vania-janet/multiturn-rag-retrieval-data huggingface dataset:
curl -X GET https://private.us-south.atracker.cloud.ibm.com/api/v2/targets -H "Authorization: $ACCESS_TOKEN" -H "content-type: application/json"

Results will show if the target is COS ("target_type": "cloud_object_storage") or an IBM Cloud Activity Tracker Event Routing hosted event search offering ("target_type": "logdna").





 HTTP response codes 

When you use the IBM Cloud Activity Tracker Event Routing REST API, you can get standard HTTP response codes to indicate whether a method completed successfully.



* A 200 response always indicates success.
* A 4xx response indicates a failure.
* A 5xx response usually indicates an internal system error.



See the following table for some HTTP response codes:



Table 3. List of HTTP response codes

 Status code Status Description 

 200 OK The request was successful. 
 201 OK The request was successful. A resource is created. 
 400 Bad Request The request was unsuccessful. You might be missing a parameter that is required. 
 401 Unauthorized The IAM token that is used in the API request is invalid or expired. 
 403 Forbidden The operation is forbidden due to insufficient permissions. 
 404 Not Found The requested resource doesn't exist or is already deleted. 
 429 Too Many Requests Too many requests hit the API too quickly. 
 500 Internal Server Error Something went wrong in IBM Cloud Activity Tracker Event Routing processing.
Limiting instance access to only private endpoints 

You can limit access to an IBM Cloud® Activity Tracker instance to private endpoints only.

You can configure your IBM Cloud Activity Tracker instance so it is accessible through [private endpoints](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-endpoints) only.

If you configure your instance to use private endpoints only, this will block the public endpoints. All API usage that may be in progress on the public endpoints will be blocked when the configuration change is made.

Unless otherwise specified when provisioning an instance, the default is for the instance to be accessible by both public and private endpoints.



 Limiting instances while provisioning 

You can configure your instance to only use private endpoints when you [provision your instance.](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-provision)





 Limiting an existing instance 

If you have an exising instance you can change it to use private endpoints only.



 Limiting the instance using the Observability dashboard 

If you have an existing IBM Cloud Activity Tracker instance and need to change it to be accessible by private endpoints only, do the following using the Observability dashboard:



1. [Log in to your IBM Cloud account](https://cloud.ibm.com/login).

After you log in with your user ID and password, the IBM Cloud dashboard opens.
2. Click the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/icons/icon_hamburger.svg) > Observability.
3. Select Activity Tracker.

The list of IBM Cloud Activity Tracker instances is displayed.

There is 1 instance per region.
4. Select the instance in the region where you want to view events. Then, click Open Dashboard.
5. Select the settings icon.
6. Click Organization > General.
+------------+-----------------------------------------------------------------------------------+
 PrivateKey /Users/username/.hpcs-cert-mgr-cfg/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX.priv 
 PublicKey /Users/username/.hpcs-cert-mgr-cfg/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX.pub 
+------------+-----------------------------------------------------------------------------------+

An automatically generated keypair is stored locally and configured to node remotely, please keep the keypair carefully!!!

command completed successfully.







 hpcs-cert-mgr adminkey delete 

Use this command to delete the administrator signature key for the certificate administrator.

ibmcloud hpcs-cert-mgr adminkey delete --crn HPCS_CRN --admin-priv-key ADMIN_PRIV_KEY [--private]



* Command options

--crn HPCS_CRN
: Required. The crn of your Hyper Protect Crypto Services instance. You can use the ibmcloud resource service-instances --long command to retrieve the crn.

--admin-priv-key ADMIN_PRIV_KEY
: Required. The file path of your current private key that is stored on your local workstation.
[-i, --instance-id INSTANCE_ID]
[-p, --allowed-ip]
[-a, --allowed-network]
[-d, --dual-auth-delete]
[-k, --key-create-import-access]
[-m, --metrics]
[-o, --output OUTPUT]
[-r, --rotation]



 Example 

The example shows how to use the command and the results. If the service has no results to the query, an empty array ([]) will be returned.,

 update the instance policy and set the allowed network to public-and-private
$ ibmcloud kp instance policy-update allowed-network --enable --network-type public-and-private

Updating instance policy...
OK

 list the instance policies
$ ibmcloud kp instance policies

Retrieving policy details for instance: a192d603-0b8d-452f-aac3-f9e1f95e7411...
OK
Created By user id ...<redacted>...
Creation Date 2020-06-22T16:17:52Z
Last Updated 2020-06-22T16:17:52Z
Updated By user id ...<redacted>...
Policy Type allowedNetwork
Enabled true
Network Allowed public-and-private

 disable the instance allowed-network policy
$ ibmcloud kp instance policy-update allowed-network --disable

Updating instance policy...
OK

 list the instance policies - the policy exists and it's disabled
$ ibmcloud kp instance policies

Retrieving policy details for instance: a192d603-0b8d-452f-aac3-f9e1f95e7411...
OK
Created By user id ...<redacted>...
Creation Date 2020-06-22T16:17:52Z
Last Updated 2020-06-22T16:20:08Z
"config_type" : "private_cert_configuration_template",
"created_at" : "2022-11-08T11:22:23Z",
"created_by" : "iam-ServiceId-8e54a866-476b-46cd-ba05-dbeae5f1d984",
"name" : "example-certificate-template",
"secret_type" : "private_cert",
"updated_at" : "2022-11-08T11:22:23Z"
} ],
"total_count" : 6
}







 ibmcloud secrets-manager configuration 

Get a configuration by specifying its name.

A successful request returns the details of your configuration.

ibmcloud secrets-manager configuration --name NAME [--x-sm-accept-configuration-type X-SM-ACCEPT-CONFIGURATION-TYPE]



 Command options 

--name (string)
: The name of the configuration. Required.

The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /^[A-Za-z0-9](?:_-\.[A-Za-z0-9]+)$/.

--x-sm-accept-configuration-type (string)
: The configuration type of this configuration - use this header to resolve 300 error responses.

Allowable values are: public_cert_configuration_ca_lets_encrypt, public_cert_configuration_dns_classic_infrastructure, public_cert_configuration_dns_cloud_internet_services, iam_credentials_configuration, private_cert_configuration_root_ca, private_cert_configuration_intermediate_ca, private_cert_configuration_template.





 Example 

ibmcloud secrets-manager configuration --name=configuration-name --x-sm-accept-configuration-type=private_cert_configuration_root_ca







 ibmcloud secrets-manager configuration-update 

Update a configuration.
"type": "uri"
}
},
}
Show more

Zoom

![Public network access to IBM Cloud](https://cloud.ibm.com/docs-content/v1/content/2a59ee244ed61eb35ab50e45757b42d22f720132/Db2onCloud/connecting/images/public_connection.png)

Figure 1. Public network access to IBM Cloud

Non-admin users can also use allowlisting available in the Db2 on Cloud web console under Settings > Manage Users.









 Connecting to a private endpoint: IBM Cloud service endpoint 

Db2 on Cloud supports private connectivity through an [IBM Cloud service endpoint](https://cloud.ibm.com/docs/account?topic=account-service-endpoints-overview). IBM Cloud service endpoints securely route network traffic between different IBM Cloud services through the IBM Cloud private backplane network. When you configure your Db2 on Cloud instance with IBM Cloud service endpoint connectivity, traffic between your cloud database and applications deployed on your IBM Cloud account will not traverse any public networks.



 How to configure IBM Cloud private endpoint connectivity 

Complete the following steps to enable IBM Cloud private endpoint connectivity for your Db2 on Cloud instance:

Enable your IBM Cloud account to use virtual routing and forwarding (VRF) and IBM Cloud service endpoints. To enable both of these items, see [Enabling VRF and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint).



* For Enterprise and Standard plans



1. On the console, click Administration.
2. Click Access restriction.
3. Select Private endpoints or Public-and-private endpoints and click Update to enable private endpoints.



Zoom

!
Verify that the oc commands run properly with your cluster through the private cloud service endpoint by checking the version.

oc version

Example output

Client Version: 4.5.0-0.okd-2020-09-04-180756
Server Version: 4.5.35
Kubernetes Version: v1.18.3+cdb0358







 Accessing classic clusters through the private cloud service endpoint 

The Red Hat OpenShift master is accessible through the private cloud service endpoint if authorized cluster users are in your IBM Cloud private network or are connected to the private network such as through a [classic VPN connection](https://cloud.ibm.com/docs/iaas-vpn?topic=iaas-vpn-getting-started) or [IBM Cloud Direct Link](https://cloud.ibm.com/docs/dl?topic=dl-get-started-with-ibm-cloud-dl). However, communication with the Kubernetes master over the private cloud service endpoint must go through the 166.X.X.X IP address range, which is not routable from a classic VPN connection or through IBM Cloud Direct Link. You can expose the private cloud service endpoint of the master for your cluster users by using a private network load balancer (NLB). The private NLB exposes the private cloud service endpoint of the master as an internal 10.X.X.X IP address range that users can access with the VPN or IBM Cloud Direct Link connection. If you enable only the private cloud service endpoint, you can use the Red Hat OpenShift web console to create the private NLB.



1. Log in to your [Red Hat OpenShift cluster by using the public cloud service endpoint](https://cloud.ibm.com/docs/openshift?topic=openshift-access_clusteraccess_public_se).
2. Get the private cloud service endpoint URL and port for your cluster.

ibmcloud oc cluster get -c <cluster_name_or_ID>
TCP Any <cidr_range> 3389 
 UDP Any <cidr_range> 3389 
 ICMP Any <cidr_range> Type: 8, Code: Any 



Then, configure outbound rules to allow all TCP traffic:



Table 2. Configuration information for outbound rules

 Protocol Destination Type Source Value 

 TCP Any <cidr_range> Any port 









 Connecting to your Windows bare metal server 

After you create your Windows server and complete the prerequisites, use the following steps to connect to it.



1. Query the status of your server by running the following command. SERVER_ID is the ID for the server that you want to connect:

ibmcloud is bare-metal-server SERVER

When the server shows running, you are ready to retrieve the initialization values to get your password.
2. Run the following command to initialize your server and obtain your password. Specify your server ID for the SERVER_ID variable and your private key for the KEY or KEY_FILE variable:

ibmcloud is bare-metal-server-initialialization-values SERVER_ID [--private-key (KEY | @KEY_FILE)]

This command decodes and decrypts your password, which is automatically generated when you create a server by using a Windows image. The password is decoded and decrypted based on the public SSH Key that you used at creating time and the associated private SSH key that you specify in this bare-metal-server-initialization-values command. For more information, see the [CLI command reference](https://cloud.ibm.com/docs/vpc?topic=vpc-infrastructure-cli-plugin-vpc-referencebare-metal-server-initialization-values).

The following command shows example usage for the bare-metal-server-initialization-values command where 0xx4e27x-33xx-4e7x-a08b-bexx2ac3xx0c is the server ID and /.ssh/id_rsa is the location of the user's private key file:
Now you can add users and service IDs to the access group so that you can assign access to Secrets Manager with a single access policy. For more information, see [Setting up access groups](https://cloud.ibm.com/docs/account?topic=account-groups).







 Assigning access to a secret group 

You can further narrow the scope of access to secrets in your instance by creating and managing

secret groups.



 Assigning access to a secret group in the service UI 

[After you create a secret group for your instance](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-secret-groupscreate-secret-groups), you can use the Secret groups section of the Secrets Manager UI to manage its access.



1. In the console, click the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/icon_hamburger.svg)> Resource List to view a list of your resources.
2. Select your instance of Secrets Manager.
3. In the navigation, click Secret groups.
4. Use the Secret groups table to browse the groups in your instance.
5. In the row of the group that you want to manage, click the Actions menu ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/actions-icon-vertical.svg)> Manage access.
6. Select an access group to give its contained users and service IDs access to your secret group.
7. Choose a combination of [access roles](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam) to assign.
The name of the Secrets Manager instance to remove.

-q
: Optional: Do not show the message of the day or update reminders.

Example:

ibmcloud ks ingress instance unregister --cluster my-cluster --name my-secrets-manager-instance





 ibmcloud ks ingress lb get 

Virtual Private Cloud

Classic infrastructure

Get the configuration of load balancers that expose Ingress ALBs in your cluster.

For example, if you previously ran commands such as [ibmcloud ks ingress lb proxy-protocol enable](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_ingress_lb_proxy-protocol_enable), you can use this command to view your configuration changes.

ibmcloud ks ingress lb get --cluster CLUSTER [--output OUTPUT] [-q]

Minimum required permissions
: Viewer platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

-f
: Optional: Force the command to run with no user prompts.

-q
: Optional: Do not show the message of the day or update reminders.



 Example ingress lb get command 

ibmcloud ks ingress lb get --cluster mycluster







 ibmcloud ks ingress lb proxy-protocol disable 

Virtual Private Cloud

Disable the NGINX PROXY protocol for the load balancers in front of all Ingress ALBs in your cluster so that client connection information is no longer passed in request headers to ALBs.

After you run this command, the existing load balancers are deleted and re-created, which can cause service disruptions. Two unused IP addresses must be available in each subnet during the load balancer recreation.

ibmcloud ks ingress lb proxy-protocol disable --cluster CLUSTER [-f] [-q]

Minimum required permissions
: Operator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.
The name of the Secrets Manager instance to remove.

-q
: Optional: Do not show the message of the day or update reminders.

Example:

ibmcloud ks ingress instance unregister --cluster my-cluster --name my-secrets-manager-instance





 ibmcloud ks ingress lb get 

Virtual Private Cloud

Classic infrastructure

Get the configuration of load balancers that expose Ingress ALBs in your cluster.

For example, if you previously ran commands such as [ibmcloud ks ingress lb proxy-protocol enable](https://cloud.ibm.com/docs/cli?topic=cli-kubernetes-service-clics_ingress_lb_proxy-protocol_enable), you can use this command to view your configuration changes.

ibmcloud ks ingress lb get --cluster CLUSTER [--output OUTPUT] [-q]

Minimum required permissions
: Viewer platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

-f
: Optional: Force the command to run with no user prompts.

-q
: Optional: Do not show the message of the day or update reminders.



 Example ingress lb get command 

ibmcloud ks ingress lb get --cluster mycluster







 ibmcloud ks ingress lb proxy-protocol disable 

Virtual Private Cloud

Disable the NGINX PROXY protocol for the load balancers in front of all Ingress ALBs in your cluster so that client connection information is no longer passed in request headers to ALBs.

After you run this command, the existing load balancers are deleted and re-created, which can cause service disruptions. Two unused IP addresses must be available in each subnet during the load balancer recreation.

ibmcloud ks ingress lb proxy-protocol disable --cluster CLUSTER [-f] [-q]

Minimum required permissions
: Operator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
Display name CLI option Type Description Required? Default value 

 vCenter username vcenter-username Secret The vCenter username. You must specify the username along with the domain name. For example: Administrator@vsphere.local. true N/A 
 vCenter password vcenter-password Secret The vCenter server user password. true N/A 
 Insecure connection insecure-flag Config Include the insecure-flag. true indicates that you want to include the flag, which uses self-signed certificate for login. false indicates that you use a secure connection. If you select false, you must provide an SSL thumbprint. true false 
 vCenter host host Config The vCenter server IP address. true N/A 
 vCenter data centers datacenters Config List all data center paths where host VMs are present, separated by commas. Provide the name of the data center when it is located at the root. When it is placed in the folder, you need to specify the path as folder/data-center-name true N/A 
 SSL certificate thumbprint thumbprint Secret The SSL thumbprint to be used to establish a secure connection to VC. false N/A 









 Getting help and support for VMWare 

If you run into an issue with VMware submit a support request with [VMware Support](https://www.vmware.com/support/contacts.html).
"renewable": false,
"lease_duration": 0,
"data": {
"policies": [
{
"created_by": "iam-ServiceId-c0c7cfa4-b24e-4917-ad74-278f2fee5ba0",
"creation_date": "2021-06-21T14:30:17Z",
"crn": "crn:v1:bluemix:public:secrets-manager:us-south:a/a5ebf2570dcaedf18d7ed78e216c263a:0f4c764e-dc3d-44d1-bd60-a2f7cd91e0c0:policy:ea1907c8-8c8e-6b83-3c20-05f2015b80d8",
"id": "ea1907c8-8c8e-6b83-3c20-05f2015b80d8",
"last_update_date": "2021-06-21T14:33:41Z",
"rotation": {
"interval": 10,
"unit": "day"
},
"type": "application/vnd.ibm.secrets-manager.secret.policy+json",
"updated_by": "iam-ServiceId-c0c7cfa4-b24e-4917-ad74-278f2fee5ba0"
}
]
},
"wrap_info": null,
"warnings": null,
"auth": null
}







 List secret policies 

Retrieves a list of policies that are associated with a secret.



 Example request 

List the policies for an username_password secret.

curl -X GET "https://{instance_id}.
* Adds the cluster pull-secret apply command, which creates an IAM service ID for the cluster, policies, API key, and image pull secrets so that containers that run in the default Kubernetes namespace can pull images from IBM Cloud Container Registry. For new clusters, image pull secrets that use IAM credentials are created by default. Use this command to update existing clusters or if your cluster has an image pull secret error during creation. For more information, see [the doc](https://cloud.ibm.com/docs/openshift?topic=openshift-registrycluster_registry_auth).
* Fixes a bug where ibmcloud oc init failures caused help output to be printed.







 Version 0.2.53 

Version 0.2.53 of the CLI was released on 19 February 2019.



* Fixes a bug where the region was ignored for ibmcloud oc api-key reset, ibmcloud oc credential get/set, and ibmcloud oc vlan spanning get.
* Improves performance for ibmcloud oc worker update.
* Adds the version of the add-on in ibmcloud oc cluster addon enable prompts.







 Version 0.2.44 

Version 0.2.44 of the CLI was released on 8 February 2019.



* Adds --skip-rbac option to the ibmcloud oc cluster config command to skip adding user Kubernetes RBAC roles based on the IBM Cloud IAM service access roles to the cluster configuration. Include this option only if you [manage your own Kubernetes RBAC roles](https://cloud.ibm.com/docs/openshift?topic=openshift-usersrbac). If you use [IBM Cloud IAM service access roles](https://cloud.ibm.com/docs/openshift?topic=openshift-iam-service-access-roles) to manage all your RBAC users, don't include this option. - Updates the Go version to 1.11.5.







 Version 0.2.40 

Version 0.2.40 of the CLI was released on 6 February 2019.
spec:
secretStoreRef:
name: ibmcloud-secrets-manager-example
kind: SecretStore
target:
name: ibmcloud-secrets-manager-example
data:
- secretKey: username
remoteRef:
property: username
key: username_password/<SECRET_ID>
- secretKey: password
remoteRef:
property: password
key: username_password/<SECRET_ID>
Show more

Replace <endpoint_url> with the Secrets Manager endpoint URL that you retrieved [earlier](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-tutorial-kubernetes-secretstutorial-kubernetes-secrets-prepare-sm). Replace <SECRET_ID> with the unique ID of the secret that you created in the previous step.

If you're using a trusted profile to authenticate, replace the auth block with the following snippet.

auth:
containerAuth:
profile: "External Secrets"
iamEndpoint: https://iam.cloud.ibm.com
tokenLocation: /var/run/secrets/tokens/sa-token
3. Apply the configuration to your cluster.

kubectl apply -f external-secrets-example.yml
4. Verify that the External Secrets Operator is able to fetch the secret that is stored in your Secrets Manager instance.

kubectl get secret ibmcloud-secrets-manager-example -o json | jq '.data | map_values(@base64d)'

Example output:

{
"password": "cloudy-rainy-coffee-book",
"username": "user123"
}

Success! You're now able to fetch the secret data that is stored in your Secrets Manager instance. Continue to the next step.









 Step 4: Deploy an app to the cluster 

Finally, you can deploy an application in your cluster that uses the Secrets Manager secret that you defined in the external-secret-example.yml file.