vania-janet/multiturn-rag-retrieval-data huggingface dataset:
<br> <br>Resources <br><br><br><br> * ibm_compute_vm_instance<br> * ibm_resource_group<br> * ibm_database<br><br><br> [View code snippet](https://github.com/IBM-Cloud/terraform-provider-ibm/tree/master/examples/ibm-database) 







 DNS templates 



 Name Description and resources Code 

 ibm-private-dns Create an IBM Cloud VPC and an IBM Cloud DNS Services instance, and add the VPC as a permitted network to the DNS service instance. Then, you create different types of DNS records. <br> <br>Resources <br><br><br><br> * ibm_is_vpc<br> * ibm_resource_instance<br> * ibm_dns_zone<br> * ibm_dns_resource_record<br><br><br> [View code snippet](https://github.com/IBM-Cloud/terraform-provider-ibm/tree/master/examples/ibm-private-dns) 







 Internet templates 



 Name Description and resources Code 

 ibm-cis Create an IBM Cloud Internet Services instance and configure the instance with health check monitoring, origin pool, global load-balancing, DNS records, firewall, and limit the rate rules.
client_certificate_forwarding
: Specify the hostname to forward client certificate or not. For example: -v host1=on,host2=on,host3=off

-i, --instance
: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.

--output
: Specify output format, only JSON is supported.





 Examples 

Update access certificates settings for Domain 31984fea73a15b45779fa0df4ef62f9b.

ibmcloud cis access-certificates-settings-update 31984fea73a15b45779fa0df4ef62f9b -f client_certificate_forwarding -v mtls1.example.com=on,mtls2.example.com=off -i cis-demo









 Access policy 



 ibmcloud cis access-policy-create 

Create access policy for a given access application (Enterprise plan only).

ibmcloud cis access-policy-create DNS_DOMAIN_ID ACCESS_APPLICATION_ID --name NAME --decision DECISION --include INCLUDE [-i, --instance INSTANCE] [--output FORMAT]



 Command options 

DNS_DOMAIN_ID
: The ID of DNS domain. Required.

ACCESS_APPLICATION_ID
: The ID of access application. Required.

--name value
: The name of the policy. Required.

--decision value
: Defines the action Access will take if the policy matches the user. Valid values: non_identity. Required.

--include value
: The included rule of the policy. Valid values: certificate, common_name. Required.

-i, --instance
: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.

--output
: Specify output format, only JSON is supported.





 Examples 

Create access policy for access application a5836c2a7ea72d2e225890caea70ae32.
ibmcloud cis logpush-job-update DNS_DOMAIN_ID --destination DESTINATION_URL] --enable true|false] --fields FIELDS | all] --timestamps format] --dataset DATASET] --jobid JOB_ID] --frequency FREQUENCY] -i, --instance INSTANCE] --output FORMAT] ! ! ! ! ! !
<-- <section "id="section-command-options-logpush-job-update" "> --> Command options DNS_DOMAIN_ID: The ID of DNS domain. Required.--destination value: Specify a COS bucket path or a LogDNA path where data will be pushed. Syntax for LogDNA Path: https://{LOGS_REGION_URL}?hostname={DOMAIN}&apikey={LOGDNA_INGRESS_KEY} Example: 'https://logs.eu-de.logging.cloud.ibm.com/logs/ingest?hostname=testv2_logpush&apikey=xxxxxx' Syntax for COS Path: cos://<BUCKET_OBJECT_PATH>?region=<REGION>&instance-id=<IBM_ClOUD_OBJECT_STORAGE_INSTANCE_ID> Example: 'cos://cis-test-bucket/logs?region=us&instance-id=f75e6d90-4212-4026-851c-d572071146cd' To separate logs into daily subfolders, use the special string {DATE} in the bucket path. It will be substituted with the date in YYYYMMDD format, for example '20190423'. Subfolders will be created as appropriate, for example: 'cos://cis-test-bucket/logs/{DATE}?region=us&instance-id=f75e6d90-4212-4026-851c-d572071146cd'--enable value: Enable the job or not. The job is disabled by default.--fields value: Define the list of log fields to be included in log files.
<-- <section "id="section-command-options-logpush-available-fields" "> --> Command options DNS_DOMAIN_ID: The ID of DNS domain. Required.--dataset value: The category of logs you want to receive. This value cannot be changed after the job is created. Valid values: http_requests, range_events, firewall_events. The default value is http_requests.-i , --instance value: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.<-- </section "id="section-command-options-logpush-available-fields" "> --><-- <section "id="section-command-example-logpush-available-fields" "> --> Examples Get all available fields for http_requests logs. ibmcloud cis logpush-available-fields 31984fea73a15b45779fa0df4ef62f9b --dataset http_requests -i cis-demo
<-- </section "id="section-command-example-logpush-available-fields" "> --><-- </section "id="section-get-log-push-available-fields" "> --><-- </section "id="section-log-push-cli-ref" "> --><-- <section "id="section-log-retention-cli-ref" "> --> Log retention (Enterprise plan only) <-- <section "id="section-log-retention" "> --> ibmcloud cis log-retention Get log retention setting for the domain. ibmcloud cis log-retention DNS_DOMAIN_ID -i, --instance INSTANCE] --output FORMAT] ! ! ! ! ! !
<-- <section "id="section-command-options-log-retention" "> --> Command options DNS_DOMAIN_ID: The ID of DNS domain. Required.-i, --instance: Instance name or ID.
[Create a subnet](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-clicreate-a-subnet-cli).
3. Store the subnet ID in a variable to be used in the API command:

export SubnetId=<your_subnet_id>
4. Create a reserved IP, and optionally specify and address in the address property:



curl -X POST -sH "Authorization:${iam_token}" "$vpc_api_endpoint/v1/subnets/$SubnetId/reserved_ips?version=$api_version&generation=2" -d '{"name": "test-reserved-ip", "address": "10.240.0.15"}' | jq



 Deleting a reserved IP 

Use the following API to delete a reserved IP:

curl -X DELETE -sH "Authorization:${iam_token}" "$vpc_api_endpoint/v1/subnets/$SubnetId/reserved_ips/$ReservedIpId?version=$api_version&generation=2"



* The API does not allow you to delete a reserved IP that is bound to a primary network interface. A virtual server instance must have a primary network interface, and all network interfaces must have a reserved IP.
* A reserved IP that is bound to a secondary network interface can be bound to a variety of resources, including but not limited to:



* Network interfaces
* Virtual Private Endpoints (VPEs)
* Load balancers
* VPN gateways
* IKS workers
* DNS Services instances



* Unbinding a reserved IP deletes the reserved IP if the auto-delete property is set to true.





 When auto-delete is disabled 

If you create a reserved IP without binding it, auto-delete is disabled by default. A reserved IP that is unbound cannot have auto-delete enabled.

When the auto-delete option is off, unbinding leaves the reserved IP in place, but doesn't delete the reserved IP.
Show the instance policy for "allowed ip".
* -a, --allowed-network

Show the instance policy for "allowed network".
* -d, --dual-auth-delete

Show the instance policy for "dual authorization delete".
* -k, --key-create-import-access

Retrieves the key create import access policy details of the instance.
* -m, --metrics

Retrieves the metrics policy details of the instance.
* -o, --output

Set the CLI output format. By default, all commands print in table format. To change the output format to JSON, use --output json.
* -r, --rotation

Retrieves rotation policy details of the instance.









 kp instance policy-update allowed-network 

Update the policy for an instance and set the allowed network to public-and-private or private-only.

The allowed-network policy blocks an instance from getting requests from public or private networks.

For existing instances the network access policy is enforced after it is set.

For more information, see [managing network access policies](https://cloud.ibm.com/docs/key-protect?topic=key-protect-managing-network-access-policies).

ibmcloud kp instance policy-update allowed-network
-i, --instance-id INSTANCE_ID
-d, --disable OR
-e, --enable
-t, --network-type NETWORK_TYPE



 Example 

This example sets the "allowed network" policy to "public-and-private".

 update the instance policy and set the allowed network to public-and-private
$ ibmcloud kp instance policy-update allowed-network --enable --network-type public-and-private

Updating instance policy...
OK

 list the instance policies
$ ibmcloud kp instance policies

Retrieving policy details for instance: a192d603-0b8d-452f-aac3-f9e1f95e7411...
OK
If an upstream DNS resolver's cached resource records contains a lower TTL in its cache as a result of its particular caching method, then the minimum TTL observed among all considered resource records might be pushed lower. This results in a DNS response that contains resource records with TTLs lower than the maximum expected duration.







 Viewing, editing, or deleting components of a global load balancer 

To view, edit or delete a load balancer, or one of its components, click an action from the overflow menu ![overflow icon](https://cloud.ibm.com/docs-content/v1/content/d56dbd8ab7d14086029681ee71679e14aea53723/dns-svcs/images/horizontal-overflow-icon.png) on the table row of the load balancer.

The following options are provided for each list.



* Health Checks



* Edit health check - Redirects to the edit flow.
* Delete health check - Shows the confirmation dialog box for the deletion flow.



* Origin Pools



* Edit pool - Redirects to the edit flow.
* Delete pool - Shows the confirmation dialog box for the deletion flow.



* Load Balancers



* Edit load balancer - Redirects to the edit flow.
* Delete load balancer - Shows the confirmation dialog box for the deletion flow.
If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.--output: Specify output format, only JSON is supported.<-- </section "id="section-update-waf-override-options" "> --><-- <section "id="section-update-waf-override-examples" "> --> Examples Update a WAF overide rule under instance cis-demo. ibmcloud cis waf-override-update 31984fea73a15b45779fa0df4ef62f9b a5836c2a7ea72d2e225890caea70ae32 --json '{"description":"Enable IBM Magento ruleset for www.example.com","urls":"www.example.com/"] ! ! ! ,"priority":1,"groups":{"ea8687e59929c1fd05ba97574ad43f77":"default"},"rules":{"100015":"disable"},"rewrite_action":{"default":"block","challenge":"block","simulate":"disable"}}' -i "cis-demo"
<-- </section "id="section-update-waf-override-examples" "> --><-- </section "id="section-update-waf-override" "> --><-- <section "id="section-list-waf-overrides" "> --> ibmcloud cis cis waf-overrides List all URL based Web Application Firewall (WAF) rules. ibmcloud cis waf-overrides DNS_DOMAIN_ID (--json @JSON_FILE | JSON_STRING) -i, --instance INSTANCE] --output FORMAT] ! ! ! ! ! !
Export resource records in zone f1d596fc-7e86-4b99-b912-9508167e9e56 to zone file dns_records.cfg for instance dns-demo.

ibmcloud dns resource-records-export f1d596fc-7e86-4b99-b912-9508167e9e56 --file dns_records.cfg -i "dns-demo"









 Global load balancer 

Manage global load balancers by using the following glb commands.



 ibmcloud dns glb-create 

Create a global load balancer in a zone.

ibmcloud dns glb-create DNS_ZONE_ID --name NAME --default-pools POOL_LIST --fallback-pool POOL_ID [--description DESCRIPTION] [--enabled true|false] [--ttl TTL] [--az-pools AZPOOLS1 --az-pools AZPOOLS2] [-i, --instance INSTANCE] [--output FORMAT]

ibmcloud dns glb-create DNS_ZONE_ID (-j, --json @JSON_FILE | JSON_STRING) [-i, --instance INSTANCE] [--output FORMAT]



 Command options 

DNS_DOMAIN_ID
: The ID of DNS zone. Required.

--json
: The JSON file or JSON string used to describe a global load balancer. Required.



* The required fields in JSON data are name, fallback_pool, default_pools:



* name: The DNS hostname to associate with your load balancer.
* fallback_pool: The pool ID to use when all other pools are detected as unhealthy.
* default_pools: A list of pool IDs ordered by their failover priority.



* The optional fields are description, ttl, az_pools, enabled:



* description: The descriptive text of the load balancer.
* ttl: Time to live (TTL) of the DNS entry for the IP address returned by this load balancer.
"https://{instance_ID}.{region}.secrets-manager.appdomain.cloud/api/v2/configurations"

A successful response adds the configuration to your service instance. For more information about the required and optional request parameters, see [Add a configuration](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2create-config-element).





 Configuring classic infrastructure 

The following example shows a query that you can use to add a classic infrastructure DNS configuration to your Secrets Manager instance. When you call the API, replace the classic_infrastructure_username and classic_infastructure_password (API key) values.

curl -X POST
--H 'Authorization: Bearer {iam_token}" --H "Accept: application/json" --H "Content-Type: application/json" --d '{
"classic_infrastructure_password": "sRBm1jkHOH2kn9oBnK5R0ODsRBm1jkHOH2kn9oBnK5R0ODsRBm1jkHOH2kn9oBnK5R0OD",
"classic_infrastructure_username": "1234567_JohnDoe@mail.com",
"config_type": "public_cert_configuration_dns_classic_infrastructure",
"name": "classic-infrastructure-config"
}' 
"https://{instance_ID}.{region}.secrets-manager.appdomain.cloud/api/v2/configurations"

A successful response adds the configuration to your service instance. For more information about the required and optional request parameters, see [Add a configuration](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2create-config-element).







 Adding a DNS provider configuration with Terraform 

You can add DNS provider configurations to your service instance by using Terraform for Secrets Manager.



 Configuring Cloud Internet Services (CIS) with Terraform
QyBLRVktLS0tLQo="
}

 extract the nonce that was created by the "kp import-token create" command
$ ibmcloud kp import-token show | jq -r '.["nonce"]'

8rf2ldP/zWm1Tjrb

 extract the public key that was created by the "kp import-token create" command
$ ibmcloud kp import-token show | jq -r '.["payload"]'

LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0t ...<redacted>... QyBLRVktLS0tLQo=





 Required parameters 



* -i, --instance-id

The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.









 kp instance policies 

Retrieve details about instance policies, such as allowed networks (public-and-private or private-only), allowed IP policies, key create import access, metrics, and dual-authorization delete (deleting a key requires an authorization from two users).

ibmcloud kp instance policies
[-i, --instance-id INSTANCE_ID]
[-p, --allowed-ip]
[-a, --allowed-network]
[-d, --dual-auth-delete]
[-k, --key-create-import-access]
[-m, --metrics]
[-o, --output OUTPUT]
[-r, --rotation]



 Example 

The example shows how to use the command and the results. If the service has no results to the query, an empty array ([]) will be returned.,

 update the instance policy and set the allowed network to public-and-private
$ ibmcloud kp instance policy-update allowed-network --enable --network-type public-and-private

Updating instance policy...
OK
5. Enter the new worker's name and IP address. Leave the port number empty.
6. Click Save and then click Apply to commit your changes.



6. Create DNS records for the new worker.



1. Log in to the AD NS server for your vCenter Server instance.
2. Using the DNS Manager, add a new A record to the corresponding ocp zone. When you create the A record, make sure the option to create associated PTR record is selected.



7. Approve any certificate signing requests (CSRs) from the bastion. During the provisioning of the new worker, you might have to [approve CSRs](https://docs.openshift.com/container-platform/4.4/installing/installing_vsphere/installing-vsphere.htmlinstallation-approve-csrs_installing-vsphere) from the bastion.



1. Log in to the bastion as the root user and change to the bastion installation directory, as described in [Bastion details](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-ocp_overviewocp_overview-bastion).
2. Before you can run any commands, you must authenticate to Red Hat OpenShift.



* If authentication is not configured and you are using the default kubeadmin account and password, run the command export KUBECONFIG=auth/kubeconfig and verify that you are authenticated by running the command ./oc whoami.
* If other backends or users are authenticated, log in by using one of those accounts as explained in the Red Hat OpenShift documentation, for example, by running the command ./oc login.



3. Run ./oc get nodes to see the new worker. If it is not yet in the Ready state, you must repeatedly check for pending CSRs by using the command ./oc get csr, and then approve the CSRs by using the command ./oc adm certificate approve <csr_name>.
The default value is off.--traffic-type: Determines how data travels from the edge to your origin. Valid values: direct, http, https. The default value is direct.--json: The JSON file or JSON string used to describe a range application.
<-- <ul> -->

* The required fields in JSON data are protocol, dns.

<-- <ul> -->

* protocol: Port configuration at CIS's edge.
* dns: The name and type of DNS record for the range application.

<-- <ul> -->

* name: The name of DNS record for the range application.
* type: The type of DNS record associated with the application. Valid values: CNAME.

<-- </ul> -->

<-- </ul> -->

* The optional fields are origin_direct, origin_dns, origin_port, proxy_protocol, ip_firewall, edge_ips, tls, traffic_type.

<-- <ul> -->

* origin_direct: A list of destination addresses to the origin.
* origin_dns: Method and parameters used to discover the origin server address via DNS.

<-- <ul> -->

* name: DNS record name.

<-- </ul> -->

* origin_port: The destination port at the origin.
* proxy_protocol: Enable Proxy Protocol to the origin. Valid values: on, off, v1, v2, simple. The default value is off. Deprecated. The value on is equivalent to v1.
* ip_firewall: Control whether or not enables the IP Firewall for this application. Valid values: on, off.
* edge_ips: The anycast edge IP configuration for the hostname of this application.

<-- <ul> -->

* type: The type of edge IP configuration specified. Dynamically allocated edge IPs use range anycast IPs in accordance with the connectivity you specify. Valid values: dynamic.
"exclude_cn_from_sans" : false,
"permitted_dns_domains" : [ "exampleString" ],
"use_csr_values" : false,
"ou" : [ "exampleString" ],
"organization" : [ "exampleString" ],
"country" : [ "exampleString" ],
"locality" : [ "exampleString" ],
"province" : [ "exampleString" ],
"street_address" : [ "exampleString" ],
"postal_code" : [ "exampleString" ],
"serial_number" : "d9:be:fe:35:ba:09:42:b5",
"csr" : "exampleString"
}
Show more





 ConfigElementDefConfig 

The following example shows the format of the ConfigElementDefConfig object.

{
"cis_crn" : "crn:v1:bluemix:public:internet-svcs:global:a/<account-id>:<service-instance>::",
"cis_apikey" : "cis_apikey_value"
}





 EngineConfig 

The following example shows the format of the EngineConfig object.

{
"api_key" : "API_KEY"
}





 LockSecretBodyLocksItem[] 

The following example shows the format of the LockSecretBodyLocksItem[] object.

[ {
"name" : "lock-1",
"description" : "lock for consumer-1",
"attributes" : {
"anyKey" : "anyValue"
}
} ]





 SecretAction 

The following example shows the format of the SecretAction object.

{
"payload" : "exampleString",
"custom_metadata" : {
"anyKey" : "anyValue"
},
"version_custom_metadata" : {
"anyKey" : "anyValue"
}
Valid values are true and false.--tls-1-2-only: Specify whether Crypto TLS 1.2 feature is enable for your domain. Enabling this feature prevents use of previous versions. Valid values are on and off.--tls-1-3: Specify whether Crypto TLS 1.3 feature is enabled for your domain. Valid values are on, off.--min-tls-version: Only accept HTTPS requests that use at least the TLS protocol version specified. Valid values: 1.0, 1.1, 1.2, 1.3.-i, --instance: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.--output: Specify output format, only JSON is supported.<-- </section "id="section-update-tls-settings-options" "> --><-- <section "id="section-update-tls-settings-examples" "> --> Examples Update TLS settings for for domain 372e67954025e0ba6aaa6d586b9e0b60. ibmcloud cis tls-settings-update 31984fea73a15b45779fa0df4ef62f9b --mode end-to-end-ca-signed --tls-1-2-only on -i "cis-demo"
<-- </section "id="section-update-tls-settings-examples" "> --><-- </section "id="section-update-tls-settings" "> --><-- <section "id="section-list-cert" "> --> ibmcloud cis certificates List all certificates for a given DNS domain, including shared, dedicated and custom certificates. ibmcloud cis certificates DNS_DOMAIN_ID -i, --instance INSTANCE] --output FORMAT] ! ! ! ! ! !
* Re-encrypt: If you use a custom domain, include --hostname, --cert, and --key options, and optionally the --ca-cert option. For more information about the TLS certificate requirements, see the [Red Hat OpenShift re-encrypt route documentation](https://docs.openshift.com/container-platform/4.11/networking/routes/secured-routes.htmlnw-ingress-creating-a-reencrypt-route-with-a-custom-certificate_secured-routes).

oc create route reencrypt --service <app_service_name> --dest-ca-cert <destca.crt> [--hostname <subdomain> --cert <tls.crt> --key <tls.key> --ca-cert <ca.crt>]



7. Verify that the route for your app service is created.

oc get routes
8. Optional: Customize default routing rules with [optional configurations](https://docs.openshift.com/container-platform/4.11/networking/routes/route-configuration.html). For example, you can use [route-specific HAProxy annotations](https://docs.openshift.com/container-platform/4.11/networking/routes/route-configuration.htmlnw-route-specific-annotations_route-configuration).







 Setting up a third-party load balancer in front of the Red Hat OpenShift Ingress controller 

To health check the IP addresses of the hosts that are registered in the Ingress controller's DNS records, you can set up your own third-party load balancer in front of the IP addresses for the hosts that are assigned as worker nodes to your cluster.

For example, if you remove a host that was assigned to your cluster from your location and replace it with a different host, IBM updates the host IP addresses in your Ingress controller's DNS record for you.