vania-janet/multiturn-rag-retrieval-data huggingface dataset:
For more information, see [Assigning users access to projects](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-access-project).





 Monitoring needs attention items 

Needs attention items are best used to monitor validation, approvals, failures, and version updates. By checking the needs attention items regularly, you can ensure that your project and configuration are up-to-date and compliant.





 Adding tags to projects 

You can apply tags to organize, track, and manage your projects. It can be useful to add tags to related projects, or even an extra tag to projects that are temporary, such as infrastructure used for a customer demo or a prototype that's no longer needed. This allows temporary projects to be easily located and managed.

Tags are not case-sensitive, and the maximum length of a tag is 128 characters. The permitted characters are A-Z, 0-9, spaces, underscore, hyphen, period, and colon.





 Destroying resources created by projects 

When you deploy your configuration, resources that are created can be managed as a group within your project. These resources are created based on the Terraform plan and can be managed individually in your Schematics workspace.

Although you can destroy individual resources from the Schematics workspace, doing so is not recommended for resources that are created by using a project, as it leads to drift. Instead, you can destroy all of the resources that are associated with a configuration at once from the project UI with a single click. Doing so removes the deployment from whatever target environment that your configuration was deployed to. Destroying resources without deleting the configuration can be helpful if you need to deploy your configuration again in the future.

By default, when you delete a project or a configuration, any resources that were deployed are destroyed automatically. It's recommended to keep this setting enabled, but you can disable it by opening your project and going to Manage > Settings. If you disable that setting, resources remain deployed when you delete a configuration or a project, but you lose the ability to easily manage those resources within the project. Deployed resources can continue accruing costs to your target account if they remain available after a project or configuration is deleted.
Why does the Ingress status show an ESSSMINF error? 

Virtual Private Cloud

Classic infrastructure

You can use the the ibmcloud oc ingress status-report ignored-errors add command to add an error to the ignored-errors list. Ignored errors still appear in the output of the ibmcloud oc ingress status-report get command, but are ignored when calculating the overall Ingress Status.

  What’s happening 

When you check the status of your cluster's Ingress components by running the ibmcloud oc ingress status-report get command, you see an error similar to the following example.

The Secrets Manager instance is not found (ESSSMINF).

  Why it’s happening 

The Kubernetes Service is unable to access the Secrets Manager instance. The instance might have been deleted from your IBM Cloud account, but still remains registered to your cluster.

  How to fix it 

Check that the Secrets Manager instances registered to your cluster still exist in your IBM Cloud account.



1.  List the Secrets Manager instances that are registered to your cluster.

ibmcloud oc ingress instance ls --cluster <cluster>
2.  List the resources in your account and check that the Secrets Manager instances registered to your cluster also exist in your account.

ibmcloud resource service-instances
3.  If the Secrets Manager instance no longer exists in your account, remove it from the cluster.

ibmcloud oc ingress instance unregister
4.  If the problem persists, [open a support ticket](https://cloud.ibm.com/docs/openshift?topic=openshift-get-helphelp-support).
Why does the Ingress status show an ESSSMINF error? 

Virtual Private Cloud

Classic infrastructure

You can use the the ibmcloud ks ingress status-report ignored-errors add command to add an error to the ignored-errors list. Ignored errors still appear in the output of the ibmcloud ks ingress status-report get command, but are ignored when calculating the overall Ingress Status.

  What’s happening 

When you check the status of your cluster's Ingress components by running the ibmcloud ks ingress status-report get command, you see an error similar to the following example.

The Secrets Manager instance is not found (ESSSMINF).

  Why it’s happening 

The Kubernetes Service is unable to access the Secrets Manager instance. The instance might have been deleted from your IBM Cloud account, but still remains registered to your cluster.

  How to fix it 

Check that the Secrets Manager instances registered to your cluster still exist in your IBM Cloud account.



1.  List the Secrets Manager instances that are registered to your cluster.

ibmcloud ks ingress instance ls --cluster <cluster>
2.  List the resources in your account and check that the Secrets Manager instances registered to your cluster also exist in your account.

ibmcloud resource service-instances
3.  If the Secrets Manager instance no longer exists in your account, remove it from the cluster.

ibmcloud ks ingress instance unregister
4.  If the problem persists, [open a support ticket](https://cloud.ibm.com/docs/containers?topic=containers-get-helphelp-support).
The following table shows the services that are affected and the pattern for hostnames for these services. The hostname might differ from the exact pattern displayed. Use the pattern to locate all the registered DNS hostnames associated with a service. Services might have more than one registered hostname.



Table 1. Hostname patterns and examples for affected services

 Service Hostname Pattern Example 

 Caveonix RiskForesight™ riskforesight riskforesight <br>inst01-riskforesight 
 F5® BIG-IP® nickname-bigip1 <br>nickname-bigip2 edgefw-bigip1 
 FortiGate Virtual Appliance nickname-fortigate edgefw-fortigate01 
 Entrust CloudControl™ htccnn-id htcc02-GY67239 
 VMware Aria® Operations™ vrli <br>vrops <br>vrlog vrli-master <br>vrops-data1 <br>vrlog-master 



To remove the DNS entires, complete the following steps:



1. Log in to the Active Directory™ appliance and open the DNS tools.
2. Go to the instance subdomain, which is the subdomain under the root domain. Its name resembles the name of the Cyber Recovery instance.
3. Remove the hostname entries for the specific deleted service appliances.
4. Open the associated reverse lookup table and remove the DNS entries from the table.







 Related links 



* [FAQ](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-faq-vmwaresolutions)
Canceling your FortiGate Security Appliance 10 Gbps 

A FortiGate Security Appliance 10 Gbps can be cancelled immediately or on the anniversary date. Cancelling on the anniversary date keeps the firewall active until the beginning of the next billing period.

Take the following steps to cancel a firewall:



1.  Navigate to the Device Overview page by selecting the name of the firewall under the Firewall Name column.
2.  Click the overflow menu and select Cancel Device.
3.  Choose to either cancel immediately or on the anniversary date (next billing cycle).
4.  Confirm your selection.



If the option to cancel a firewall is missing, then it is already being cancelled.

Downgrading from a high availability to a standalone server is not supported.
* [Deleting charts from your private repository](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_helm_chartsregistry_helm_charts_remove)



* [Deleting charts from your private repository in the CLI](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_helm_chartsregistry_helm_charts_remove_cli)
* [Deleting charts from your private repository in the console](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_helm_chartsregistry_helm_charts_remove_gui)



* [Listing charts in the trash](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_helm_chartsregistry_helm_charts_list_trash)
* [Restoring charts](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_helm_chartsregistry_helm_charts_restore)



* [Restoring charts by digest](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_helm_chartsregistry_helm_charts_restore_digest)
* [Restoring charts by tag](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_helm_chartsregistry_helm_charts_restore_tag)



* [Deleting a private repository and any associated charts](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_helm_chartsregistry_helm_charts_repo_remove)







 Cleaning up your namespaces 

[Cleaning up your namespaces](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_retentionregistry_retention)



* [Planning retention](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_retentionretention_plan)
[Multiregion multi-organization ordering service](https://cloud.ibm.com/docs-content/v1/content/c5288bed34c3820e3a5251d820ee91adcd2591a3/blockchain/images/mr-ha-os-multiorg.png)

Figure 6. Multiregion, multi-organization ordering service





* Clean up
Want to start fresh? You can remove the following resources that you created as a part of this tutorial:



* From the Nodes tab, open the Multiregion OS CA and click the trash can ![trash can](https://cloud.ibm.com/docs-content/v1/content/icons/icon_trash.svg).
* From the Organizations tab, open the Multiregion OS MSP and click the trash can ![trash can](https://cloud.ibm.com/docs-content/v1/content/icons/icon_trash.svg).
* From the Nodes tab, open the Multiregion Ordering Service and click the trash can ![trash can](https://cloud.ibm.com/docs-content/v1/content/icons/icon_trash.svg).
* From the Wallet tab, open Multiregion OS CA Admin and click Remove identity.
* From the Wallet tab, open Multiregion OS MSP Admin and click Remove identity.
After you delete all CA certificates from the certificate manager server, the mutual TLS authentication for the GREP11 instance is disabled. Applications then do not need mutual TLS connection to connect to the GREP11 instance.
2. (Optional) Check and confirm whether all the CA certificates are deleted with the following command:

ibmcloud hpcs-cert-mgr cert list --crn HPCS_CRN [--private]

If no certificate is returned, it means all the certificates of your service instance are deleted.
3. (Optional) Update the GREP11 or PKCS #11 applications to delete the certificate configurations, so that the applications no longer use the certificate for future API connections.







 What's next 



* For the complete certificate manager CLI command reference, see [Hyper Protect Crypto Services certificate manager CLI plug-in](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-cli-plugin-hpcs-cli-plugincert-manager-cli-plugin).
* For the GREP11 API and PKCS #11 API reference, see [Cryptographic operations: GREP11 API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grep11-api-ref) and

[Cryptographic operations: PKCS #11 API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-pkcs11-api-ref).
Canceling spare pools 

Devices that are added to the spare pool can be canceled only from anywhere within the IBM Cloud® console. The cancellation of a device in the spare pool is identical to that of a device within the Device List.



  Canceling a spare pool 

Use the following steps to remove a device from the spare pool.

Canceling a device results in removing all data from the canceled device. All information that is stored on the device cannot be retrieved after the device is canceled.



1.  Back up any data that you want to keep from the device that you are canceling.
2.  Access your [IBM Cloud® console](https://cloud.ibm.com/) by using your unique credentials.
3.  Select Devices > Spare Pool from the Navigation Bar to access the Spare Pool screen.
4.  Select the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/211160e8ccd9679349ee8d97c04d9e21c9533330/icons/action-menu-icon.svg). Then, select Cancel Device for the specific device.
5.  Select the cancellation reason from the Reason drop-down list.
6.  Enter a brief cancellation explanation in the text box.
7.  Click Continue to proceed to the next screen. Click Cancel to stop the cancellation process and return to the Spare Pool screen.
8.  Select Data Loss Acknowledgement to acknowledge that data loss can occur as part of the cancellation process.
9.  Click Cancel Device to cancel the device. Click Close to stop the cancellation process and return to the Spare Pool screen.







  What's next 

After you request the cancellation of a spare pool device, the device is scheduled for cancellation. The device is then immediately reclaimed and removed from the account.
Why do my unassigned hosts have an Unresponsive status? 

  What’s happening 

When you view the hosts in your location or run the ibmcloud sat host ls command, your unassigned show an Unresponsive status similar to the following.

Name                        ID                     State        Status         Zone         Cluster                           Worker ID                                                 Worker IP
t-ca594kp10egvr0u1usv0-40   23cfa4f4349fd0104008   unassigned   Unresponsive   *            -                                 -                                                         -
t-ca594kp10egvr0u1usv0-41   67f0bf6701a17c5a0c98   unassigned   Unresponsive   *            -                                 -                                                         -

  Why it’s happening 

The host attach script for your location expires one year from the creation date. To make sure that hosts in your location don't have authentication issues, make sure to download a new copy of the host attach script at least once per year and update any unassigned hosts.

  How to fix it 

To resolve this issue, remove the hosts from your location, download a new copy of the host attach script for your location, then reattach the hosts. Repeat the following steps for all unresponsive and unassigned hosts in your location.



1.  Remove the unresponsive hosts from your location.

ibmcloud sat host rm --host HOST --location LOCATION
2.  Download a new copy of the host attach script for your location.

ibmcloud sat host attach --location LOCATION [--host-label "LABEL"]  [--operating-system (RHEL|RHCOS)] [-q] [--reset-key]
3.  Reattach the hosts by running the attach script that you downloaded in the previous step. For more information, see [Attaching hosts to your location](https://cloud.ibm.com/docs/satellite?topic=satellite-attach-hosts).
Release notes for IBM Cloud Gateway Appliances 

Find out about new and updated features in gateway appliances.



 21 May 2021 

Renewing a vSRX license
: The vSRX standard and CSB licenses for both 1G and 10G that were included with deployments before mid-May 2021 have an expiration date in 2021. After this license expires, updates for some new vSRX features might not take effect. A newer license with an expiration date in 2024 is now available, and you can renew your gateway license to obtain it. If you are using a High Availability vSRX, renewing your license automatically modifies the license on both vSRX nodes. You can find the current expiration date on the gateway appliance details page.
: For more information, refer to [Renewing a vSRX license](https://cloud.ibm.com/docs/vsrx?topic=vsrx-license-renewal).





 20 April 2020 

Checking vSRX readiness
: You can now run readiness checks to verify the ability of your IBM Cloud® Juniper vSRX to perform certain gateway actions. They include:



* OS reloads
* License upgrades
* Version upgrades



: After you run a readiness check, errors alert you to any necessary actions that you should take before beginning one of these actions, or inform you that you're ready to proceed.
: For more information, refer to [Checking vSRX readiness](https://cloud.ibm.com/docs/vsrx?topic=vsrx-vsrx-readinessvsrx-readiness).





 21 August 2018 

Brocade operating system version 18.x
: Version 18.x of the Brocade OS is now available for the IBM Cloud® Virtual Router Appliance. Among other new features, this version provides remediation for the Spectre security breach.
: New features of the 18.x VRA are discussed in the following topics:
Renewing a vSRX license 

The vSRX standard and CSB licenses for both 1G and 10G that were included with deployments before mid-May 2021 have an expiration date in 2021. After this license expires, updates for some new vSRX features might not take effect. A newer license with an expiration date in 2024 is now available, and you can renew your gateway license to obtain it. If you are using a High Availability vSRX, renewing your license automatically modifies the license on both vSRX nodes. You can find the current expiration date on the gateway appliance details page. See the view license steps below.

Actions such as OS Reload will re-apply the license currently applied to the node(s). It will not update the license.

For vSRX instances running with version 15.1 the license renewal is not available. Follow the steps [here](https://cloud.ibm.com/docs/vsrx?topic=vsrx-upgrading-the-vsrx) to upgrade to a newer vSRX version.



 Viewing your license expiration date 

To find your current license expiration date, follow these steps:



1. Open the [IBM Cloud console](https://cloud.ibm.com/vpc-ext) and log in to your account.
2. Select the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/af86f2de476b09efc2fa731457e7b3e58571f062/icons/icon_hamburger.svg) from the upper left, then click Classic Infrastructure.
3. Choose Network > Gateway Appliances.
4. Click the gateway appliance name to access the gateway appliance details page. You can find the license expiration date in the Details section.



To view your current license expiration from the vSRX CLI, run show system license. You should see the 2024 expiration date for each of the license features on each node.





 Renewing your license
If you no longer need a specific domain, you can use the ibmcloud ks ingress domain rm[command](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-cliingress-domain-rm) to remove it.
5. If you still need the domain, you can update the registered addresses for the domain by using the ibmcloud ks ingress domain update[command](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-cliingress-domain-update) command.

Note that you must include all addresses you want to be registered as the update operation replaces the currently registered addresses. For example, if 52.137.182.166 is currently registered to your domain and you want to add 52.137.182.270, you must specify --ip 52.137.182.166 --ip 52.137.182.270 in the command.
6. Wait a 15-30 minutes, then check if the warning is resolved.
7. If the issue persists, contact support. Open a [support case](https://cloud.ibm.com/docs/get-support?topic=get-support-using-avatar). In the case details, be sure to include any relevant log files, error messages, or command outputs.
[details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-authorizations-not-met)
16. Only a single instance policy may be... [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-num-collection-resource-err)
17. Only imported keys may be restored [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-key-impt-req-err)
18. Requested action can only be completed with a root key (400) [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-key-root-req-err)
19. Requested action can only be completed with a root key (422) [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-key-root-req-reg-err)
20. Requested change is not compliant with configuration rules [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-config_rule_conflict_err)
21. Signature is invalid [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-invalid_sig_exp_err)
22. The action could not be performed on... [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-key-expired-err)
23. The encrypted nonce given does not match...
{
"errorMsg": "Conflict: Key could not be created: Please see reasons for more details (KEY_CREATE_IMPORT_ACCESS_ERR)",
"reasons":
{
"code": "KEY_CREATE_IMPORT_ACCESS_ERR",
"message": "KeyCreateImportAccess instance policy does not allow this action",
"status": 409,
"moreInfo": "https://cloud.ibm.com/apidocs/key-protect"
}
]
}
]
}

Steps 3-4 disables the keyCreateImportAccess policy and successfully creates a standard key.

 step 3 - disable the policy, that is, enable creating standard keys
$ curl -X PUT "https://us-south.kms.cloud.ibm.com/api/v2/instance/policies?policy=keyCreateImportAccess" -H "accept: application/vnd.ibm.kms.policy+json" -H "authorization: Bearer $ACCESS_TOKEN" -H "bluemix-instance: $KP_INSTANCE_ID" -H "content-type: application/vnd.ibm.kms.policy+json" -d '{
"metadata": {
"collectionType": "application/vnd.ibm.kms.policy+json",
"collectionTotal": 1
},
"resources": [
{
"policy_type": "keyCreateImportAccess",
"policy_data": {
"enabled": false
}
}
]
}'

 step 4a - create a standard key using the ibmcloud CLI
$ ibmcloud kp key create my-standard-key --standard-key -o json

{
"id": "3511e0bc-e32d-40b8-b6c2-96cd651858a4",
"name": "my-standard-key",
[Decryption](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959745) C_DecryptInit Yes Initializes a decryption operation. 
 [Decryption](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959745) C_Decrypt Yes Decrypts single-part encrypted data. 
 [Decryption](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959745) C_DecryptUpdate Yes Continues a multiple-part decryption operation. 
 [Decryption](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959745) C_DecryptFinal Yes Finishes a multiple-part decryption operation. 
 [Message digesting](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959746) C_DigestInit Yes Initializes a message-digesting operation. 
 [Message digesting](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959746) C_Digest Yes Digests single-part data. The length of the input data cannot be zero and the pointer that points to the input data location cannot be NULL.
* [Before you begin](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-recover-master-key-recovery-crypto-unitrecover-master-key-prerequisites)
* [Recovering master keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-recover-master-key-recovery-crypto-unitrecover-master-key-step)
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-recover-master-key-recovery-crypto-unitrecover-master-key-next)







 Enabling crypto mechanisms 

[Enabling crypto mechanisms](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-enable-mechanismsenable-mechanisms)



* [Enabling BIP32 deterministic wallets](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-enable-mechanismsenable-BIP32)
* [Enabling Edwards-curve Digital Signature Algorithm](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-enable-mechanismsenable-EdDSA)
* [Enabling the Schnorr algorithm](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-enable-mechanismsenable-schnorr)
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-enable-mechanismsnext-enable-mechanisms)







 Adding or removing crypto units 

[Adding or removing crypto units](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-add-remove-crypto-unitsadd-remove-crypto-units)