vania-janet/multiturn-rag-retrieval-data huggingface dataset:
ansible-playbook --connection=local -i "localhost," powervs-rhel.yml -e @ filesystem_creation_variables
* For SLES

ansible-playbook --connection=local -i "localhost," powervs-sles.yml -e @ filesystem_creation_variables





After successful execution, file systems that are required for HANA installations are available.





 Preparing for SAP installation 

Preparation for SAP installation is needed for SAP HANA and SAP NetWeaver and not required on Power Systems Virtual Server instance for SAP shared file systems.



 Using saptune on SLES for SAP 

Use the saptune tool to apply recommended operating system settings for SAP HANA or SAP NetWeaver on SUSE Linux® Enterprise Server. On IBM Power Systems Virtual Servers, the same SUSE Linux® Enterprise Server image is used for SAP NetWeaver and SAP HANA.

The following workflow shows how you can use the saptune tool to apply the SAP solution to your server. For more information about saptune, see [SAP Note 1275776 - Linux: Preparing SLES for SAP environments](https://launchpad.support.sap.com//notes/1275776).



1. Verify that the package status is current.

zypper info saptune
2. Verify that the saptune version is at least 3.

saptune version
3. List all available solutions. Numbered entries represent integrated SAP Notes for each of the solutions.

saptune solution list
4. Get an overview of saptune options.

saptune --help
5. Enable and start the saptune.service. This command also disables sapconf and tunes, which isn't used since saptune version 3.

saptune service takeover
6. Simulate the changes before you apply them. (optional)

For SAP HANA:

saptune solution simulate HANA

For SAP NetWeaver:

saptune solution simulate NETWEAVER
7. Apply the saptune solution.

For SAP HANA:

saptune solution apply HANA
: Added a reference to the [NVIDIA GPU operator installation guide](https://docs.nvidia.com/datacenter/cloud-native/gpu-operator/getting-started.htmloperator-install-guide) in the [deploying a sample GPU workload](https://cloud.ibm.com/docs/containers?topic=containers-deploy_appgpu_app) topic.

Master versions
: Master fix pack update change log documentation is available for Kubernetes version [1.19.4_1527](https://cloud.ibm.com/docs/containers?topic=containers-changelog_1191194_1527), [1.18.12_1533](https://cloud.ibm.com/docs/containers?topic=containers-118_changelog11812_1533), [1.17.14_1545](https://cloud.ibm.com/docs/containers?topic=containers-117_changelog11714_1545), and [1.16.15_1552](https://cloud.ibm.com/docs/containers?topic=containers-116_changelog11615_1552)..





 13 November 2020 

IBM Cloud Activity Tracker and IAM events
: Added [IAM actions and Activity Tracker events](https://cloud.ibm.com/docs/containers?topic=containers-api-at-iamks-ingress) for the Ingress secret, Ingress ALB, and NLB DNS APIs.





 9 November 2020 

Worker node versions
: Worker node fix pack update change log documentation is available.
See detailed information here on [SAP HANA Deployment Types - SAP HANA Server Installation and Update Guide](https://help.sap.com/viewer/2c1988d620e04368aa4103bf26f17727/latest/en-US/6483b71787f2439c907bd99036559e72.html) and a summary of this information below:



* Approved for production



* Dedicated also known as. Single Application on One SAP HANA System (SCOS)
* Multitenant Database Containers (MDC)



* Approved for production (with restrictions)



* Virtualized Single Tenant - restrictions to the hypervisor; see [SAP Note 1788665 - SAP HANA Support for virtualized / partitioned (multi-tenant) environments](https://launchpad.support.sap.com//notes/1788665)
* Multiple Applications on One SAP HANA System (MCOD) - supported only for approved applications; see [SAP Note 1661202 - Support multiple applications one SAP HANA database / tenant DB](https://launchpad.support.sap.com//notes/1661202)
* Multiple SAP HANA Systems on One Host (MCOS)





Multi-SID hosted with the same physical host, requires significant attention to detailed tasks related to system administration and performance management. For more information, see [SAP Note 1681092 - Multiple SAP HANA systems (SIDs) on the same underlying servers](https://launchpad.support.sap.com//notes/1681092)





 SAP HANA System Type 

System Types are listed by SAP on [SAP HANA System Types](https://help.sap.com/viewer/2c1988d620e04368aa4103bf26f17727/latest/en-US/df16fa40b3dc4ed3b86e575ad6d1198d.html) as:



* Single-host system - one SAP HANA instance on one host server
* Multi-node / distributed / scale-out cluster



A single-host system is the simplest system installation type.
If no version is specified, the default version is installed.







 ibmcloud ks cluster addon get 

Virtual Private Cloud

Classic infrastructure

View the details of an installed add-on.

ibmcloud ks get --addon ADDON --cluster CLUSTER [--output OUTPUT] [-q]

Minimum required permissions
: Viewer platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

--addon ADDON
: Required: The name of the addon. To list installed add-ons, run ibmcloud ks cluster addon ls.

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

--output json
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.





 ibmcloud ks cluster addon ls 

Virtual Private Cloud

Classic infrastructure

List any managed add-ons that are enabled in a cluster.

ibmcloud ks cluster addon ls --cluster CLUSTER

Minimum required permissions
: Viewer platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

--output json
: Optional: Prints the command output in JSON format.





 ibmcloud ks cluster addon options 

Virtual Private Cloud

Classic infrastructure

Before you enable an add-on, view its installation options.

ibmcloud ks cluster addon options --addon ADDON [--output OUTPUT] [-q] [--version VERSION]

Minimum required permissions
: Viewer platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

--addon ADDON
: Required: The name of the addon. To list available add-ons, run ibmcloud ks cluster addon versions.

--output json
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.
In your local R environment, install the ibmdbR package by entering the following command:

install.packages("ibmdbR")

Your local R environment accesses the Comprehensive R Archive Network (CRAN) and automatically downloads and installs the ibmdbR package and any prerequisite packages that are not already installed.
2. Create an ODBC driver connection between your R development environment and your Db2 Warehouse on Cloud database:

a. [Set up your database as an ODBC data source](https://www.ibm.com/support/knowledgecenter/SS6NHC/com.ibm.swg.im.dashdb.doc/connecting/connect_connecting_cli_and_odbc_applications.html).

b. Open your locally installed R development environment.

c. At the R prompt, enter the following statements to create the connection. Replace the placeholders with the [connection information](https://cloud.ibm.com/docs/Db2whc/connecting?topic=Db2whc-db_details_cxn_credsdb_details_cxn_creds) that you collected beforehand.



* If your locally installed R development environment runs in the Db2 Warehouse on Cloud database:

library(ibmdbR)
host.name <- "placeholderForYourHostName"
port <-"placeholderForPortNumber" 50000 if not using SSL or 50001 if using SSL
user.name <-"placeholderForYourUserName"
pwd <- "placeholderForYourPassword"
con.text <- paste("placeholderForYourDSNName;DRIVER=BLUDB",
";Database=BLUDB",
";Hostname=",host.name,
";Port=",port,
";PROTOCOL=TCPIP",
";UID=", user.name,
";PWD=",pwd,sep="")
 Connect to using a odbc Driver Connection string to a remote database
con <- idaConnect(con.text)
apiEndpoint: API_ENDPOINT for example, eu-gb.monitoring.cloud.ibm.com
benchmarkRunner:
deploy: false







 Step 3. Install the helm chart 

To deploy the agent, the Workload Protection components, or both, you must install the sysdig/sysdig-deploy chart and use the variables yaml file that you configured in the previous step.

Run the following command to install the agent by using the helm chart:

helm install -n ibm-observe sysdig-agent sysdig/sysdig-deploy -f agent-values-monitor-secure.yaml

If you encounter the following error: Error: INSTALLATION FAILED: Kubernetes cluster unreachable: xxxxxx failed to refresh token: oauth2: cannot fetch token: 400 Bad Request, set your cluster context and try again.







 Update an agent 

To update the agent version by using Helm, complete the following steps:



1. Update the chart.

helm repo update
2. Find the values yaml file that you used to deploy the agent and modify the agent.image.tag with the version of the agent that you want to deploy.
3. Upgrade the agent.

helm upgrade -n ibm-observe sysdig-agent sysdig/sysdig-deploy -f agent-values-monitor-secure.yaml







 Remove an agent 

To delete the agent by using Helm, you must uninstall the chart.

Complete the following steps:



1. List the charts that are installed.

helm list -n ibm-observe

The output of the command lists charts as follows:

NAME 	NAMESPACE 	REVISION	UPDATED 	STATUS 	CHART 	APP VERSION
sysdig-agent	ibm-observe	1 	2023-03-24 15:02:58.408108 +0100 CET	deployed	sysdig-deploy-1.6.3
2. Uninstall the chart.

helm delete sysdig-agent -n ibm-observe

In terms of Helm, sysdig-agent is the name of teh release.
Install the [Teleport client tool tsh](https://goteleport.com/docs/user-manual/installing-tsh).
2. [Log in using tsh](https://goteleport.com/docs/user-manual/logging-in).

tsh login --proxy=<fqdn of telport server>:3080
3. Run shell or execute a command on a remote SSH node by using the [tsh ssh command](https://goteleport.com/docs/cli-docs/tsh-ssh)

tsh ssh <[user@]host>









 Step 8: Install tools 

Now that the bastion host is set up and configured, you can install the tools that are needed to interact with your infrastructure, such as:



1. [IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli) and associated [plug-ins](https://cloud.ibm.com/docs/cli?topic=cli-plug-ins).
2. [OpenShift Origin CLI](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift-cli).



For information on accessing your Red Hat OpenShift on IBM Cloud cluster via the tools above, see accessing [Red Hat OpenShift clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-access_clusteraccess_oc_cl).





 Step 9: Remove SSH port from security group and access control list 

Now that Teleport is installed and setup, remove SSH port 22 from the allowed list of ports within the configured security group and access control list that is assigned to the virtual server and subnet.





 Related controls in IBM Cloud Framework for Financial Services
On SUSE: zypper update -y; zypper install -y aws-cli. On RHEL: yum update -y; yum install epel-release; yum install -y awscli.







 Setting up NFS server for SAP installation files -- Ansible 

To perform the previous steps through ansible automation, download ansible-galaxy collection ibm.power_linux_sap.

ansible-galaxy collection install ibm.power_linux_sap

After the ansible collection is installed, update the variable file playbook/vars/sample_services_variable_file.yml to set up proxy.

server_config: {
nfs: { enable: true, nfs_directory: "/NFS;/hana/software" }
}

If you also want to install awscli, by using ansible, add update variable file playbook/vars/sample_services_variable_file.yml as

server_config: {
nfs: { enable: true, nfs_directory: "/NFS;/hana/software" },
awscli: { enable: true }
}

After file is updated, run the following ansible-playbook command.

ansible-playbook --connection=local -i "localhost," powervs-services.yml -e @vars/sample_services_variable_file.yml

This ansible execution makes sure that the host for workload services acts as an NFS server and awscli package is installed.





 Setting up NTP proxy and forwarder 



1. Ensure all required ports in the security group in IBM Cloud VPC for workload services that are used by host for private services are open. The needed ports are configured for private services. Required port for NTP forwarder is: 123 (TCP).
2. Log in to the workload services instance. SSH command example:
[Figure 2. Standard installation](https://cloud.ibm.com/docs-content/v1/content/f89cc64b006ca59b35404693959c83d5747fee3e/sap/images/refarch-sap-hana-single-host-only.svg)

Figure 2. SAP NetWeaver 7.x SAP HANA single-host installation with AAS

Architecture of SAP NetWeaver AS for ABAP

SAP tools create a PAS Instance and an ASCS Instance. This method is the standard for Java Stack (System) and is now standard for ABAP Stack.



1. The Primary Application Server (PAS) - An instance is an administrative unit that contains various components of an SAP system. The components of an instance are parameterized in a shared instance profile. Each instance is identified by a system ID and an instance number and includes:



* [SAP Web Dispatcher](https://help.sap.com/saphelp_snc700_ehp01/helpdata/en/f9/e2350eca7f4a109eb0a7bc63135e27/frameset.htm) & Work Process (DIA,BTC,UPD,SPOOL) - The SAP Web Dispatcher lies between the internet and your SAP system. The SAP Web Dispatcher is the entry point for HTTP and HTTPs requests into your system, which consists of one or more SAP NetWeaver application servers. As a “software web switch”, the SAP Web dispatcher can reject or accept connections. When it accepts a connection, it balances the load to ensure an even distribution across the servers. The SAP Web Dispatcher contributes to security and also balances the load in your SAP system.

You can use the SAP Web Dispatcher in ABAP and Java systems, in pure Java systems, and in pure ABAP systems.
To deploy the agent, the Secure components, or both, you must install the sysdig/sysdig-deploy chart and use the variables yaml file that you configured in the previous step.

Run the following command to install the agent by using the helm chart:

helm install -n ibm-observe sysdig-agent sysdig/sysdig-deploy -f agent-values-monitor-secure.yaml

Run the following command to install the agent by using the helm chart and the variables yaml file:

helm install sysdig-agent sysdig/sysdig-deploy --namespace ibm-observe --create-namespace --set global.sysdig.accessKey=<SERVICE_ACCESS_KEY> --set agent.collectorSettings.collectorHost=<INGESTION_ENDPOINT> --set nodeAnalyzer.nodeAnalyzer.apiEndpoint=<API_ENDPOINT> --set global.kspm.deploy=true --set nodeAnalyzer.nodeAnalyzer.benchmarkRunner.deploy=false --set global.clusterConfig.name=<CLUSTER_NAME> --set kspmCollector.apiEndpoint=<API_ENDPOINT> --set agent.image.registry=icr.io --set agent.slim.image.repository=ext/sysdig/agent-slim --set agent.slim.kmoduleImage.repository=ext/sysdig/agent-kmodule

Where



* CLUSTER_NAME is the name of the cluster where you are deploying the agent.
* SERVICE_ACCESS_KEY is the Workload Protection instance access key.
* INGESTION_ENDPOINT is the instance's ingestion endpoint.
* API_ENDPOINT is the intance's API endpoint.



If you encounter the following error: Error: INSTALLATION FAILED: OpenShift cluster unreachable: xxxxxx failed to refresh token: oauth2: cannot fetch token: 400 Bad Request, set your cluster context and try again.







 Update an agent 

To update the agent version by using Helm, complete the following steps:



1. Update the chart.

helm repo update
2.
* In the PVM instance, you can ping the private IP of the proxy by using the ping <private IP of proxy> command.



4. A squid (proxy caching server) must be installed on the VM.
5. Set up squid by completing the following steps:

a. Install the squid base by running the following commands:



* sudo yum update -y
* sudo yum install epel-release
* sudo yum install squid



You must have root authority to run these commands. After the installation completes, the squid config file is stored in the /etc/squid/squid.conf location.

b. Use the configuration provided in the following example for your reference. Values represented in the example configuration denote the following:



* acl localnet src 192.168.0.0/16: the IP ranges of the IBM private network that the proxy will accept.
* acl ibmprivate dst 161.26.0.0/16 and acl ibmprivate dst 166.8.0.0/14: the IP ranges of the IBM networks this proxy will be going to, this is the location of the RHEL satellite servers and SLES RMT servers.
* acl SSL_ports port 443 8443 : Ports used for communication with RHEL satellite servers and SLES RMT servers.
* http_port 3128: the port that will be listening for squid. This will be used as the communication port from your Power Systems Virtual Server VM to the squid proxy.



 Recommended minimum configuration:


 Example rule allowing access from your local networks.
 Adapt to list your (internal) IP networks from where browsing
 should be allowed
acl localnet src 10.0.0.0/8 RFC1918 possible internal network
acl localnet src 172.16.0.0/12 RFC1918 possible internal network
acl localnet src 192.168.0.0/16 RFC1918 possible internal network
acl localnet src fc00::/7 RFC 4193 local private network range
acl localnet src fe80::/10 RFC 4291 link-local (directly plugged) machines
* Add the image pull secret imagePullSecret to access the Infrastructure management images required by the installer.



* imagePullSecret: my-pull-secret

Note:imagePullSecret is the same secret that was created for entitled registry. For more information, see [Create the entitled registry secret](https://www.ibm.com/support/knowledgecenter/SSFC4F_2.1.0/install/prep_online.htmler)





Example CR:

apiVersion: infra.management.ibm.com/v1alpha1
kind: IMInstall
metadata:
labels:
app.kubernetes.io/instance: ibm-infra-management-install-operator
app.kubernetes.io/managed-by: ibm-infra-management-install-operator
app.kubernetes.io/name: ibm-infra-management-install-operator
name: im-iminstall
namespace: management-infrastructure-management
spec:
applicationDomain: inframgmtinstall.apps.mycluster.os.fyre.ibm.com
databaseRegion: 99
imagePullSecret: my-pull-secret
httpdAuthenticationType: openid-connect
httpdAuthConfig: imconnectionsecret
enableSSO: true
initialAdminGroupName: inframgmtusers
license:
accept: true
orchestratorInitialDelay: '2400'
Show more

Apply the CR by using the Red Hat® OpenShift console or the CLI.



 Install by using the OpenShift Console 



1. Verify that the Infrastructure management operator is already installed.
2. Create an instance to deploy Infrastructure management.



1. Browse to Operators > Installed Operators.
2. Click IBM Infrastructure Management Install.
3. Click Create Instance.
4. Select Update YAML (see the example CR)
5. Click Create



3. Verify that pods are running (it can take up to 15 minutes for pods to start).
Typically many organizations have existing Artifactory installations, with network monitoring and network access rules in place to allow secure public access from Artifactory.

A virtual Terraform repository, combining a local repo with a remote proxy repo, allows for hosting of custom providers locally along with secure access to any additional public Terraform providers.



 Configuring a local Artifactory provider registry 

A local Artifactory registry can be used to host custom developed providers for use with agents in a users private network. Artifactory access is configured using the following workspace environment variables, to configure the Terraform CLI to refer to the the local repository and select providers by name and namespace from this registry.

TF_TOKEN_name.artifactory.user.com:<artifactory_local_registry_token>TF_NETWORK_MIRROR_PROVIDER_NAME:"user_namespace/provider_name"TF_NETWORK_MIRROR_URL=https://name.artifactory.user.com/artifactory/api/terraform/user-terraform-virtual/providers/

Refer to the Artifactory documentation and UI to source the values for the bearer token and URL of the local registry.

Schematics will generate a Terraform CLI configuration of the form below.

provider_installation {
network_mirror {
url = "https://name.artifactory.user.com/artifactory/api/terraform/user-terraform-local/providers/"
include = ["user_namespace/provider_name"]
}
direct {
exclude = ["user_namespace/provider_name"]
}
}





 Configuring a remote Artifactory provider registry 

A remote Artifactory registry can be used to cache public providers for use by Terraform, without giving Terraform public network access. Artifactory access is configured using the following workspace environment variables, to configure the Terraform CLI to refer to the the remote repository and retrieve all providers using this proxy registry.
: Optional: Specify the version of the add-on to install. If no version is specified, the default version is installed. Note that Istio version 1.3 is supported only in Kubernetes version 1.15 and earlier clusters, and Istio versions 1.4 and later are supported only in Kubernetes version 1.16 and later clusters.





 ibmcloud ks cluster addon enable static-route 

Virtual Private Cloud

Classic infrastructure

Enable the [static route](https://cloud.ibm.com/docs/containers?topic=containers-static-routes) add-on.

ibmcloud ks cluster addon enable static-route --cluster CLUSTER [--version VERSION]

Minimum required permissions
: Administrator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

--cluster CLUSTER
: Required: The name or ID of the cluster.

--version VERSION
: Optional: Specify the version of the add-on to install. If no version is specified, the default version is installed.





 ibmcloud ks cluster addon enable vpc-block-csi-driver 

Virtual Private Cloud

Enable the [IBM Cloud VPC Block Storage CSI Driver](https://cloud.ibm.com/docs/containers?topic=containers-vpc-block) add-on.

ibmcloud ks cluster addon enable vpc-block-csi-driver --cluster CLUSTER [--version VERSION]

Minimum required permissions
: Administrator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

--cluster CLUSTER
: Required: The name or ID of the cluster.

--version VERSION
: Optional: Specify the version of the add-on to install. If no version is specified, the default version is installed.







 ibmcloud ks cluster addon get 

Virtual Private Cloud

Classic infrastructure

View the details of an installed add-on.

ibmcloud ks get --addon ADDON --cluster CLUSTER [--output OUTPUT] [-q]

Minimum required permissions
: Viewer platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:
Since Infrastructure management is not yet installed, the route is an assumed route as the eventual route doesn't exist yet.

This can be derived by appending the Infrastructure management installation name (default: inframgmtinstall) to the cluster domain.

Example: inframgmtinstall.apps.mycluster.os.fyre.ibm.com

Note: This value in subsequent steps is referenced as <YOUR_IM_HTTPD_ROUTE>. Specify host names using lowercase letters only. Uppercase letters and underscore (_) characters are not permitted in host names.





 Step 4. Register Infrastructure management with IAM as an OIDC client 

Complete these steps on the IBM Cloud Pak for Multicloud Management cluster. Create and update the example registration.json file with the values specific to your cluster. Replace the values in brackets (<>) with your specific values, which are derived from the previous steps.

You can register Infrastructure management as an OIDC client with IAM (Common Services) by using the cloudctl command.

The registration method requires the following registration payload in a file registration.json:

{
"token_endpoint_auth_method": "client_secret_basic",
"client_id": "<YOUR_CLIENT_ID>",
"client_secret": "<YOUR_CLIENT_SECRET>",
"scope": "openid profile email",
"grant_types": [
"authorization_code",
"client_credentials",
"password",
"implicit",
"refresh_token",
"urn:ietf:params:oauth:grant-type:jwt-bearer"
],
"response_types": [
"code",
"token",
"id_token token"
],
"application_type": "web",
"subject_type": "public",
"post_logout_redirect_uris": [
"https://<YOUR_CP4MCM_ROUTE>"
],