vania-janet/multiturn-rag-retrieval-data huggingface dataset:
After you create zones, you can [update](https://cloud.ibm.com/apidocs/context-based-restrictionsreplace-zone) or [delete](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-remove&interface=ui) them.





 Creating network zones by using the CBR UI 

After you set the prerequisites and requirements, you can create zones in the UI. For more information about the steps to follow, see [Creating context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-create&interface=uinetwork-zones-create).

Instead of creating a zone by using UI inputs, you can use the JSON code form to create a zone by clicking Enter as JSON code.

After you create zones, you can also [update](https://cloud.ibm.com/apidocs/context-based-restrictionsreplace-zone) and [delete](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-remove&interface=ui) them.







 Understanding network rules 

After you create your zones, you can attach the zones to your network resources by creating rules. When you add resources to a rule, you can choose from the available [types of endpoints](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-whatiscontext-restrictions-endpint-type) that are specific to your network topology.



 Create network rules by using the CBR API 

You can define network rules with the API by using the information that you collected from creating network zones.

By using GET /v1/rules with the endpoints that you chose, you can view a list of current rules. Use POST /v1/rules to create new rules. For more information, including a request body example, see [Creating rules by using the API](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-create&interface=apicontext-restrictions-create-rules-api).
If you do not have the authorization and attempt to create a Cloud Connection (Direct Link Connect), a link will be generated. This Direct Link is not operational and must be authorized by the IBM Cloud account user who has the required authority via [IBM Cloud Console Direct Link Portal](https://cloud.ibm.com/interconnectivity).





 Modifying IBM Cloud connections 

When you create or edit a subnet, you can attach an existing IBM Cloud connection to the subnet. For more information, see [Configuring and adding a private network subnet](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-configuring-subnet).

To view or edit IBM Cloud connections, complete the following steps:



1. From the Power Systems Virtual Server dashboard, click Cloud connections in the left navigation pane.
2. Click the Cloud connection that you want to configure. The corresponding Connection details page appears.
3. If a transit gateway is enabled for the connection, you can view the Managed with IBM Transit Gateway details.
4. Click the Edit details icon.

If you have an existing IBM Cloud connection with a speed of 5 Gbps or less, you cannot increase the speed limit to 10 Gbps. Also, you cannot modify an IBM Cloud connection with 10 Gbps to be GRE-capable by reducing the speed.
5. Modify the details, review the pricing changes, and click Save edits.







 Deleting an IBM Cloud connection 

To delete an IBM Cloud connection, complete the following steps:



1. From the Power Systems Virtual Server dashboard, click Cloud connections in the left navigation window.

You can see the list of IBM Cloud connections that are currently configured.



1. To delete a specific IBM Cloud connection, click the Delete icon in the last column of the table.





When you delete a virtual server instance, it deletes the private networks (subnets) and other resources. It would help if you considered the following:



* You must delete the Cloud Connection (Direct Link) from the IBM Cloud Transit Gateway interface before deleting the Cloud Connection.
Actions on the target service that are required to manage authorizations

 Action Administrator Operator Editor Viewer 

 View all authorizations that are configured in the account ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/dad8f28785f0dc036aaae4b777787e73db9ff0d4/icons/checkmark-icon.svg) 
 Create authorizations ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/dad8f28785f0dc036aaae4b777787e73db9ff0d4/icons/checkmark-icon.svg) 
 Delete authorizations ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/dad8f28785f0dc036aaae4b777787e73db9ff0d4/icons/checkmark-icon.svg) 



Users can only see authorizations that they configure in the account.





 Creating an authorization in the console 

Complete the following steps:



1. In the IBM Cloud console, click Manage > Access (IAM), and select Authorizations.
2. Click Create.
3. Select a source account.

If the source service that needs access to the target service is in this account, select This account.

If the source service that needs access to the target service is in a different account, select Other account. Then, enter the account ID of the source account.
4. Select IBM Cloud Metrics Routing as the source service. Then, set the scope of the access to All resources.
5. Select IBM Cloud Monitoring as the target service. Then, set the scope of the access to All resources or a single instance by configuring Resources based on selected attributes > Service Instance.

Other attributes are not supported for this type of authorization.
6.
Setting up a target account 

If you want to use a different account to validate your product and run security and compliance scans, you can add a target account. You can add a target account by using an IBM Cloud API key or a trusted profile ID.

You might want to use a target account for the following reasons:



* Prevent the account with the product from becoming cluttered with resources that are created and deleted as part of the onboarding process
* Allow users to complete onboarding when they might not have authorization to create resources in the account that contains the product





 Before you begin 



1. Verify that you're using a Pay-As-You-Go or Subscription account. See [Viewing your account type](https://cloud.ibm.com/docs/account?topic=account-account_settingsview-acct-type) for more details.
2. Make sure you have the [administrator role on the catalog management service](https://cloud.ibm.com/docs/account?topic=account-account-servicescatalog-management-account-management) or have the catalog administrator complete this task.
3. Set up [service-to-service authorization](https://cloud.ibm.com/docs/account?topic=account-catalog-catalog-service-authorization).
4. If you want to use an IBM Cloud API key, [create an API key](https://cloud.ibm.com/docs/account?topic=account-userapikey&interface=uicreate_user_key) for the target account.
5. If you want to use a trusted profile ID, see [Creating trusted profiles](https://cloud.ibm.com/docs/account?topic=account-create-trusted-profile&interface=ui).







 Using an IBM Cloud API key 

You can add a target account by using an API key. Alternatively, if you would like to add a trusted profile ID, see [Using a trusted profile](https://cloud.ibm.com/docs/account?topic=account-catalog-cross-validatione&interface=uitarget-trusted-profile).



1.
* Select Direct resources (default) to create a direct, private connection between your on-premises network and IBM Cloud deployment. Optionally, choose a connection and enter a connection name. To add multiple network connections to the Direct Link gateway, click Add connection +. You can create one of the following connections:



* Classic infrastructure networks allow you to connect to IBM Cloud classic resources. Only one classic infrastructure connection is allowed per Direct Link gateway.
* VPC networks allow you to connect to your account’s VPC resources.



You cannot request a connection to a network in another account when you create a gateway. However, you can request a connection to a network in another account after a gateway is provisioned. You also can create classic infrastructure and VPC connections after a gateway is created. To learn more, see [Adding virtual connections to a Direct Link gateway](https://cloud.ibm.com/docs/dl?topic=dl-add-virtual-connection).
* Select Transit Gateway to bind your direct link to transit gateways. You can bind your direct link to one or more local gateways, or one global gateway.

If you select Transit Gateway as the type of network connection, you must also initiate a Direct Link connection through the [IBM Cloud Transit Gateway console](https://cloud.ibm.com/interconnectivity/transit) from the same IBM Cloud account. For instructions, see [Adding a connection](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-adding-connections).



11. An order summary shows pricing estimates for your review. Read and agree to the [Direct Link prerequisites](https://cloud.ibm.com/docs/dl?topic=dl-ibm-cloud-dl-prerequisites) and review Cloud Services [Terms](https://www.ibm.com/software/sla/sladb.nsf/searchsaas/?searchview&searchorder=4&searchmax=0&query=%28Direct+Link+Connect%29). Then, click Create to complete your order.
[Menu icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/icon_hamburger.svg) > Manage > Access (IAM) > Trusted profiles to access your existing trusted profile.
6. Select the trusted profile that you want to use.
7. Click IBM Cloud services > Add.
8. Enter the CRN and click Save.
9. Click Details to find the Profile ID of the trusted profile.
10. Copy the Profile ID. You use the ID to add a target account to your private catalog.



You linked the private catalog to the trusted profile as a trust relationship and are ready to add a target account.





 Adding a target account 



1. Click the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/icon_hamburger.svg) > Manage > Catalogs > Private catalogs to access your private catalogs.
2. Select the private catalog that you want add a target account to.
3. Click Actions... > Edit catalog details > Add to add a target account.
4. Select Trusted profile ID as the method.
5. Create a unique programmatic name for the target account.
6. Create a display name for the target account. The display name appears as a target account option for users that are onboarding products.
7. Enter the profile ID of the trusted profile. If you do not have the profile ID, see [Updating a trusted profile](https://cloud.ibm.com/docs/account?topic=account-catalog-cross-validatione&interface=uiupdate-create-profile).
8. Click the checkbox to indicate that you set you service authorization for Schematics and Catalog management.
9.
Generate a new IBM Cloud IAM token that includes your IBM Cloud credentials and the account ID that you want to work with.

If you use an IBM Cloud API key, you must use the IBM Cloud account ID the API key was created for. To access Schematics Workspaces or actions in account B, log in to account B and create an IBM Cloud API key that is based on account B.

POST https://iam.cloud.ibm.com/identity/token



Input parameters to get IAM tokens.

 Input parameters Values 

 Header :Content-Type: application/x-www-form-urlencoded:Authorization: Basic Yng6Yng=[^] <br>Yng6Yng= equals the URL-encoded authorization for the username bx and the password bx. 
 Body for IBM Cloud username and password :grant_type: password:response_type: cloud_iam uaa:username: Your IBM Cloud username. :password: Your IBM Cloud password. :uaa_client_ID: cf:uaa_client_secret: <br>Add the uaa_client_secret key with no value specified.:bss_account: The IBM Cloud account ID that you retrieved in the previous step. 
 Body for IBM Cloud API keys :grant_type: urn:ibm:params:oauth:grant-type:apikey:response_type: cloud_iam uaa:apikey: Your IBM Cloud API key.:uaa_client_ID: cf:uaa_client_secret: <br>Add the uaa_client_secret key with no value specified.:bss_account: The IBM Cloud account ID that you retrieved in the previous step. 
 Body for IBM Cloud one-time passcode :grant_type:urn:ibm:params:oauth:grant-type:passcode:response_type: cloud_iam uaa:passcode: Your IBM Cloud passcode. :uaa_client_ID: cf:uaa_client_secret: <br>Add the uaa_client_secret key with no value specified. :bss_account: The IBM Cloud account ID that you retrieved in the previous step. 



Example output

{
* Make sure you have the [administrator role on the catalog management service](https://cloud.ibm.com/docs/account?topic=account-account-servicescatalog-management-account-management) to complete this task.
* To customize catalogs by using Terraform, make sure that you have completed the following:



* Install the Terraform CLI and configure the IBM Cloud Provider plug-in for Terraform. For more information, see the tutorial for [Getting started with Terraform on IBM Cloud®](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-getting-started). The plug-in abstracts the IBM Cloud APIs that are used to complete this task.
* Create a Terraform configuration file to define resources by using HashiCorp Configuration Language. For more information, see the [Terraform documentation](https://www.terraform.io/docs/language/index.html).









 Creating a private catalog with all products included by using the console 

Complete the following steps to create a catalog that includes all products in the IBM Cloud catalog:



1. Go to Manage > Catalogs, in the IBM Cloud console, and click Create a catalog.
2. Select the Product (default) catalog type.
3. Enter a name and description.
4. Make sure the All products option is selected, and click Create. The availability is based on the filters set at the account level on the [Settings page](https://cloud.ibm.com/content-mgmt/catalog-settings).
5. Confirm that the catalog includes all products by clicking the catalog name > Manage filters. Then, check that Include all products in the IBM Cloud catalog is selected in Step 1: Select to include or exclude all products in the IBM Cloud catalog.







 Creating a private catalog with select products included by using the console 

Complete the following steps to create a catalog that includes a specific set of products in the IBM Cloud catalog:



1. Go to Manage > Catalogs, in the IBM Cloud console, and click Create a catalog.
2.
Manually create a child account for centralized administration in the production enterprise ([docs](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-enterprise-add&interface=uicreate-accounts))
3. Onboard deployable architectures for the network and services account and for the central administration account to a private catalog ([docs](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-manifest)). The deployable architecture source can be stored in a private git repo accessible over the public network during the bootstrap procedure.
4. Deploy the network and services account through a project ([docs](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-setup-project)). This includes setting up direct link to provide connectivity to on premises networking.
5. Populate the central administration account through a project. This includes provisioning the schematics agent to enable access to private git repos stored on premises.
6. (optional) Update the private catalog entries for previously onboarded deployable architectures to point to a git repo on the private network.
Now, you’re ready to validate that your product can be successfully installed on the deployment target. [Click Validate product. Click Next > Next > Validate to validate your product.]

Head back to Partner Center and check your progress in the Onboarding checklist. [Once validation is complete, click Go to Partner Center.]

At this point, you’ve completed all the required tasks and you’re ready to submit your product for publishing approval. [Click Request approval.]

Submitting your request automatically notifies our onboarding team that you’re ready to publish your product to the catalog. We’ll review the details that you provided and either approve your product for publishing, or request some updates. You'll get an email with details about any changes that you might need to make.

After your product is approved, you're ready to return to Partner Center and publish it. Your software is now live and available to users in the IBM Cloud catalog. [Click Publish. Click View in IBM Cloud catalog and search for the name of the product to open it.]







 Before you begin 



* Verify that you're using a Pay-As-You-Go or Subscription account. To check which type of account you're using, go to Manage > Account > Account settings in the IBM Cloud console.

It's recommended that you use an account that was created with a [functional ID](https://cloud.ibm.com/docs/account?topic=account-identity-overviewfunctionalid-bestpract) to ensure your continued access to the products that are onboarded in the account.
* Verify that you're assigned the administrator role on all account management services and all IAM-enabled services. See [Assigning access to account management services](https://cloud.ibm.com/docs/account?topic=account-account-services) and [Managing access to resources](https://cloud.ibm.com/docs/account?topic=account-assign-access-resources).
* Review the list of supported software:



* Helm charts on Kubernetes and Red Hat OpenShift on IBM Cloud clusters
* Terraform templates
[Navigation Menu icon](https://cloud.ibm.com/docs-content/v1/content/ff5860bfede49db3197c4bbba7f7123769bdc068/icons/icon_hamburger.svg) > Partner Center > Sell > Get started.
2. Enter the name of your company as you want it to be displayed in the catalog, and click Save. For the purpose of this tutorial, enter Example Corp as the company name.







 Step 2: Create your test environment 

You, or a member of your team, uses the test environment to onboard the virtual server image and validate that it can be deployed to your Power Systems Virtual Server. Your test environment includes a private catalog in which you import the virtual server image from an external repository.



1. Click Create in the Create your test environment section.
2. Enter Example Corp Catalog as the name of the private catalog, and click Create.







 Step 3: Set up access for your team 

You can enlist team members to help with the onboarding process by assigning them specific levels of IBM Cloud Identity and Access Management (IAM) access. To streamline the process of assigning access, complete the following steps to create your access group:



1. Click Assign in the Assign access section.
2. Enter Example Corp Virtual Server Image as the name of the access group, and click Assign. The following roles are assigned to the access group by default:



* Administrator on the Catalog Management service
* Editor on the Partner Center - Sell service
* Editor on the User Management service
* Editor on the IAM Access Groups service
* Viewer on all account management services



For more information about the actions associated with each role, see [Actions and roles for account management services](https://cloud.ibm.com/docs/account?topic=account-account-servicesaccount-management-actions-roles).







 Step 4: Invite team members to your account 

After you create the Example Corp Virtual Server Image access group, you're ready to invite team members to your account and add them to your access group. Team members are granted the following editor permissions by default:
For more information, see [Required access for managing service ID API keys](https://cloud.ibm.com/docs/account?topic=account-serviceidapikeys&interface=uirequired-access-serviceid-keys)
3. Create a policy that grants the trusted profile access to deploy the deployable architecture.

You can choose from a couple of approaches to grant the service ID access to authorize deployments in your account. See [Granting wide-ranging access](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-tp-projectserviceid-access-wide)[Granting specific access](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-tp-projectserviceid-access-specific) for more information.
4. Click Add.







 Granting wide-ranging access 

Grant the trusted profile Administrator access to everything in the account by assigning two policies. Consider this option if you plan to deploy many deployable architectures to the same target account. You can use the same trusted profile for different deployable architectures across projects, eliminating the need to continuously update the trusted profile's access policies.

It's secure and convenient to give the trusted profile a wide range of access because projects have many [governance checks](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-understanding-projectsproject-use) already in place, including pre-deployment validation and a required approval process. By granting Administrator access now, you don't need to update the policy for the multiple deployable architectures that you might use that require different levels of access.



1. To create the first policy, select All Identity and Access enabled services and click Next.



1. Select All resources and click Next.
2. For the resource group access, select the Administrator role and click Next.
3. Select the Manager service role and the Administrator platform role.
4. Click Add.



2. For the second policy, select All Account Management services and click Next.



1. Select the Administrator role.
2.
Generate an API key, then request a refresh token. For more information, see [Generating an IBM Cloud IAM token by using an API key](https://cloud.ibm.com/docs/account?topic=account-iamtoken_from_apikey).
2. Copy one of the following example requests and replace the variables that you want to use.

Example request to create a version 2.5.1 configuration.

curl -X POST "https://containers.cloud.ibm.com/global/v2/storage/satellite/createStorageConfigurationByController" -H "accept: application/json" -H "Authorization: TOKEN" -H "Content-Type: application/json" -d "{ "config-name": "string", "controller": "string", "storage-class-parameters": [ { "additionalProp1": "string", "additionalProp2": "string", "additionalProp3": "string" } ], "storage-template-name": "vsphere-csi-driver", "storage-template-version": "2.5.1", "update-assignments": true, "user-config-parameters": { "entry.name": "INSECURE-FLAG", { "entry.name": "HOST", { "entry.name": "DATACENTERS","user-secret-parameters": { "entry.name": "VCENTER-USERNAME",{ "entry.name": "VCENTER-PASSWORD",{ "entry.name": "THUMBPRINT",}







 Creating a storage assignment in the console 

If you didn't assign your configuration to a cluster or service when you created it, you can create an assignment by completing the following steps.



1. Open the [Satellite console](https://cloud.ibm.com/satellite/locations) in your browser.
2. Select the location where you created your storage configuration.
3. Click the Locations tab, then click Storage.
4. Click the storage configuration that you want to assign to a cluster group.
5.