vania-janet/multiturn-rag-retrieval-data huggingface dataset:
If corporate network policies prevent access from your local system to public endpoints via proxies or allowlists, to run calicoctl commands, you must allow TCP access for the Calico commands.

Before you begin, allow access to run [ibmcloud commands](https://cloud.ibm.com/docs/containers?topic=containers-vpc-firewallvpc-firewall_bx) and [kubectl commands](https://cloud.ibm.com/docs/containers?topic=containers-vpc-firewallvpc-firewall_kubectl).



1. Retrieve the IP address from the master URL that you used to allow the [kubectl commands](https://cloud.ibm.com/docs/containers?topic=containers-vpc-firewallvpc-firewall_kubectl).
2. Get the port for etcd.

kubectl get cm -n kube-system cluster-info -o yaml | grep etcd_host
3. Allow access for the Calico policies via the master URL IP address and the etcd port.









 Allowing traffic from your cluster in other services' allowlists or in on-premises allowlists 

Allow your worker nodes to communicate with services that are protected by allowlists.

For example, you might have services that run inside or outside IBM Cloud, or services that run on-premises, that are protected by an allowlist. You want to permit incoming network traffic to those services from your cluster. In your service's allowlist, you must add the external IP addresses of the public gateways on your cluster's VPC subnets.

If you want to permit egress from your allowlist-protected services to your cluster, you must add your worker nodes' private IP addresses or your cluster's VPC subnet CIDRs in your service's allowlist. Note that because worker nodes in VPC clusters have only private IP addresses, connections into the VPC cluster worker nodes can only originate from systems that are connected to your IBM Cloud private network.

Before you begin



1. [Log in to your account. If applicable, target the appropriate resource group.
ACL File 

Lines preceded by a  will be ignored as a comment
To allow specific port on a specific host:
acl allow <hostname>:<port>

To allow all ports on a specific host:
acl allow <hostname>:

To allow all hosts from a specific port:
acl allow :<port>

To allow all hosts and ports, use below command:
acl allow :

To deny specific port on a specific host:
acl deny <hostname>:<port>

To deny all ports on a specific host:
acl deny <hostname>:

To deny all hosts from a specific port:
acl deny :<port>

To deny all hosts and ports, use below command:
acl deny :
Show more
[Controlling traffic between pods with Kubernetes policies](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-kube-policiesvpc-kube-policies)



* [Isolate app services within a namespace](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-kube-policiesservices_one_ns)
* [Isolate app services between namespaces](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-kube-policiesservices_across_ns)



[Opening required ports and IP addresses in other network allowlists](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-firewallvpc-firewall)



* [Opening ports in a corporate allowlist](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-firewallvpc-corporate)



* [Running ibmcloud, ibmcloud oc, and ibmcloud cr commands from behind an allowlist](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-firewallvpc-firewall_bx)
* [Running oc commands from behind an allowlist](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-firewallvpc-firewall_kubectl)
* [Running calicoctl commands from behind an allowlist](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-firewallvpc-firewall_calicoctl)
* [Allowing access to the Red Hat OpenShift image registry in an allowlist](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-firewallopenshift-registry)
[Provision your service from the IBM Cloud Catalog](https://cloud.ibm.com/catalog/services/databases-for-mysql) and choose your IP addresses from the [Cloud Databases Allowlist page](https://cloud.ibm.com/docs/databases-for-mysql?topic=cloud-databases-allowlisting).



1. Run the following example command to create a network that includes a range of allowed IP addresses.

ibmcloud cbr zone-create --addresses=169.38.95.127/27,169.38.121.159/28,169.38.132.127/25,169.38.136.255/26,169.38.73.151/29,169.38.105.79/29,10.162.8.127/26,10.163.20.127/25,10.162.115.103/29,10.162.132.79/29 --name=tutorial_zone
2. Verify the network zone was created.

ibmcloud cbr zones







 Step 2: Creating your CBR rule in the CLI 



1. After you create your network zone (allowlist), create a context-based restrictions rule and add the network zone you created in the previous step. The following example creates a rule that uses the data-plane API type. Replace ZONE-ID with the ID of the tutorial_zone network zone that you created in [Step 1](https://cloud.ibm.com/docs/databases-for-redis?topic=databases-for-redis-cbr-tutorialcreating-your-network-zone).

ibmcloud cbr rule-create --enforcement-mode enabled --context-attributes networkZoneId=<ZONE-ID> --resource-group-id <RESOURCE_GROUP_ID> --service-name databases-for-mysql --service-instance <SERVICE-INSTANCE> --api-types crn:v1:bluemix:public:context-based-restrictions::::api-type:data-plane --description <DESCRIPTION>

Understanding the command options.

--context-attributes (string)
Example commands to create separate network zones called public-IP-zone and private-IP-zone. In this example, each zone contains multiple IP addresses or CIDRs, separated by a comma, that you want to allow to access your clusters.

ibmcloud cbr zone-create --addresses 1.2.3.4,12.12.12.0/24 --description "Allowed Public IP Addresses Zone" --name "public-ip-zone"

ibmcloud cbr zone-create --addresses 10.20.20.20,10.10.10.0/24 --description "Allowed Private IP Addresses Zone" --name "private-ip-zone"
2. Get the IDs of the private-ip-zone and public-ip-zone zones you created in the previous step.

ibmcloud cbr zones
3. Create a rule that allows the private-ip-zone to connect to your cluster's private service endpoint and that also allows the public-ip-zone to connect to your cluster's public service endpoint only. This rule applies to the cluster specified with the --service-instance option. If you want to apply the rule to all clusters in your account, do not specify a cluster.

ibmcloud cbr rule-create --context-attributes "endpointType=public,networkZoneId=PUBLIC-IP-ZONE-ID" --context-attributes "endpointType=private,networkZoneId=PRIVATE-IP-ZONE-ID" --description "Separate private and public IPs for cluster and management rule" --service-name containers-kubernetes --service-instance CLUSTER-ID







 Allowing different IPs to access different API types over the public and private service endpoints 

Similar to the previous scenario, in this scenario you allow different IP addresses to access the respective public or private service endpoint for Red Hat OpenShift on IBM Cloud clusters. However, in this scenario, access is further restricted by specific API types for the cluster and management APIs. For more information about the API types, see [Protecting specific APIs](https://cloud.ibm.com/docs/containers?topic=containers-cbr&interface=cliprotect-api-types-cbr).
1. Create a security group for basic management services as described [Configuring the security group for the instance](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-ibm-cloud-consoleconfiguring-the-security-group). Specify following rules:

Inbound security group rules

Outbound security group rules



Table 5. Overview of inbound security group rules for the internet services host

 Protocol Source type Source Value Rule's purpose 

 ALL CIDR Block 10.0.0.0/8 n/a address block of IBM Cloud VPC and Power Systems Virtual Server management subnets 
 TCP CIDR Block 0.0.0.0/8 Port 80-80 HTTP 
 TCP CIDR Block 0.0.0.0/8 Port 443-443 HTTPS 
 TCP CIDR Block 0.0.0.0/8 Port 8443-8443 HTTPS (used by OS registration) 
 ALL CIDR Block 161.26.0.0/16 n/a address block of OS registration servers 
 UDP CIDR Block 0.0.0.0/0 Port 53-53 DNS 



2. Create an ACL to restrict the access to the edge IBM Cloud VPC's subnets.

Inbound ACL rules

Outbound ACL rules



Table 7. Overview of ACL inbound rules for the internet services host

 Rule Priority Allow or deny Protocol Source Destination Value Rule's purpose 

 1 Allow ALL 161.0.0.0/8 10.0.0.0/8 n/a address block of OS registration servers 
 2 Allow UDP Any IP, ports 53-53 10.0.0.0/8, any port n/a DNS 
 3 Allow ALL 10.0.0.0/8 10.0.0.0/8 n/a address block that is allowed for IBM Cloud VPC and Power Systems Virtual Server management subnets 
 4 Allow TCP Any IP, ports 8443-8443 10.0.0.0/8, any port n/a HTTPS for OS registration
[Provision your service from the IBM Cloud Catalog](https://cloud.ibm.com/catalog/services/databases-for-mysql) and choose your IP addresses from the [Cloud Databases Allowlist page](https://cloud.ibm.com/docs/databases-for-mysql?topic=cloud-databases-allowlisting).



1. Run the following example command to create a network that includes a range of allowed IP addresses.

ibmcloud cbr zone-create --addresses=169.38.95.127/27,169.38.121.159/28,169.38.132.127/25,169.38.136.255/26,169.38.73.151/29,169.38.105.79/29,10.162.8.127/26,10.163.20.127/25,10.162.115.103/29,10.162.132.79/29 --name=tutorial_zone
2. Verify the network zone was created.

ibmcloud cbr zones







 Step 2: Creating your CBR rule in the CLI 



1. After you create your network zone (allowlist), create a context-based restrictions rule and add the network zone you created in the previous step. The following example creates a rule that uses the data-plane API type. Replace ZONE-ID with the ID of the tutorial_zone network zone that you created in [Step 1](https://cloud.ibm.com/docs/databases-for-etcd?topic=databases-for-etcd-cbr-tutorialcreating-your-network-zone).

ibmcloud cbr rule-create --enforcement-mode enabled --context-attributes networkZoneId=<ZONE-ID> --resource-group-id <RESOURCE_GROUP_ID> --service-name databases-for-mysql --service-instance <SERVICE-INSTANCE> --api-types crn:v1:bluemix:public:context-based-restrictions::::api-type:data-plane --description <DESCRIPTION>

Understanding the command options.

--context-attributes (string)
VPNs can take 2-4 weeks to design, setup, test and validate (from start to finish). Proper time should be allowed for a VPN build when planning integrations or services will that depend on it for connectivity. MAS-SaaS customers must specifically request a VPN by submitting a case to the IBM Support Community.

Only one case is needed for VPN setup and can cover configuration for multiple environments (DEV, TEST, PROD, etc).

It is important to bear in mind a VPN may not necessarily be needed to establish certain types of connectivity. Some integration types can run over HTTPS and/or Cloud Object Storage (AWS S3) and may not require a VPN.

Currently MAS on AWS does not support NAT at MAS side in Site-to-Site VPN.





 Maximo Mobile 

For questions related to use of Maximo Mobile in MAS-SaaS Manage, please refer to the links below:



* Maximo Manage Version 8.3 - [https://www.ibm.com/docs/en/maximo-manage/8.3.0?topic=managing-maximo-mobile](https://www.ibm.com/docs/en/maximo-manage/8.3.0?topic=managing-maximo-mobile)
* Maximo Manage Version 8.2 - [https://www.ibm.com/docs/en/maximo-manage/8.2.0?topic=managing-maximo-mobile](https://www.ibm.com/docs/en/maximo-manage/8.2.0?topic=managing-maximo-mobile)
* Maximo Manage Version 8.1 - [https://www.ibm.com/docs/en/maximo-manage/8.1.0?topic=managing-maximo-mobile](https://www.ibm.com/docs/en/maximo-manage/8.1.0?topic=managing-maximo-mobile)







 Self-Service Portal 

A Self Service Portal (SSP) for Maximo Application Suite as a Service (MAS-SaaS) is not available at this time and is under construction.
* Node



String authRefreshToken = "{authRefreshToken}";
String versionLocator = "{versionLocator}";
ValidationInstallOptions installOptions = new ValidationInstallOptions.Builder().xAuthRefreshToken(authRefreshToken).versionLocId(versionLocator).build();
Response<Void> response = service.validationInstall(installOptions).execute();
System.out.println(response.getResult());

authRefreshToken="{authRefreshToken}"
versionLocator = "{versionLocator}"
response = self.service.validation_install(version_locator_id=versionLocator, x_auth_refresh_token=authRefreshToken)
print(response)

versionLocator := "{versionLocator}"
authRefreshToken := "{authRefreshToken}"
installOptions := service.NewValidationInstallOptions(versionLocator, authRefreshToken)
response, _ := service.ValidationInstall(installOptions)
fmt.Println(response)

versionLocator = "{versionLocator}";
authRefreshToken = "{authRefreshToken}";
response = await service.validationInstall({ 'versionLocatorId': versionLocator, 'xAuthRefreshToken': authRefreshToken });
console.log(response);





 Publishing your software to your account by using the API 

You can programmatically publish your software to your account by calling the Catalog Management API as shown in the following sample request. For detailed information about the API, see [Catalog Management API](https://cloud.ibm.com/apidocs/resource-catalog/private-catalog?code=javaaccount-publish-version).
For more information about using Continuous Delivery with the API, see [Creating a Continuous Delivery service instance with the API](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-create_cd_service&interface=apicreate_cd_service_api) and [Deleting a Continuous Delivery service instance with the API](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-delete_cd_service&interface=apideleting_rg_api).

You cannot use APIs to manage the list of authorized users of a Continuous Delivery service instance. You can manage the list of authorized users only by using the console. For information about authorized user management, see [Authorized users](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-limitations_usage&interface=uiauthorized_users).





 Can I use the console, APIs, or CLI to modify resources that are managed by Terraform? 

When you use Terraform to manage resources such as Continuous Delivery service instances, toolchains, and Tekton pipelines, avoid changing the resources by using the console, APIs, or CLI, or by any other method outside of Terraform's control.

If you circumvent Terraform by directly changing resources, you might cause [resource drift](https://developer.hashicorp.com/terraform/tutorials/state/resource-drift), a situation in which the states of your actual resources on IBM Cloud deviate from the definition of the resources in Terraform. The next time that you apply the Terraform configuration, Terraform attempts to update your resources to bring them back in alignment with the Terraform configuration. This action might lead to unintended consequences, such as reverting changes or deleting and then re-creating resources.

For more information about resource drift, see [Manage Resource Drift](https://developer.hashicorp.com/terraform/tutorials/state/resource-drift).
curl -X PUT https://<region>.appid.cloud.ibm.com/management/v4/<tenantID>/config/cloud_directory/mfa --header 'Content-Type: application/json' --header 'Accept: application/json' --header 'Authorization: Bearer <IAMToken>' -d '{"isActive": true}'
2. Enable your MFA channel by making a PUT request to the /mfa/channels/<channel> endpoint with your MFA configuration. When isActive is set to true, your MFA channel is enabled. The config takes in the Nexmo API key and secret as well as the from number.

curl -X PUT https://<region>.appid.cloud.ibm.com/management/v4/<tenantID>/mfa/channels/nexmo' --header 'Content-Type: application/json' --header 'Accept: application/json' --header 'Authorization: Bearer <IAMToken>' -d '{
"isActive": true,
"config": {
"key": "<nexmoKey>",
"secret": "<nexmoSecret>",
"from": <senderPhoneNumber>
}
}'
3. After the channel is successfully configured, verify that your Nexmo configuration and connection is set up correctly by using the test button on the UI or by using the management API.

curl -X PUT https://<region>.appid.cloud.ibm.com/management/v4/<tenantID>/config/cloud_directory/sms_dispatcher/test --header 'Content-Type: application/json' --header 'Accept: application/json' --header 'Authorization: Bearer <IAMToken>' -d '{"phone_number": "+1 999 999 9999"}'









 Extending MFA 

With extensions, you can take the security of multifactor authentication to the next level.
Log in to the cloud side HCX UI by using the HCX registration UI provided by IBM.
2. Use the cloud vCenter ID and password to log in to the UI.
3. On the Administration tab, select request download link to download the client-side OVA. Use a jump server that is local to the source vCenter where the OVA is deployed to complete this step.







 Installing and configuring HCX on the source 

The on-premises installation entails deploying the HCX management appliance and registering it with the vCenter environment.



 Installing the HCX Manager Appliance 

Install the HCX Manager appliance in the on-premises vCenter.



1. Log in to My VMware and download the Hybrid Cloud Services OVA file from the product download page.
2. Open a browser and log in to the vSphere Web Client. View the Home tab.
3. In the Inventories Trees list, click Host and Clusters.
4. Expand the hierarchy to show the data centers.
5. Right-click the target data center and select Deploy OVF Template from the menu. It might take a few seconds for the Deploy OVF template menu item to appear.
6. Choose Deploy OVF template.



1. Select Local file and click Browse to find the OVA file downloaded to the computer. Click Next.
2. On the Review details page, check the Accept extra configuration options box and click Next.
3. On the Accept EULAs page, scroll down to review the VMware user license agreement. Click Accept and Next.
4. On the Select name and folder page, edit the name if necessary and select the location for the Hybrid Cloud Services. Click Next.
5. On the Select a resource page, select the installation location.
6. On the Select storage page, select the storage for the Hybrid Cloud Services and click Next. From the Select virtual disk format list, you can select either thin provisioning or thick provisioning.
7.
public void onAuthorizationCanceled () {
// Changed details canceled by the user
}

@Override
public void onAuthorizationSuccess (AccessToken accessToken, IdentityToken identityToken, RefreshToken refreshToken) {
// User authenticated, and fresh tokens received
}
});
Show more







 Change password 



1. Configure your Cloud Directory [settings](https://cloud.ibm.com/docs/appid?topic=appid-cloud-directorycd-settings) in the GUI. Both Allow users to sign up to your app and Allow users to manage their account from your app must be set to On.
2. Place the following code in your app to start the change password flow.

LoginWidget loginWidget = AppID.getInstance().getLoginWidget();
loginWidget.launchChangePassword(this, new AuthorizationListener() {
@Override
public void onAuthorizationFailure (AuthorizationException exception) {
// Exception occurred
}

@Override
public void onAuthorizationCanceled () {
// Change password canceled by the user
}

@Override
public void onAuthorizationSuccess (AccessToken accessToken, IdentityToken identityToken, RefreshToken refreshToken) {
// User authenticated, and fresh tokens received
}
});
Show more









 Displaying the Login Widget with the iOS Swift SDK 

You can call preconfigured screens with the [iOS Swift client SDK](https://github.com/ibm-cloud-security/appid-clientsdk-swift).

Place the following command in your code.

import IBMCloudAppID
class delegate : AuthorizationDelegate {
public func onAuthorizationSuccess(accessToken: AccessToken, identityToken: IdentityToken, refreshToken: RefreshToken?) {
//User authenticated
Before the pods send data back through the VPN tunnel, the remapped IP subnet is switched back to the actual subnet that is being used by the remote network. You can expose both remapped and non-remapped subnets at the same time over the VPN.







 Step 6 (optional): Enable monitoring with the Slack webhook integration 

To monitor the status of the strongSwan VPN, you can set up a webhook to automatically post VPN connectivity messages to a Slack channel.



1. Sign in to your Slack workspace.
2. Go to the [Incoming WebHooks app page](https://slack.com/apps/A0F7XDUAZ-incoming-webhooks).
3. Click Request to Install. If this app is not listed in your Slack setup, contact your Slack workspace owner.
4. After your request to install is approved, click Add Configuration.
5. Choose a Slack channel or create a new channel to send the VPN messages to.
6. Copy the webhook URL that is generated. The URL format looks similar to the following:

https://hooks.slack.com/services/A1AA11A1A/AAA1AAA1A/a1aaaaAAAaAaAAAaaaaaAaAA
7. To verify that the Slack webhook is installed, send a test message to your webhook URL by running the following command:

curl -X POST -H 'Content-type: application/json' -d '{"text":"VPN test message"}' <webhook_URL>
8. Go to the Slack channel you chose to verify that the test message is successful.
9. In the config.yaml file for the Helm chart, configure the webhook to monitor your VPN connection.



1. Change monitoring.enable to true.
2. Add private IP addresses or HTTP endpoints in the remote subnet that you want ensure are reachable over the VPN connection to monitoring.privateIPs or monitoring.httpEndpoints.
Not all users have permission to change the BIOS of the server. If necessary, you can open a support case and request the following items:



* Root user administrator privileges on IPMI (to be able to change the Virtual Media Attach mode).
* Change the boot sequence to ‘IPMI Virtual Disk’ as first boot option.





 What next 

After you make these changes, go back to the IPMI management console and go to Configuration > Remote session. Change the attach mode to Attach. Then, restart the server and boot from the virtual media.

In some older IPMI consoles, you can skip this option.







 Option 2: Mounting an ISO from your local computer 

You can mount an ISO from your local computer by using the Java® iKVM viewer (console). By using the Java iKVM viewer, you can mount an ISO while it is connected to the console. The speed at which the installation progresses can vary depending on the upload speed and latency of your internet connection, performance of Java and your computer.

If you do not have permission to change the BIOS on a server, open a support case to request the following changes:



* Root user administrator privileges on IPMI (to be able to change the Virtual Media Attach mode)
* To change the boot sequence to ‘IPMI Virtual Disk’ as first boot option. (Because ISO is not mounted, support can change only the boot device priority for now).





1. Log in to the IPMI management console by pointing your web browser to the IP that is specified in cloud.ibm.com.
2. Go to Devices > your server (device details) > Remote Mgmt. Specify the username and password.
3. Click Configuration > Remote session and change attach mode to attach. In some older IPMI consoles this option is not available so you can skip this step.
4. To return to the system information page, go to System > System information and click the console window icon. Accept all security warnings.
5. When the console connects, you see login prompt.
6. Click Virtual Media > Virtual Storage.
7. Go to the CDROM&ISO tab and select the ISO File under Logical Drive Type