vania-janet/multiturn-rag-retrieval-data huggingface dataset:
-D, --forcedecision Optional Set the value to true to exit with an error code if the policy evaluation fails. The value defaults to false if this option isn't specified. 
 -E, --ruletype Optional A rule type to consider. If you include this option, only rules of this type are considered in the decision-making process. 
 --region Optional The ibmcloud region of the toolchain. 





 Example 

ibmcloud doi gate-evaluate -P "policyname" -D true -L testapp -N master:199 -I b531487c-9c22-4f3b-9d20-5be408d57891 --region br-sao
or
ibmcloud doi gate-evaluate --policy "policyname" --forcedecision true --logicalappname testapp --buildnumber master:199 --toolchainid b531487c-9c22-4f3b-9d20-5be408d57891







 Updating custom data sets and policies 

The following command creates and updates custom data sets and policies for a toolchain:

ibmcloud doi policies-update --file FILELOCATION --toolchainid TOOLCHAINID [--dryrun] [--region REGION]

The following are command options for updating custom data sets and policies:



Table 6. Command options for updating custom data sets and policies

 Command Options Required or Optional Description 

 -F, --file Required The location of the JSON file that contains the list of custom data sets and policies to add or update. Both absolute and relative paths are accepted. 
 -I, --toolchainid Required If the TOOLCHAIN_ID environment variable is set, this flag is optional. If both the environment variable and the flag are provided, the value of the flag overrides the value of the environment variable. 
 -D, --dryrun Optional The option to simulate only the changes, with no updates. 
 --region Optional The ibmcloud region of the toolchain. 





 Example
Working with Network Interface Card routing 

When working with a VSI that has multiple network interface cards (NICs), pay close attention to its networking settings to avoid connectivity problems. These problems may be due to how the routing works in the VSI and its security group. The default route points to the first NIC. In that case, pinging the address of the first NIC may work, however pinging the address of the second NIC may fail. Your security group may block response traffic that is not associated with inbound traffic.

As per your needs, you may need to change your default route to configure where to route traffic from all source addresses. Or, you may need to add a route to your routing table to configure where to send traffic from specific source addresses.
IBM Cloud Paks Master N/A N/A Removed duplicate repositories in ClusterImagePolicies resources that are installed by IBM Cloud Paks. 
 Load balancer and load balancer monitor for IBM Cloud Provider Master 169 203 Version 2.0 network load balancers (NLB) were updated to fix problems with long-lived network connections to endpoints that failed readiness probes. Updated image for [CVE-2020-1967](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1967). 
 Red Hat OpenShift Master 3.11.200 3.11.216 See the [Red Hat OpenShift release notes](https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.htmlocp-3-11-216). 
 RHEL 7 Packages Worker 3.10.0-1127.el7 3.10.0-1127.8.2.el7 Updated worker node images with kernel package updates for [CVE-2017-18595](https://nvd.nist.gov/vuln/detail/CVE-2017-18595), [CVE-2019-19768](https://nvd.nist.gov/vuln/detail/CVE-2019-19768), and [CVE-2020-10711](https://nvd.nist.gov/vuln/detail/CVE-2020-10711). 







 Change log for worker node fix pack 3.11.216_1550_openshift, released 11 May 2020 

The following table shows the changes that are in the worker node fix pack update 3.11.216_1550_openshift. Worker node patch updates can be applied by updating or reloading the worker node



Changes since version 3.11.200_1549_openshift

 Component Previous Current Description
Updating VMware NSX 

The following information is a summary of the update process for NSX-T Data Center®. Refer to the VMware® guide for the update process for the NSX-T Data Center version that you are upgrading to, for example to update to version 3.2 see [Upgrading NSX-T Data Center](https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.2/upgrade/GUID-E04242D7-EF09-4601-8906-3FA77FBB06BD.html).

VMware provides the [NSX-T Data Center Upgrade Checklist](https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.2/upgrade/GUID-E35506A7-8050-482A-BABA-F356D2AC3B65.html) with the steps that are required to update NSX-T Data Center. In summary, the steps are:



1. Upgrade vCenter, if needed to support the required host OS.
2. Upgrade the host OS, if needed to support the required NSX-T Data Center version.
3. Download the most recent NSX-T Data Center upgrade bundle - The upgrade bundle contains all the files to upgrade the NSX-T Data Center infrastructure.
4. Upgrade NSX-T - The upgrade coordinator runs in the NSX Manager and is a self-contained web application that orchestrates the upgrade of the following components.



* NSX edge cluster - Familiarize yourself with the upgrade impact during and after the NSX Edge cluster upgrade.
* NSX on the hosts - For ESXi hosts that are part of a fully enabled DRS cluster, if the host is not in maintenance mode, the upgrade coordinator requests the host to be put in maintenance mode. vSphere DRS migrates the VMs to another host in the same cluster during the upgrade and places the host in maintenance mode.
* NSX management plane.





Review the following best practice information:
Updating a global rule 

Global compatibility rules can be updated by issuing a PUT request to the /rules/{rule-type} endpoint (where {rule-type} identifies the type of global rule to be updated - currently the only supported type is COMPATIBILITY), with the new rule configuration in the body of the request. If the request is successful, the newly updated rule config is returned in the payload of the response, together with a status code of 200 (OK).

The JSON document that is sent in the request body must have the following properties:



 Property name Description 

 Type Must always be set to the value COMPATIBILITY. 
 Config Must be set to one of the following values: NONE, BACKWARD, BACKWARD_TRANSITIVE, FORWARD, FORWARD_TRANSITIVE, FULL, or FULL_TRANSITIVE (See the section on [compatibility rules](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-ES_schema_registryapplying_compatibility_rules) for details on each of these values). 



Example curl request:

curl -u token:$APIKEY -X PUT $URL/rules/COMPATIBILITY -d '{"type":"COMPATIBILITY","config":"BACKWARD"}'

Example response:

{"type":"COMPATIBILITY","config":"BACKWARD"}

Updating a global rule configuration requires at least:



* Manager role access to the Event Streams cluster resource type.



An activity tracker event is generated to report the action. For more information, see [Activity Tracker events](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-at_eventsevents).





 Getting the current value of a global rule 

The current value of a global rule is retrieved by issuing a GET request to the /rules/{rule-type} endpoint (where {rule-type} is the type of global rule to be retrieved - currently the only supported type is COMPATIBILITY). If the request is successful, the current rule configuration is returned in the payload of the response, together with a status code of 200 (OK).

Example curl request:

curl -u token:$APIKEY $URL/rules/COMPATIBILITY
* Possible breaking change: Review the [Potential WebSphere App Server problems when deployed behind a WebSphere-aware proxy server](https://www.ibm.com/support/pages/node/879485) document to determine if your app is affected. This document includes the steps that are needed to resolve the issue. To resolve the issue, you will need to add a httpDispatcher directive with the trustedSensitiveHeaderOrigin attribute set to "*" and enableWelcomePage set to "false" to the server.xml file.







 1 April 2019 

Updated Liberty buildpack v3.30-20190325-1301
: The default Liberty runtime GA version was changed to the [19.0.0.3](https://openliberty.io/blog/2019/03/28/microprofile22-liberty-19003.html) release.



* The alternate Liberty runtime GA version is also the 19.0.0.3 release.
* The Cloudant client libraries were updated to 2.15.0.
* The IBM JRE version was updated to 8 SR5 FP30.
* Possible breaking change: Review the [Potential WebSphere App Server problems when deployed behind a WebSphere-aware proxy server](https://www.ibm.com/support/pages/node/879485) document to determine if your app is affected. This document includes the steps that are needed to resolve the issue. To resolve the issue, you will need to add a httpDispatcher directive with the trustedSensitiveHeaderOrigin attribute set to "*" and enableWelcomePage set to "false" to the server.xml file.







 20 March 2019 

Updated ASP.NET Core buildpack v2.2-20190319-1114
: This release includes version 2.2.7 of the dotnet-core Cloud Foundry buildpack.



* Add support for .NET ASP.NET Core 2.1.7
* Add support for .NET ASP.NET Core 2.1.8
* Add support for .NET ASP.NET Core 2.2.1
* Add support for .NET ASP.NET Core 2.2.2
IBM Calico extension 954 980 Updated to use Go version 1.17.10. Updated minimal UBI to version 8.5. 
 IBM Cloud Controller Manager v1.23.5-9 v1.23.7-4 Updated to support the Kubernetes 1.23.7 release and Go version 1.17.10 
 IBM Cloud File Storage for Classic plug-in and monitor 408 410 Updated universal base image (UBI) to version 8.6-751 to resolve CVEs. 
 IBM Cloud RBAC Operator 8c8c82b 8c96932 Updated Go to version 1.18.1 
 Key Management Service provider v2.5.4 v2.5.5 Updated Go to version 1.17.10 and updated the golang dependencies. 
 Kubernetes v1.23.6 v1.23.7 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.23.7). 
 Kubernetes Dashboard v2.4.0 v2.4.0 The default Kubernetes Dashboard settings found in the kubernetes-dashboard-settings config map in the kube-system namespace have been updated to set resourceAutoRefreshTimeInterval to 60. This default change is only applied to new clusters. The previous default value was 5. If your cluster has Kubernetes Dashboard performance problems, see the steps for [changing the auto refresh time interval](https://cloud.ibm.com/docs/containers?topic=containers-ts-kube-dashboord-oom). 
 Load balancer and load balancer monitor for IBM Cloud Provider 1916 1998 Updated Go to version 1.17.10 and updated dependencies. 







 Change log for worker node fix pack 1.23.6_1530, released 23 May 2022 

The following table shows the changes that are in the worker node fix pack 1.23.6_1530. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.23.6_1529
Updating plan my-policy-plan-c of the backup policy r138-0521986d-963c-4c18-992d-d6a7a99d115f under account Test Account as user test.user@ibm.com...

ID r138-6f4f08ba-e0bb-470f-bbfb-f3a22aebbfa9
Name my-policy-plan-b
Active true
Lifecycle state updating
Clone policy Max snapshots Zones
3 eu-de-1,eu-de-2

Deletion trigger Delete after Delete over count
20 20

Attached tags daily-backup-plan
Copy tags true
Cron specification 10 20 * * 
Created at 2023-02-21T22:42:32+00:00
Resource type backup_policy_plan

To update locations of fast restore clones of backup snapshots, run the command like the following example. It specifies the backup policy and plan by their IDs. Because only eu-de-1 is specified in the --clone-policy-zones option, fast restore snapshot clones are no longer retained in eu-de-2. The update also changes the number of backup clones to be created and stored in that zone from three to five.

cloudshell:$ ibmcloud is backup-policy-plan-update r138-0521986d-963c-4c18-992d-d6a7a99d115f r138-6f4f08ba-e0bb-470f-bbfb-f3a22aebbfa9 --clone-policy-max-snapshots 5 --clone-policy-zones eu-de-1
Updating plan r138-6f4f08ba-e0bb-470f-bbfb-f3a22aebbfa9 of the backup policy r138-0521986d-963c-4c18-992d-d6a7a99d115f under account Test Account as user test.user@ibm.com...
Check the Health Status field for the version that the add-on is updating to. 
 warning The add-on might not function properly due to cluster limitations. Check the Health Status field for more information. 



The Health Status provides details of what add-on operation is in progress. Each status is described in the following table.



Add-on health statuses

 Status code Add-on health status Description 

 H1500 Addon Ready The add-on is successfully deployed and is healthy. 
 H1501, H1502, H1503 Addon Not Ready Some or all the add-on components are unhealthy. Check whether all add-on component pods are running. Satellite clusters: Also see [Why doesn't my cluster add-on work?](https://cloud.ibm.com/docs/satellite?topic=satellite-addon-errors). 
 H1504, H1505, H1506, H1507, H1508 Failure determining health status. The add-on health can't be determined. [Open a support case](https://cloud.ibm.com/docs/get-support?topic=get-support-using-avatar). In the description, include the error code from the health status. 
 H1509 Addon Unsupported The add-on runs an unsupported version, or the add-on version is unsupported for your cluster version. [Update your add-on to the latest version](https://cloud.ibm.com/docs/containers?topic=containers-managed-addonsupdating-managed-add-ons). 
 H1510 Cluster resources low, not enough workers in Ready state. The add-on is not ready to be used for one of the following reasons:<br><br><br><br> * The cluster does not meet the size criteria for the add-on.<br> * Worker nodes in your cluster are not in a Normal state.
Updating the async stage webhooks 

If you need to update the async webhook token in the pipeline for some reason (for example secret token update), take the following steps:



1.  Find the async webhook trigger, it is added to the triggers of your pipeline, named "Subpipeline Webhook Trigger"
2.  Update the "Secret" value of the trigger, and copy its value and save the trigger
3.  In the Pipeline Environment properties, set the new value to the secret subpipeline-webhook-token



The pipeline run now picks up the new secret value on the next new run, and will trigger your async stages.

The trigger name "Subpipeline Webhook Trigger" and the header name x-async-stage-token in the trigger are fixed, do not change these.

The pipeline variable subpipeline-webhook-token is also fixed. The triggering scripts will look for its content.

You can change the webhook URL and the worker of the trigger as well, if necessary, also any trigger parameters added to the Subpipeline Webhook Trigger will be available in the async stage.



  Related information 

For more information, see the following topics:



*  [Triggering a stage by using async sub pipelines](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops-async-sub-pipelines)
*  [Async, parallel stage runs](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops-async-stages)
* Updates CSI sidecar images to fix [DLA-2542-1](https://www.debian.org/lts/security/2021/dla-2542), [DLA-2509-1](https://www.debian.org/lts/security/2020/dla-2509), and [DLA-2424-1](https://www.debian.org/lts/security/2020/dla-2424).
* Updates the sidecar images to the following versions.



* csi-provisioner: icr.io/ext/sig-storage/csi-provisioner:v2.2.2
* csi-resizer: icr.io/ext/sig-storage/csi-resizer:v1.2.0
* csi-attacher: icr.io/ext/sig-storage/csi-attacher:v3.2.1
* liveness-probe: icr.io/ext/sig-storage/livenessprobe:v2.3.0
* csi-node-driver-registrar: icr.io/ext/sig-storage/csi-node-driver-registrar:v2.2.0



* Updates the Golang version from 1.15.12 to 1.16.7
* Increases the resources to the csi-attacher, csi-resizer, csi-provisioner, ibm-vpc-block-csi-controller, and ibm-vpc-block-csi-node plug-ins to fix containers crashing due to OOM issues.
* Improves volume attach/detach performance by increasing the worker thread count for the csi-attacher sidecar.
* Improves error messaging
* Fixes a bug related to unexpected IAM behavior.
* Changes the version numbering system to X.X.Y_YYY where X.X is the major version number and .Y_YYY is the patch version number.









 Version 3.0.1 

Review the changes in version 3.0.1 of the Block Storage for VPC add-on.



 Change log for version 3.0.1, released 15 July 2021
IBM Calico extension 763 864 Updated to use Go version 1.16.9. Updated universal base image (UBI) to resolve CVEs. 
 IBM Cloud Controller Manager v1.20.11-1 v1.20.11-2 Updated to ignore VPC load balancer (LB) state when a LB delete is requested. 
 IBM Cloud File Storage for Classic plug-in and monitor 400 401 Updated universal base image (UBI) to the latest 8.4-210 version 
 Key Management Service provider v2.3.7 v2.3.8 Updated universal base image (UBI) to the latest 8.4 version to resolve CVEs: [CVE-2021-36222](https://nvd.nist.gov/vuln/detail/CVE-2021-36222), [CVE-2021-37750](https://nvd.nist.gov/vuln/detail/CVE-2021-37750), [CVE-2021-22922](https://nvd.nist.gov/vuln/detail/CVE-2021-22922), [CVE-2021-22923](https://nvd.nist.gov/vuln/detail/CVE-2021-22923), [CVE-2021-22924](https://nvd.nist.gov/vuln/detail/CVE-2021-22924) 







 Change log for worker node fix pack 1.20.11_1559, released 25 October 2021 

The following table shows the changes that are in the worker node fix pack patch update 1.20.11_1559. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.20.11_1555

 Component Previous Current Description 

 Ubuntu 18.04 packages N/A N/A Updated worker node images with package updates. Contains fix for cloud-init performance problem. 
 Worker-pool taint automation N/A N/A Fixes known issue related to worker-pool taint automation that prevents workers from getting providerID.
Before updating the add-on review the [change log](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc_bs_changelog).



1. Check to see if an update is available. If an update is available, the plug-in version is flagged with an asterisk and the latest version is shown. Note the latest version as this value is used later.

ibmcloud oc cluster addons --cluster <cluster_name_or_ID>

Example output

Name Version Health State Health Status
vpc-block-csi-driver 1.0.0* (2.0.0 latest) normal Addon Ready
2. Disable the Block Storage for VPC add-on.

ibmcloud oc cluster addon disable vpc-block-csi-driver --cluster <cluster_name_or_ID> -f

Example output

Disabling add-on vpc-block-csi-driver for cluster <cluster_name_or_ID>...
OK
3. Verify that the add-on is disabled. If the add-on is disabled it does not appear in the list of add-ons in your cluster. The add-on might still display in your list of add-ons for a few minutes after running the disable command.

ibmcloud oc cluster addon ls --cluster <cluster_name_or_ID>
4. Re-enable the add-on and specify the latest version that you retrieved earlier.

ibmcloud oc cluster addon enable vpc-block-csi-driver --version <version> --cluster <cluster_name_or_ID>

Example output

Enabling add-on vpc-block-csi-driver(2.0.0) for cluster <cluster_name_or_ID>...
OK
5. Verify that the add-on is in the Addon Ready state. The add-on might take a few minutes to become ready.

ibmcloud oc cluster addon ls --cluster <cluster_name_or_ID>

Example output
RHEL 7 Packages 3.10.0-1160.42.2.el7 3.10.0-1160.45.1.el7 Updated worker node images and kernel with package updates for [CVE-2021-3778](https://nvd.nist.gov/vuln/detail/CVE-2021-3778) and [CVE-2021-3796](https://nvd.nist.gov/vuln/detail/CVE-2021-3796). 
 Worker-pool taint automation N/A N/A Fixes known issue related to worker-pool taint automation that prevents workers from getting providerID. 







 Change log for worker node fix pack 4.8.13_1528_openshift, released 11 October 2021 

The following table shows the changes that are in the worker node fix pack patch update 4.8.13_1528_openshift. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 4.8.12_1527_openshift

 Component Previous Current Description 

 Red Hat OpenShift 4.8.12 4.8.13 See the [change logs](https://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.htmlocp-4-8-13). The update resolves CVE-2021-25741 (see the [IBM security bulletin](https://www.ibm.com/support/pages/node/6515606)).
unassigned The host is attached to the Satellite location and ready to be [assigned to a Satellite resource](https://cloud.ibm.com/docs/satellite?topic=satellite-assigning-hostshost-assign-manual). If you tried to assign the host unsuccessfully, see [Cannot assign hosts to a cluster](https://cloud.ibm.com/docs/satellite?topic=satellite-assign-fails). 
 unknown The health of the host is unknown. If the host is unassigned, try [assigning the host](https://cloud.ibm.com/docs/satellite?topic=satellite-assigning-hostshost-assign-manual) to a Satellite resource, such as a cluster. If the host is assigned, try debugging the host by following the steps in [debugging the health of the host](https://cloud.ibm.com/docs/satellite?topic=satellite-ts-hosts-debug). If the host still has issues, try removing, updating, and reattaching the host. 
 unresponsive The host did not check in with the Satellite location control plane within the past 5 minutes. The host cannot be assigned when it is unresponsive. Try [debugging the health of the host](https://cloud.ibm.com/docs/satellite?topic=satellite-ts-hosts-debug), particularly the network connectivity.
Why isn't the flow log collector authorized to publish data to the IBM Cloud Object Storage bucket? 

A flow log collector requires a IBM Cloud Object Storage bucket to be defined and accessible. If you see the error log with message ID is.flow-log-collector.00002E, the IBM Cloud Object Storage bucket is not accessible. The flow log collector cannot publish data to the bucket.

To avoid lost data, create a IBM Cloud Object Storage bucket within the next 24 hours to correct this problem.

  What’s happening 

The flow log collector is not authorized to publish data to the IBM Cloud Object Storage bucket: is.flow-log-collector.00002E: Unauthorized access to Cloud Object Storage bucket <BucketName>

  Why it’s happening 

The IBM Cloud Object Storage bucket does not have the correct access to allow the flow log collector to publish data.

  How to fix it 

Check for a defined authorization between the flow log collector and the IBM Cloud Object Storage bucket. If not, add one so that the flow log collector can access the bucket.

To define an authorization, follow these steps:



1.  In the IBM Cloud console, click Manage > Access (IAM).
2.  Select Authorizations from the navigation pane.
3.  Click Create.
4.  For Source service:



*  Select VPC Infrastructure Services. Then, select Services based on attributes.
*  Select Resource type. Then, select Flow Logs for VPC.
*  Select Source resource instance and choose an option.



5.  For Target service:



*  Select Cloud Object Storage. Then, select Services based on attributes.
*  Select Service instance and choose an option.



6.  For Service access, select the Writer role.
7.  Click Authorize.



For more information, see [Creating a flow log collector](https://cloud.ibm.com/docs/vpc?topic=vpc-ordering-flow-log-collector).