vania-janet/multiturn-rag-retrieval-data huggingface dataset:
"id": "5295ad47-2ce9-43c3-b9e7-e5a9482c362b",
"name": "Test Vault Name",
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/vaults/5295ad47-2ce9-43c3-b9e7-e5a9482c362b"
},
"id": "ada4293c-07ed-4903-b3ee-419bd1a05fde",
"version": 0,
"name": "IBM-CLOUD-EXAMPLE-TEMPLATE",
"key": {
"size": "256",
"algorithm": "aes",
"activation_date": "P5Y1M1W2D",
"expiration_date": "P1Y2M1W4D",
"state": "active"
},
"description": "IBM CLOUD key template description",
"created_at": "2022-03-09T15:40:52Z",
"updated_at": "2022-03-09T15:40:52Z",
"created_by": "IBMid-1308197YB4",
"updated_by": "IBMid-1308197YB4",
"keystores": [
{
"group": "Production",
"type": "ibm_cloud_kms"
}
],
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/templates/ada4293c-07ed-4903-b3ee-419bd1a05fde"
}







 hpcs uko key-template-delete 

Delete a key template from the vault.
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:390086ac-76fa-4094-8cf3-c0829bd69526:key:264fadc3-7667-4b25-916e-5825fe70de0b"
}







 Required parameters 



* KEY_ID_OR_ALIAS

The v4 UUID or alias of the key that you want to delete. To retrieve a list of your available keys, run the [kp keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-keys) command.
* -i, --instance-id

The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.







 Optional parameters 



* --key-ring

A unique, human readable name for the key-ring. Required if the user doesn't have permissions on the default key ring.









 kp key enable 

When you enable a root key that was previously disabled, the key transitions from the Suspended (value is 2) to the Active (value is 1) key state. This action restores the key's encrypt and decrypt operations.

If you're using an integrated Cloud Service that supports restoring access to a disabled root key, the service may take up to a maximum of 4 hours before access to the root key's associated data is restored.

After access to the associated data is restored, a corresponding enable event is displayed in the IBM Cloud Activity Tracker web UI. The enable event indicates the key has been restored (and is now enabled) and the key can be used for encrypt and decrypt operations, such as wrap, unwrap, and rewrap.
kms.instancepolicies.read kms.instance-policies.read 
 kms.instancepolicies.default kms.instance-policies.request 
 kms.keyrings.create kms.key-rings.create 
 kms.keyrings.delete kms.key-rings.delete 
 kms.keyrings.list kms.key-rings.list 
 kms.keyrings.default kms.key-rings.request 
 kms.secrets.defaultalias kms.secrets-alias.request 
 kms.secrets.createalias kms.secrets-alias.create 
 kms.secrets.deletealias kms.secrets-alias.delete 
 kms.secrets.eventack kms.secrets-event.ack 
 kms.secrets.listkeyversions kms.secrets-key-versions.list 
 kms.secrets.readmetadata kms.secrets-metadata.read 







 Key events 

The following table lists the key actions that generate an event:



Table 2. Lifecycle Key Actions

 Action Description 

 kms.secrets.create Create a key 
 kms.secrets-alias.create Create a key alias 
 kms.secrets.default Invalid key request event 
 kms.secrets.delete Delete a key 
 kms.secrets-alias.delete Delete a key alias 
 kms.secrets.disable Disable operations for a key 
 kms.secrets.enable Enable operations for a key 
 kms.secrets-event.ack Acknowledge a lifecycle action on a key 
 kms.secrets.expire Expire a key 
 kms.secrets.head Retrieve key total 
 kms.secrets.list List keys 
 kms.secrets-key-versions.list List all the versions of a key 
 kms.secrets.wrap Wrap a key 
 kms.secrets.patch Patch a key 
 kms.secrets.purge Purge a key 
 kms.secrets.read Retrieve all key information 
 kms.secrets-metadata.read Retrieve key metadata (excluding key payload, if applicable) 
 kms.secrets.restore Restore a key
curl -X DELETE "$vpc_api_endpoint/v1/shares/$share_id?version=2023-07-11&generation=2&maturity=beta" -H "Authorization: Bearer ${API_TOKEN}"

A successful response confirms acceptance for deletion and shows file share information. The status of file share is updated to pending_deletion.

Example:

{
"access_control_mode": "vpc",
"created_at": "2023-05-30T23:31:59Z",
"crn": "crn:[...]",
"encryption": "provider_managed",
"href": "$vpc_api_endpoint/v1/shares/0995b8c6-c323-4e59-9ea9-fa14dd66bba8",
"id": "0995b8c6-c323-4e59-9ea9-fa14dd66bba8",
"iops": 3000,
"lifecycle_state": "pending_deletion",
"name": "share-name1",
"profile": {
"href": "$vpc_api_endpoint/v1/share/profiles/tier-10iops",
"name": "tier-10iops",
"resource_type": "share_profile"
},
"resource_group": {
"crn": "crn:[...]",
"href": "https://resource-controller.cloud.ibm.com/v2/resource_groups/bfb4a7c7-00d8-400b-98ba-5a67e5851970",
"id": "bfb4a7c7-00d8-400b-98ba-5a67e5851970",
"name": "Default"
},
"resource_type": "share",
OK

 list the instance policies
$ ibmcloud kp instance policies --output json

[
{
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-22T18:45:14Z",
"lastUpdated": "2020-06-22T18:51:33Z",
"updatedBy": "user id ...<redacted>...",
"policy_type": "dualAuthDelete",
"policy_data": {
"enabled": false
}
}
]





 Example 2 

This example enables the dual authorization delete policy and creates a new key to show how a new key inherits the instance policy.

Disabling the dual authorization policy for an instance does not change the policy for existing keys. The instance policy applies to new keys created after the policy is updated.

 enable the instance dual authorization policy
$ ibmcloud kp instance policy-update dual-auth-delete --enable

Updating instance policy...
OK

 create a new key
$ ibmcloud kp key create my-protected-key

Creating key: 'my-protected-key', in instance: 'a192d603-0b8d-452f-aac3-f9e1f95e7411'...
OK
Key ID Key Name
6a8a129b-0cd4-4667-ba57-b355a125a7ca my-protected-key

 list the policies for the key - dual-auth-delete is
 enabled because the key inherits the instance policy
$ ibmcloud kp key policies 6a8a129b-0cd4-4667-ba57-b355a125a7ca --output json

[
{
"createdBy": "user id ...<redacted>...",
* ReaderPlus: Have the same rights as a reader, with the additional ability to retrieve a standard key's payload.
* KeyPurge: Has the ability to [purge keys after four hours](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-purge-keys).



Note that the permissions included in roles are additive. A Manager, for example, has all of the permissions that a Reader has and more. The exception is the KeyPurge role, which includes the kms.secrets.purge action that is not a part of any other role and must therefore be set explicitly.

The following table shows how service access roles map to Key Protect permissions.

Keys

Key Rings

Policies



Table 2. Lists service access roles as they apply to Key Protect key resources

 Action Reader ReaderPlus Writer Manager KeyPurge 

 Create a key ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/0bc8db34a3d90b2a5103c9c71b08a96de9525bbc/icons/checkmark-icon.svg) ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/0bc8db34a3d90b2a5103c9c71b08a96de9525bbc/icons/checkmark-icon.svg) 
 Import a key ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/0bc8db34a3d90b2a5103c9c71b08a96de9525bbc/icons/checkmark-icon.svg) ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/0bc8db34a3d90b2a5103c9c71b08a96de9525bbc/icons/checkmark-icon.svg) 
 Retrieve a key !
"locks": ["lock-name-1", "lock-name-2"]
}'





 Example response 

A request to remove all locks returns the following response:

{
"request_id": "4708ebbf-eab0-e68a-9e72-d1c67a209fdc",
"lease_id": "",
"renewable": false,
"lease_duration": 0,
"data": {
"secret_group_id": "default",
"secret_id": "184408d6-8264-5ff3-c308-6922ed04ad88",
"versions": [
{
"alias": "current",
"id": "f2b68dbb-c291-87df-6026-7611c324c823",
"locks": ],
"payload_available": true
}
]
},
"wrap_info": null,
"warnings": null,
"auth": null
}

A request to remove only specific locks lists the remaining locks in the response:

{
"request_id": "4d954026-68b3-6506-dc1d-5e77574fd2f0",
"lease_id": "",
"renewable": false,
"lease_duration": 0,
"data": {
"secret_group_id": "default",
"secret_id": "184408d6-8264-5ff3-c308-6922ed04ad88",
"versions": [
{
"alias": "current",
"id": "f2b68dbb-c291-87df-6026-7611c324c823",
"locks":
"lock-for-app-1"
],
<br>1 - Monday <br>2 - Tuesday <br>3 - Wednesday <br>4- Thursday <br>5 - Friday <br>6 - Saturday <br>7 - Sunday See [example](https://cloud.ibm.com/docs/account?topic=account-iam-condition-properties&interface=uidayOfWeekAnyOf-timeGreaterThanOrEquals-timeLessThanOrEquals). 
 timeGreaterThanOrEquals The time that the condition begins granting access. Time is calculated by <time>±<time_zone_offset>. See [example](https://cloud.ibm.com/docs/account?topic=account-iam-condition-properties&interface=uidayOfWeekAnyOf-timeGreaterThanOrEquals-timeLessThanOrEquals). 
 timeLessThanOrEquals The time that the condition terminates access. Time is calculated by <time>±<time_zone_offset>. See [example](https://cloud.ibm.com/docs/account?topic=account-iam-condition-properties&interface=uidayOfWeekAnyOf-timeGreaterThanOrEquals-timeLessThanOrEquals). 
 dateTimeGreaterThanOrEquals The date and time that the condition begins granting access. Date is calculated by <datetime>±<time_zone_offset>. See [example](https://cloud.ibm.com/docs/account?topic=account-iam-condition-properties&interface=uidateTimeGreaterThanOrEquals). 
 dateTimeLessThanOrEquals The date and time that the condition terminates access. Date is calculated by <datetime>±<time_zone_offset>. See [example](https://cloud.ibm.com/docs/account?topic=account-iam-condition-properties&interface=uidateTimeLessThanOrEquals). 



When you define a condition with a GreaterThanOrEquals operator, always include a condition with a LessThanOrEquals operator. This way, there is a clearly defined duration, whether it is temporary, recurring all day, or recurring with custom hours.
This option can be used for [routine maintenance](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-failover&interface=uifs-failover-maintenance) on the primary site or when the site is having problems. You can fall back to the original share when the maintenance is complete and the site is stable again.
* If you decide to remove the replication relationship, the system splits the two file shares apart, and they become independent read/write file shares. This option can be used for failover in a [disaster recovery](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-failover&interface=uifs-failover-dr) situation when it's more important to start your application up as quickly as possible on the replica site and the future of the original site is uncertain.



The default timeout is 5 minutes. If the failover does not complete in 5 minutes, the destination site becomes the primary site, and the file share is made read/write. You must [remount the file share](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-remount) after failover.

A failover operation or a replica split cannot occur when another operation is being performed on the source or replica file share (for example, the file share size is being expanded). The split or failover operations remains pending until the other operation completes.

The [failover status](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-managingfile-storage-vpc-status) shows failover_pending while the operation is underway, or while the service is waiting for another operation to complete, such as file share expansion.



 Failover for routine maintenance 

Use failover for routine maintenance on the primary site or when the site is having problems. The process works as follows.



* The file share at the source site begins refusing all read and write operations and the system attempts to pull a final copy of the share's data to the replica file share.
This option can be used for [routine maintenance](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-failoverfs-failover-maintenance) on the primary site or when the site is having problems. You can fall back to the original share when the maintenance is complete and the site is stable again.
* If you decide to remove the replication relationship, the system splits the two file shares apart, and they become independent read/write file shares. This option can be used for failover in a [disaster recovery](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-failoverfs-failover-dr) situation when it's more important to start your application up as quickly as possible on the replica site and the future of the original site is uncertain.



The default timeout is 5 minutes. If the failover does not complete in 5 minutes, the destination site becomes the primary site, and the file share is made read/write. You must [remount the file share](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-remount) after failover.

A failover operation or a replica split cannot occur when another operation is being performed on the source or replica file share (for example, the file share size is being expanded). The split or failover operations remains pending until the other operation completes.

The [failover status](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-managingfile-storage-vpc-status) shows failover_pending while the operation is underway, or while the service is waiting for another operation to complete, such as file share expansion.



 Failover for routine maintenance 

Use failover for routine maintenance on the primary site or when the site is having problems. The process works as follows.



* The file share at the source site begins refusing all read and write operations and the system attempts to pull a final copy of the share's data to the replica file share.
* The data is copied to the replica file share, which becomes read/write and is considered the new source site.
@sys-date string If the input is May 13, 2020, returns 2020-05-13. 
 @sys-date.alternatives array For example, if today's date is 10 March 2019, and the user enters on March 1, then the March 1st date for next year is saved as the @sys-date (2020-03-01). However, the user might have meant March 1st of 2019. The system also saves this year's date (2019-03-01) as an alternative date value. As another example, if today is Tuesday and a user enters, this Tuesday or next Tuesday, then @sys-date is set to the date of Tuesday of next week and no alternative dates are created. 
 @sys-date.calendar_type string For any date mention, returns GREGORIAN. 
 @sys-date.datetime_link string N/A 
 @sys-date.day string If the input is 13 May 2020, returns 13. 
 @sys-date.day_of_week string If the input is 13 May 2020 and it's a Wednesday, returns wednesday. 
 @sys-date.festival string If the input contains Thanksgiving Day, then 2020-11-26 is returned. 
 @sys-date.granularity string If the input mentions next year, returns year. 
 @sys-date.literal string If the input is, I plan to leave on Saturday., then on Saturday is returned. 
 @sys-date.location array If the input is My vacation starts tomorrow., returns [19, 27]. 
 @sys-date.month string If the input is 13 May 2020, returns 5. 
 @sys-date.range_link string For example, the input might be I will travel from March 15 to March 22. Each @sys-date entity that is detected has a range_link object in its output that is named date_range_14_39 where the location of the date range text is [14,39]. The start date (2020-05-15) has a role type of date_from. The end date (2020-05-22) has a role type of date_to.
The client automatically refreshes its metadata to find the up-to-date leader information. Retry the operation that succeeds with the updated metadata.





 org.apache.kafka.common.errors.CommitFailedException 

Thrown as a result of Consumer.commitSync(...) when an unrecoverable error occurs. In some cases, it is not possible to repeat the operation because the partition assignment has changed and the consumer is no longer be able to commit its offsets. Because Consumer.commitSync(...) can be partially successful when used with multiple partitions in a single call, the error recovery can be simplified by using a separate Consumer.commitSync(...) call for each partition.





 org.apache.kafka.common.errors.TimeoutException 

Thrown by Producer.send(...), Consumer.listTopics() if the metadata cannot be retrieved. The exception is also seen in the send callback (or the returned Future) when the requested acknowledgment does not come back within request.timeout.ms. The client can retry the operation, but the effect of a repeated operation depends on the specific operation. For example, if sending a message is retried, the message is possibly duplicated.
curl -X POST https://api.{region}.databases.cloud.ibm.com/v4/ibm/deployments/{id}/remotes/promotion -H 'Authorization: Bearer <>' -H 'Content-Type: application/json' -d '{"promotion": {"skip_initial_backup": true}}' 



 Time to completion 

The promote recipe completes only when the database is highly available. However, read/write availability occurs after about 10 minutes with one major caveat: the database is not highly available until the recipe completes.

The full promotion time of a read-replica is determined by the size of the data in two possible ways:



* Read replicas are single members. When promoted, two additional members are added as replicas. The time this takes depends on the size of the data. As databases grow, the creation can take a substantial amount of time. The promote operation does not complete until the creation of both replicas is complete.
* If you choose to take a backup as part of the promotion, the completion of that backup also needs to finish before the recipe completes. Again, this depends on the size of the database.



Remember, no High-Availability member exists until the promotion recipe completes. Likewise, if you have selected to have an initial backup, no backup exists until the second point completes or a manual backup is created.
When you use the --force option with these commands, the action to create, update, or run the app or job completes. However, the app or job will not run successfully until the referenced secret exists. If you add the --no-wait option in addition to the --force option to the command, the system completes the action, and does not wait for the app or job to run successfully.

The following example describes how to reference a secret that is not yet defined with a job by using the CLI.



1. [Create a job](https://cloud.ibm.com/docs/codeengine?topic=codeengine-job-plan). For this example, create a Code Engine job that uses the icr.io/codeengine/codeengine image and then run the job. When a request is sent to this sample job, the job reads the TARGET environment variable, and the job prints Hello ${TARGET} from Code Engine and prints a listing of environment variables. If the TARGETenvironment variable is empty, Hello World from Code Engine is returned.

ibmcloud ce job create --name myjob --image icr.io/codeengine/codeengine
2. Use the jobrun submit command to run the myjob job. Note that the mynewliteralsecret does not exist. By using the --no-wait option with the jobrun submit command, the job run is submitted and does not wait for the instances of this job run to complete.

ibmcloud ce jobrun submit --name myjobrun1 --job myjob --env-from-secret mynewliteralsecret --force --no-wait
3. Use the jobrun get command to display details of the job run, including the environment variable information. Notice that the job run is in pending status.

ibmcloud ce jobrun get --name myjobrun1

Example output

Getting jobrun 'myjobrun1'...
Getting instances of jobrun 'myjobrun1'...
Getting events of jobrun 'myjobrun1'...
[...]
@sys-date attributes

 Attribute Type Example 

 @sys-date string If the input is May 13, 2020, returns 2020-05-13. 
 @sys-date.alternatives array For example, if today's date is 10 March 2019, and the user enters on March 1, then the March 1st date for next year is saved as the @sys-date (2020-03-01). However, the user might have meant March 1st of 2019. The system also saves this year's date (2019-03-01) as an alternative date value. As another example, if today is Tuesday and a user enters, this Tuesday or next Tuesday, then @sys-date is set to the date of Tuesday of next week and no alternative dates are created. 
 @sys-date.calendar_type string For any date mention, returns GREGORIAN. 
 @sys-date.datetime_link string N/A 
 @sys-date.day string If the input is 13 May 2020, returns 13. 
 @sys-date.day_of_week string If the input is 13 May 2020 and it's a Wednesday, returns wednesday. 
 @sys-date.festival string If the input contains Thanksgiving Day, then 2020-11-26 is returned. 
 @sys-date.granularity string If the input mentions next year, returns year. 
 @sys-date.literal string If the input is, I plan to leave on Saturday., then on Saturday is returned. 
 @sys-date.location array If the input is My vacation starts tomorrow., returns [19, 27]. 
 @sys-date.month string If the input is 13 May 2020, returns 5. 
 @sys-date.range_link string For example, the input might be I will travel from March 15 to March 22. Each @sys-date entity that is detected has a range_link property in its output that is named date_range_14_39 where the location of the date range text is [14,39]. The start date (2020-05-15) has a role type of date_from. The end date (2020-05-22) has a role type of date_to.
On NODE1, run the following command.

pcs resource unmanage group_${sid_np}_non_prod





 Test2 - Test Procedure 

On NODE1, run the following command to move the SAP HANA primary back to NODE1.

pcs resource move SAPHana_${SID}_${INSTNO}-clone





 Test2 - Expected behavior 



* The cluster creates a location constraint to move the resource.
* The cluster triggers a takeover to the secondary HANA database on NODE1.
* If an application, such as SAP NetWeaver, is connected to a tenant database of SAP HANA, the application automatically reconnects to the new primary.
* The resource of the nonproduction SAP HANA system ${SID_np} is in the unmanaged state and isn't started automatically.







 Test2 - Recovery procedure 

Several steps need to be followed to reestablish the complete HA scenario.



1. Wait until the primary HANA instance is active. Then, reduce the memory footprint of the secondary.

On NODE2, run the following commands to reduce the memory.

export GLOBAL_ALLOCATION_LIMIT=<size_in_mb_for_hana_secondary>

sudo -i -u ${sid}adm -- <<EOT
python $DIR_INSTANCE/exe/python_support/setParameter.py -set SYSTEM/global.ini/system_replication/preload_column_tables=false -set SYSTEM/global.ini/memorymanager/global_allocation_limit=$GLOBAL_ALLOCATION_LIMIT
EOT
2. Remove the location constraint, which triggers the start of the secondary instance.

pcs resource clear SAPHana_${SID}_${INSTNO}-clone

Verify that the constraint is cleared.

pcs constraint

Check the cluster status.

pcs status --full
3. On NODE2, run the following commands to check that the global_allocation_limitand preload_column_tables are set.

sudo -i -u ${sid}adm -- hdbcons "mm globallimit" | grep limit