vania-janet/multiturn-rag-retrieval-data huggingface dataset:
"name": "<ADMIN_ID>",
"pass": "<ADMIN_PWD>",
"type": "client",
"attrs": {
"hf.Registrar.Roles": "",
"hf.Registrar.DelegateRoles": "",
"hf.Revoker": true,
"hf.IntermediateCA": true,
"hf.GenCRL": true,
"hf.Registrar.Attributes": "",
"hf.AffiliationMgr": true
}
}
]
},
"affiliations": {
"ibp": []
},
"cfg": {
"identities": {
"passwordattempts": 3
}
}
}
}
Show more

This snippet is provided only as an example of what the modified JSON would resemble. Do not copy and edit this snippet, as it does not contain the custom values for your configuration. Rather, edit the JSON from your console Configuration JSON box because it includes the settings for your node.





 Considerations when including certificates 

Unlike in the Fabric CA configuration file, where specification of a certfile includes a file path and certificate name, in this case you need to base64 encode the certificate file (or a concatenated chain of certificates) and then paste the resulting string into the CA JSON override. To convert a certificate file into base64 format, run the following command:

export FLAG=$(if [ "$(uname -s)" == "Linux" ]; then echo "-w 0"; else echo "-b 0"; fi)
cat <CERT_FILE> | base64 $FLAG



* Replace <CERT_FILE> with the name of the file that you need to encode.



Paste the resulting string into the CA JSON override.





 Modifying CA settings after deployment 

After a CA is deployed, a subset of the fields can be updated as well.
By default, members accounts do not expire. When you add users to your Watson IoT Platform org, you can optionally set an expiry date for their account.



 Adding members to your Watson IoT Platform organization 

To add a member to your organization, you will need the IBMid of the member. To add a member, you do not need confirmation from the member.

To add a single member to your Watson IoT Platform organization:



1. In your Watson IoT Platform dashboard, click Members from the navigation bar.
2. Click Add Members and select the Add tab.
3. Enter the IBMid of the member.
4. Select a role for the member.
5. Optional: Set an expiry date.
6. Click Add.



To add multiple members simultaneously, you must upload a .csv file that contains the IBMid, the role, and the optional expiry date for each member. For information, see [Constructing your CSV file](https://cloud.ibm.com/docs/IoT?topic=IoT-managing-user-accessconstructing-your-csv).



1. In your Watson IoT Platform dashboard, click Members from the navigation bar.
2. Click Add Members and select the Import tab.
3. Browse your files or drag the .csv file into the Upload CSV window.
4. Select a default role to use if a role specified in the CSV file is not recognized.
5. Map the column numbers in your CSV file to the corresponding IBMid, role, and optional expiry date entries.
6. Select the appropriate comma or semicolon column separator to match the separator used in your .csv file.
7. Click Import to import the IBMids and create the members.







 Constructing your CSV file 

When you construct a CSV file to import members into your organization, ensure that you include the required information for the method that you are using. Use either commas or semicolons to separate columns.
[Available](https://cloud.ibm.com/docs-content/v1/content/11f96f96f8f4b60cf6f3fa4d904856a2c4528bc2/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/11f96f96f8f4b60cf6f3fa4d904856a2c4528bc2/icons/checkmark-icon.svg) 
 Organization: Import User/Group from IdP while Editing VDC ACL ![Available](https://cloud.ibm.com/docs-content/v1/content/11f96f96f8f4b60cf6f3fa4d904856a2c4528bc2/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/11f96f96f8f4b60cf6f3fa4d904856a2c4528bc2/icons/checkmark-icon.svg) 
 Organization: Perform Administrator Queries ![Available](https://cloud.ibm.com/docs-content/v1/content/11f96f96f8f4b60cf6f3fa4d904856a2c4528bc2/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/11f96f96f8f4b60cf6f3fa4d904856a2c4528bc2/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/11f96f96f8f4b60cf6f3fa4d904856a2c4528bc2/icons/checkmark-icon.svg) !
6. Select the appropriate comma or semicolon column separator to match the separator used in your .csv file.
7. Click Import to import the IBMids and create the members.







 Constructing your CSV file 

When you construct a CSV file to import members into your organization, ensure that you include the required information for the method that you are using. Use either commas or semicolons to separate columns.
Important: When you upload the CSV file, under CSV settings, ensure that you select the correct column separator.

Sample CSV file with comma delimitation:

user1@sample.com,PD_DEVELOPER_USER,2018-03-13
user2@sample.com,PD_OPERATOR_USER,2018-03-13
user3@sample.com,PD_ADMIN_USER,2018-03-13

Where the following column entries are used:



* Column 1: The email address of the user.
If you are adding members, make sure that you use the email address that corresponds to a valid IBMid. If you are inviting members, you can use any valid email address.
* Column 2: The role to be assigned to the user.
Enter one of the following roles:
* PD_ADMIN_USER
* PD_OPERATOR_USER
* PD_DEVELOPER_USER
* PD_ANALYST_USER
* PD_READER_USER
For more information about user roles, see [User, application, and gateway roles ![External link icon](https://cloud.ibm.com/docs-content/v1/content/icons/launch-glyph.svg)](https://www.ibm.com/support/knowledgecenter/SSQP8H/iot/platform/roles_index.htmluser_roles).
* Column 3: The ISO 6801 date (for example, 2018-03-13) that corresponds to the user expiry date.









 Editing users 

Users can be edited to change their role, add, remove, or change an access expiration date, or add or remove access to the organization.



1.
Get the user information for the individual user or access group that you want to assign the service access role to.



1. Get your Account ID.

ibmcloud account show
2. For individual users, get the user's userID and ibmUniqueId.

ibmcloud account users --account-id <account_ID> --output JSON
3. For access groups, get the Name and ID.

ibmcloud iam access-groups



2. Create a policy.json file that scopes the service access role to a Kubernetes namespace in your cluster.

{
"subjects": [
{
"attributes":
{
"name": "(iam_id|access_group_id)",
"value": "<user_or_group_ID>"
}
]
}
],
"roles": [
{
"role_id": "crn:v1:bluemix:public:iam::::serviceRole:<(Manager|Writer|Reader)>"
}
],
"resources": [
{
"attributes":
{
"name": "accountId",
"value": "<account_ID>"
},
{
"name": "serviceName",
"value": "containers-kubernetes"
},
{
"name": "serviceInstance",
"value": "<cluster_ID1,cluster_ID2>"
},
{
"name": "namespace",
"value": "<namespace_name>"
}
]
}
]
}
Show more



Table 1. Understanding options for service access role policy

 Component Description 

 subjects.attributes Enter the IBM Cloud IAM details for the individual user or access group that you previously retrieved.<br><br><br><br> * For individual users, set iam_id for the name field.
For more information, see: [CloudForms Roles](https://access.redhat.com/documentation/en-us/red_hat_cloudforms/5.0/html-single/general_configuration/indexroles).

The LDAP configuration searches the UID and email attributes. Make sure that all accounts have a defined email attribute.

Example: In LDAP a group that is named group100 exists and a user with username user100 is a member of the group. The user user100 must have an email attribute defined and the group group100 must be created in CloudForms.
9. Click Save.







 Congratulations! 

You successfully installed and configured CloudForms and integrated CloudForms with IBM Cloud Pak for Multicloud Management in IBM Cloud.
The associated enroll secrets are provided in the corresponding variable files [ordering-org-vars.yml](https://github.com/IBM-Blockchain/ansible-collection/blob/main/tutorial/ordering-org-vars.yml), [org1-vars.yml](https://github.com/IBM-Blockchain/ansible-collection/blob/main/tutorial/org1-vars.yml), and [org2-vars.yml](https://github.com/IBM-Blockchain/ansible-collection/blob/main/tutorial/org2-vars.yml). You can customize the values of the enroll ID and secrets in these files according to your needs. 







 Next steps 

Now that you have used the playbooks to deploy your components or even scripted the deployment of your network, you can continue to use the console UI to interact with and govern your blockchain components. You will notice right away that the Ansible scripts do not associate an identity with the nodes that it deploys. If you plan to operate the nodes from the console, you need to use a manual process to upload the node identities to the console wallet and associate them with the nodes. The generated node identities are JSON files and are stored in the tutorial folder.



 Generated identities 

The following table lists the names of the JSON files that contain the identities that are generated by the build_network.sh script with the build option or the join_network.sh script for the case of Org 2. If you customized organization names inside the playbook .yml files, it is possible that your JSON files will be named differently. In order to operate the nodes from the console, you need to import all of the generated identities into the console wallet by using the following process:



1. Navigate to the console wallet and click Add identity.
2. Click the Upload JSON tab and browse to the generated identities in the tutorial folder and click Add identity.
3. Repeat these steps for each identity file in the following table.





Table 1. File names of organization admin identities
Cloud Directory change password appid.cloud-dir-user-credentials.update success 200 [appid user CRN] cloud_directory:[GUID] appid/cloud_dir/user 
 Cloud Directory change password failure appid.cloud-dir-user-credentials.update failure 400 crn:unknown cloud_directory:unknown 
 Revoke user tokens appid.user-tokens.revoke success 200 appid user CRN idp:[GUID] appid/user 
 Revoke user tokens failure appid.user-tokens.revoke failure 400 appid user CRN idp:[GUID] appid/user 
 Cloud Directory user SSO logout appid.cloud-dir-user.set-off success 200 appid user CRN idp:[GUID] appid/user 
 View user profile attributes appid.user-profile-attributes.read success 200 crn:profiles:[User-ID] profiles:[User-ID] appid-user-profiles/attributes 
 Update user profile attribute appid.user-profile-attributes.update success 200 crn:profiles:[User-ID] profiles:[User-ID] appid-user-profiles/attribute/[Attribute-name] 
 Delete user profile attribute appid.user-profile-attributes.delete success 200 crn:profiles:[User-ID] profiles:[User-ID] appid-user-profiles/attribute/[Attribute-name] 







 Analyzing runtime events 

A user that generates a runtime event is identified as a GUID rather than by name or email. As the account owner, you can use the GUID to identify a specific user and then you can search to see all the events that the user triggered.

The following scenario works only for Cloud Directory users. If the user is defined by an external IdP such as Google or Facebook, only that identity provider can interpret the GUID.



 Extracting user information from the GUID 

An event in the Activity Tracker console contains the following fields.



Table 3. Example fields that can be found in an event from the Activity Tracker console

 Field Value Description
Select an identity in the wallet whose certificate is also inside your organization MSP definition. You will also need to select an admin identity in the Associate identity section when you create or edit a channel. This allows your console to know which identity to use when it communicates with your peers, orderers, and ordering service consortium. The identity that is currently associated with a peer or ordering service is visible on the left side of the node panel, below the name, Node location, and Fabric version.





 Viewing the contents of a signing certificate 

As a network operator, there may be situations when you need to view the contents of a signing certificate, or sign cert, to debug a problem. If you have the certificate PEM file, you can run the following openSSL command to print out the certificate contents:

openssl x509 -in <certificate.pem> -text -noout

Replace <certificate.pem> with the sign cert file and the output will resemble the following content:

Certificate:
Data:
Version: 3 (0x2)
Serial Number:
68:b9:6d:d3:00:1e:1b:9d:4b:99:1e:ab:ed:05:48:be:28:51:69:3d
Signature Algorithm: ecdsa-with-SHA256
Issuer: C=US, ST=North Carolina, O=Hyperledger, OU=Fabric, CN=fabric-ca-server
Validity
Not Before: Nov 20 19:08:00 2019 GMT
Not After : Nov 19 19:13:00 2020 GMT
Subject: OU=client, OU=org1, OU=department1, CN=user1
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey
Public-Key: (256 bit)
pub:
04:11:0c:c9:9e:47:d8:38:aa:c7:24:65:90:98:a3:
42:a8:b0:18:3e:03:43:13:ae:64:6a:18:93:6e:06:
Log in with the user that was added in the previous step to the Symphony cluster by running the following command:

[root@hpcc-symphony-primary-0 ] su symphonyuser01
[symphonyuser01@hpcc-symphony-primary-0 root]$ egosh
egosh> user logon -u symphonyuser01 -x welcome2
Logged on successfully
symphonyuser01@HPCCluster> resource list
NAME status mem swp tmp ut it pg r1m r15s r15m ls
hpcc-sy* ok 14G 0M 87G 3% 8200 0.0 0.1 0.1 0.1 0
hpcc-sy* ok - - - - - - - - - -
hpcc-sy* ok 14G 0M 86G 2% 0 0.0 0.1 0.2 0.0 1
symphonyuser01@HPCCluster> ego info
Cluster name : HPCCluster
EGO master host name : hpcc-symphony-primary-0.ibm.com
EGO master version : 3.9
symphonyuser01@HPCCluster>
3. Assign roles to the new users by running the following commands:

Admin@HPCCluster> user assignrole -u symphonyuser01 -r CONSUMER_USER
Role <Consumer User> is assigned to user <symphonyuser01>.
Admin@HPCCluster> user list
ACCOUNT PHONE EMAIL DESCRIPTION
----------------------------------------------------------------
Admin
Guest
symphonyuser02
symphonyuser01
smith







 Conclusion 

You have now successfully integrated OpenLDAP with IBM Spectrum Symphony to provide centralized authentication and directory services.
Example output

NAME: 10.184.58.3
Roles: <none>
Labels: arch=amd64
beta.kubernetes.io/arch=amd64
beta.kubernetes.io/os=linux
failure-domain.beta.kubernetes.io/region=us-south
failure-domain.beta.kubernetes.io/zone=dal12
ibm-cloud.kubernetes.io/encrypted-docker-data=true
ibm-cloud.kubernetes.io/iaas-provider=softlayer
ibm-cloud.kubernetes.io/machine-type=u3c.2x4.encrypted
kubernetes.io/hostname=10.123.45.3
privateVLAN=2299001
publicVLAN=2299012
Annotations: node.alpha.kubernetes.io/ttl=0
volumes.kubernetes.io/controller-managed-attach-detach=true
CreationTimestamp: Tue, 03 Apr 2022 15:26:17 -0400
Taints: <none>
Unschedulable: false
4. Create a config map and define the unavailability rules for your worker nodes. The following example shows four checks, the zonecheck.json, regioncheck.json, defaultcheck.json, and a check template. You can use these example checks to define rules for worker nodes in a specific zone (zonecheck.json), region (regioncheck.json), or for all worker nodes that don't match any of the checks that you defined in the config map (defaultcheck.json). Use the check template to create your own check. For every check, to identify a worker node, you must choose one of the worker node labels that you retrieved in the previous step.

For every check, you can set only one value for NodeSelectorKey and NodeSelectorValue.
ibmcloud ks worker ls --cluster <cluster_name_or_ID>

Example output

OK
ID Public IP Private IP Machine Type State Status Zone Version
kube-dal10-crb1a23b456789ac1b20b2nc1e12b345ab-w26 169.xx.xxx.xxx 10.xxx.xx.xxx b3c.4x16.encrypted normal Ready dal10 1.26_1523

If your worker node does not apply the latest patch version, you see an asterisk () in the Version column of your CLI output.
2. Review the [version change log](https://cloud.ibm.com/docs/containers?topic=containers-changelog) to find the changes that are in the latest patch version.
3. Apply the latest patch version by reloading your worker node. Follow the instructions in the [ibmcloud ks worker reload command](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_worker_reload) to safely reschedule any running pods on your worker node before you reload your worker node. Note that during the reload, your worker node machine is updated with the latest image and data is deleted if not [stored outside the worker node](https://cloud.ibm.com/docs/containers?topic=containers-storage-plan).



2. Review the change log and verify support for your [cluster version and architecture](https://cloud.ibm.com/docs/containers?topic=containers-cos_plugin_changelog).
3. [Follow the instructions](https://cloud.ibm.com/docs/containers?topic=containers-helminstall_v3) to install the version 3 Helm client on your local machine.
In the Labels output, note the subnet ID in the label ibm-cloud.kubernetes.io/subnet-id, such as 5f5787a4-f560-471b-b6ce-20067ac93439 in the following example.

kubectl describe node <worker_primary_ip>

Example output

NAME: 10.240.01.00
Roles: <none>
Labels: arch=amd64
beta.kubernetes.io/arch=amd64
beta.kubernetes.io/instance-type=c2.2x4
beta.kubernetes.io/os=linux
failure-domain.beta.kubernetes.io/region=us-south
failure-domain.beta.kubernetes.io/zone=us-south-1
ibm-cloud.kubernetes.io/ha-worker=true
ibm-cloud.kubernetes.io/iaas-provider=gc
ibm-cloud.kubernetes.io/internal-ip=10.240.0.77
ibm-cloud.kubernetes.io/machine-type=c2.2x4
ibm-cloud.kubernetes.io/os=UBUNTU_18_64
ibm-cloud.kubernetes.io/region=us-south
ibm-cloud.kubernetes.io/sgx-enabled=false
ibm-cloud.kubernetes.io/subnet-id=5f5787a4-f560-471b-b6ce-20067ac93439
ibm-cloud.kubernetes.io/worker-id=kube-bl25g33d0if1cmfn0p8g-vpcprod-default-00001093
ibm-cloud.kubernetes.io/worker-pool-id=bl25g33d0if1cmfn0p8g-5aa474f
ibm-cloud.kubernetes.io/worker-pool-name=default
If the output from the previous step contains softlayer, then set the CLUSTER_PROVIDER to "IBMC". If the output contains gc, ng, or g2, then set the CLUSTER_PROVIDER to "IBMC-VPC". Store the infrastructure provider in an environment variable. For example: SET CLUSTER_PROVIDER="IBMC-VPC".

WORKER_OS and PLATFORM
: The operating system of the worker nodes. To retrieve these values, run oc get nodes -o jsonpath="{.items[].metadata.labels.ibm-cloud.kubernetes.io/os}{'n'}". Store the operating system of the worker nodes in an environment variable. For Red Hat OpenShift on IBM Cloud clusters, run SET WORKER_OS="redhat" and SET PLATFORM="openshift".

REGION
: The region of the worker nodes. To retrieve this value, run oc get nodes -o yaml grep 'ibm-cloud.kubernetes.io/region'. Store the region of the worker nodes in an environment variable by running SET REGION="< region>". |
5. Verify that the ibmcloud-object-storage-plugin is successfully upgraded. The upgrade of the plug-in is successful when you see deployment "ibmcloud-object-storage-plugin" successfully rolled out in your CLI output.

oc rollout status deployment/ibmcloud-object-storage-plugin -n ibm-object-s3fs
6. Verify that the ibmcloud-object-storage-driver is successfully upgraded. The upgrade is successful when you see daemon set "ibmcloud-object-storage-driver" successfully rolled out in your CLI output.

oc rollout status ds/ibmcloud-object-storage-driver -n ibm-object-s3fs
7. Verify that the IBM Cloud Object Storage pods are in a Running state.

oc get pods -n <namespace> -o wide | grep object-storage
If the output from the previous step contains softlayer, then set the CLUSTER_PROVIDER to "IBMC". If the output contains gc, ng, or g2, then set the CLUSTER_PROVIDER to "IBMC-VPC". Store the infrastructure provider in an environment variable. For example: SET CLUSTER_PROVIDER="IBMC-VPC".

WORKER_OS and PLATFORM
: The operating system of the worker nodes. To retrieve these values, run kubectl get nodes -o jsonpath="{.items[].metadata.labels.ibm-cloud.kubernetes.io/os}{'n'}". Store the operating system of the worker nodes in an environment variable. For IBM Cloud Kubernetes Service clusters, run SET WORKER_OS="debian" and SET PLATFORM="k8s".

REGION
: The region of the worker nodes. To retrieve this value, run kubectl get nodes -o yaml grep 'ibm-cloud.kubernetes.io/region'. Store the region of the worker nodes in an environment variable by running SET REGION="< region>". |
5. Verify that the ibmcloud-object-storage-plugin is successfully upgraded. The upgrade of the plug-in is successful when you see deployment "ibmcloud-object-storage-plugin" successfully rolled out in your CLI output.

kubectl rollout status deployment/ibmcloud-object-storage-plugin -n ibm-object-s3fs
6. Verify that the ibmcloud-object-storage-driver is successfully upgraded. The upgrade is successful when you see daemon set "ibmcloud-object-storage-driver" successfully rolled out in your CLI output.

kubectl rollout status ds/ibmcloud-object-storage-driver -n ibm-object-s3fs
7. Verify that the IBM Cloud Object Storage pods are in a Running state.

kubectl get pods -n <namespace> -o wide | grep object-storage
kube-dal10-crb1a23b456789ac1b20b2nc1e12b345ab-w26 169.xx.xxx.xxx 10.xxx.xx.xxx b3c.4x16.encrypted normal Ready dal10 1.26_1523

If your worker node does not apply the latest patch version, you see an asterisk () in the Version column of your CLI output.
2. Review the [version change log](https://cloud.ibm.com/docs/containers?topic=containers-changelog) to find the changes that are in the latest patch version.
3. Apply the latest patch version by reloading your worker node. Follow the instructions in the [ibmcloud oc worker reload command](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_worker_reload) to safely reschedule any running pods on your worker node before you reload your worker node. Note that during the reload, your worker node machine is updated with the latest image and data is deleted if not [stored outside the worker node](https://cloud.ibm.com/docs/containers?topic=containers-storage-plan).



2. Review the change log and verify support for your [cluster version and architecture](https://cloud.ibm.com/docs/openshift?topic=openshift-cos_plugin_changelog).
3. [Follow the instructions](https://cloud.ibm.com/docs/openshift?topic=openshift-helminstall_v3) to install the version 3 Helm client on your local machine.
: Optional: Do not show the message of the day or update reminders.



 Example worker add command 

ibmcloud oc worker add --cluster my_cluster --workers 3 --public-vlan my_public_VLAN_ID --private-vlan my_private_VLAN_ID --flavor b3c.4x16 --hardware shared







 ibmcloud oc worker get 

Virtual Private Cloud

Classic infrastructure

View the details of a worker node.

ibmcloud oc worker get --cluster CLUSTER_NAME_OR_ID --worker WORKER_NODE_ID [--output json] [-q]

Minimum required permissions
: Viewer platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER_NAME_OR_ID
: Optional: The name or ID of the worker node's cluster.

--worker WORKER_NODE_ID
: Required: The name of your worker node. Run ibmcloud oc worker ls --cluster CLUSTER to view the IDs for the worker nodes in a cluster.

--output json
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.



 Example worker get command 

ibmcloud oc worker get --cluster my_cluster --worker kube-dal10-cr18a61a63a6a94b658596aa93d087aaa9-w1







 ibmcloud oc worker ls 

Virtual Private Cloud

Classic infrastructure

List all worker nodes in a cluster.

ibmcloud oc worker ls --cluster CLUSTER [--worker-pool POOL] [--show-pools] [--show-deleted] [--output json] [-q]

Minimum required permissions
: Viewer platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster for the available worker nodes.

-p, --worker-pool POOL