vania-janet/multiturn-rag-retrieval-data huggingface dataset:
For HTTP connections with the back-end servers (against front-end HTTP or HTTPS connections), the load balancer preserves the original client IP address by including it inside the X-Forwarded-For HTTP header. For TCP connections, the original client IP information is not preserved.





 Preserving end-client protocol (HTTP/HTTPS only) 

An ALB preserves the original protocol that is used by the client for front-end HTTP and HTTPS connections by including it inside the X-Forwarded-Proto HTTP header. This does not apply to TCP protocol since an ALB does not look at Layer-7 traffic when TCP protocol is used.





 Enabling private load balancer enforcement 

Private load balancer enforcement prevents public load balancers from being created. This ensures only non-internet clients, or clients from within your network environment, can access your load balancers. When enabled, a restriction is placed on your account to prevent the creation of floating IPs on all ALBs.

To implement private load balancer enforcement, open an [IBM Support case](https://cloud.ibm.com/docs/get-support?topic=get-support-using-avatar) and reference your need to alter your account to restrict the creation of floating IPs. After IBM processes the change, you will no longer be able to create public load balancers.

Private load balancer enforcement applies for all regions when enabled.





 HTTP/2 support for clients connecting to HTTPS listeners 

Application Load Balancer for VPC uses Application-Layer Protocol Negotiation (ALPN) to negotiate with clients connecting to HTTPS listeners, and supports both HTTP/1.1 and HTTP/2. If the client connecting to the ALB is using HTTP/2, then the ALB also uses HTTP/2 as its preferred protocol, and processes the request to the back-end pool. Otherwise, HTTP/1.1 is chosen by default.

The HTTP/2 protocol is not yet supported for back-end pools. However, HTTP and HTTPS protocols are supported.





 Compression (HTTP/HTTPS only) 

HTTP/HTTPS compression allows you to compress the data being transmitted to your users using gzip.
Retrieves the key create import access policy details of the instance.
* -m, --metrics

Retrieves the metrics policy details of the instance.
* -o, --output

Set the CLI output format. By default, all commands print in table format. To change the output format to JSON, use --output json.
* -r, --rotation

Retrieves rotation policy details of the instance.









 kp instance policy-update allowed-network 

Update the policy for an instance and set the allowed network to public-and-private or private-only.

The allowed-network policy blocks an instance from getting requests from public or private networks.

For existing instances the network access policy is enforced after it is set.

For more information, see [managing network access policies](https://cloud.ibm.com/docs/key-protect?topic=key-protect-managing-network-access-policies).

ibmcloud kp instance policy-update allowed-network
-i, --instance-id INSTANCE_ID
-d, --disable OR
-e, --enable
-t, --network-type NETWORK_TYPE



 Example 

This example sets the "allowed network" policy to "public-and-private".

 update the instance policy and set the allowed network to public-and-private
$ ibmcloud kp instance policy-update allowed-network --enable --network-type public-and-private

Updating instance policy...
OK

 list the instance policies
$ ibmcloud kp instance policies

Retrieving policy details for instance: a192d603-0b8d-452f-aac3-f9e1f95e7411...
OK
Created By user id ...<redacted>...
Creation Date 2020-06-22T16:17:52Z
Last Updated 2020-06-22T18:17:32Z
Updated By user id ...<redacted>...
Policy Type allowedNetwork
Enabled true
Network Allowed public-and-private
Enforcing private endpoints to configure Activity Tracker Event Routing resources 

Use this tutorial to learn how to enforce the use of private endpoints to configure Activity Tracker Event Routing resources in your account.

You can use the Activity Tracker Event Routing CLI or the Activity Tracker Event Routing REST API to define the type of endpoints that are allowed to configure Activity Tracker Event Routing resources in the account.

[![Step 1. Check that your account is VRF enabled.](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/atracker/images/endpoint_s1.svg)](https://cloud.ibm.com/docs/atracker?topic=atracker-getting-started-mng-endpointsgetting-started-mng-endpoints-step1)[![Step 2. Disable public endpoints.](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/atracker/images/endpoint_s2.svg)](https://cloud.ibm.com/docs/atracker?topic=atracker-getting-started-mng-endpointsgetting-started-mng-endpoints-step2)[![Step 3. Check you have access to private endpoints.](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/atracker/images/endpoint_s3.svg)](https://cloud.ibm.com/docs/atracker?topic=atracker-getting-started-mng-endpointsgetting-started-mng-endpoints-step3)



 Prerequisites 



* You need a user ID that is a member, or an owner of, an IBM Cloud account.
Limiting instance access to only private endpoints 

You can limit access to an IBM® Log Analysis instance to private endpoints only.

You can configure your IBM Log Analysis instance so it is accessible through [private endpoints](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-endpoints) only.

If you configure your instance to use private endpoints only, this will block the public endpoints. All ingestion and API usage that may be in progress on the public endpoints will be blocked when the configuration change is made.

Unless otherwise specified when provisioning an instance, the default is for the instance to be accessible by both public and private endpoints.



 Limiting instances while provisioning 

You can configure your instance to only use private endpoints when you [provision your instance.](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-provision)





 Limiting an existing instance 

If you have an exising instance you can change it to use private endpoints only.



 Limiting the instance using the Observability dashboard 

If you have an existing IBM Log Analysis instance and need to change it to be accessible by private endpoints only, do the following using the Observability dashboard:



1. [Log in to your IBM Cloud account](https://cloud.ibm.com/login).

After you log in with your user ID and password, the IBM Cloud dashboard opens.
2. Click the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/icons/icon_hamburger.svg) > Observability.
3. Select Logging.

The list of IBM Log Analysis instances is displayed.
4. Select the instance in the region where you want to view events. Then, click Open Dashboard.
5. Select the settings icon.
6. Click Organization > General.
7.
You can use private and public endpoints to manage targets. For more information about the list of ENDPOINTS that are available, see [Endpoints](https://cloud.ibm.com/docs/metrics-router?topic=metrics-router-endpoints).



* You can manage targets from the private network using an API endpoint with the following format: https://private.REGION.metrics-router.cloud.ibm.com
* You can manage targets from the public network using an API endpoint with the following format: https://REGION.metrics-router.cloud.ibm.com
* You can disable the public endpoints by updating the account settings. For more information, see [Configuring target and region settings](https://cloud.ibm.com/docs/metrics-router?topic=metrics-router-settings).



For more information about the REST API, see [Targets](https://cloud.ibm.com/apidocs/metrics-router/metrics-router-v3create-target).





 API prerequisites 

To make API calls to manage targets, complete the following steps:



1. Get an IAM access token. For more information, see [Retrieving IAM access tokens](https://cloud.ibm.com/docs/metrics-router?topic=metrics-router-retrieve-iam-token).
2. Identify the API endpoint in the region where you plan to configure or manage a target. For more information, see [Endpoints](https://cloud.ibm.com/docs/metrics-router?topic=metrics-router-endpoints).
3. Before you configure IBM Cloud Metrics Routing routes or targets, you must configure a primary metadata region. The primary metadata region is configured using the [modify settings API method.](https://cloud.ibm.com/apidocs/metrics-router/metrics-router-v3update-settings)







 Creating a Monitoring target using the API
2d290fcafca295cd2de49e7246a5a5a080f503cb066d451b008a863b84a82ee1 root.tar.gz





 /dev/disk/by-label/cidata 

The /dev/disk/by-label/cidata is a block device that is attached to the running instance that contains the cloud-init files as provided by IBM Cloud® Virtual Private Cloud (VPC). For more information about Cloud-Init, see [User data](https://cloud.ibm.com/docs/vpc?topic=vpc-user-data), or [cloud-init documentation](https://cloudinit.readthedocs.io/en/latest/).





 cidata 

All the files in cidata copied are from the /dev/disk/by-label/cidata block device that is provided by VPC.

6dc2640b909f4077b17059f3edc1d0f3c1d286f4afc9f3d28f9ee9e72509ca51 cidata/meta-data
272aa3529571b4fc592bf89e9242d3f57ae8ff29fb514c4ee6d7ce1eeb2ac1ee cidata/user-data
baef972e58d4362d97f822d8ff4c5339c5898a0dc184d88d29e5b010b9835ed6 cidata/vendor-data





 attestationPublicKey 

The attestationPublicKey is the public key that you provide which is used to encrypt the attestation document. The attestationPublicKey is part of the user-data file. Encrypting the attestation document is optional.
Make sure to specify your catalog, or the filter will default to the account level. See [Catalogs management CLI](https://cloud.ibm.com/docs/cli?topic=cli-manage-catalogs-pluginoffering-filter) for more command options.

ibmcloud catalog filter offering --offering PRODUCT-NAME







 Setting the visibility of the IBM Cloud catalog by using the CLI 

By default, the IBM Cloud public catalog is visible to all users in the account. You can make products available only to the users you choose by turning off visibility to the IBM Cloud catalog and adding the products to your private catalogs. Use the following command to turn off visibility of the public catalog to all users in your account.

ibmcloud catalog filter hide-ibm-public-catalog





 Authorizing access to private catalogs by using the CLI 

To authorize users to work with the products in your private catalogs, assign them the [viewer role on the catalog management service](https://cloud.ibm.com/docs/account?topic=account-account-servicesassigning-access-by-using-the-cli).





 Deleting a private catalog by using the CLI 

If you delete a private catalog, all of the products within the catalog are deleted as well. Run the following command to delete a private catalog:

ibmcloud catalog delete --catalog CATALOG

You can [restore a private catalog](https://cloud.ibm.com/docs/account?topic=account-resource-reclamation&interface=clirestore-resource-cli) within 7 days after you delete it.





 Creating a private catalog with all products included by using the API 

To create a catalog that includes all products in the IBM Cloud catalog, call the [Catalog Management API](https://cloud.ibm.com/apidocs/resource-catalog/private-catalog?code=gocreate-catalog) as shown in the following sample request. Replace variables with the values from your account.



* Curl
* Java
* Python
* Go
* Node
curl -X GET -H "Authorization: Bearer <>" 'https://api.{region}.databases.cloud.ibm.com/v5/ibm/deployments/{id}/users/{userid}/connections/{endpoint_type}'

Remember to replace {region}, {id}, {userid}, and {endpoint_type} with the appropriate values.





 Additional Users and Connection Strings 

Access to your Databases for MongoDB deployment is not limited to the admin user. Create more users and retrieve connection strings specific to them by using the UI, the [Cloud Databases CLI plug-in](https://cloud.ibm.com/docs/databases-cli-plugin?topic=databases-cli-plugin-cdb-reference), or the [Cloud Databases API](https://cloud.ibm.com/apidocs/cloud-databases-api/cloud-databases-api-v5introduction).

All users on your deployment can use the connection strings, including connection strings for either public or private endpoints.

For more information, see the [Managing Users and Roles](https://cloud.ibm.com/docs/databases-for-mongodb?topic=databases-for-mongodb-user-management) page.
ibmcloud hpcs-cert-mgr cert set --crn HPCS_CRN --admin-priv-key ADMIN_PRIV_KEY --cert-id CERT_ID --cert CERT_FILE [--private]



* Command options

--crn HPCS_CRN
: Required. The crn of your Hyper Protect Crypto Services instance. You can use the ibmcloud resource service-instances --long command to retrieve the crn.

--admin-priv-key ADMIN_PRIV_KEY
: Required. The file path of your current private key that is stored on your local workstation. The private key is used to sign this command action toward your instance certificate manager server.

--cert-id CERT_ID
: Required. The string ID that you want to assign to the certificate for easy identification.

--cert CERT_FILE
: Required. The certificate file that is stored on your workstation. It is suggested to use the IBM Cloud Certificate Manager to order and manage SSL/TLS certificates for your applications and services.

--private
: Optional. If you use this option, the certificate manager server URL points to the private network. For example,: cert-mgr.private.<region>.hs-crypto.cloud.ibm.com:443. The region is the abbreviation of the geographic area where you log in to IBM Cloud. In this case, you need to use the private network to connect your service instance.
* Example

export HPCS_CRN=crn:v1:staging:public:xxx:yyy:zzz

export CERT=/Users/admin1/cert.pem

export ADMIN_PRIV_KEY=/Users/admin1/.hpcs-cert-mgr-cfg/44de77d2-599b-0089-2f0f-bad8d1c94a7c.priv
: The private key data to store for an imported_cert secret. Supported file type is .pem.

intermediate
: Intermediate certificate data to store for an imported_cert secret. Supported file type is .pem.

ca
: The [certificate authority configuration](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-add-certificate-authority) to be used for ordering a public_cert secret.

dns
: The [DNS provider configuration](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-add-dns-provider) to be used for ordering a public_cert secret.

key_algorithm
: The key algorithm to be used for signing and issuing a public_cert secret. Allowable values include: RSA2048, RSA4096, ECDSA256, ECDSA384

certificate_template
: The [certificate template](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-certificate-templates) to be used for creating a private_cert secret.

common_name
: The common name to be used for creating a private_cert secret. Depending on the certificate template that you choose, some restrictions on the common name for your private certificate might apply.

-format
: Prints the output in the format that you specify. Valid formats are table, json, and yaml. The default is table. You can also set the output format by using the VAULT_FORMAT environment variable.





 Examples 

Create a user credential with an expiration date and two labels.

vault write -format=json ibmcloud/username_password/secrets name="my-test-user-credential" expiration_date="2020-12-31T23:59:59Z" username="user123" password="window-steel-dogs-coffee" labels=label-1,label-2

Create an arbitrary secret with an expiration date and two labels.
Enforcing private endpoints to configure IBM Cloud Metrics Routing resources 

Use this tutorial to learn how to enforce the use of private endpoints to configure IBM Cloud Metrics Routing resources in your account.

You can configure your account to manage private and public endpoints by using the IBM Cloud Metrics Routing CLI, the IBM Cloud Metrics Routing REST API, and Terraform scripts.



Table 1. Configuration steps

 Step Description Link 

 1 Check that your account is VRF enabled. [link](https://cloud.ibm.com/docs/metrics-router?topic=metrics-router-endpoints-enforce-privatemng-endpoints-step1) 
 2 Disable public endpoints. [link](https://cloud.ibm.com/docs/metrics-router?topic=metrics-router-endpoints-enforce-privatemng-endpoints-step2) 
 3 Check you have access to private endpoints. [link](https://cloud.ibm.com/docs/metrics-router?topic=metrics-router-endpoints-enforce-privatemng-endpoints-step3) 





 Prerequisites 



* You need a user ID that is a member, or an owner of, an IBM Cloud account. To get an IBM Cloud user ID, go to: [Create an account](https://cloud.ibm.com/login).
* If you prefer to work with the command line, you must install the IBM Cloud CLI. For more information, see [Installing the IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli). In addition, you must install the IBM Cloud Metrics Routing CLI plugin. For more information, see [IBM Cloud Metrics Routing CLI](https://cloud.ibm.com/docs/metrics-router?topic=metrics-router-metrics-router-cli).
* Your user ID needs administrator platform permissions to manage the IBM Cloud Metrics Routing service.
To obtain service tokens, exchange your verified user information by using the [/token endpoint](https://us-south.appid.cloud.ibm.com/swagger-ui//Authorization_Server_V4/token).

Post /token
Content-Type: application/x-www-from-urlencoded
grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer
assertion=<payload>
scope="<spaceSeparatedScopeArray>"



Table 2. Required request variables

 Variable Description 

 Content-type applications/x-www-from-urlencoded 
 grant_type urn:ietf:params:oauth:grant-type:jwt-bearer 
 assertion A JWS payload string. 
 scope A white space separated list of your custom scopes.
Verify your connection.



* If the public cloud service endpoint is enabled:

curl --insecure <public_service_endpoint_URL>/version

Example command:

curl --insecure https://c3.<region>.containers.cloud.ibm.com:31142/version

Example output

{
"major": "1",
"minor": "7+",
"gitVersion": "v1.7.4-2+eb9172c211dc41",
"gitCommit": "eb9172c211dc4108341c0fd5340ee5200f0ec534",
"gitTreeState": "clean",
"buildDate": "2017-11-16T08:13:08Z",
"goVersion": "go1.8.3",
"compiler": "gc",
"platform": "linux/amd64"
}
* If the private cloud service endpoint is enabled, you must be in your IBM Cloud private network or connect to the private network through a VPN connection to verify your connection to the master. Note: You must [expose the master endpoint through a private load balancer](https://cloud.ibm.com/docs/openshift?topic=openshift-access_clusteraccess_private_se) so that users can access the master through a VPN or IBM Cloud® Direct Link connection.

curl --insecure <private_service_endpoint_URL>/version

Example command:

curl --insecure https://c3-private.<region>.containers.cloud.ibm.com:31142/version

Example output

{
"major": "1",
"minor": "7+",
"gitVersion": "v1.7.4-2+eb9172c211dc41",
The private and public VLANs must be compatible, which you can determine from the Router ID prefix.

--private-only
: Optional: Unset the public VLAN so that the workers in this zone are connected to a private VLAN only.

-f
: Optional: Force the command to run with no user prompts.

-q
: Optional: Do not show the message of the day or update reminders.

Usage:



1. Check the VLANs that are available in your cluster.

ibmcloud ks cluster get --cluster <cluster_name_or_ID> --show-resources

Example output

Subnet VLANs
VLAN ID Subnet CIDR Public User-managed
229xxxx 169.xx.xxx.xxx/29 true false
229xxxx 10.xxx.xx.x/29 false false
2. Check that the public and private VLAN IDs that you want to use are compatible. To be compatible, the Router must have the same pod ID. Private VLAN routers always begin with bcr (back-end router) and public VLAN routers always begin with fcr (front-end router). When you create a cluster and specify the public and private VLANs, the number and letter combination after those prefixes must match.

ibmcloud ks vlan ls --zone <zone>

In the example output, note that Router pod IDs match: 01a and 01a. If one pod ID was 01a and the other was 02a, you can't set these public and private VLAN IDs for your worker pool.

ID Name Number Type Router Supports Virtual Workers
229xxxx 1234 private bcr01a.dal12 true
229xxxx 5678 public fcr01a.dal12 true
3. If you don't have any VLANs available, you can [order new VLANs](https://cloud.ibm.com/docs/vlans?topic=vlans-ordering-premium-vlansordering-premium-vlans).





 Example zone network-set command
This is generally an alpha-numeric block of text. 
 Private key Private key details for the certificate, provided by the certificate authority. This is generally an alpha-numeric block of text. 
 Intermediate certificate Intermediate certificate details, provided by the certificate authority. Intermediate certificates are not required; however, if the information is available for the SSL certificate, it should be entered. 
 Certificate signing request Certificate signing request (CSR) details provided by the certificate authority. CSR details are not required, but should be provided if they are part of the certificate. Note: Do not change the CSR in any way. A public key can be included with the CSR and should not be replaced by the Private Key. 
 Notes Any notes regarding the SSL certificate that might be helpful to other users. 







 Next steps 

After the SSL certificate is imported to the IBM Cloud console, it is stored on the SSL certificates screen until it is [manually deleted](https://cloud.ibm.com/docs/infrastructure/ssl-certificates?topic=ssl-certificates-deleting-ssl-certificatesdeleting-ssl-certificates). For all products or services requiring SSL certificate details, the new SSL certificate appears in the list of available certificates for use when interacting with the SSL feature for the wanted product or service. The certificate can be [updated](https://cloud.ibm.com/docs/infrastructure/ssl-certificates?topic=ssl-certificates-viewing-and-updating-ssl-certificates) and details about the certificate can be [securely downloaded](https://cloud.ibm.com/docs/infrastructure/ssl-certificates?topic=ssl-certificates-downloading-ssl-certificate-details) at any time.
4. Select Private, if it is not already selected.
5. Click Save changes.







 Project membership 

Git Repos and Issue Tracking is a cloud hosted social coding environment that is available to all Continuous Delivery users. If you are a Git Repos and Issue Tracking project Maintainer or Owner, you can invite any user and group members to the project. IBM Cloud places no restrictions on who you can invite to a project. Because you can invite anyone into a GitLab project, be careful to invite only those users or groups who are part of your company or organization, unless you explicitly intend otherwise.

For more information about managing GitLab project members, see [Members of a project](https://docs.gitlab.com/ee/user/project/members/).





 Project email settings 

By default, Git Repos and Issue Tracking notifies project members by way of email about project activities. These emails typically include customer-owned data that was provided to Git Repos and Issue Tracking by users. For example, if a user posts a comment to an issue, Git Repos and Issue Tracking sends an email to all subscribers that includes information such as a copy of the comment, the user who posted it, and when the comment was posted. To turn off all email notifications for your project, complete the following steps:



1. From the project sidebar, click Settings > General.
2. On the General Settings page, click Visibility > project features > permissions.
3. Select the Disable email notifications checkbox.
4. Click Save changes.







 Project integrations and webhooks 

Git Repos and Issue Tracking projects might also be configured with integrations or webhooks to other systems, or equipped with access tokens, deploy tokens, and deploy keys. To review or change the integrations, webhooks, tokens, and keys that might be configured with your project, from the project sidebar, complete the following steps:



1. From the project sidebar, click Settings.
2. Click Integrations to work with your project's integrations with other applications.
3.