> <br><br> * [Set up and monitor the health](https://cloud.ibm.com/docs/containers?topic=containers-health) of your container logs and cluster metrics.<br> * Set up and, if applicable, [configure kube-audit logs](https://cloud.ibm.com/docs/openshift?topic=openshift-health-audit) to be sent to [Activity Tracker](https://cloud.ibm.com/docs/openshift?topic=openshift-at_events).<br><br><br> 







 Change management 

You and IBM share responsibilities for keeping your clusters at the latest container platform and operating system versions, along with recovering infrastructure resources that might require changes. You are responsible for change management of your application data.



Table 3. Responsibilities for change management

 Resource IBM responsibilities Your responsibilities 

 Worker nodes <br><br> * Provide worker node patch operating system (OS), version, and security updates.<br> * Fulfill automation requests to update and recover worker nodes.<br><br><br> <br><br> * Use the API, CLI, or console tools to [apply](https://cloud.ibm.com/docs/containers?topic=containers-updateupdate) the provided worker node updates that include operating system patches; or to request that worker nodes are rebooted, reloaded, or replaced.<br><br><br>
Classic clusters: Why can't my app connect via Ingress? 

Classic infrastructure

  What’s happening 

You exposed your app by creating an Ingress resource for your app in your classic cluster.

  Why it’s happening 

When you tried to connect to your app by using the public IP address or Ingress subdomain, the connection failed or timed out.

  How to fix it 

First, check that your cluster is fully deployed and has at least 2 worker nodes available per zone to ensure high availability for your router for the Ingress controller.

ibmcloud oc worker ls --cluster <cluster_name_or_ID>

In your CLI output, make sure that the Status of your worker nodes displays Ready and that the Machine Type shows a flavor other than free.



*  If your standard cluster is fully deployed and has at least 2 worker nodes per zone, but no Ingress Subdomain is available, see [Why does no Ingress subdomain exist after cluster creation?](https://cloud.ibm.com/docs/containers?topic=containers-ingress_subdomain).
*  For other issues, troubleshoot your Ingress setup by following the steps in [Debugging Ingress](https://cloud.ibm.com/docs/openshift?topic=openshift-ingress-debug-roks4).
Customers need to provision their own PostgreSQL database instance in IBM Cloud or from a third-party provider. When you deploy a new CA by using the blockchain console or APIs, you need to provide the connection information for the database. Each CA needs its own PostgreSQL database.







 Considerations 



* CA replica sets are only possible when the PostgreSQL database is selected for the CA. The SQLite database is not supported for use with CA replica sets.
* Because you cannot switch a CA database from SQLite to PostgreSQL, only new CAs that use PostgreSQL can be configured to be HA. Likewise, after a CA is deployed and configured to use a PostgreSQL database, it cannot be reconfigured to use a different PostgreSQL instance or later configured to use SQLite.
* CA replica sets are automatically spread across your worker nodes in a single zone according to available resources. Replica sets are not available across zones.
* Because creating a CA replica set results in a new CA pod, when you configure an additional replica set, the CPU and memory requirements for the CA are doubled. If three replica sets are required, then the total CPU and memory requirements triple, and so on. However, the storage allocation does not change because all of the replica sets use the same PostgreSQL database. When you configure your CA, you can specify how many replica sets to create.
* The number of replica sets can be scaled up or down over time according to your availability needs.
* Replica sets are only available when PostgreSQL is selected as the CA database.
* The ability to deploy a CA to a specific Kubernetes cluster zone is only available when SQLite is selected as the CA database.







 Before you begin 

You need to configure an instance of a PostgreSQL database. There are two options available in IBM Cloud:



* [Databases for PostgreSQL](https://cloud.ibm.com/catalog/services/databases-for-postgresql).
Maintenance is simplified for you because IBM provides the installation and updates for the managed add-ons.<br> * Provide cluster integration with Activity Tracker and send Red Hat OpenShift on IBM Cloud API events for auditability.<br><br><br> <br><br> * [Set up and monitor the health](https://cloud.ibm.com/docs/containers?topic=containers-health) of your container logs and cluster metrics.<br> * Set up and, if applicable, [configure](https://cloud.ibm.com/docs/containers?topic=containers-health-audit)kube-audit logs to be sent to [Activity Tracker](https://cloud.ibm.com/docs/containers?topic=containers-at_events).<br><br><br> 







 Change management 

You and IBM share responsibilities for keeping your clusters at the latest container platform and operating system versions, along with recovering infrastructure resources that might require changes. You are responsible for change management of your application data.



Table 3. Responsibilities for change management

 Resource IBM responsibilities Your responsibilities 

 Worker nodes <br><br> * Provide worker node patch operating system (OS), version, and security updates.<br> * Fulfill automation requests to update and recover worker nodes.<br><br><br> <br><br> * Use the API, CLI, or console tools to [apply](https://cloud.ibm.com/docs/containers?topic=containers-updateupdate) the provided worker node updates that include operating system patches; or to request that worker nodes are rebooted, reloaded, or replaced.<br><br><br>
IN NO EVENT SHALL THE AUTHORS OR DISTRIBUTORS BE LIABLE TO ANY PARTY FOR
DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING
OUT OF THE USE OF THIS SOFTWARE, ITS DOCUMENTATION, OR ANY DERIVATIVES
THEREOF, EVEN IF THE AUTHORS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH
DAMAGE.

THE AUTHORS AND DISTRIBUTORS SPECIFICALLY DISCLAIM ANY WARRANTIES,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. THIS SOFTWARE IS
PROVIDED ON AN "AS IS" BASIS, AND THE AUTHORS AND DISTRIBUTORS HAVE NO
OBLIGATION TO PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR
MODIFICATIONS.

GOVERNMENT USE: If you are acquiring this software on behalf of the U.S.
government, the Government shall have only "Restricted Rights" in the
software and related documentation as defined in the Federal Acquisition
Regulations (FARs) in Clause 52.227.19 (c) (2). If you are acquiring the
software on behalf of the Department of Defense, the software shall be
classified as "Commercial Computer Software" and the Government shall have
only "Restricted Rights" as defined in Clause 252.227-7013 (c) (1) of
DFARs. Notwithstanding the foregoing, the authors grant the U.S. Government
and others acting in its behalf permission to use and distribute the
software in accordance with the terms specified in this license.

END OF TCL LICENSE
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

UNIQUE

These are the packages covered under this license:

Floating point exception control (The Regents of the University of California)
Additionally, the Edge responds to the requester with a Cache-Control max-age value equal to the remaining time until the content goes stale on the Edge server.

However, if your origin does not provide a Cache-Control header to the Edge server, then the Edge server will not provide a Cache-Control header to the requester. The Edge cache duration for your content is still derived from your CDN's TTL settings.





 Summary 

Scroll for more

Scroll for more



Table 1. Summary: HTTP client's cache duration

 Respect Header Origin provides Cache-Control Specific Content's Cache Duration on Edge Server Edge Server provides Cache-Control 

 On Yes, origin specifies a max-age Edge cache duration overridden with origin's max-age value Yes, Edge also provides a max-age with a value that is the (overridden) time before the Edge needs to refresh the content from the origin 
 On Yes, but origin does not specify a max-age Edge cache duration based on the CDN's TTL configuration Yes, Edge also provides a max-age with a value that is the time before the Edge needs to refresh the content from the origin 
 On No Edge cache duration based on the CDN's TTL configuration No 
 Off Yes, origin specifies a max-age Edge cache duration base on the CDN's TTL configuration Yes, Edge also provides a max-age value that is the lesser of origin's max-age value and the time before the Edge needs to refresh the content from the origin 
 Off Yes, but origin does not specify a max-age Edge cache duration based on the CDN's TTL configuration Yes, Edge also provides a max-age that is the time before the Edge needs to refresh the content from the origin 
 Off No Edge cache duration based on the CDN's TTL configuration No 







 More information 

See cache-control as defined in section 14.9 of [RFC 2616](https://www.ietf.org/rfc/rfc2616.txt).



Contribute in GitHub

Open doc issue

Edit topic
"database": "db_name",
"authentication": {
"username": "db_user",
"password": "db_password"
},
"query_options": {
"sslmode": "verify-full"
},
"certificate": {
"certificate_base64": "tls_certificate"
},
"client": {
"certificate_base64": "client_tls_certificate",
"private_key_base64": "client_tls_private_key"
}
}
}
}
Show more



Enter the corresponding hostname, port, database, username, and password values for your PostgreSQL database.

Valid values for sslmode are listed in the [Hyperledger Fabric CA PostgreSQL documentation](https://hyperledger-fabric-ca.readthedocs.io/en/release-1.4/users-guide.htmlpostgresql).

The certificate and client fields are required only if you are using TLS to encrypt communications to the PostgreSQL database. All certificate strings must be base64 encoded.

If you are not using TLS, you need to remove the certificate and client elements from your JSON file.



* If the third-party database is configured to use TLS, you will need to provide at least one server certificate.
* If SSL client authentication (mutual TLS) is enabled, you will need to provide the certificate as well as the client certificates, certificate_base64 and private_key_base64.



Save this information to a JSON file on your local system so that is can be provided when you create your CA.





 Creating an HA CA 

Create a new CA by using the IBM Blockchain Platform console.



1. Navigate to the Nodes tab on the left and click Add Certificate Authority.
2. Make sure that the option to Create a Certificate Authority is selected. Then click Next.
3. Give your CA a display name and enter your CA admin credentials by specifying a CA administrator enroll ID and secret.
* [Node smart contract-API compatibility](https://github.com/hyperledger/fabric-chaincode-node/blob/main/COMPATIBILITY.md)









 Registering an application identity 

Applications need to sign the transactions they submit to IBM Blockchain nodes, and attach a signing certificate that is used by nodes to verify that the transactions are being sent by the proper party. This ensures that transactions are submitted by the organizations that have permission to participate.

The network operator needs to use the organization's CA to [register an application identity](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-register), which can then be used by the application developer to generate a certificate and private key. The operator can provide the enroll ID and secret of the identity, along the CA endpoint information, to be used by the SDK to generate certificates. By enrolling on the client side, the application developer ensures that no other party has access to the private key of the application. During registration, the network operator can set an enrollment limit of one for additional security. After the application developer enrolls, the enroll ID and secret cannot be used to generate another private key.

If you are less worried about security, the network operator can enroll an application identity by using the [CA tab](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-enroll). The operator can then download the identity or export it to the console wallet. In order to use the certificates from the SDK, you need to convert the keys from base64 into PEM format. You can decode the certs by running the following command on your local system:

export FLAG=$(if [ "$(uname -s)" == "Linux" ]; then echo "-w 0"; else echo "-b 0"; fi)
echo <base64_string> | base64 --decode $FLAG > <key>.pem





 Downloading your connection profile 

A client application connects to a network via one or more gateway peers.
If an ordering service organization was added as an administrator of the system channel after this application channel was created, it must be added to the channel before any nodes belonging to it can be added as application channel consenters. Note: if your console is at a build before 2.1.3-104, you will not see this option. To see the version of your build, click on the support icon in the upper right corner (it resembles a question mark). The version will be listed below IBM Blockchain Platform version on the upper left.
* Ordering cluster without a system channel - Ordering organizations that are administrators were added to the application channel at channel creation. If an ordering service organization was created and intended to be an administrator after the application channel was created, it must be added to the channel before any nodes belonging to it can be added as application channel consenters.



* Consenter set. The ordering service nodes on a particular channel are known in a Raft consensus mechanism as a "consenter set". For this reason, the ordering nodes in a consenter set are sometimes referred to as "consenters". The orderer's system channel (when applicable) will always contain all of the possible consenters available in a network (its consenter set is "all consenters"), while application channels might have all consenters or some subset of consenters. It is possible to add or remove particular nodes from this consenter set during both the creation of an application channel and through a channel update. For example to add newly created orderers, if a system channel is being used they are first added to the system channel, then to the consenter set of an application channel. To add a node to the consenter set, first ensure that the organization that owns the consenter is an admin of the ordering service of the application channel through the Ordering service administrator panel. You can then add the consenter through this Consenter set panel by opening the drop-down list, clicking on a node, and clicking Add.
Build app containers from [images in public or private image registries](https://cloud.ibm.com/docs/containers?topic=containers-images).
3. Specify your [app requirements in a YAML file](https://cloud.ibm.com/docs/containers?topic=containers-appapp_yaml), which declares the configuration of the Kubernetes object.



2. Version your app:



1. To plan customized configurations for more than one environment, such as development, testing, and production environments, [use the Kustomize tool](https://cloud.ibm.com/docs/containers?topic=containers-appkustomize) to manage your configuration YAML file.
2. If you want to run your app in multiple clusters, public and private environments, or even multiple cloud providers, [package your application to help automate deployments](https://cloud.ibm.com/docs/containers?topic=containers-plan_deploypackaging).





Need help? Check out [Troubleshooting apps and integrations](https://cloud.ibm.com/docs/containers?topic=containers-debug_apps).





 Deploy your app 

Deploy your app to the cluster by running your app configuration file.



* [Deploying apps with the Kubernetes dashboard](https://cloud.ibm.com/docs/containers?topic=containers-deploy_appapp_ui).
* [Deploying apps with the CLI](https://cloud.ibm.com/docs/containers?topic=containers-deploy_appapp_cli).
* [Deploying apps to specific worker nodes by using labels](https://cloud.ibm.com/docs/containers?topic=containers-deploy_appnode_affinity).
* [Deploying an app on a GPU machine](https://cloud.ibm.com/docs/containers?topic=containers-deploy_appgpu_app).



Need help?
Build app containers from [images in the internal, public, or private registries](https://cloud.ibm.com/docs/openshift?topic=openshift-images).
3. Specify your [app requirements in a YAML file](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_appsapp_yaml), which declares the configuration of the Kubernetes object.



2. Version your app:



1. Version 4: To plan customized configurations for more than one environment, such as development, testing, and production environments, [use the Kustomize tool](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_appskustomize) to manage your configuration YAML file.
2. If you want to run your app in multiple clusters, public and private environments, or even multiple cloud providers, [package your application to help automate deployments](https://cloud.ibm.com/docs/openshift?topic=openshift-plan_deploypackaging).





Need help? Check out [Troubleshooting apps and integrations](https://cloud.ibm.com/docs/openshift?topic=openshift-debug_apps).





 Deploy your app 

Deploy your app to the cluster by running your app configuration file.



* [Deploying apps through the console](https://cloud.ibm.com/docs/openshift?topic=openshift-deploy_appdeploy_apps_ui).
* [Deploying apps through the CLI](https://cloud.ibm.com/docs/openshift?topic=openshift-deploy_appdeploy_apps_cli).
* [Deploying apps to specific worker nodes by using labels](https://cloud.ibm.com/docs/openshift?topic=openshift-deploy_appnode_affinity).



Need help?
You can decode the certs by running the following command on your local system:

export FLAG=$(if [ "$(uname -s)" == "Linux" ]; then echo "-w 0"; else echo "-b 0"; fi)
echo <base64_string> | base64 --decode $FLAG > <key>.pem





 Downloading your connection profile 

A client application connects to a network via one or more gateway peers. The gateway peers are the peers that are specified in the connection profile, and they are used to perform service discovery to find all of the endorsing peers in the network that will endorse transactions. Service discovery ensures that the request is sent to a peer that is available to process requests.

The Hyperledger Fabric [Transaction Flow](https://hyperledger-fabric.readthedocs.io/en/release-2.2/txflow.html) spans multiple components, with the client applications collecting endorsements from peers and sending endorsed transactions to the ordering service. The connection profile provides your application with the endpoints of the peers and ordering nodes that it needs to submit a transaction. It also contains information about your organization, such as your Certificate Authorities and your MSP ID. The Fabric SDKs can read the connection profile directly, without you having to write code that manages the transaction and endorsement flow.

Click the Organization MSP tile for the organization that your client application interacts with. Click Create connection profile to open a side panel where you can build and download your connection profile.

![Create connection profile panel](https://cloud.ibm.com/docs-content/v1/content/c5288bed34c3820e3a5251d820ee91adcd2591a3/blockchain/images/create-connx-profile.png)

If you plan to use the client application to register and enroll users with the organization CA, you need to include the Certificate Authority in the connection profile definition.

Select the peers to include in the connection profile definition. When a peer is not available to process requests from a client application, service discovery ensures that the request is automatically sent to a different peer.