vania-janet/multiturn-rag-retrieval-data huggingface dataset:
In order for a CA, peer, or ordering node to be able to communicate with the HSM client image you need to create a Kubernetes secret named hsmcrypto that contains the keys and configuration files for the HSM that you are using. When the console deploys a node that is configured with HSM, it uses this secret to access the HSM client image keys and configuration files.

The Kubernetes secret needs to be created in the IBM Blockchain Platform service instance namespace that is visible on the console Support page. If you are using the IBM Cloud HSM, the command would be:

$ kubectl create secret generic hsmcrypto -n <NAMESPACE> --from-file=Chrystoki.conf --from-file=cert.pem --from-file=key.pem --from-file=server.pem

Replace <NAMESPACE> with the name of your service instance namespace or OpenShift project If you are not using IBM Cloud HSM, you need to replace the values of the --from-file parameters with the set of certificates and configuration files that are required for your HSM client image.

When successful, the output looks similar to:

secret/hsmcrypto created

To verify the contents of the secret, run the command:

kubectl get secret -n <namespace> hsmcrypto -o yaml

You should see results similar to:

apiVersion: v1
data:
Chrystoki.conf: ""
cafile.pem: ""
cert.pem: ""
key.pem: ""
kind: Secret
metadata:
name: hsmcrypto
namespace: <NAMESPACE>





 Step five: Create the HSM configmap 

Because the console needs to know the configuration settings to use for your HSM, you need to create a Kubernetes [configmap](https://kubernetes.io/docs/concepts/configuration/configmap/) to store these values. The configMap settings depend on whether you configured a daemon for your HSM or not.
[Create connection profile panel](https://cloud.ibm.com/docs-content/v1/content/c5288bed34c3820e3a5251d820ee91adcd2591a3/blockchain/images/create-connx-profile.png)

If you plan to use the client application to register and enroll users with the organization CA, you need to include the Certificate Authority in the connection profile definition.

Select the peers to include in the connection profile definition. When a peer is not available to process requests from a client application, service discovery ensures that the request is automatically sent to a different peer. Therefore, to accommodate for peer downtime during a maintenance cycle for example, it is recommended that you select more than one peer for redundancy. In addition to peers created by using the console or APIs, imported peers that have been imported into the console are eligible to be selected as well.

The list of channels that the selected peers have joined is also provided for your information. If a channel is missing from the list, it is likely because the peer joined to it is currently unavailable.

You can then download the connection profile to your local file system and use it with your client application to generate certificates and invoke smart contracts.

The connection profile that is downloaded from the IBM Blockchain Platform console can only be used to connect to your network by using the Node.js (JavaScript and TypeScript) and Java Fabric SDKs.

The generated connection profile only supports Fabric CAs. If you manually built your organization MSP with certificates from an external CA, the connection profile will not include any information in the "certificateAuthorities": section.





 Service discovery 

Service discovery allows your applications to dynamically find the peer and ordering endpoints of your network. If you do not use service discovery, you need to manually add the endpoint information of peer and ordering nodes on your channel to your connection profile or your application. You would need to edit your connection profile or update your application each time a node is added or removed from your network.
textFileContents := "This is a test file from Node.js code sample!!!"
conf := aws.NewConfig().
WithEndpoint(serviceEndpoint).
WithCredentials(ibmiam.NewStaticCredentials(aws.NewConfig(),
authEndpoint, apiKey, serviceInstanceID)).
WithS3ForcePathStyle(true)

sess := session.Must(session.NewSession())
client := s3.New(sess, conf)
createBucket(bucketName, client) // Create a new cos bucket with object lock enabled.
objectLockConfiguration(bucketName, client) // Put objectlock configuration(i.e. default retention) on COS bucket and get the configuration.
uploadObject(bucketName, client, textFileName, textFileContents) // Upload an object to cos bucket.
objectLockRetention(bucketName, client, textFileName) // Put objectlock retention(i.e. retain until date) on the object and get the configured retention.
objectLockLegalHold(bucketName, client, textFileName) // Put objectlock legalhold on the object and get the legalhold status.

}
Show more





 Terraform 

// Create COS instance.
resource "ibm_resource_instance" "cos_instance" {
name = "cos-instance"
resource_group_id = data.ibm_resource_group.cos_group.id
service = "cloud-object-storage"
plan = "standard"
location = "global"
}

// Create a new bucket with objectlock and object versioning enabled.
resource "ibm_cos_bucket" "bucket" {
bucket_name = var.bucket_name
resource_instance_id = ibm_resource_instance.cos_instance.id
region_location = var.regional_loc
storage_class = var.standard_storage_class
object_versioning {
client_idle_timeout: 15m
disconnect_expired_cert: no
enhanced_recording:
- command
- network
forward_agent: true
max_session_ttl: 1h
port_forwarding: false
allow:
logins: [root]
node_labels:
"": ""
rules:
- resources: [""]
verbs: [""]
Show more
12. Create the OIDC connector.



1. Create the file oidc.yaml within the directory /var/lib/teleport by using the following example content. Ensure the appropriate changes where noted with <variables>. For more information, see [OIDC Authentication](https://goteleport.com/docs/enterprise/sso/oidc/).



oidc connector
kind: oidc
version: v2
metadata:
name: appid
spec:
redirect_url: "https://<virtual server instance DNS FQDN>:3080/v1/webapi/oidc/callback"
client_id: "<Client ID from AppID Service Credentials>"
display: AppID
client_secret: "<secret from AppID Service Credentials>"
issuer_url: "<oauthServerUrl from AppID Service Credentials>"
scope: ["openid", "email"]
claims_to_roles:
- {claim: "email", value: "<Email Address>", roles: ["teleport-admin"]}

Example claim names can be email, family_name, given_name, or name. The value is what that claims value will be set to.
13. Using the [tctl](https://goteleport.com/docs/cli-docs/) to apply the yamls:



* tctl create /var/lib/teleport/role.yaml
You then need to set up a PKCS 11 proxy that allows your nodes to communicate with your HSM. You can then create a node with the private key that is stored in an HSM partition by providing the HSM endpoint along with the slot key and pin before the node is deployed. For more information, see Configuring a node to use an HSM]] .If you are using the APIs to deploy a node, you need to provide the HSM endpoint to the HSM field of the API call. You also need to use the config override to provide the label and pin of the HSM slot that you will use and select "PKCS11" as the default crypto service provider. As an example The following API call deploys a peer node with an HSM. curl -X POST "https://{API-Endpoint}/ak/api/v2/kubernetes/components/fabric-peer" 
-H "Content-Type: application/json" 
-H "Authorization: Bearer {IAM-Token}" 
-d "{
"display_name": "My Peer",
"msp_id": "org2",
"config": {
"enrollment": {
"component": {
"cahost": "n3a3ec3-myca.ibp.us-south.containers.appdomain.cloud",
"caport": "7054",
"caname": "ca",
"catls": {
"cacert": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCkNlcnQgZGF0YSB3b3VsZCBiZSBoZXJlIGlmIHRoaXMgd2FzIHJlYWwKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo"
},
"enrollid": "admin",
"enrollsecret": "password",
"admincerts":
"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCkFkbWluIGNlcnQgZGF0YSB3b3VsZCBiZSBoZXJlIGlmIHRoaXMgd2FzIHJlYWwKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo="
]
},
"tls": {
"cahost": "n3a3ec3-myca.ibp.us-south.containers.appdomain.cloud",
"caport": "7054",
"caname": "tlsca",
"catls": {
openssl req -newkey rsa:2048 -nodes -keyout clientKey.pem -x509 -days 365 -out clientCert.pem

 Combine the private key and public certificate into a single file
cat clientKey.pem > clientCombined.pem
cat clientCert.pem >> clientCombined.pem
2. Add the newly generated client certificate to the local keystore file:

Import the combined client key/cert into the keystore file, making a note of the label that you use.

runmqakm -cert -add -db key.kdb -file clientCombined.pem -label runmqsc -stashed -type pkcs12 -format ascii
3. Configure the queue manager to trust the client certificate:



* Import the public part of the client certificate by navigating to the queue manager details page in the MQ on Cloud service console user interface, and selecting the "Trust store" tab
* Click the "Import certificate" button, and select the file containing the public part of the client certificate, for example clientCert.pem
* Click Next and pick a label for the certificate (it doesn't have to be the same label as in the client keystore file), then click Save
* Once the certificate has been uploaded you will be requested to refresh the queue manager SSL security configuration which you can do using MQ Console, MQ Explorer or runmqsc as [described here](https://cloud.ibm.com/docs/services/mqcloud?topic=mqcloud-mqoc_refresh_security)



4. Configure the queue manager channel to require mutual TLS:



* The TLS mode for a channel is controlled by the SSL Authentication attribute of the channel, which must be set to Required to enable mutual TLS. You can set the attribute using MQ Console or MQ Explorer via the UI, or if you are using runmqsc then you must set the attribute SSLCAUTH to REQUIRED.



5. Configure runmqsc to present the client certificate when it connects to the queue manager:
Client Version: 4.9.13

 zip
Copyright (c) 1990-2008 Info-ZIP - Type 'zip "-L"' for software license.
This is Zip 3.0 (July 5th 2008), by Info-ZIP.

 unzip
UnZip 6.00 of 20 April 2009, by Info-ZIP. Maintained by C. Spieler. Send

 git --version
git version 2.27.0

 curl
curl 7.61.1 (x86_64-redhat-linux-gnu) libcurl/7.61.1 OpenSSL/1.1.1k zlib/1.2.11 brotli/1.0.6 libidn2/2.2.0 libpsl/0.20.2 (+libidn2/2.2.0) libssh/0.9.4/openssl/zlib nghttp2/1.33.0

 wget
GNU Wget 1.19.5 built on linux-gnu.

 openssl version
OpenSSL 1.1.1k FIPS 25 Mar 2021

 make
GNU Make 4.2.1

 docker
Client:
Version: 20.10.11
API version: 1.41
Go version: go1.16.10
Git commit: dea9396
Built: Thu Nov 18 00:34:03 2021
OS/Arch: linux/amd64
Context: default

 dc --version
dc (GNU bc 1.07.1) 1.4.1

 ed --version
GNU ed 1.14.2
Show more





 Version 3.4 

To view the contents of version 3.4, from the running image, type default_versions.sh. The 3.x branch provides images with the current tool versions. The current Java™ version is Java™ 11. Node.js no longer uses nvm to manage different node.js versions. It provides the current LTS version of Node.js at the time that it was built.

The IBM Cloud CLI provides code risk analysis commands.
"tls": {
"certfiles": null,
"client": {
"certfile": null,
"keyfile": null
}
}
},
"cfg": {
"identities": {
"passwordattempts": 10,
"allowremove": true
}
},
"metrics": {
"provider": "prometheus",
"statsd": {
"network": "udp",
"address": "127.0.0.1:8125",
"writeInterval": "10s",
"prefix": "server"
}
}
}
}
Show more





 Providing your own customizations when you create a CA 

After you click Create a CA on the nodes tab and step through the CA configuration panels, you can click Edit configuration on the Summary panel to view and edit the JSON. Note that if you do not select any advanced options in the console, then those advanced configuration settings are not included in the JSON, but you can insert them yourself, using the elements provided in JSON above.

Alternatively, if you do check any of the advanced options when you configure the CA, those settings are included in the JSON on the Summary panel and can be additionally customized.

Any edits that you make to the JSON override what was specified in the console UI. For example, if you specified a Maximum enrollments value of 10 in the console, but then provided the maxenrollments value of -1 in the JSON, then the value in theJSON file is used when the CA is deployed. It is the settings that are visible in the JSON on the Summary page that are used when the CA is deployed.

Here is an example of the minimum required JSON parameters for any override when a CA is deployed.

{
"ca": {
"csr": {
"cn": "<COMMONNAME>",
"keyrequest": {
"algo": "ecdsa",
"size": 256
db2 update dbm cfg using SSL_CLNT_STASH /<ssl_directory_name>/ssl/dashclient.sth

e. Catalog the Db2 on Cloud node so that client applications can connect to it. Issue the following command:

db2 catalog tcpip node <node_name> remote <Db2_Warehouse_IP_address> server <port_number> security ssl

where:

<node_name> is your name for the node.

<Db2_Warehouse_IP_address> is the IP address of the Db2 Warehouse on Cloud server.

<port_number> is the port that is used to connect to Db2 Warehouse by using an SSL connection. If you are using the default port, specify 50001.

f. Catalog the remote Db2 on Cloud database so that client applications can connect to it. Issue the following command:

db2 catalog database bludb as <db_alias> at node <node_name>

where db_alias is your name for the Db2 on Cloud database.

g. Test the SSL connection in one of the following ways:



* Test the connection by using CLP by issuing the following command to connect to the Db2 on Cloud database:

db2 connect to <db_alias> user <user_id>

where <user_id> is your Db2 on Cloud user ID. You are prompted to enter your password.
* Test the connection by using CLI by issuing the following command to connect to the Db2 on Cloud database:

db2cli validate -dsn <alias> -connect -user <user_id> -passwd <password>

where <alias> is a DSN alias that you created by using the db2cli writecfg command, <user_id> is your Db2 on Cloud user ID, and <password> is your Db2 on Cloud database password.



* To create a connection without SSL, complete the following steps:

a. Catalog the Db2 on Cloud node so that client applications can connect to it. Issue the following command:
At the NSF client end, the LSF cluster nodes in this case, the remote directory, /data, is mounted to /mnt/data locally. A soft link, /home/lsfadmin/shared, also points to /mnt/data. You can use /home/lsfadmin/shared as a shared file system for your applications.



The HPC cluster solution provides a base custom image, which includes the LSF installation. You can create your own custom image on top of the base image. For more information, see [Create custom image](https://cloud.ibm.com/docs/ibm-spectrum-lsf?topic=ibm-spectrum-lsf-getting-started-tutorial&interface=uicreate-custom-image). The image service on VPC provides a way for doing this. You can then specify the custom image that you want to use in Schematics for LSF management nodes and worker nodes. The image that is used by the login node and the storage node is not configurable at the moment (CentOS 7 by default).





 Step 1: Create SSH key 

Complete the following steps to create your SSH key:



1. Generate an SSH key on your system by running the following command:

ssh-keygen -t rsa
2. Copy and save all of the content from .ssh/id_rsa.pub.







 Step 2: Add SSH key to the VPC infrastructure 



1. Log in to the [IBM Cloud® console](https://cloud.ibm.com/) by using your unique credentials.
2. From the dashboard, click Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/74a831a53989757bd05bd0dea7bb42c9ede61d0f/icons/icon_hamburger.svg) > VPC Infrastructure > SSH keys.
3. Click Create.
4.
It then creates an identity for the signing certificate and private key and imports them into the wallet. Notice how the file passes your organization MSP ID into the wallet as well.

// Enroll the admin user, and import the new identity into the wallet.
const enrollment = await ca.enroll({ enrollmentID: '<app_enroll_id>', enrollmentSecret: '<app_enroll_secret>' });
const identity = X509WalletMixin.createIdentity('<msp_id>', enrollment.certificate, enrollment.key.toBytes());
wallet.import('user1', identity);
console.log('Successfully enrolled client "user1" and imported it into the wallet');

EditenrollUser.js to replace the following values:



* Replace <CA_Name> with the name of your organization's CA. You can find your CA name in the "organizations" section of your connection profile under "Certificate Authorities". Do not use the "caName" in the "Certificate Authorities" section.
* Replace <app_enroll_id> with the application enroll ID provided by your network operator.
* Replace <app_enroll_secret> with the application enroll secret provided by your network operator.
* Replace <msp_id> with the MSP ID of your organization. You can find this MSP ID under the "organizations" section of your connection profile.



Save enrollUser.js and close it. In the magnetocorp directory, run the following command:

node enrollUser.js

When the command completes successfully, you should see the following output:

Successfully enrolled client "user1" and imported it into the wallet

You can find the wallet that was created in the identity folder of the magnetocorp directory.





 Step four: Use the connection profile to build a Fabric gateway 

The Hyperledger Fabric [Transaction Flow](https://hyperledger-fabric.readthedocs.io/en/release-2.2/txflow.html) spans multiple components, with the client applications playing a unique role.
The participants can then operate blockchain nodes and submit transactions from client applications.

Each organization in a network needs to operate a Certificate Authority to create all of the identities for the admins and nodes that belong to your organization. These public-private keys pairs are issued by the CA and used by the members of your organization to sign and verify their actions. When an organization joins a channel, the public key of the CA associated with that organization allows other organizations to verify that your peers and applications are valid participants. For more information about membership in Hyperledger Fabric, see the [Membership concept topic](https://hyperledger-fabric.readthedocs.io/en/release-2.2/membership/membership.html) in the Fabric documentation.

Before your organization can join a consortium, it needs to create an organization definition that is known as a Membership Services Provider (MSP). The MSP contains the following information:



* A certificate signed by your root Certificate Authority. This certificate is used to verify the identity of your nodes, channels, and applications.
* A certificate signed by your TLS CA. A root TLS certificate allows your peers to participate in cross organizationgossip, which is necessary to take advantage of the [Private data collections](https://hyperledger-fabric.readthedocs.io/en/release-2.2/private-data/private-data.htmlwhat-is-a-private-data-collection) and [Service Discovery](https://hyperledger-fabric.readthedocs.io/en/release-2.2/discovery-overview.html) features of Hyperledger Fabric.
* The MSP ID. The MSP ID is the formal name of your organization. You need to remember the MSP ID for your applications or when using the SDK to submit transactions.
* The MSP display name. This is an informal name that is given to your organization, which is used to identity your MSP in the console.
* The Admin certificates of your Organization Admin identities. These certificates are passed to the ordering service and are used to verify which identities in your organization are allowed to create or edit channels.
Docker is running on your local machine as a consequence of installation, but if you need to restart it do so. If you build your new web application without Docker running it fails, but that's not the only possible error. If you run into trouble, check the resulting error messages, which might have the appropriate link to view result logs in your online portal for your IBM Cloud Platform account.

ibmcloud dev build

Now that the app is built, you can run the code locally with the run command. When finished, copy and paste the provided URL into your browser's address bar, typically, http://localhost:3000.

ibmcloud dev run

Now that the app is created and defined, view your application to confirm it works. If you see the placeholder image as shown in Figure 2, well done! You've created a new Node.js web application and are ready to deploy it to the cloud.

Zoom

![initial node app](https://cloud.ibm.com/docs-content/v1/content/63322f2f3a72050206eb05ba7f590fdcb741105c/cloud-object-storage/images/web-app-tutorial-002-splash-graphic.png)

Figure 2. New Node.js Application!

Deploy the app to IBM Cloud Platform with the deploy command (as shown in the example).

ibmcloud dev deploy

The URL again is displayed by ibmcloud dev deploy based on the regional endpoint and the hostname you specified earlier. You can see links to the logs that are stored in your portal at the IBM Cloud Platform. Go ahead and visit your new web application in the cloud!





 Step 2: Creating the Web Gallery app 

Let's recall the prerequisites that you needed for developing a Node.js app on IBM Cloud Platform. You already created your IBM Cloud Platform account as well as installed the Developer Tools, which installed Docker. Then, you installed Node.js. The last item listed as a prerequisite for this tutorial was Git, which we dive into now.
Optional: To provide the credentials during the creation of a Satellite location, format the credentials in a JSON file. The client_id is the ID of the access key and the client_secret is the secret access key that you created for the IAM user in AWS.

{
"client_id":"string",
"client_secret": "string"
}







 I created a Satellite location, what's next? 

Now that your Satellite location is set up, you are ready to start using IBM Cloud services.



1. Add compute capacity to your location by [attaching more hosts to the location](https://cloud.ibm.com/docs/satellite?topic=satellite-attach-hosts) so that you can run [Satellite-enabled IBM Cloud service](https://cloud.ibm.com/docs/satellite?topic=satellite-managed-services).
2. Create a [Satellite-enabled IBM Cloud service](https://cloud.ibm.com/docs/satellite?topic=satellite-managed-services), such as a [Red Hat OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-satellite-clusters). You assign the additional hosts that you previously attached as worker nodes to provide the compute power for the cluster. You can even [register existing Red Hat OpenShift clusters to your location](https://cloud.ibm.com/docs/satellite?topic=satellite-register-openshift-clusters) to use as deployment targets.
3. [Manage your applications](https://cloud.ibm.com/docs/satellite?topic=satellite-cluster-config) with Satellite Config.
4. Create [Satellite cluster storage templates](https://cloud.ibm.com/docs/satellite?topic=satellite-storage-template-ov).
5. Learn more about the [Satellite Link component](https://cloud.ibm.com/docs/satellite?topic=satellite-link-location-cloud) and how you can use endpoints to manage the network traffic between your location and IBM Cloud.