vania-janet/multiturn-rag-retrieval-data huggingface dataset:
An account administrator can give the developer permissions to access the resources on their project by using a combination of access-groups and tags.

As an account administrator, click Manage then Access and select Access groups. You have two access groups set up: one for the soulmate project, one for the FAQ.

There's one developer in the soulmate developer's group. There are no policies set up, so the account administrator needs to assign access. To do so, select all services in the account based on specific attributes. Select Access Management Tags to view all the tags that are available in the account. Since you're creating a policy for the project soulmate, select the corresponding tag. The console shows that the project soulmate tag is mapped to three distinct resources.

Next, select some roles. Give the whole group the viewer role so everyone can view the resources in the list as well as all the functional access to these services. Click Assign to create the policy.

Now there are three services available for the developer. They have access to all three resources and any subresources that might exist.

Flexibility is important, so we've made it easy to share resources between various groups. Let's say an account administrator notices that IBM Cloud Object Storage is great for backup purposes and works well with the FAQ project. The account administrator wants to use IBM Cloud Object Storage in the soulmate project.

Simply edit the Access management tags. Add the project soulmate tag and click Save.

In the resource list, you can confirm that there are two access management tags attached to the Cloud Object Storage instance.

In addition to the original resources, the developer can now see the Cloud Object Storage resource. The instance is available to anyone who has access to project soulmate or project FAQ.

Let's say you don't want the Tone Analyzer service for the soulmate project anymore. Detaching the project soulmate tag from the Tone Analyzer service revokes the developer's access to that service instance. An account administrator can detach the tag by clicking Edit tags, and deleting the tag from the list.

The Tone Analyzer service instance is no longer included in the developer's list of resources.
For more information about the actions associated with each role, see [Actions and roles for account management services](https://cloud.ibm.com/docs/account?topic=account-account-servicesaccount-management-actions-roles).





 Step 4: Add team members to your account 

After you create the Example Corp Operator access group, you're ready to add team members to your account and access group. Team members are granted the following editor permissions by default:



* Partner Center - Sell: Complete onboarding tasks, update the visibility of products at the account level, and request approval to publish products to the IBM Cloud catalog.
* Private catalog: Onboard products to private catalogs, update the visibility of products at the account and private catalog levels, and restrict the visibility of products in the IBM Cloud catalog.





1. Click Invite in the Invite team members section.
2. Select the user type:



* Business: A team member who can provide certain details, such as the product logo, description, and customer support experience.
* Technical: A team member who can import the product to your test environment, configure the deployment details, and validate it's ready for use.



3. Enter the email address of each team member.
4. Click Invite.







 Next steps 

You're ready to start the onboarding process. In the Onboard your product section, click Let's go, and [define the product details for the Operator](https://cloud.ibm.com/docs/sell?topic=sell-operator-define).
[the confirm icon](https://cloud.ibm.com/docs-content/v1/content/cd4be197c8921ed12923aa899ac93a8ab643c158/AnalyticsEngine/images/confirm.png) ![the confirm icon](https://cloud.ibm.com/docs-content/v1/content/cd4be197c8921ed12923aa899ac93a8ab643c158/AnalyticsEngine/images/confirm.png) ![the confirm icon](https://cloud.ibm.com/docs-content/v1/content/cd4be197c8921ed12923aa899ac93a8ab643c158/AnalyticsEngine/images/confirm.png) 
 Invoke Spark History REST API ![the confirm icon](https://cloud.ibm.com/docs-content/v1/content/cd4be197c8921ed12923aa899ac93a8ab643c158/AnalyticsEngine/images/confirm.png) ![the confirm icon](https://cloud.ibm.com/docs-content/v1/content/cd4be197c8921ed12923aa899ac93a8ab643c158/AnalyticsEngine/images/confirm.png) ![the confirm icon](https://cloud.ibm.com/docs-content/v1/content/cd4be197c8921ed12923aa899ac93a8ab643c158/AnalyticsEngine/images/confirm.png) 



To onboard new users to your account:



1. Log on to the [IBM Cloud dashboard](https://cloud.ibm.com).
2. Click Manage -> Access (IAM) from the Manage menu on the IBM Cloud console.
3. On the Manage access and users page, click Invite users.
4.
Why can't I add users to an org? 

You can invite users to your organization only if you're the account owner, or if you're both a manager and a member of the organization.

  What’s happening 

You can't see the Invite a New User link in your Manage Organizations section.

  Why it’s happening 

Only the following IBM Cloud users can invite users to an organization:



*  The account owner of the organization
*  Organization managers who are also members, not collaborators, of the organization



In IBM Cloud, you can be either a member or a collaborator of an organization:

Collaborator
:   If you already have an IBM Cloud account, and someone else invites you to the organization.

Member
:   If you don't have an IBM Cloud account, but then someone invites you to the organization and you sign up for IBM Cloud from the invitation.

You can't invite users to your organization if you're a collaborator of the organization, even if you're assigned as an organization manager.

All organization managers, including collaborators in an organization, can add, modify, and remove users that are already in the organization.

  How to fix it 

If you can't invite users to your organization and need a different role to do so, contact your organization manager to change your role. To identify your organization manager, complete the following steps:



1.  From the IBM Cloud console menu bar, click Manage > Account, and select Company contacts.
2.  Go to your organization, and view the information of organization manager on the USERS tab.



If you can't invite users because you're a collaborator and not a member, you must close your previous IBM Cloud account and then be invited to join the account as a member of the organization. To close your previous account and join the account as a member, complete the following steps:



1.  Contact [IBM Cloud Support](https://cloud.ibm.com/unifiedsupport/supportcenter) to open a support case and request to close your account. If you have data that is associated with your old account that you want to save and move to the new account, include this information in your email.
2.  After your account is closed, have a user with the organization manager role invite you to the organization as an organization manager. Then, sign up for IBM Cloud from the invitation.
sudo sed -i '/^ Specify one or more NTP servers./a IBM Cloud NTPnserver servertime.service.softlayer.com prefer iburst' /etc/ntp.conf
sudo service ntp restart

The command ntpq -p is used to verify NTP. The line remote is 10.0.77.54 is shown in the output, which is the IP address of "servertime.service.softlayer.com".





 Creating the users 

Two users are created on the server. The first user is an account that you can use to connect to the server, as in a subsequent step SSH as root is removed. The second user is an account that is used by Ansible.



1. Using the IP address and the root credentials of the IBM Cloud Portal, from your laptop, connect to the Linux server ssh root@<public_ip_address>.
2. At the command line, enter the following commands and supply a password when prompted.



adduser <your_username>
usermod -aG sudo <your_username>
adduser ansible
usermod -aG sudo ansible





 Creating the key pair for the Ansible user 



1. At the command line, switch to the ansible user with su - ansible.
2. To create a key pair, enter ssh-keygen -b 4096, and follow the prompts. A passphrase complicates the use of the SSH key in automation.







 Creating the key pair for your user 

Suppose that you are using a Mac or Linux laptop to create an SSH key pair and create or update an SSH config file.



1. Log out of the SSH session of the automation server.
2. If you do not have a key pair on your laptop, create one with the command ssh-keygen -b 4096. A passphrase is recommended here.
3. Transfer the public key to the automation server: ssh-copy-id <your_username@<bastion_host_public_ip_address>.
4.
* Power plug must fit a standard 120v socket (NEMA 5-15P).
* Device must be USB 2.0 or USB 3.0 compatible.
* Provide a USB A male connector (standard USB plug that fits most computers).

Encrypted USB devices that require support for proprietary encryption software are not supported for data transfer.



* Can the device be sent back sooner or can it stay longer than two weeks?

Yes, your hardware can be returned at any time or can stay connected longer, if necessary. To request a return on an extension, add a comment to the original data transfer request case with the appropriate request. If you request a return, IBM Cloud® disconnects and returns the hardware to the return address provided in the original request by using the pre-paid shipping labels and packaging that you provided.

If you request an extension, the extension request is processed as quickly as possible. It's important to note that each extension request extends the time that the device is connected for one week and can be subject to an extension fee. More details are added when a member of the IBM Cloud® team responds to the request in the original ticket.

Each status on the data transfer case indicates the phase of the transfer process for the hardware that was submitted to the data center. Refer to the table for specific details on each status:



Table 1. Status definitions.

 Status Definition 

 Sent To SoftLayer The Data Transfer Request was submitted by the user and the hardware is being shipped to the selected data center. 
 Received by SoftLayer The shipment was received by the data center, the device was assigned a serial number and was scanned into the IBM Cloud® system. 
 Connect The hardware is connected to the device. 
 Connected An iSCSI target is created for the device. 
 Request for Extension Client requested an extension on the two-week connection time. 
 Request for Return Client requested the return of hardware. 
 Disconnect Disconnection of hardware was initiated. 
 Disconnected Target is safely detached. 
 Destroyed The device was destroyed on site by following the IBM Cloud® HDD destruction procedure. 
 Return by SoftLayer Hardware was packaged and shipped to the return address provided in the original request. 



* Can I mount DTS on VMware® ESXi servers?
* Viewer on all account management services





For more information about the actions associated with each role, see [Actions and roles for account management services](https://cloud.ibm.com/docs/sell?topic=account-account-servicesaccount-management-actions-roles).





 Step 4: Add team members to your account 

After you create the Example Corp Bundle access group, you're ready to add team members to your account and access group. Team members are granted the following editor permissions by default:



* Partner Center - Sell: Complete onboarding tasks, update the visibility of products at the account level, and request approval to publish products to the IBM Cloud catalog.
* Private catalog: Onboard products to private catalogs, update the visibility of products at the account and private catalog levels, and restrict the visibility of products in the IBM Cloud catalog.





1. Click Invite in the Invite team members section.
2. Select the user type:



* Business: A team member who can provide certain details, such as the product logo, description, and customer support experience.
* Technical: A team member who can import the product to your test environment, configure the deployment details, and validate it's ready for use.



3. Enter the email address of each team member.
4. Click Invite.







 Next steps 

You're ready to start the onboarding process. In the Onboard your product section, click Let's go, and [define the product details for the Operator bundle](https://cloud.ibm.com/docs/sell?topic=sell-bundle-define).
now().after(${start_date}) && now().before(${end_date})





 java.util.Date support 

In addition to the built-in methods, you can use standard methods of the java.util.Date class.

For example, to get the date of the day that falls a week from today, you can use the following syntax:

new Date(new Date().getTime() + (7 * (2460601000L)))

This expression first gets the current date in milliseconds (since January 1, 1970, 00:00:00 GMT). It also calculates the number of milliseconds in 7 days ((2460601000L) represents one day in milliseconds). It then adds 7 days to the current date. The result is the full date of the day that falls a week from today (for example, Fri Jan 26 16:30:37 UTC 2018).







 Number methods 

These methods help you get and reformat number values.

For information about recognizing numbers in customer responses, see [Choosing a response type](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-collect-infochoosing-a-response-type).

If you want to change the decimal placement for a number (for example, to reformat a number as a currency value), see the [String format() method](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-expression-methods-actionsexpression-methods-actions-strings-java-lang-String-format).



 toDouble() 

Converts the object or field to the Double number type. You can call this method on any object or field. If the conversion fails, null is returned.





 toInt() 

Converts the object or field to the Integer number type. You can call this method on any object or field. If the conversion fails, null is returned.





 toLong() 

Converts the object or field to the Long number type. You can call this method on any object or field.
For more information about setting classic infrastructure permissions, see [Managing classic infrastructure access](https://cloud.ibm.com/docs/account?topic=account-mngclassicinfra).







 Managing invitation notifications 

Users can receive an invitation link in their notifications and by email to join an account, if they are already members of IBM Cloud. User managers can invite any user to the IBM Cloud platform if they have an email address to use for an invite.

On the IBM Cloud [Notifications page](https://cloud.ibm.com/notifications), you can use the search field to locate an invitation or filter by the notification type called account. You cannot set email preferences for receiving account type notifications.

Users already present in IBM Cloud will receive an email and a notification with an invitation link. If an email address does not correspond to a known user in IBM Cloud, an invitation email gets sent to accept, but users can also choose not to accept the invitation. For more information, see [Viewing notifications](https://cloud.ibm.com/docs/get-support?topic=get-support-viewing-notifications) and [Inviting users to an account](https://cloud.ibm.com/docs/account?topic=account-iamuserinv).

The invitations expire after 30 days. New users to IBM Cloud can only accept an invitation by using the invitation link they received through email.





 Managing marketing communications 

You might receive notifications about significant technical enhancements, changes to the terms of service, plan changes, pricing changes, and the future removal of a product from the IBM Cloud catalog. With a few exceptions, these announcements are published to the [IBM Cloud blog](https://www.ibm.com/cloud/blog/announcements).

Use the following steps to update your preferences:



1. Log in to the [IBM Privacy Preference Center](https://myibm.ibm.com/profile/dataprivacypreferences/consent/us-en) by using your IBM Cloud credentials. The toggle indicates if your entered credential is your preferred method of contact.
2. Click Next.
3.
Activating XenServer 

The Citrix XenServer free license is licensed for 30 days from the initial install or reload. During this time, you need to register with Citrix and request a fully functional 1-year license. To create this license, Citrix requires personal information that IBM Cloud® doesn't have access to. The license is an agreement between you and Citrix to use XenServer.

If you don't register your system within 30 days, you can't power on any virtual machines.

To register your system, complete the following steps:



1.  Download and install the XenCenter client.
2.  Connect to your private network through the VPN.
3.  Start XenCenter and click Add new server, or click Server > Add... from the drop-down menu.
4.  Use the private IP address for the hostname, 'root' for username, and your root password for Password.
5.  After the system connects, a dialog box appears. This dialog box alerts you that your license expires in 30 days. If you don't see a dialog box, go to Tools > License Manager... from the drop-down menu.
6.  Check your server and click Activate.... A browser opens and goes to the Citrix registration site. Complete the form and submit it. Check your inbox for an email from Citrix. This email has your license key as an attachment.
7.  After you receive the email, save the attached license key file locally.
8.  In the XenCenter left pane, highlight your server. In the menu bar, go to Server > Install license key.... A dialog box appears that asks for the location of the license key. Point it to the saved location from Step 7.
During the reboot, the Key Daemon keeps checking the state by polling, and when the time it takes exceeds kmsTimeout, the virtual server shuts down. You need to [enable the root key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-disable-keys&interface=uienable-ui) to bring the key back to Active.

Make sure that your CRK is not expired. Otherwise, its state becomes Deactivated, and the virtual server reboots and eventually shuts down. For more information about key states, see [Monitoring the lifecycle of encryption keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-key-states).
Default endpoints for IBM Cloud services (IAM, Object Storage, Monitoring, Log Analysis) m65f0b26d6c5f695647f5-6b64a6ccc9c596bf59a86625d8fa2202-c000.us-east.satellite.appdomain.cloud 90 days IBM The Link tunnel server regenerates the certificate, and the Link Connector automatically reboots to reflect the rotated certificate. 
 c000, c001, c002, and c003 subdomains for each location zone s7033baaa45e1ae1a1060-d603ff82e51c94176a53d44566df9d79-c000.us-south.satellite.appdomain.cloud 19800 hours (2.26 years) You Regenerated during a [cluster master refresh](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_apiserver_refresh) or [cluster master update](https://cloud.ibm.com/docs/containers?topic=containers-updatemaster). 
 ce00 Ingress subdomains s7033baaa45e1ae1a1060-d603ff82e51c94176a53d44566df9d79-ce00.us-south.satellite.appdomain.cloud 90 days IBM [Setting up Ingress](https://cloud.ibm.com/docs/openshift?topic=openshift-ingress-roks4). 
 Worker node connection to the API server 10.240.128.09 3 years You [Update hosts that are assigned as worker nodes](https://cloud.ibm.com/docs/satellite?topic=satellite-host-update-workers). 
 Satellite control plane master API endpoint http://c103-1.containers.cloud.ibm.com/ 19800 hours (2.26 years) IBM Regenerated during automated rollouts for major and minor version updates for the Satellite location control plane master hosts.
Why do OpenSSL connections to Let's Encrypt fail after 30 September 2021? 

You experience connectivity issues with OpenSSL versions before 1.1 against websites with the default Let's Encrypt configuration.

 What’s happening 

When you try to connect to websites that have the default Let's Encrypt configuration by using OpenSSL you see an error message similar to the following.

bad result:
connection failed
verify depth is 1
CONNECTED(00000003)
depth=3 C = US, O = (STAGING) Internet Security Research Group, CN = (STAGING) Doctored Durian Root CA X3
verify error:num=10:certificate has expired
notAfter=Jan 30 14:01:15 2021 GMT
140672978626200:error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed:s3_clnt.c:1264:

 Why it’s happening 

Certificates that are automatically generated by Red Hat OpenShift on IBM Cloud have a cross-signature "DST Root CA X3" which expires on 30 September 2021.

Usually, there is no impact due to the certificates having the root certificate "ISRG Root X1", which is trusted by most modern operating systems and web browsers. However, for TLS clients with the containers.appdomain.cloud subdomain that were automatically generated for your cluster during initial cluster provisioning, or those created by using the ibmcloud ks nlb-dns command might be impacted.

TLS clients using OpenSSL 1.1 or greater and newer web browsers aren't impacted. Impacted TLS clients include clients using versions before OpenSSL 1.1. and also have the "DST Root CA X3" in their root truststore.

 How to fix it 

No actions need to be taken to Red Hat OpenShift on IBM Cloud or Satellite. However, if there are TLS clients connecting to the Kubernetes Ingress controller, OpenShift router, or custom services with a containers.appdomain.cloud subdomain, it is recommended that these clients be updated to the latest version to prevent downtime.
set security zone-policy zone OUTSIDE to APP firewall OUTSIDE-TO-APP
commit
3. Validate the VSI in the APP zone can now access services on the Internet. Login to the local VSI using SSH:

ssh root@<VSI Private IP>

use ping and curl to validate icmp and tcp access to sites on the Internet:

ping 8.8.8.8
curl www.google.com







 Step 5: Remove resources 

Steps to take to remove the resources created in this tutorial.

The VRA is on a monthly paid plan. Cancellation does not result in a refund. It is suggested to only cancel if this VRA will not be required again in the next month. If a dual VRA High-Availability cluster is required, this single VRA can be upgraded on the [Gateway Details](https://cloud.ibm.com/classic/network/gatewayappliances) page.



1. Cancel any virtual servers or bare-metal servers
2. Cancel the VRA
3. [Cancel any VLANs](https://cloud.ibm.com/docs/vlans?topic=vlans-cancel-vlan)







 Related content 



* [VRA Network Address Translation](https://cloud.ibm.com/docs/virtual-router-appliance?topic=virtual-router-appliance-about-the-vranetwork-address-translation-nat-)
* [NAT Masquerade](https://cloud.ibm.com/docs/virtual-router-appliance?topic=virtual-router-appliance-setting-up-nat-rules-on-vyatta-5400one-to-many-nat-rule-masquerade-)
* [Supplemental VRA documentation](https://cloud.ibm.com/docs/virtual-router-appliance?topic=virtual-router-appliance-supplemental-vra-documentationsupplemental-vra-documentation).