vania-janet/multiturn-rag-retrieval-data huggingface dataset:
1.2.12 IBM Cloud Kubernetes Service does not enable the [AlwaysPullImages](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/alwayspullimages) admission controller since it overrides a container's imagePullPolicy and may impact performance. 
 1.2.13 IBM Cloud Kubernetes Service can optionally configure [pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 1.2.16 IBM Cloud Kubernetes Service can optionally configure [pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 1.2.22 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server). 
 1.2.23 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server). 
 1.2.24 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server).
Configure your app to read the environment variable and to parse the JSON content to retrieve the information that you need to access your service.

Example code in Python:

if os.environ.get('BINDING'):
credentials = json.loads(os.environ.get('BINDING'))
8. Optional: As a precaution, add error handling to your app in case that the BINDING environment variable is not set properly.

Example code in Java:

if (System.getenv("BINDING") == null) {
throw new RuntimeException("Environment variable 'SECRET' is not set!");
}

Example code in Node.js:

if (!process.env.BINDING) {
console.error('ENVIRONMENT variable "BINDING" is not set!');
process.exit(1);
}









 Removing a service from a cluster 

If you don't want to use an IBM Cloud service that you bound to your cluster, you can manually remove the Kubernetes secret and the pods that access the secret from your cluster.



1. List the services that are bound to your cluster and note the name of your service and the project that the service is bound to.

ibmcloud oc cluster service ls --cluster

Example output

OK
Service Instance GUID Key Namespace
myservice 12345ab1-1234-1abc-a12b-12abc12a12ab kube-a1a12abcd12a123abc1a12ab1a1234ab7.abcdefg0p1abcd123lgg.default default
2. List the Kubernetes secrets in the project that your service is bound to and look for the secret with a name that follows the binding-<service_name> format.

oc get secrets -n <project> | grep Opaque

Example output

binding-myservice Opaque 1 3d23h
3. Retrieve all the pods that access the secret.
Configure your app to read the environment variable and to parse the JSON content to retrieve the information that you need to access your service.

Example code in Python:

if os.environ.get('BINDING'):
credentials = json.loads(os.environ.get('BINDING'))
8. Optional: As a precaution, add error handling to your app in case that the BINDING environment variable is not set properly.

Example code in Java:

if (System.getenv("BINDING") == null) {
throw new RuntimeException("Environment variable 'SECRET' is not set!");
}

Example code in Node.js:

if (!process.env.BINDING) {
console.error('ENVIRONMENT variable "BINDING" is not set!');
process.exit(1);
}









 Removing a service from a cluster 

If you don't want to use an IBM Cloud service that you bound to your cluster, you can manually remove the Kubernetes secret and the pods that access the secret from your cluster.



1. List the services that are bound to your cluster and note the name of your service and the namespace that the service is bound to.

ibmcloud ks cluster service ls --cluster

Example output

OK
Service Instance GUID Key Namespace
myservice 12345ab1-1234-1abc-a12b-12abc12a12ab kube-a1a12abcd12a123abc1a12ab1a1234ab7.abcdefg0p1abcd123lgg.default default
2. List the Kubernetes secrets in the namespace that your service is bound to and look for the secret with a name that follows the binding-<service_name> format.

kubectl get secrets -n <namespace> | grep Opaque

Example output

binding-myservice Opaque 1 3d23h
3. Retrieve all the pods that access the secret.
Why does the Ingress status show an ERRICCNF error? 

Virtual Private Cloud

Classic infrastructure

You can use the the ibmcloud ks ingress status-report ignored-errors add command to add an error to the ignored-errors list. Ignored errors still appear in the output of the ibmcloud ks ingress status-report get command, but are ignored when calculating the overall Ingress Status.

  What’s happening 

When you check the status of your cluster's Ingress components by running the ibmcloud ks ingress status-report get command, you see an error similar to the following example.

The Ingress controller ConfigMap is not found on the cluster (ERRICCNF).

  Why it’s happening 

The Ingress controller ConfigMap is missing from your cluster.

  How to fix it 

Create the ConfigMap.



1.  Run the following command to create the ConfigMap.

kubectl create -f https://raw.githubusercontent.com/IBM-Cloud/kube-samples/master/ingress-config/ibm-k8s-controller-config.yaml
2.  Wait 10 to 15 minutes, then check if the warning is resolved by running the ibmcloud ks ingress status-report get command.
3.  If the issue persists, contact support. Open a [support case](https://cloud.ibm.com/docs/get-support?topic=get-support-using-avatar). In the case details, be sure to include any relevant log files, error messages, or command outputs.
1.2.12 IBM Cloud Kubernetes Service does not enable the [AlwaysPullImages](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/alwayspullimages) admission controller since it overrides a container's imagePullPolicy and may impact performance. 
 1.2.13 IBM Cloud Kubernetes Service can optionally configure [Pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 1.2.16 IBM Cloud Kubernetes Service can optionally configure [Pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 1.2.22 IBM Cloud Kubernetes Service can optionally [Enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server). 
 1.2.23 IBM Cloud Kubernetes Service can optionally [Enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server). 
 1.2.24 IBM Cloud Kubernetes Service can optionally [Enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server).
*For MacOS, ensure sure you have the certificate imported into your trust store, and mark the certificate as trust always.





 CLI plug-in support for the self-signed certificate 

You can display the decoded certificate for your deployment with the CLI plug-in with the command ibmcloud cdb deployment-cacert "your-service-name". It decodes the base64 into text. Copy and save the command's output to a file and provide the file's path to the driver.







 Other Language Drivers 

MongoDB has a vast array of language drivers. The table covers a few of the most common. If you're looking for more languages, try the [MongoDB.org Driver List](http://www.mongodb.org/display/DOCS/Drivers).
curl -X POST --header 'Content-Type: application/json' --header 'Accept: application/json' --header 'Authorization: Bearer eyJraWQiOiIyMDE3MTAzMC0wMDowMDowMCIsImFsZyI6IlJTMjU2In0.eyJpYW1faWQiOiJpYW0tU2VydmljZUlkLTYxZDdhNzJkLWM3YzAtNGNlZS05Zjg0LWI2ZDc1NzgzMWM2NSIsImlkIjoiaWFtLVNlcnZpY2VJZC02MWQ3YTcyZC1jN2MwLTRjZWUtOWY4NC1iNmQ3NTc4MzFjNjUiLCJyZWFsbWlkIjoiaWFtIiwiaWRlbnRpZmllciI6IlNlcnZpY2VJZC02MWQ3YTcyZC1jN2MwLTRjZWUtOWY4NC1iNmQ3NTc4MzFjNjUiLCJzdWIiOiJTZXJ2aWNlSWQtNjFkN2E3MmQtYzdjMC00Y2VlLTlmODQtYjZkNzU3ODMxYzY1Iiwic3ViX3R5cGUiOiJTZXJ2aWNlSWQiLCJhY2NvdW50Ijp7ImJzcyI6Ijk3MDg5MjkzNTg0OTg1NzBhYjYxMjUwNDk3ZjBmMDI2In0sImlhdCI6MTUzNTM2NTQ5MywiZXhwIjoxNTM1MzY5MDkzLCJpc3MiOiJodHRwczovL2lhbS5ibHVlbWl4Lm5ldC9pZGVudGl0eSIsImdyYW50X3R5cGUiOiJ1cm46aWJtOnBhcmFtczpvYXV0aDpncmFudC10eXBlOmFwaWtleSIsInNjb3BlIjoiaWJtIG9wZW5pZCIsImNsaWVudF9pZCI6ImRlZmF1bHQiLCJhY3IiOjEsImFtciI6WyJwd2QiXX0.ASKxD9Wrz5--OYVkPIsufKK9RNKKhJKuvRldm5mnGNv6PSH7sPBB6NiRG-SSGzEC0ZIei1WqtRE-0TRHwzSnIjXPb3yffBcvNtXuG9wT8GT8zsvxQ7bJk0ovge_0Xrrcym4cCTq2jO6ROWzOZ275wkH0h4fIzukbPv7YpT2Z-DdxIwHY_uALxqcCY83xODtMIs21PO6YwQ3KX4YfNEpKUminJpo45T8po4k049PODQKEK65YrqHYK1_voCJUu9xt9uVoGd-r962fhnbuxeEAe6di9KGVfOGfEdZFHgexoG__wXHa0Rmv9dCl-nNI4WMZfCTj8jgfEOhuZstpW7pW2g' --header 'Accept-Language: en-US' -d '{ "message": { "alert": "Notification alert message" } }' 'https://us-east.imfpush.cloud.ibm.com/imfpush/v1/apps/4809d407-85ff-4d11-ae4b-0fcdf8a833f1/messages'
Show more

For more information about IAM, see [IAM Access](https://cloud.ibm.com/docs/account?topic=account-userroles).
6. Select "All" in the Resources section.
7. Check "IP Spoofing Operator" in the Roles and actions section.
8. Click Add.



To enable IP spoofing from the CLI, run the following command:

ibmcloud iam user-policy-create YOUR_USER_EMAIL_ADDRESS --roles "IP Spoofing Operator" --service-name is





 Understanding the risks 

When you allow IP spoofing on your network interface, consider the potential security risks that are involved. Anyone with the IP Spoofing Operator role not only has permission to enable virtual network appliances, but they can configure an instance to send traffic on behalf of another instance, too. This configuration increases the chance of situations where the platform might be attacked due to the action of an uneducated or malicious user.

Be cautious when you assign the IP Spoofing Operator role to users.





 Alerting for IP spoofing events 

When IP spoofing is modified on a network interface, an Activity Tracker log is generated.

For more information, see the [Getting started tutorial](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started) for Activity Tracker. For more information about setting up alerts, see [Managing alerts through the UI](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-alerts) and [Managing views and alerts programmatically](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-config_api).
(At crawl and index time, only documents that the current user has the right to access are returned.)
* The required and hidden validation settings. They are ignored when the connector is displayed in Discovery
* The use of <condition /> tags in the definition file. These tags are currently ignored.



* When you use the example connector code in the current release, Discovery does not collapse and group authentication settings for the custom connector's properties. For example, even when the {connector_name}_DATASOURCE_SETTINGS_USE_KEY_LABEL toggle is set to Off, the user interface shows the fields for {connector_name}_DATASOURCE_SETTINGS_KEY_LABEL and {connector_name}_DATATSOURCE_SETTINGS_PASSPHRASE_LABEL.
* The list parameter type is not supported.
* If a custom connector fails to connect to its source for any reason, it issues a generic error message such as Failed to create connector or Timed out, or a 500 HTTP error. Specific failure information is not currently provided.

See the [Release notes](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-release-notes-data) for more possible issues.
* [BOOTSTRAP DOCS](https://github.com/twbs/bootstrap/tree/v3.3.2)
* SITE-POLICIES [golang/net](https://github.com/golang/net/archive/161cd47e91fd.zip), DIR.TMPL - SITE POLICIES [golang/tools](https://github.com/golang/tools/archive/bf090417da8b.zip)
* CONTENT-SITE-POLICIES#RESTRICTIONS [golang.org/x/tools](https://proxy.golang.org/golang.org/x/tools/@v/v0.0.0-20201224043029-2b0845dc783e.zip), DOCS [docker/libtrust](https://proxy.golang.org/github.com/docker/libtrust/@v/v0.0.0-20160708172513-aabc10ec26b7.zip), GODOCS btoa (Not Required), GOPROXY-JQUERY-VERSION elazarl/goproxy(Not Required)
For more information about how this mechanism works, see [extending-caches.md](https://github.com/cloudfoundry/java-buildpack/blob/main/docs/extending-caches.md).
* [Cloud Foundry Node.js buildpack](https://github.com/cloudfoundry/nodejs-buildpack). This buildpack provides similar functions by using environment variables. To enable the Node.js buildpack to download node modules from the internet every time, type the following command in the IBM Cloud command-line interface:

set NODE_MODULES_CACHE=false



If the buildpack that you are using doesn't provide a mechanism to load the latest components automatically, you can manually delete the contents in the cache directory and push your app again. Use the following steps:



1. Check out a branch of a null buildpack, for example, [https://github.com/ryandotsmith/null-buildpack](https://github.com/ryandotsmith/null-buildpack). For information about how to check out a branch, see [Git Basics - Getting a Git Repository](http://www.git-scm.com/book/en/v2/Git-Basics-Getting-a-Git-Repository).
2. Add the following line to the null-buildpack/bin/compile file and commit the changes. For information about how to commit changes, see [Git Basics - Recording Changes to the Repository](http://www.git-scm.com/book/en/v2/Git-Basics-Recording-Changes-to-the-Repository).

rm -rfv $2/
3. Push your app with the null buildpack that was modified to delete the cache by using the following command. After you complete this step, all contents in the cache directory of your app are deleted.

ibmcloud cf push appname -p app_path -b <modified_null_buildpack>
4. Push your app with the latest buildpack that you want to use by using the following command:
| base64 -w0 > compose.b64

Make sure that the compose tgz file only contains directories and regular files. Links or pipes are not supported.

Copy the content of compose.b64 as a value of compose -> archive.

compose:
archive: <paste the content of compose.b64 >

For this example, you'd see a response similar to the following output:

compose:
archive: H4sIAKOFmGIAA+2RTW6DMBBGs84pRuyB8Q8k+DIRwZOGtmBkkyrcvhgnLVVV1EWkqhJv4ZHt8ednWZvqhWxcmaYzjpKhed08HETMpQRfd3k2VeRhPpEJCUxymTPkIuOALBOIG8DHq3zn4vrSjiqdLY/nsv+xb2w7nRZywlPgo/4THNm3uiKntgCWdO1aowmZnwLUTflECpwo8Jpu9NyZ2zvQgdADFEudoXyQzSu+fPPzseSvedo6qjV7mDa2anZbdH8totL6somtUlvX8K4SJshDsFKU2NmFvAZuMc9U37wceeys+Y6BI8Fi6+6vxK5RS+YFDh6RNu//tuVlZWVJd4BcjKckQAIAAA=





 The play subsection 

In the play subsection, you can define the workload via [Pod descriptors](https://kubernetes.io/docs/concepts/workloads/pods/). Each pod can contain one or more container definitions. Descriptors can be provided in one of the following ways:



* In plain YAML format in the resources subsection of play. This section is an array of descriptors and supports two types of descriptors: [Pods](https://kubernetes.io/docs/concepts/workloads/pods/) and [ConfigMaps](https://kubernetes.io/docs/concepts/configuration/configmap/).

The following example illustrates how to use the resources section:

workload:
type: workload
play:
resources:
- apiVersion: v1
kind: Pod
metadata:
name: busybox
spec:
containers:
* MASTER SHAKE PHOTO BY SOL GRUNDY (MASTER_SHAKE.JPG) [rest-client (Ruby Gem)](https://rubygems.org/gems/rest-client-1.8.0.gem)
* TXT_KR [golang/text](https://github.com/golang/text/archive/v0.3.0.zip)







 Creative Commons Attribution Share Alike 2.5 Generic 

The Program includes some or all of the following works licensed under the Creative Commons. The URL to the license is [https://creativecommons.org/licenses/by-sa/2.5/legalcode](https://creativecommons.org/licenses/by-sa/2.5/legalcode)

TXT_CN [golang/text](https://github.com/golang/text/archive/v0.3.0.zip)





 Creative Commons Attribution Share Alike 3.0 Generic 

The Program includes some or all of the following works licensed under the Creative Commons. The URL to the license is [https://creativecommons.org/licenses/by-sa/3.0/legalcode](https://creativecommons.org/licenses/by-sa/3.0/legalcode)



* [envoyproxy/protoc-gen-validate](https://github.com/envoyproxy/protoc-gen-validate/archive/v0.1.0.zip)
* TXT_VN [golang/text](https://github.com/golang/text/archive/v0.3.0.zip)
* IMAGES [jQuery-ui (Not Required)](http://jqueryui.com/resources/download/jquery-ui-1.10.3.zip)







 Creative Commons Attribution Share Alike 4.0 Generic 

The Program includes some or all of the following works licensed under the Creative Commons.
Public GitHub (github.com) Personal access token is not required, but you can set one up and use it GitHub user name and password, or GitHub user name and Personal Access token, or just the personal access token as the user name [Configure a GitHub SSH key](https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/) 



If you prefer to use SSH, you can reuse a single key across all Git servers. Create or locate your key and configure it in each server as described in the previous links. If you create your key with a passphrase, you are prompted for that passphrase when you use the key.
2. If you are going to use the Git command line, complete the following steps:

a. Check whether Git is installed. On a command line, type git version. If Git is installed, the version number is shown and you can begin.

b. If Git is not installed, [go to the Git website](http://git-scm.com/downloads).

c. Download and install the version for your operating system. You can accept the default installation values.







 Cloning your project 

Create a local copy of the project files by cloning the Git repo so that you can access the contents of your repo by using any desktop tool.



1. From your toolchain's Overview page, on the Repositories card, click the repo that you want to clone.
2. Gather your repo URL:

a. In GitHub, click Clone or download. To use HTTPS, Select Use HTTPS. To use SSH, click Use SSH. Click the clipboard icon to copy the URL.

b. In Git Repos and Issue Tracking, select either HTTPS or SSH and copy the URL in the field.
3. Open a command line.
4.
* [Install the opm command-line interface](https://docs.openshift.com/container-platform/4.6/cli_reference/opm-cli.htmlopm-cli), including its prerequisite tools such as podman.
* Have a Red Hat account with credentials to pull images from the registry.redhat.io and quay.io registries, or use the [default global pull secret](https://cloud.ibm.com/docs/openshift?topic=openshift-registrycluster_global_pull_secret).



To disable and mirror the OperatorHub source images:



1. Disable the catalog sources as described in [Disabling the default OperatorHub sources](https://docs.openshift.com/container-platform/4.6/operators/admin/olm-restricted-networks.htmlolm-restricted-networks-operatorhub_olm-restricted-networks).
2. Optional: Prune the catalog index to a select list of packages as described in [Pruning an index image](https://docs.openshift.com/container-platform/4.6/operators/admin/olm-restricted-networks.htmlolm-pruning-index-image_olm-restricted-networks). You might prune the catalog to control what images your cluster users can install and to reduce the size of the images in your registry.
3. Mirror the catalog to your compatible registry, such as IBM Cloud Container Registry, as described in [Mirroring an Operator catalog](https://docs.openshift.com/container-platform/4.6/operators/admin/olm-restricted-networks.htmlolm-mirror-catalog_olm-restricted-networks).
* [Create fine-grained personal access tokens](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-tokencreating-a-fine-grained-personal-access-token).
* [Restrict access by fine-grained personal access tokens](https://docs.github.com/en/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organizationrestricting-access-by-fine-grained-personal-access-tokens).
* [Create personal access tokens (classic)](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-tokencreating-a-personal-access-token-classic).
* [Restrict access by personal access tokens (classic)](https://docs.github.com/en/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organizationrestricting-access-by-personal-access-tokens-classic).



* Can I run the terraform init -backend-config="KEY=VALUE" option through CLI?

Schematics does not support you the ability to edit the Terraform [backend configuration](https://developer.hashicorp.com/terraform/language/settings/backends/configurationpartial-configuration). Schematics internally manages the [state-file](https://cloud.ibm.com/docs/schematics?topic=schematics-schematics-cli-referencestate-file-cmds), in its own COS bucket, that are encrypted by using [envelop encryption](https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryption).
* Why are files removed from Terraform, or Ansible templates?
Schematics will generate a Terraform CLI configuration of the form below.

provider_installation {
network_mirror {
url = "https://name.artifactory.user.com/artifactory/api/terraform/user-terraform-remote/providers/"
include = ["/"]
}
direct {
exclude = ["/"]
}
}





 Configuring a virtual Artifactory provider registry 

A virtual Artifactory registry can be used to combine the hosting of custom provides with the caching of public providers for use by Terraform. Artifactory access is configured using the following workspace environment variables, to configure the Terraform CLI to refer to the the virtual repository and retrieve all providers using this proxy registry.

TF_TOKEN_name.artifactory.user.com:<artifactory_virtual_registry_token>TF_NETWORK_MIRROR_URL=https://name.artifactory.user.com>/artifactory/api/terraform/<user-terraform-virtual/providers/

Refer to the Artifactory documentation and UI to source the values for the bearer token and URL of the virtual registry. The virtual repository must be configured as an aggregate of a local and remote registry as discussed in the previous sections.

Schematics will generate a Terraform CLI configuration of the form below.

provider_installation {
network_mirror {
url = "https://name.artifactory.user.com/artifactory/api/terraform/user-terraform-virtual/providers/"
include = ["/"]
}
direct {
exclude = ["/"]
}
}







 Can I inject self signed or TLS certificates in IBM Cloud Kubernetes Service pod or container's trusted CA root certificate store during agent runtime? 

Yes, follow these steps to inject the certificates into an agent runtime.

In the four .cer extension filenames ensure you modify to replace the space with underscore.



1. Create config map by using .cer file as shown in the kubectrl command.