vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Install the Active Directory Domain Services (AD DS) domain controller on this Windows server and join the secondary controller with your on-premises domain.

Domain join your Cloud Connectors, and then run the Cloud Connector registration scripts to add the connectors to the resource location.

The Cloud Connector PowerShell scripts are available in C:postscript.
3. Run the configuration scripts on each of the three connector virtual server instances:



1. Make sure your Connector and Active Directory can talk to each other. Run the ping command if imp is not blocked.
2. Use PowerShell to go to the directory C:postscript.
3. Verify that the ManualRegisterConnector.ps1 command is in the directory.
4. Run the ManualRegisterConnector.ps1 command:

If you are using the APIClientID and APIClientSecret that you used to create the order, enter:

./ManualRegisterConnector.ps1 -ADDomainName {ADDomainName} -ADServerName {ADServerName} -ActiveDirectoryUserName {ActiveDirectoryUserName} -ActiveDirectoryPassword {ActiveDirectoryPassword} -PreferredDnsServer {PreferredDnsServer}

Replace the contents of the {} with the values for your system.

If you need to use a different APIClientID and APIClientSecret enter:

./ManualRegisterConnector.ps1 -APIClientID {APIClientID} -APIClientSecret {APIClientSecret} -ADDomainName {ADDomainName} -ADServerName {ADServerName} -ActiveDirectoryUserName {ActiveDirectoryUserName} -ActiveDirectoryPassword {ActiveDirectoryPassword} -PreferredDnsServer {PreferredDnsServer}

Replace the contents of the {} with the values for your system.









 Extended (Site-to-Site) 

Domain controller latency issues

The Extended (Site-to-Site) option does not have a domain controller (DC) on IBM Cloud.
(https://cloud.ibm.com/docs/containers?topic=containers-ts-app-helm-installts-app-helm-install)





 Managed add-ons 

[Debugging cluster add-ons](https://cloud.ibm.com/docs/containers?topic=containers-debug_addonsdebug_addons)

[Debugging Istio](https://cloud.ibm.com/docs/containers?topic=containers-istio_debug_toolistio_debug_tool)

[Why are the ibm-cloud-provider-ip pods for the Istio ingress gateway stuck in pending?](https://cloud.ibm.com/docs/containers?topic=containers-istio_gateway_affinityistio_gateway_affinity)



* [Moving the istio-ingressgateway pod](https://cloud.ibm.com/docs/containers?topic=containers-istio_gateway_affinitymove-gateway-pod)
* [Moving the ibm-cloud-provider-ip pod](https://cloud.ibm.com/docs/containers?topic=containers-istio_gateway_affinitymove-ip-pod)



[Why are Istio components missing?](https://cloud.ibm.com/docs/containers?topic=containers-istio_components_missingistio_components_missing)

[Why can't I upgrade to version 1.12 of the managed Istio add-on?](https://cloud.ibm.com/docs/containers?topic=containers-ts-addon-istio-webhooksts-addon-istio-webhooks)

[Why does my custom gateway Istio operator have a reconcile loop error?](https://cloud.ibm.com/docs/containers?topic=containers-istio_control_planeistio_control_plane)

[How do I delete Operator Lifecycle Manager components?]
* [ClusterRoleBinding privileged-psp-user does not have expected roleRef](https://cloud.ibm.com/docs/containers?topic=containers-ts-app-pod-securityunexpected-role-ref)
* [ClusterRoleBinding privileged-psp-user does not have expected subjects](https://cloud.ibm.com/docs/containers?topic=containers-ts-app-pod-securitypsp-privilieged-unexpected-subjects)
* [Could not get ClusterRoleBinding restricted-psp-user](https://cloud.ibm.com/docs/containers?topic=containers-ts-app-pod-securitypsp-restrictred-user-missing)
* [ClusterRoleBinding restricted-psp-user does not have expected roleRef](https://cloud.ibm.com/docs/containers?topic=containers-ts-app-pod-securitypsp-restricted-role-ref)
* [ClusterRoleBinding restricted-psp-user does not have expected subjects](https://cloud.ibm.com/docs/containers?topic=containers-ts-app-pod-securitypsp-restricted-subjects)
* [Creating or updating the privileged-psp-user ClusterRoleBinding](https://cloud.ibm.com/docs/containers?topic=containers-ts-app-pod-securitycreate-privileged-psp-user)
* [Creating the restricted-psp-user cluster role binding](https://cloud.ibm.com/docs/containers?topic=containers-ts-app-pod-securitycreate-restricted-psp-user)



[Why can't the cluster pull images from IBM Cloud Container Registry during creation?](https://cloud.ibm.com/docs/containers?topic=containers-ts_image_pull_createts_image_pull_create)

[Why do cluster master operations fail due to a broken webhook?](https://cloud.ibm.com/docs/containers?topic=containers-webhooks_updatewebhooks_update)
Why does DNS resolution fail when CoreDNS pods are restarted? 

Virtual Private Cloud

Classic infrastructure

  What’s happening 

Your app sometimes fails to resolve DNS names for cluster services around the same time that one or more CoreDNS pods are restarted, such as during a worker reload or patch update.

  Why it’s happening 

Your app's DNS request was sent to a CoreDNS pod that was in the process of terminating.

  How to fix it 

To help the CoreDNS pods terminate without disruption, you can edit the coredns configmap in the kube-system namespace.

In the health plug-in configuration of the main Corefile, add lameduck 10s. For more information on customizing CoreDNS, see [Customizing the cluster DNS provider](https://cloud.ibm.com/docs/containers?topic=containers-cluster_dnsdns_customize). The resulting customization looks like the following example.

health {
lameduck 10s
}
Why are the ODF pods stuck at Pending? 

  What’s happening 

When you list pods in the openshift-storage namespace with the oc get pods -n openshift-storage command, the ODF pods are stuck at Pending.

  Why it’s happening 

To determine why your storage cluster status is stuck at Pending, describe the pods that have the status Pending.

oc describe pod <pod> -n openshift-storage

In the output, check the Events section for the following error:

"Error: 0/3 nodes are available: 1 node(s) didn't match pod affinity/anti-affinity, 2 node(s) had volume node affinity conflict"

  How to fix it 

This error indicates that that the classic or VPC cluster where your ODF storage cluster is installed is a multizone cluster, but the storage classes specified in the monStorageClassName or osdStorageClassName fields in your CRD have a VolumeBindingMode parameter that is set to Immediate. Multizone ODF deployments require storage classes that have the VolumeBindingMode parameter set to WaitForFirstConsumer.



1.  [Create custom storage class](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-blockvpc-customize-storage-class) with the VolumeBindingMode set to WaitForFirstConsumer, or choose a pre-existing storage class with the same parameters.
2.  List the name of your ODF storage cluster.

oc get ocscluster

Example output:

NAME             AGE
ocscluster-vpc   71d
3.  Delete the storage cluster.

oc delete ocscluster <ocs_cluster_name>
4.  Verify that your storage cluster is deleted and is not listed.

oc get ocscluster
5.  Re-create the CRD with the pre-existing or custom storage class you chose earlier.
6.  Re-deploy the storage cluster.
Are you getting a "multiple targets" error when working with a target? 

When working with a target, for example, when validating a target using the ibmcloud atracker target validate command and specifying a target name for --target, the following message is returned: Multiple targets were found with the same name - marisa-acc-bucket, use target id instead.

  What’s happening 

Your request fails with an error message that indicates you have more than one target defined with the same name.

  Why it’s happening 

You have more than one target defined with the same name and IBM Cloud Activity Tracker Event Routing cannot identify the unique target when the target name is specified.

  How to fix it 

To work with a target, use the target ID instead of the target name when you have multiple targets defined with the same name.
can't create bucket <bucket_name>: InvalidAccessKeyId: The AWS Access Key ID you provided does not exist in our records The IBM Cloud Object Storage access key ID or the secret access key of your HMAC credentials that you provided in your Kubernetes secret is not correct. See [PVC creation fails due to wrong credentials or access denied](https://cloud.ibm.com/docs/containers?topic=containers-cred_failure). 
 can't create bucket <bucket_name>: CredentialsEndpointError: failed to load credentials <br>can't access bucket <bucket_name>: CredentialsEndpointError: failed to load credentials The IBM Cloud Object Storage API key of your IAM credentials and the GUID of your IBM Cloud Object Storage service instance are not correct. See [PVC creation fails due to wrong credentials or access denied](https://cloud.ibm.com/docs/containers?topic=containers-cred_failure). 
 TokenManagerRetrieveError: error retrieving the token This error occurs when you create a PVC with IAM credentials on a cluster that does not have public outbound access. If your cluster does not have public outbound access, [create an IBM Cloud Object Storage instance that uses HMAC credentials](https://cloud.ibm.com/docs/containers?topic=containers-storage-cos-understandcreate_cos_service). 
 set-access-policy not supported for classic cluster This error occurs when you install the ibm-object-storage-plugin in a Classic cluster and set the bucketAccessPolicy=true option. The bucketAccessPolicy=true option is only used with VPC clusters. [Install the plug-in](https://cloud.ibm.com/docs/containers?topic=containers-storage_cos_install) and set the bucketAccessPolicy=false option.
(https://cloud.ibm.com/docs/openshift?topic=openshift-ts-ocs-pods-pending-statusts-ocs-pods-pending-status)

[Why is the status of my OpenShift Data Foundation storage cluster stuck at Progressing?](https://cloud.ibm.com/docs/openshift?topic=openshift-ocs-ts-error-progressingocs-ts-error-progressing)



* [Error: Cloud credentials secret "ibm-cloud-cos-creds" is not ready yet](https://cloud.ibm.com/docs/openshift?topic=openshift-ocs-ts-error-progressingts-storage-ocs-cos-cred)



[Why are no pods listed in the openshift-storage namespace?](https://cloud.ibm.com/docs/openshift?topic=openshift-ts-ocs-no-podsts-ocs-no-pods)

[What if my OpenShift Data Foundation issue is still unresolved?](https://cloud.ibm.com/docs/openshift?topic=openshift-ocs-error-unresolvedocs-error-unresolved)







 Service limitations 

[Service limitations](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_limitationsopenshift_limitations)



* [Service and quota limitations](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_limitationstech_limits)



* [Version 4 cluster limitations](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_limitationsocp4_limitations)



* [Classic cluster limitations](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_limitationsclassic_limits)
Instead, you can [label worker nodes as edge nodes, and then taint those edge nodes](https://cloud.ibm.com/docs/containers?topic=containers-edge).

If you complete one of the previous options but the keepalived pods are still not scheduled, you can get more information about the keepalived pods:



1. Get the keepalived pods.

kubectl get pods -n ibm-system
2. In the output, look for ibm-cloud-provider-ip pods that have a Status of Pending. Example:

ibm-cloud-provider-ip-169-61-XX-XX-55967b5b8c-7zv9t 0/1 Pending 0 2m <none> <none>
ibm-cloud-provider-ip-169-61-XX-XX-55967b5b8c-8ptvg 0/1 Pending 0 2m <none> <none>
3. Describe each keepalived pod and look for the Events section. Address any error or warning messages that are listed.

kubectl describe pod ibm-cloud-provider-ip-169-61-XX-XX-55967b5b8c-7zv9t -n ibm-system
Deny "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/controller@sha256:80e040a58ce6c4d58ae893eb934777bce013ef8be079967dc3db783d76fa5aaa", no matching repositories in ClusterImagePolicy and no ImagePolicies in the "tekton-pipelines" namespace
Error from server (InternalError): error when creating "https://private-worker-service.us-south.devops.cloud.ibm.com/install": Internal error occurred: admission webhook "trust.hooks.securityenforcement.admission.cloud.ibm.com" denied the request:
Deny "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/webhook@sha256:da75fbdaeb800813d85b99f7f54b665e8d0edbb2c5a7ffc6a99d66aede0291a3", no matching repositories in ClusterImagePolicy and no ImagePolicies in the "tekton-pipelines" namespace

 Why it’s happening 

The private worker installer pulls images from icr.io. Some platforms, such as IBM Cloud Private, do not allow these container registries on the default image policy.

 How to fix it 

Make sure that the policy for pulling images in your cluster supports pulling images from icr.io. For example, if you are installing the private worker framework on IBM Cloud Private, add those policies by using the IBM Cloud Private Web console. For more information about managing image security enforcement by using the IBM Cloud Private Web console, see [Enforcing container image security](https://www.ibm.com/support/knowledgecenter/en/SSBS6K_3.1.0/manage_images/image_security.html).
Why does the DNS Operator show a RouteHealthDegraded or can't marshal DNS message error? 

Virtual Private Cloud

Classic infrastructure

 What’s happening 

You receive an error message similar to one of the following.

The following example error message is displayed when installing IBM Cloud Pak for Data from the console.

XXX.us-south.containers.appdomain.cloud: Get "http://image-registry-openshift-image-registry.ocp-data-privacy-prod-c-XXX.us-south.containers.appdomain.cloud/v2/": dial tcp: lookup image-registry-openshift-image-registry.ocp-data-privacy-prod-c-XXX.us-south.containers.appdomain.cloud on XXX.XX.X.XX:XX: can't marshal DNS message

Example nslookup error.

 nslookup XXX.XXX.databases.appdomain.cloud
Server: XXX.XX.X.XX
Address: XXX.XX.X.XX:XX

Non-authoritative answer:
 Can't find XXX.XXX.databases.appdomain.cloud: Parse error

Non-authoritative answer:
 Can't find XXX.XXX.databases.appdomain.cloud: Parse error

 Why it’s happening 

The fix for [bug 1953097](https://bugzilla.redhat.com/show_bug.cgi?id=1970140) enabled CoreDNS bufsize plug-in responses of 1232 bytes. Some DNS resolvers can't receive responses greater than 512 bytes. Note that DNS resolvers that retry lookups using TCP, such as Dig, are not impacted. DNS clients that don't require UDP DNS messages to exceed 512 bytes are not impacted.

 How to fix it 

Update your cluster master and worker nodes.



1. [Update your cluster master](https://cloud.ibm.com/docs/openshift?topic=openshift-updatemaster).
Instead, you can [label worker nodes as edge nodes, and then taint those edge nodes](https://cloud.ibm.com/docs/containers?topic=containers-edge).



If you completed the previous steps, but the keepalived pods are still not scheduled, you can get more information about the keepalived pods:



1. Get the keepalived pods.

kubectl get pods -n ibm-system
2. In the output, look for ibm-cloud-provider-ip pods that have a Status of Pending. Example:

ibm-cloud-provider-ip-169-61-XX-XX-55967b5b8c-7zv9t 0/1 Pending 0 2m <none> <none>
ibm-cloud-provider-ip-169-61-XX-XX-55967b5b8c-8ptvg 0/1 Pending 0 2m <none> <none>
3. Describe each keepalived pod and look for the Events section. Address any error or warning messages that are listed.

kubectl describe pod ibm-cloud-provider-ip-169-61-XX-XX-55967b5b8c-7zv9t -n ibm-system
If the command returns ibm.io/object-store-endpoint: NA, your cluster is deployed in a location that is supported in IBM Cloud Kubernetes Service but is not yet supported by the IBM Cloud Object Storage plug-in. To add the location to the IBM Cloud Kubernetes Service, post a question in our public Slack or open an IBM Cloud support case. For more information, see [Getting help and support](https://cloud.ibm.com/docs/containers?topic=containers-getting_help_storage).
2. If you manually added the s3fs API endpoint with the ibm.io/endpoint annotation or the IAM API endpoint with the ibm.io/iam-endpoint annotation in your PVC, make sure that you added the endpoints in the format https://<s3fs_api_endpoint> and https://<iam_api_endpoint>. The annotation overwrites the API endpoints that are automatically set by the ibmc plug-in in the IBM Cloud Object Storage storage classes.

kubectl describe pvc <pvc_name>
can't create bucket <bucket_name>: InvalidAccessKeyId: The AWS Access Key ID you provided does not exist in our records The IBM Cloud Object Storage access key ID or the secret access key of your HMAC credentials that you provided in your Kubernetes secret is not correct. See [PVC creation fails due to wrong credentials or access denied](https://cloud.ibm.com/docs/openshift?topic=openshift-cred_failure). 
 can't create bucket <bucket_name>: CredentialsEndpointError: failed to load credentials <br>can't access bucket <bucket_name>: CredentialsEndpointError: failed to load credentials The IBM Cloud Object Storage API key of your IAM credentials and the GUID of your IBM Cloud Object Storage service instance are not correct. See [PVC creation fails due to wrong credentials or access denied](https://cloud.ibm.com/docs/openshift?topic=openshift-cred_failure). 
 TokenManagerRetrieveError: error retrieving the token This error occurs when you create a PVC with IAM credentials on a cluster that does not have public outbound access. If your cluster does not have public outbound access, [create an IBM Cloud Object Storage instance that uses HMAC credentials](https://cloud.ibm.com/docs/openshift?topic=openshift-storage-cos-understandcreate_cos_service). 
 set-access-policy not supported for classic cluster This error occurs when you install the ibm-object-storage-plugin in a Classic cluster and set the bucketAccessPolicy=true option. The bucketAccessPolicy=true option is only used with VPC clusters. [Install the plug-in](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_cos_install) and set the bucketAccessPolicy=false option.
func userNotificationCenter(_ center: UNUserNotificationCenter, didReceive response: UNNotificationResponse, withCompletionHandler completionHandler: @escaping () -> Void) {
switch response.actionIdentifier {
case "Accept":
print("Clicked Accept")
case "Reject":
print("Clicked Reject")
default:
}
completionHandler()
}



This callback method is invoked when user clicks the action button. The implementation of this method must perform tasks that are associated with the specified identifier and run the block in the completionHandler parameter.





 Adding custom DeviceId for registration 

To send DeviceId use the setDeviceId method of ENPushClientOptions class.

let options = ENPushClientOptions();
options.setDeviceId(deviceId: "YOUR_DEVICE_ID");

Remember to keep custom DeviceId unique for each device.





 Enabling rich media notifications 

Rich media notifications are supported on iOS 10 or later. To receive rich media notifications, implement UNNotificationServiceExtension. The extension will intercept and handle the rich media notification.

In the didReceive() method of your service extension, add the following code to retrieve the rich push notification content.

override func didReceive(_ request: UNNotificationRequest, withContentHandler contentHandler: @escaping (UNNotificationContent) -> Void) {
self.contentHandler = contentHandler
bestAttemptContent = (request.content.mutableCopy() as? UNMutableNotificationContent)
ENPushRichPushNotificationOptions.didReceive(request, withContentHandler: contentHandler)
}







 Step 8: Send notifications to the iOS device 

Use the [Send Notification API](https://cloud.ibm.com/apidocs/event-notifications/event-notificationssend-notifications) to send the push notification for the iOS device.
After Watson Assistant is installed, the dataexhausttenant custom resource named wa-data-governor-ibm-data-governor-data-exhaust-internal gets stuck in the Topics phase. When this happens, errors in the Data Governor pods report that the service does not exist.



1. Get the status of the wa-data-governor custom resource:

oc get DataExhaust
2. Wait for the wa-data-governor custom resource to be in the Completed phase:

NAME STATUS VERSION COMPLETED
wa-data-governor Completed master 1s
3. Pause the reconciliation of the wa-data-governor custom resource:

oc patch dataexhaust wa-data-governor -p '{"metadata":{"annotations":{"pause-reconciliation":"true"}}}' --type merge
4. Apply the fix to the dataexhausttenant custom resource:

oc patch dataexhausttenant wa-data-governor-ibm-data-governor-data-exhaust-internal -p '{"spec":{"topics":{"data":{"replicas": 1}}}}' --type merge
5. Wait for the Data Governor pods to stop failing. You can restart the admin pods to speed up this process.
6. Continue the reconciliation of the wa-data-governor custom resource:

oc patch dataexhaust wa-data-governor --type=json -p='[{"op": "remove", "path": "/metadata/annotations/pause-reconciliation"}]'







 RabbitMQ gets stuck in a loop after several installation attempts 

After an initial installation or upgrade failure and repeated attempts to retry, the common services RabbitMQ operator pod can get into a CrashLoopBackOff state. For example, the log might include the following types of messages:

"error":"failed to upgrade release: post-upgrade hooks failed: warning:
Hook post-upgrade ibm-rabbitmq/templates/rabbitmq-backup-labeling-job.yaml
* An order will exceed maximum number of storage volumes allowed error message because you have exceeded the combined quota of file and block storage devices that are allowed per account. [Remove unused storage devices](https://cloud.ibm.com/docs/containers?topic=containers-file_storagestorage_remove_file) or [increase your storage quota](https://cloud.ibm.com/docs/BlockStorage?topic=BlockStorage-managingstoragelimits), and restart the pod.
* A message that images can't be stored because the file storage device is full. [Resize the storage device](https://cloud.ibm.com/docs/openshift?topic=openshift-file_storagefile_change_storage_configuration) and restart the pod.
* A Pull image still failed due to error: unauthorized: authentication required error message because the internal registry can't pull images from an external registry. Check that [the image pull secrets](https://cloud.ibm.com/docs/openshift?topic=openshift-registrycluster_registry_auth) are set for the project and restart the pod.



3. Check the Node that the failing pods run on. If all the pods run on the same worker node, the worker node might have a network connectivity issue. Reload the worker node.

ibmcloud oc worker reload -c <cluster_name_or_ID> -w <worker_node_ID>







 Step 8: Check the OpenVPN 

Check that the OpenVPN in the cluster is set up properly.



1. Check that the OpenVPN pod is Running.

oc get pods -n kube-system -l app=vpn
2. Check the OpenVPN logs, and check for an ERROR message such as WORKERIP:<port>, such asWORKERIP:10250, that indicates that the VPN tunnel does not work.

oc logs -n kube-system <vpn_pod> --tail 10
3. If you see the worker IP error, check if worker-to-worker communication is broken.