vania-janet/multiturn-rag-retrieval-data huggingface dataset:
(Optional) If your IBM Cloud account includes multiple Kubernetes clusters, you should also filter by cluster. Add an additional cluster filter, by selecting agent.tag.clusterin and then select your cluster name. Click Save.



Next, we will segment the data in the panels by peer containers.





 Configure panels to view CPU and Memory usage 

Now the data on the dashboard is filtered to only show data from the peers in your cluster. Let's drill in a little deeper to see the resource usage by peer container.



1. Click the CPU % chart and then click the pencil Edit Panel icon. In this panel you can tailor the graph type and even change the metric. But we just want to see the data broken out by peer container, assuming you have more than one peer in your cluster.
2. In the Segment by drop down list, select the kubernetes.deployment.label.name which is the segmentation choice that causes the chart data to be broken down by each peer container in your cluster. Click Save.
3. Repeat this process for the Memory Usage % panel. Now you can monitor the CPU and Memory used by each peer container.



At this point you can edit the panels and play with the different chart types to see different representations of the data.





 Configure panels to view disk usage 

Storage usage is also interesting to monitor but is not part of the default dashboard panel set. We need to add a new panel to dashboard to monitor disk usage.



1. Click the + sign above the Edit Scope button in the top right corner.
2. Give this new panel a title, Disk space used %.
3. Select fs.used.percent from the Metrics drop-down list.
4. In the Segment by drop down list, select kubernetes.deployment.label.name and click Save.
5. Hover your mouse over the data in the generated graph and a pop-up window is displayed that shows the average disk space percentage used by each peer container.
The default value is null because a password is randomly generated. null 
 global.postgres.store.database Name of the database that is used by the Store microservice conversation_icp_${release-name} 









 Model mesh 

The TAS and ED-MM microservices use a model-mesh pattern. In model mesh, each pod contains a set of loaded NLP models. Managing where models are loaded is handled by a model-mesh library. During normal operations, the model is loaded in one pod only. If traffic to the model cannot be handled by a single pod, the model is loaded into other pods also. The metadata about where the models are loaded is stored in Etcd.

TAS and ED-MM belong to separate model-mesh groups. Each group has an independent set of pods and loaded models.

Here's how model mesh functions in the ED-MM microservice pod group. For the ED-MM microservice, you might have two pods, A and B. A gRPS request for help with contextual entity recognition is received through Kubernetes DNS. The request goes to pod A, but the contextual entity model that is needed is loaded in pod B. The model mesh on pod A forwards the request to pod B by using LiteLinks. Pod B uses the appropriate model to identify contextual entities in the input, and then sends a response to pod A. Pod A sends the information in a response back to the service that sent the initial gRPC request.

Model mesh functions in the same way for the TAS microservice. The difference is that incoming requests to TAS are sent by using LiteLinks and not gRPC. As a result, the NLU and Master microservices have no way of knowing which models are loaded in which TAS pods.
If the server must support access from multiple web pages, each served from a different origin, a single origin value for Access-Control-Allow-Origin should be dynamically generated per request. The following is a basic example of such a use case for an Nginx server:

http {
 some http context config


 Input from $http_origin, the value in Origin HTTP header
 Output to $cors_allowed_origin, a string

 Full string match on the Origin header value

 Attempt to find a match for the value from $http_origin using regex on the left column.
 If a match is found, then evaluate $cors_allowed_origin to the same value as $http_origin
 Else, default evaluate $cors_allowed_origin to an empty string, so browsers will disallow the CORS request

map $http_origin $cors_allowed_origin {
default '';
^http(s)?://(www|www2|cdn|dev).example.com$ $http_origin;
}

server {
 some server context configs

 URI path to some content
location /my-static-content {

 some location context configs

 Handle simple requests
if ($request_method = 'GET') {
add_header 'Access-Control-Allow-Origin' $cors_allowed_origin;
}

 Handle preflight requests
if ($request_method = 'OPTIONS') {
add_header 'Access-Control-Allow-Origin' '$cors_allowed_origin;
add_header 'Access-Control-Allow-Methods' 'GET';
add_header 'Access-Control-Allow-Headers' 'pragma';
add_header 'Access-Control-Max-Age' 1728000;

return 204;
}

 more location context configs

try_files $uri =404;
}

 more server context configs
}

 more http context configs
}

The previous example uses the map directive to avoid overusing the if Nginx statement.
ibmc-s3fs-flex-perf-cross-region ibm.io/ibmc-s3fs 8m
ibmc-s3fs-flex-perf-regional ibm.io/ibmc-s3fs 8m
ibmc-s3fs-flex-regional ibm.io/ibmc-s3fs 8m
ibmc-s3fs-standard-cross-region ibm.io/ibmc-s3fs 8m
ibmc-s3fs-standard-perf-cross-region ibm.io/ibmc-s3fs 8m
ibmc-s3fs-standard-perf-regional ibm.io/ibmc-s3fs 8m
ibmc-s3fs-standard-regional ibm.io/ibmc-s3fs 8m
ibmc-s3fs-vault-cross-region ibm.io/ibmc-s3fs 8m
ibmc-s3fs-vault-regional ibm.io/ibmc-s3fs 8m
2. Choose a storage class that fits your data access requirements. The storage class determines the [pricing](https://cloud.ibm.com/objectstorage/create) for storage capacity, read and write operations, and outbound bandwidth for a bucket. The option that is correct for you is based on how frequently data is read and written to your service instance.



* Standard: This option is used for hot data that is accessed frequently. Common use cases are web or mobile apps.
* Vault: This option is used for workloads or cool data that are accessed infrequently, such as once a month or less. Common use cases are archives, short-term data retention, digital asset preservation, tape replacement, and disaster recovery.
* Cold: This option is used for cold data that is rarely accessed (every 90 days or less), or inactive data. Common use cases are archives, long-term backups, historical data that you keep for compliance, or workloads and apps that are rarely accessed.
* Flex: This option is used for workloads and data that don't follow a specific usage pattern, or that are too huge to determine or predict a usage pattern.
}
}

Results in this output:

{
"context": {
"my_text": "something is here"
}
}





 java.lang.String support 

In addition to the built-in methods, you can use standard methods of the java.lang.String class.



 java.lang.String.format() 

You can apply the standard Java String format() method to text. See [java.util.formatter reference](https://docs.oracle.com/javase/7/docs/api/java/util/Formatter.htmlsyntax) for information about the syntax to use to specify the format details.

For example, the following expression takes three decimal integers (1, 1, and 2) and adds them to a sentence.

{
"formatted String": "<? T(java.lang.String).format('%d + %d equals %d', 1, 1, 2) ?>"
}

Result: 1 + 1 equals 2.

To change the decimal placement for a number, use the following syntax:

{
<? T(String).format('%.2f',<number to format>) ?>
}

For example, if the $number variable that needs to be formatted in US dollars is 4.5, then a response such as, Your total is $<? T(String).format('%.2f',$number) ?> returns Your total is $4.50.









 Indirect data type conversion 

When you include an expression within text, as part of a node response, for example, the value is rendered as a String. If you want the expression to be rendered in its original data type, then do not surround it with text.

For example, you can add this expression to a dialog node response to return the entities that are recognized in the user input in String format:

The entities are <? entities ?>.

If the user specifies Hello now as the input, then the @sys-date and @sys-time entities are triggered by the now reference.
To get the total number of rules per account, use the Context-based restrictions API:



1. Log in to IBM Cloud® CLI. If you have multiple accounts, you are prompted to select which account to use. If you do not specify a region with the -r flag, you must also select a region.

ibmcloud login

If your credentials are rejected, you might be using a federated ID. To log in with a federated ID, use the --sso flag. See [Logging in with a federated ID](https://cloud.ibm.com/docs/account?topic=account-federated_id) for more details.

If it's your first time using the IBM Cloud CLI, check out the [getting started tutorial](https://cloud.ibm.com/docs/cli?topic=cli-getting-started).
2. Generate your IAM access token:

ibmcloud iam oauth-tokens
3. Enter the following curl command to get a total number of rules in one account. You can find the correct value for the account_id query parameter by running the ibmcloud account list command. The account ID is in the Account GUID column. You might want to install jq to format the JSON, which is used in the following examples:

curl --location --request GET "https://cbr.cloud.ibm.com/v1/rules?account_id=<account_id>" --header "Content-Type: application/json" --header "Authorization: <IAM TOKEN>" | jq '.rules | length'



In the following example output, the last line displays the total number of rules:

% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 3422 100 3422 0 0 7830 0 --:--:-- --:--:-- --:--:-- 7830
4





 Viewing the total number of rules per account by using the CLI
save_repo <repo-reference-name> url="${REPO_URL}" path="${REPO_PATH}" branch="${CLONED_BRANCH}" commit="${LATEST_GIT_COMMIT}"
Show more

This way the rest of the pipeline can scan these repos for compliance violations and vulnerabilities.

Paths saved by using save_repo must be relative to the workspace path.

You don't need to install the pipelinectl tool for your scripts or base images, the reference pipeline provides the binaries for the context of your script.







 Test 

This stage is where you run your tests on your code repos. You can access your repos added in the setup stage using the list_repos and load_repo pipelinectl interfaces.



 Example 

exit_code=0


 list_repos returns the list of the reference names of saved repos

list_repos | while IFS= read -r repository ; do


 load_repo returns a property of a saved repository

 Usage:
 load_repo <repo-reference-name> <property>

url="$(load_repo "$repository" url)"
sha="$(load_repo "$repository" commit)"
branch="$(load_repo "$repository" branch)"
path="$(load_repo "$repository" path)"


 use your repos to test, etc

run_tests
result=$?

if [! $result = 0 ]; then
exit_code=$result
fi
done

exit $exit_code
Show more

The unit-test compliance control is determined by the exit code of the stage script itself. If your tests pass, exit with 0, if not, return a non-zero exit code at the end.





 Saving results 

Your tests might generate some report artifacts, such as a test results JSON or XML. To attach those to the created compliance evidence as evidence artifacts, use the save_result pipelinectl interface in this stage.
Context-based restrictions CLI plug-in 

The IBM Cloud® context-based restrictions command-line interface (CLI) provides extra capabilities for context-based restrictions. You can use this CLI plug-in to manage access restrictions for IBM Cloud® resources based on the network location of access requests.



 Before you begin 



* Install the IBM Cloud CLI. For more information, see [Getting started with the IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-getting-started). The prefix for running commands by using the IBM Cloud CLI is ibmcloud.
* Before you run commands, log in to IBM Cloud with the ibmcloud login command to generate an access token and authenticate your session.







 Installing the context-based restrictions plug-in 

To install the context-based restrictions plug-in, run the following command:

ibmcloud plugin install cbr

In the command line, you are notified when updates to the ibmcloud CLI and cbr CLI plug-in are available. Ensure that you keep your CLI up to date so that you can use all the available commands and flags.

If you want to view the current version of your cbr CLI plug-in, run ibmcloud plugin list.





 Zones 

Operations on network zones.



 ibmcloud cbr zone-create 

This operation creates a network zone for the specified account.

ibmcloud cbr zone-create [--name NAME] [--description DESCRIPTION] [--addresses ADDRESSES] [--excluded EXCLUDED] [--vpc VPC] [--service-ref SERVICE-REF] [--file FILE]



 Example 

ibmcloud cbr zone-create --name example-zone --description "Example zone description" --addresses 192.0.2.1,3ffe:1900:fe21:4545::,192.2.3.5-192.2.3.10,3ffe:1900:fe21:4547::-3ffe:1900:fe21:6767:
How much disk I/O has been used over 30 minutes as a percentage of total disk I/O available.



Table 13. IO utilization in percent 30 minute average metric metadata

 Metadata Description 

 Metric Name ibm_databases_for_postgresql_disk_io_utilization_percent_average_30m 
 Metric Type gauge 
 Value Type percent 
 Segment By Service instance 







 IO usage in percent 60-minute average 

How much disk I/O has been used over 60 minutes as a percentage of total disk I/O available.



Table 14. IO utilization in percent 60 minute average metric metadata

 Metadata Description 

 Metric Name ibm_databases_for_postgresql_disk_io_utilization_percent_average_60m 
 Metric Type gauge 
 Value Type percent 
 Segment By Service instance 







 IOPS read and write total count for an instance 

How many input/output operations per second your deployment is performing.



Table 15. IOPS read & write total count for an instance metric metadata

 Metadata Description 

 Metric Name ibm_databases_for_postgresql_disk_iops_read_write_total 
 Metric Type gauge 
 Value Type count 
 Segment By Service instance 







 Max allowed memory for an instance 

The maximum amount of memory available to your deployment.



Table 16. Max allowed memory for an instance metric metadata

 Metadata Description 

 Metric Name ibm_databases_for_postgresql_memory_limit_bytes 
 Metric Type gauge 
 Value Type byte 
 Segment By Service instance 







 Read replica replication lag 

How far behind a PostgreSQL read-only replica is, in bytes.



Table 17. Read replica replication lag metric metadata

 Metadata Description 

 Metric Name ibm_databases_for_postgresql_read_replica_replication_lag_bytes 
 Metric Type gauge 
 Value Type count 
 Segment By Service instance 







 Successful archive rate 

Successful archive rate



Table 18: Successful archive rate metric metadata

 Metadata Description 

 Metric Name ibm_databases_for_postgresql_successful_archive_rate 
 Metric Type gauge 
 Value Type rate 
 Segment By Service instance 







 Temporary files size in bytes
Public Portable Assigned for uplink NAT usage on hcx-mgmt-esg, if Hybridity Bundle selected. 
 Private A Primary Assigned to physical hosts assigned by IBM Cloud®. Used by the management interface for vSphere management traffic. 
 Private A Portable Assigned to VMs that function as management components. 
 Private A Portable Assigned to NSX VTEP. 
 Private A Portable Assigned to HCX for internal usage, if Hybridity bundle selected. 
 Private A Portable Assigned for uplink usage on the customer-nsx-esg. 
 Private A Portable Assigned to HCX, if Hybridity bundle selected. 
 Private A Portable Assigned to Zerto VRAs, if Zerto option selected. 
 Private A Portable Assigned for Caveonix RiskForesight, if Caveonix option selected. 
 Private B Primary Not used upon initial deployment. 
 Private B Portable Assigned for vSAN, if in use. 
 Private B Portable Assigned for NAS, if in use. 
 Private B Portable Assigned for vMotion.
To configure a Code Engine project for service binding to use a custom service ID that you manage, use the [ibmcloud ce project update](https://cloud.ibm.com/docs/codeengine?topic=codeengine-clicli-project-update) CLI command and specify the --binding-service-id option. You can update your project to use a custom service ID only with the CLI.

The project update command works within the project that is selected as the current context. Before you use the project update command, confirm that you are in the desired project. Use the [ibmcloud ce project current](https://cloud.ibm.com/docs/codeengine?topic=codeengine-clicli-project-current) command to display details of the project that is currently targeted. If needed, use the [ibmcloud ce project select](https://cloud.ibm.com/docs/codeengine?topic=codeengine-clicli-project-select) command to select your project as the current context.



1. Find the ID of your custom service ID by clicking Details on your service ID page from the console, or else run the ibmcloud iam service-ids CLI command.
2. Run the ibmcloud ce project update command. For example, if the ID of your service ID is ServiceId-12a3456b-c78d-901e-f2a3b4cabcde:

ibmcloud ce project update --binding-service-id ServiceId-12a3456b-c78d-901e-f2a3b4cabcde



Whenever you run the project update --binding-service-id command, Code Engine replaces any existing service ID and uses this service ID for service bindings.







 Next steps 

Now that access for service bindings is configured, you are ready to [bind a service instance to an app, job, or function workload](https://cloud.ibm.com/docs/codeengine?topic=codeengine-bind-services).
* [Create](https://cloud.ibm.com/docs/openshift?topic=openshift-cluster-create-classic) or have an existing a classic cluster in the same metro as the reservation that you want to use. If you want to use worker nodes only from a reservation, you can create a cluster with zero worker nodes, or remove existing, on demand worker pools from a cluster.



To use the reservation:



1. Log in to the [Red Hat OpenShift clusters console](https://cloud.ibm.com/kubernetes/clusters?platformType=openshift).
2. Select the cluster that you want to use.
3. From the cluster menu, select Worker pools.
4. Click Add+.
5. Fill out the worker pool details.



1. Enter the Worker pool name.
2. Select the Reservation that you want to use. Keep in mind that the reservation affects the flavor and number of worker nodes that you can provision in this worker pool.
3. Select the Worker zones and review the VLAN information.
4. For the Worker nodes, increase or decrease the number of worker nodes that you want to create per zone. You can review the percentage of your reservation that creating the worker pool uses. You can't create a worker pool with more worker nodes than you have in your reservation. To use worker nodes from another reservation, create a different worker pool.



6. In the Summary pane, notice that your estimated cost is zero, because your worker pool order uses the reservation. To complete the order, click Create.







 Reviewing reservation usage 

You can review your Red Hat OpenShift on IBM Cloud reservation usage and billing details.

Before you begin, make sure that you have the following roles in IBM Cloud IAM.



* Viewer platform access role for Kubernetes Service to view reservation usage details.
* Viewer platform access role for Account Management > Billing service to view billing details.



Reservation usage:



1.
* Golang code snippet

// Use DecryptUpdate if you would like to breakup
// the decrypt operation into multiple suboperations
DecryptUpdateRequest1 := &pb.DecryptUpdateRequest{
State: DecryptInitResponse.State,
Ciphered: ciphertext[:16], // encrypted data from a previous encrypt operation
}

DecryptUpdateResponse, err := cryptoClient.DecryptUpdate(context.Background(), DecryptUpdateRequest1)

plaintext := DecryptUpdateResponse.Plain[:]

DecryptUpdateRequest2 := &pb.DecryptUpdateRequest{
State: DecryptUpdateResponse.State,
Ciphered: ciphertext[16:], // encrypted data from a previous encrypt operation
}

DecryptUpdateResponse, err := cryptoClient.DecryptUpdate(context.Background(), DecryptUpdateRequest2)

plaintext = append(plaintext, DecryptUpdateResponse.Plain...)
Show more
* JavaScript code snippet

client.DecryptUpdate({
State: state,
Ciphered: ciphertext.slice(0, 16)
}, (err, data={}) => {
cb(err, data.State, data.Plain);
});







 DecryptFinal 

The DecryptFinal function finishes a multiple-part decryption operation.

Enterprise PKCS #11 over gRPC

Enterprise PKCS #11

PKCS #11





 Description Binds to EP11 m_DecryptFinal, which is an implementation of PKCS #11 C_DecryptFinal. 
 Parameters message DecryptFinalRequest { bytes State = 1; } message DecryptFinalResponse { bytes Plain = 2; }
All commands have an Example section, which shows how to use the command in the context of a workflow.

The examples assume you have [openssl](https://www.openssl.org/) and [jq](https://stedolan.github.io/jq/) installed.

Many examples take advantage of an environment variable set for the session regarding the Key Protect Instance ID instead of the -i parameter. Variables set in this manner will be automatically used by the plug-in where appropriate and when needed.

 export the Key Protect instance id in the command line
$ export KP_INSTANCE_ID=<INSTANCE_ID>







 ibmcloud kp command summary 

ibmcloud kp supports the commands listed here.



 kp import-token command 

The kp import-token command prepares a root key for secure import.



Table 1. Sub-commands for managing import tokens

 Sub-command Status v0.7.0 Description 

 [create](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-import-token-create) Create an import token 
 [key-encrypt](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-import-token-key-encrypt) Encrypt the key that you import into the service 
 [nonce-encrypt](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-import-token-nonce-encrypt) Encrypt the nonce that is generated by kp import-token create 
 [show](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-import-token-show) Retrieve an import token 







 kp instance command 

The kp instance command manages policies for a Key Protect instance.



Table 2. Sub-commands for managing keys

 Sub-command Status v0.7.0 Description
Previous values are overwritten for all JSON types except a JSON object. If the context variable is a complex type such as JSON object, a JSON merge procedure is used to update the variable. The merge operation adds any newly defined properties and overwrites any existing properties of the object.

In this example, a name context variable is defined as a complex object.

{
"context": {
"complex_object": {
"user_firstname" : "Paul",
"user_lastname" : "Pan",
"has_card" : false
}
}
}

A dialog node updates the context variable JSON object with the following values:

{
"complex_object": {
"user_firstname": "Peter",
"has_card": true
}
}

The result is this context:

{
"complex_object": {
"user_firstname": "Peter",
"user_lastname": "Pan",
"has_card": true
}
}

See [Expression language methods](https://cloud.ibm.com/docs/assistant?topic=assistant-dialog-methodsdialog-methods-objects) for more information about methods you can perform on objects.





 Updating arrays 

If your dialog context data contains an array of values, you can update the array by appending values, removing a value, or replacing all the values.

Choose one of these actions to update the array. In each case, we see the array before the action, the action, and the array after the action has been applied.



* Append: To add values to the end of an array, use the append method.

For this Dialog runtime context:

{
"context": {
"toppings_array": ["onion", "olives"]
}
}

Make this update:

{
"context": {
"toppings_array": "<?