vania-janet/multiturn-rag-retrieval-data huggingface dataset:
--output OUTPUT
: Optional: Prints the command output in JSON format.

--domain-provider PROVIDER
: Required. The external DNS provider type. Specify --cis-ext.

--secret-namespace NAMESPACE
: Optional. The namespace that the domain TLS secret is created in. If no namespace is specified, the secret is created in the default namespace.

--domain-zone ZONE
: Optional. The Domain ID for your IBM Cloud Internet Services instance. This is a GUID value.







 Setting up domains from other external providers 

To add an Akamai or Cloudflare domain to your cluster, you must first apply credentials for the external provider to your cluster. Then, you can either add a domain that already exists in your external provider account, or you can create a new domain that registers with both your IBM Cloud and external provider accounts.



 Set up credentials for your provider 

To use a domain that is registered with Akamai or Cloudflare, you must add the external provider credentials to your cluster. IBM Cloud Kubernetes Service uses these credentials to provision or access a domain from the external provider on your behalf. You can only add one set of credentials to your cluster.

Different providers might require different credentials, such as access tokens or secrets. IBM Cloud Kubernetes Service does not provide the credentials; you must acquire them from the external provider.



 Add Akamai credentials 

Akamai

Run the command to add Akamai provider credentials to your cluster.

Note that registering credentials for Akamai requires the READ-WRITE permission for /config-dns endpoint in your external Akamai account.

ibmcloud ks ingress domain credential set akamai --cluster CLUSTER --access-token TOKEN --client-secret SECRET --client-token TOKEN --host HOST --zone AKAMAI_ZONE [-q]

This command is only required when creating an external domain with the Akamai provider.

-c, --cluster CLUSTER
: Required. The name or ID of the cluster where you want to add the credentials.

--access-token TOKEN
! ! !
<-- <section "id="section-update-waf-setting-options" "> --> Command options DNS_DOMAIN_ID: The ID of DNS domain. Required.WAF_MODE: The mode of WAF setting. Valid values are: waf-enable , waf-disable. Required.-i, --instance: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.--output: Specify output format, only JSON is supported.<-- </section "id="section-update-waf-setting-options" "> --><-- <section "id="section-update-waf-setting-examples" "> --> Examples Enable WAF for domain 372e67954025e0ba6aaa6d586b9e0b60. ibmcloud cis waf-setting-update 31984fea73a15b45779fa0df4ef62f9b waf-enable -i "cis-demo"
<-- </section "id="section-update-waf-setting-examples" "> --><-- </section "id="section-update-waf-setting" "> --><-- <section "id="section-list-waf-packages" "> --> ibmcloud cis waf-packages List all WAF packages. ibmcloud cis waf-packages DNS_DOMAIN_ID -i, --instance INSTANCE] --output FORMAT] ! ! ! ! ! !
<-- <section "id="section-list-waf-packages-options" "> --> Command options DNS_DOMAIN_ID: The ID of DNS domain. Required.-i, --instance: Instance name or ID.
<-- <section "id="section-create-waf-override-options" "> --> Command options DNS_DOMAIN_ID: The ID of DNS domain. Required.--json: The JSON file or JSON string used to describe a override WAF rule. Required.
<-- <ul> -->

* The required fields in JSON data are urls and rules.

<-- <ul> -->

* urls: URLs to be included in this rule definition. Wildcards are permitted.
* rules: Change the action assigned to a WAF rule. The keys of this object are WAF rule IDs and the values must be a valid WAF action. Unless disabling the rule, ensure that you also enable the rule group that this WAF rule belongs to. Max length: 1024.

<-- </ul> -->

* The optional fields are paused, description, priority, groups and rewrite_action.

<-- <ul> -->

* paused: Whether this package is currently paused. Valid values: true and false.
* description: A note that you can use to describe the purpose of this rule.
* priority: Relative priority of this configuration when multiple configurations match a single URL. Higher priority configurations may overwrite values set by lower priority configurations. Min value is -1000000000, max value is 1000000000.
* groups Enable or disable WAF rule groups. The keys of this object are WAF rule group IDs and the values must be a valid WAF action (usually default or disable).
* rewrite_action: When a WAF rule matches, substitute its configured action for a different action specified by this object.

<-- </ul> -->

<-- </ul> -->

Sample JSON data: {
"description": "Enable IBM Magento ruleset for www.example.com",
"urls":
"www.example.com/"
] ! ! ,
"priority": 1,
"groups": {
linear: '{"coresPerReplica":256,"nodesPerReplica":16,"preventSinglePointFailure":true}'
kind: ConfigMap
metadata:
...







 Customizing the cluster DNS provider 

You can customize CoreDNS by editing the CoreDNS ConfigMap. For example, you might want to configure stub domains and upstream DNS servers to resolve services that point to external hosts. Additionally, you can configure multiple [Corefiles](https://coredns.io/2017/07/23/corefile-explained/) within the CoreDNS ConfigMap. For more information, see [the Kubernetes documentation](https://kubernetes.io/docs/tasks/administer-cluster/dns-custom-nameservers/).

NodeLocal DNS caching relies on CoreDNS to maintain the cache of DNS resolutions. Keep applicable NodeLocal DNS cache and CoreDNS configurations such as stub domains the same to maintain DNS resolution consistency.

Before you begin: [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)



1. Verify that the CoreDNS deployment is available. In your CLI output, verify that one deployment is AVAILABLE.

kubectl get deployment -n kube-system coredns

Example output

NAME READY UP-TO-DATE AVAILABLE AGE
coredns 3/3 3 3 69d
2. Edit the default settings for the CoreDNS ConfigMap. Use a Corefile in the data section of the ConfigMap to customize stub domains and upstream DNS servers. For more information, see [the Kubernetes documentation](https://kubernetes.io/docs/tasks/administer-cluster/dns-custom-nameservers/coredns).
Next, on both servers, go back to Traffic Management > GSLB and go through the wizard again. This time, click Next, and select Modify Configuration for Existing Domains. Select the hostname from the list and then click Next twice.
11. In the site address field, put in the site IP address of the other NetScaler and give it the other NetScaler's site name and click Add. The site will be populated with an option to click the green + again. Click the remote site plus sign to add another site. Enter the Vserver service IP (the one for the load balanced servers, not the GSLB site IP) and the port, click Create and Close, Next, Finish then Exit.



If everything has been working up to this point, and both servers are configured, everything should have a status of green in the GSLB Virtual Servers, Services and Sites. You will notice that there are now two entries in GSLB services on both machines if they are properly synchronized. The servers are now communicating with each other.

You now have to configure DNS.

In the example, gslb.tsstesting.com, you would create NS and glue records in the tsstesting.com zone:

gslb.tsstesting.com. IN NS NS1.gslb.tsstesting.com
gslb.tsstesting.com. IN NS NS2.gslb.tsstesting.com
NS1.gslb.tsstesting.com. IN A 10.54.0.141 ; nameserver IP of first NetScaler
NS2.gslb.tsstesting.com. IN A 172.16.1.101 ; nameserver IP of second NetScaler
www.tsstesting.com. IN CNAME gslb.tsstesting.com ; alias to the GSLB object on the NetScaler appliance

Remember, you can only use CNAMEs with hostnames, not the root of the domain.

This configuration sets the name servers for requests for gslb.tsstesting.com to the NetScaler IPs you configured DNS on.
3. Optional: Add custom Corefiles to the CoreDNS ConfigMap. In the following example, include the import <MyCoreFile> in the data.Corefile section, and fill out the data.<MyCorefile> section with your custom Corefile information. For more information, see [the Corefile import documentation](https://coredns.io/plugins/import/).

The CoreDNS proxy plug-in is deprecated and replaced with the forward plug-in. If you update the CoreDNS ConfigMap, make sure to replace all proxy instances with forward.

kubectl edit configmap -n kube-system coredns

Custom Corefile example output

apiVersion: v1
kind: ConfigMap
metadata:
name: coredns
namespace: kube-system
data:
Corefile: 
import <MyCorefile>
.:53 {
errors
health
kubernetes cluster.local in-addr.arpa ip6.arpa {
pods insecure
upstream 172.16.0.1
fallthrough in-addr.arpa ip6.arpa
}
prometheus :9153
forward . /etc/resolv.conf
cache 30
loop
reload
loadbalance
}
<MyCorefile>: 
abc.com:53 {
errors
cache 30
loop
forward . 1.2.3.4
}
4. After a few minutes, the CoreDNS pods pick up the ConfigMap changes.







 Setting up NodeLocal DNS cache 

Set up the NodeLocal DNS caching agent on select worker nodes for improved cluster DNS performance and availability in your IBM Cloud Kubernetes Service cluster. For more information, see the [Kubernetes docs](https://kubernetes.io/docs/tasks/administer-cluster/nodelocaldns/).
<-- </section "id="section-get-overview-examples" "> --><-- </section "id="section-get-overview" "> --><-- </section "id="section-overview" "> --><-- <section "id="section-page-rule-cli-ref" "> --> Page rules Manipulate page rules by using the following pagerule commmands.<-- <section "id="section-page-rule-create" "> --> ibmcloud cis page-rule-create Create a page rule of the DNS domain. ibmcloud cis page-rule-create DNS_DOMAIN_ID (--json @JSON_FILE | JSON_STRING) -i, --instance INSTANCE] --output FORMAT]
Deprecated] ibmcloud cis page-rule-create DNS_DOMAIN_ID (-s, --json-str JSON_STR | -j, --json-file JSON_FILE) -i, --instance INSTANCE] --output FORMAT] ! !!!!!!
<-- <section "id="section-command-options-page-rule-create" "> --> Command options DNS_DOMAIN_ID: The ID of DNS domain. Required.--json value: The JSON file or JSON string used to describe a page rule. Required.
<-- <ul> -->

* The required fields in JSON data are targets, actions:

<-- <ul> -->

* targets:The target URL pattern to evaluate on a request.
* actions:An array of actions to perform if the targets of this rule match the request.
--subdomain SUBDOMAIN
: Required. Enter the ID or name of the subdomain that you want to retrieve DNS record for. To list existing subdomains, run ibmcloud sat location dns ls.

--output json
: Optional. Prints the command output in JSON format.

-q
: Optional. Do not show the message of the day or update reminders.





 Example 

ibmcloud sat location dns get --location aaaaaaaa1111a1aaaa11a --subdomain s1b9782f9f75feeb8a5a4-d683ff82e51c94176a53d







 ibmcloud sat location dns ls 

List the DNS record for your location.

ibmcloud sat location dns ls --location LOCATION [--output json] [-q]



 Minimum required permissions 

IBM Cloud IAM Viewer platform role for the Location resource in the Satellite location. For more information, see [Checking user permissions](https://cloud.ibm.com/docs/satellite?topic=satellite-iam-assign-accesschecking-perms).





 Command options 

--location LOCATION
: Required. Enter the ID or name of the location that you want to show the DNS record for. To retrieve the location ID or name, run ibmcloud sat location ls.

--output json
: Optional. Prints the command output in JSON format.

-q
: Optional. Do not show the message of the day or update reminders.





 Example 

ibmcloud sat location dns ls --location aaaaaaaa1111a1aaaa11a







 ibmcloud sat location dns register 

Create a DNS record for your location and register the public or private IP addresses of your compute hosts that you added to the Satellite control plane to enable load balancing and health checking of your location.

A DNS record is automatically created for your location when you add compute hosts to your Satellite control plane with the public or private IP addresses that are assigned to your compute hosts.
If there is not a rule that matches the DNS query, the Customer Resolver forwards the DNS query to the specified DNS resolver in the default forwarding rule.

Custom resolvers support two types of forwarding rules:



* DNS Zone rules apply for a zone name.
* The Default rule is configured to forward queries to DNS Services DNS resolvers (161.26.0.7, 161.26.0.8). Only one default rule is allowed per custom resolver; it can be edited, but cannot be deleted.

Changing the Default rule might cause issues with DNS query resolution in VPCs that have virtual private endpoints, IKS clusters, ROKS clusters, or defined private DNS zones.





 Adding custom resolver forwarding rules using the UI 

To add a forwarding rule:



1. Go to the custom resolver details page and select the Forwarding rules tab.
2. Click Add rule.
3. In the Create forwarding rule panel, select the rule type from the list menu.
4. Enter the matching zone.
5. Enter the forwarding IP addresses (in CIDR format) separated by commas.
6. Optionally, enter a description of the rule.
7. Click Create.







 Adding custom resolver forwarding rules using the CLI 

To create a custom resolver forwarding rule using the CLI, run the following command:

ibmcloud dns custom-resolver-forwarding-rule-create RESOLVER_ID --type TYPE --match HOSTNAME --dns-svcs IPs [--description DESCRIPTION] [-i, --instance INSTANCE] [--output FORMAT]

Where:



* RESOLVER_ID is the ID of custom resolver.
* -t, --type is the type of the forwarding rule. Valid values: "zone".
* -d, --description is the descriptive text of the custom resolver forwarding rule.
* -match is the matching zone.
* --dns-svcs is the upstream DNS servers to be forwarded to.
* -i, --instance is the instance name or ID.
To manage engine configurations for your instance, you need the [Manager service role or higher](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam).



 Supported DNS providers 

You can connect the following DNS providers with your Secrets Manager service instance.

Cloud Internet Services

Classic infrastructure

Manual



Table 1. Prerequisites - CIS

 Prerequisites 

 Before you add a configuration for Cloud Internet Services (CIS), be sure that you:<br><br><br><br> * [Create a CIS service instance](https://cloud.ibm.com/docs/cis?topic=cis-getting-started).<br> * [Create an authorization between Secrets Manager and CIS](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-prepare-order-certificatesauthorize-cis).<br> * If your CIS instance is located in another account, obtain the CRN of the instance and [create an API key with the correct level of access](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-prepare-order-certificatesauthorize-cis-another-account).<br><br><br> 









 Adding a DNS provider configuration in the UI 

You can add DNS provider configurations to your service instance by using the Secrets Manager UI.



1. In the console, click the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/icon_hamburger.svg)> Resource List.
2. From the list of services, select your instance of Secrets Manager.
3. In the Secrets engines page, click the Public certificates tab.
4. In the DNS providers table, click Add.
5. Select the DNS provider that you want to use.

Currently, you can add configurations for Cloud Internet Services (CIS) and IBM Cloud classic infrastructure.
6.
You need the Cloud Resource Name (CRN) of the CIS instance that contains your domains, and an API key with the correct level of access to your instance. The API key must grant Secrets Manager the ability to view the CIS instance, access its domains, and manage TXT records.

If the CIS instance is located in an account that allows access to only specific IP addresses, you must also update the IP address restrictions in the account to allow incoming requests from Secrets Manager. For more information, see [Managing access with context-based restrictions](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-access-control-cbr).

To assign access, you can use the Access (IAM) section of the console.



1. Log in to the account in which your CIS instance is located.
2. Click Manage > Access (IAM), and select Service IDs.
3. [Create a service ID API key](https://cloud.ibm.com/docs/account?topic=account-serviceidapikeys) or select an existing one.
4. Assign the required access to view the CIS instance, access its domains, and manage TXT records.



1. In the row of the service ID, click the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/actions-icon-vertical.svg)> Assign access.
2. Click the Access policy tile.
3. From the list of services, select Internet Services and click Next.
4. Select Resources based on selected attributes.
5. In the Service instance field, select your CIS instance.
6. In the Roles and actions section, select the Manager role. If you want to grant the service ID the ability to access the CIS instance from the Resource list in the IBM Cloud console, you can also assign the Viewer platform role.
7. Click Review > Add > Assign to complete the access assignment.



5.
A URL that is registered with a custom domain might look like: http://mydomain.net/myapp2path/oauth2-myappid/callback. If the apps that you want to expose are within the same cluster but in different namespaces, you can use a wildcard to specify all of them. This can be helpful during development, but it is recommended that you exercise caution when you use wildcards in production. For example, https://custom_domain.net//oauth2-myappid/callback
* Ingress subdomain:

If your app is registered with an IBM Kubernetes Ingress subdomain, your callback URL might look like: https://mycluster.us-south.containers.appdomain.cloud/myapp1path/oauth2-myappid/callback









 Updating your Ingress resource 

Your Ingress resource is used to define how you want to expose your applications. The resource contains the rules that define how to route incoming requests to your applications. To add App ID authentication to your apps, follow the steps in the [IBM Cloud Kubernetes Service documentation](https://cloud.ibm.com/docs/containers?topic=containers-comm-ingress-annotationsapp-id-auth).





 Next steps 

Now that your application is running in a Kubernetes cluster and Ingress is configured, you can try:



* Customizing the [login widget](https://cloud.ibm.com/docs/appid?topic=appid-login-widget)
* Configuring [multi-factor authentication](https://cloud.ibm.com/docs/appid?topic=appid-cd-mfa)
* Defining the information that you want to include in your [user profiles](https://cloud.ibm.com/docs/appid?topic=appid-user-admin)
Be sure to use the fully qualified domain name (FQDN) of the server rather than the IP address so that DNS is used when each host is added.

After you add the ESXi hosts to vCenter, you might notice a couple of warnings messages about the enablement of the shell and SSH on each ESXi host. To suppress these warnings, click Suppress Warning > Yes on the pop-up window. If the Suppress Warnings link is not present, follow these steps:



1. Go to the ESXi host Manage tab.
2. Select the Settings and click Advanced System Settings.
3. Find the UserVars.SupressShellWarning key and change the value to 1.
4. Click OK.



After the management and capacity hosts are added to their respective clusters, go to each host and setup DNS and NTP. To set up DNS, follow these steps:



1. Click a host and select Manage > Networking.
2. Select the default system stack (TCP/IP configuration) and click the pencil icon.
3. Enter the IP address of the DNS server that you previously created and the host and domain name.



For NTP settings:



1. Go to Manage, Settings, Time Configuration.





* Enter servertime.service.softlayer.com as the NTP server.
* Set the NTP Service Startup Policy to Start and stop with host.







 Creating a distributed virtual switch for the capacity hosts 



1. Use the vSphere Web Client to go to Networking and right-click on the data center name.
2. Select New Distributed Switch.
3. Name the distributed switch and click Next.
4. Select the appropriate distributed switch version and click Next.
5. On the Edit Settings screen, enter 2 as the number of uplinks and clear the Create a default port group selection.
6. Click Next > Finish and create the distributed virtual switch.







 Creating port groups for distributed virtual switch 

Now that the distributed virtual switch is present, you must create port groups for vMotion, fault tolerance, VMs, and storage.
[Check and configure the DNS record](https://cloud.ibm.com/docs/citrix-netscaler-vpx?topic=citrix-netscaler-vpx-check-and-configure-the-dns-record) Ensure a DNS record exists for the FQDN that points to the public address to be configured in the Citrix Netscaler VPX as a Virtual Server. 
 [Add and configure the SSL Virtual Server](https://cloud.ibm.com/docs/citrix-netscaler-vpx?topic=citrix-netscaler-vpx-add-and-configure-the-ssl-virtual-server) Add and configure an SSL Virtual Server. 
 [Create and apply a new Cipher Suite](https://cloud.ibm.com/docs/citrix-netscaler-vpx?topic=citrix-netscaler-vpx-create-and-apply-a-new-cipher-suite) Create a Cipher Suite that prioritizes and preferences AEAD, ECDHE, and ECDSA. 







 Additional resources 

The following additional resources can help you get the most out of your Citrix Netscaler VPX when using the IBM Hardware Security Module.



* [NetScaler 12.1 Product Documentation](https://docs.citrix.com/en-us/netscaler/12-1/)
* [Gemalto Support Portal](https://supportportal.gemalto.com/csm?id=csm_index)
* [IBM Cloud Support](https://cloud.ibm.com/docs/get-support?topic=get-support-using-avatar)
However, it is related to the zone deployment category.





 ADDNS customization 

The primary use of vCenter Server instance ADDNS is to provide Active Directory™ and Domain Name Services to the infrastructure only. If you don't customize ADDNS, then the classification is Simple.

If you customize the service, such as by integrating it with your own AD or by using it for AD or DNS of workloads, you must do additional work. This action is done to migrate the customization to the target instance's new ADDNS.

This is not a key parameter. However, it gives guidance on where more project tasks and skills are required.





 Overlay and underlay network customization 

If you customize your underlay or overlay networks, review the customizations and the following areas:



* Additional IBM Cloud public or private VLANs.
* Additional portable subnets.
* Consumption of IP addressing from reserved subnets.
* Multitenant overlay deployments.
* Multiple GRE or IPsec tunnels.
* Use of hardware VTEPs - The classification becomes High complexity.



Due to the architectural differences between NSX-V and NSX-T, these aspects might require advanced configuration skills to build the wanted network topology.

This is a key parameter and defines the classification of the source environment.





 Layer 2 stretched overlay 

If you use NSX-V to stretch layer 2 networks across data centers, then the classification is Medium and High. Due to the architectural differences between NSX-V and NSX-T, these aspects might require advanced configuration skills to build the wanted network topology.

This is not a key parameter. However, it is related to the zone deployment category and adds more weighting to the complexity.





 Gateway firewall 

Does your source environment include gateway firewalls such as FortiGate®, vRAs, or Juniper® vSRX?

Due to the architectural differences between NSX-V and NSX-T, these aspects might require advanced configuration skills to build the wanted network topology. In some cases, gateway firewalls might be rebuilt with new IP addresses. For example, when the new deployment is in a new IBM Cloud data center or POD.