vania-janet/multiturn-rag-retrieval-data huggingface dataset:
The following security groups are applied:



* Default VPC security group (randomly generated name)
* kube-<cluster-id>







 If you only want the cluster security group and not the default VPC security group 

Cluster security group

When you create the cluster specify --cluster-security-group cluster. Do not specify any additional security groups.

Example command to create a VPC cluster with only the kube-<cluster-id> cluster security group:

ibmcloud ks cluster create vpc-gen2 --name <cluster-name> --zone <zone> --vpc-id <vpc-id> --subnet-id <subnet-id> --cluster-security-group cluster

The cluster kube-<cluster-id> security group is applied.





 If you want the cluster security group and your own additional security groups 

Cluster security group

Your own security groups

When you create the cluster, specify --cluster-security-group cluster and up to four additional security groups that you own. You must include a separate --cluster-security-group option for each individual security group you want to add. Note that at maximum of five security groups can be applied to workers, including the security groups that are applied by default.

Example command to create a VPC cluster with the kube-<cluster-id> cluster security group and your own additional security groups:

ibmcloud ks cluster create vpc-gen2 --name <cluster-name> --zone <zone> --vpc-id <vpc-id> --subnet-id <subnet-id> --cluster-security-group cluster --cluster-security-group <group-id-1> --cluster-security-group <group-id-2> --cluster-security-group <group-id-3>

The following security groups are applied:



* kube-<cluster-id>
* Up to four of your own additional security groups, for a maximum of five total security groups.







 If you only want your own security groups 

Your own security groups

When you create the cluster, specify up to five security groups that you own.
If you want to connect a file share to instances that are running in multiple VPCs in the same zone, you can create multiple mount targets for different VPCs.

For more information about the shared storage, see [File Storage for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-about&interface=ui).







 Related links 



* [IBM Cloud VPC getting started](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started)
* [IBM Cloud VPC Bare Metal Servers](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-for-bare-metal-servers)
* [IBM Cloud VPC RYO VMware reference architecture](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vpc-ryo-arch-overview)
* [IBM Cloud Direct Link overview](https://cloud.ibm.com/docs/dl?topic=dl-get-started-with-ibm-cloud-dl)
* [IBM Cloud Transit Gateway overview](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-getting-started)
* [IBM Cloud VPC VPN overview](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-overview)
* [VPC IaaS endpoints](https://cloud.ibm.com/docs/vpc?topic=vpc-service-endpoints-for-vpcinfrastructure-as-a-service-iaas-endpoints)
* [VMware on Bare Metal VPC tutorial](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-bm-vmware)
<br><br> * Resource group<br><br><br> [Resource group](https://cloud.ibm.com/docs/vpc?topic=vpc-iam-getting-startedresources-and-resource-groups) for the Block Storage for VPC volume. 
 <br><br> * Location<br><br><br> Policies for the selected region. 
 <br><br> * Created date<br><br><br> Date the policy was created. 
 <br><br> * CRN<br><br><br> Cloud resource name of the policy. 
 <br><br> * Policy ID<br><br><br> Backup policy ID. 
 <br><br> * Tags for target resources<br><br><br> <br><br> * User tags that can trigger the creation of a backup when they are applied to any Block Storage for VPC volumes.<br> * Click the pencil icon to add more tags. For more information, see [Edit tags for target resources](https://cloud.ibm.com/docs/vpc?topic=vpc-backup-service-manage&interface=uibackup-edit-tags).<br> * See also [Applying backup policies to resources by using tags](https://cloud.ibm.com/docs/vpc?topic=vpc-backup-use-policies).<br><br><br> 
 Plan Show the plan name, retention policy, and plan status. Optionally, click Create to add more plans for an existing policy. 
 <br><br> * Plan name<br><br><br> Unique name for the plan. Expand to see plan details, such as frequency, tags that are associated with this plan, and whether fast restore and remote copies are enabled. 
 <br><br> * Retention<br><br><br> Period that you set for the plan to be in effect, for example, 30 days. 
 <br><br> * Status<br><br><br> Plan status. Shows enabled for an active plan.
Check the [VPC quotas documentation](https://cloud.ibm.com/docs/vpc?topic=vpc-quotas) for VPC resource quotas across all your VPC clusters in your VPC.



 How to fix it 

Verify that no VPC security groups are blocking traffic to your cluster and that the VPC load balancer is available.



2. Verify that the VPC load balancer for the Kubernetes LoadBalancer service exists. In the output, look for the VPC load balancer that is formatted kube-<cluster_ID>-<kubernetes_lb_service_UID>. You can get the Kubernetes LoadBalancer service UID by running kubectl get svc <service_name> -o yaml.

ibmcloud is load-balancers



* If the VPC load balancer is not listed, it does not exist for one of the following reasons:





* You reached the maximum number of VPC load balancers permitted per account. Across all your VPC clusters in your VPC, a maximum of 20 VPC load balancers can be created. One VPC load balancer is created for each Kubernetes LoadBalancer service that you create, and it routes requests to that Kubernetes LoadBalancer service only.
* The VPC load balancer was deleted through the VPC console or the CLI. To re-create the VPC load balancer for your Kubernetes LoadBalancer service, restart the Kubernetes master by running ibmcloud ks cluster master refresh --cluster <cluster_name_or_id>.



If you want to remove the load balancing setup for an app in your VPC cluster, delete the Kubernetes LoadBalancer service by running kubectl delete svc <kubernetes_lb_service_name>. The VPC load balancer that is associated with the Kubernetes LoadBalancer service is automatically deleted from your VPC.
3.
Before you begin 

This tutorial requires:



* [set up a registry namespace](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespaceregistry_namespace_setup)
* and [understand the basics of Kubernetes](https://kubernetes.io/docs/tutorials/kubernetes-basics/).







 Step 1: Create development Kubernetes cluster 

Kubernetes Service delivers powerful tools by combining Docker and Kubernetes technologies, an intuitive user experience, and built-in security and isolation to automate the deployment, operation, scaling, and monitoring of containerized apps in a cluster of compute hosts.

A minimal cluster with one (1) zone, one (1) worker node and the smallest available size (Flavor) is sufficient for this tutorial. The name mycluster will be used in this tutorial.

Open the [Kubernetes clusters](https://cloud.ibm.com/kubernetes/clusters) and click Create cluster. See the documentation referenced below for more details based on the cluster type. Summary:



* Click Standard tier cluster
* For Kubernetes on VPC infrastructure see reference documentation [Creating VPC clusters](https://cloud.ibm.com/docs/containers?topic=containers-cluster-create-vpc-gen2&interface=ui).



* Click Create VPC:



* Enter a name for the VPC.
* Chose the same resource group as the cluster.
* Click Create.



* Attach a Public Gateway to each of the subnets that you create:



* Navigate to the [Virtual private clouds](https://cloud.ibm.com/vpc-ext/network/vpcs).
* Click the previously created VPC used for the cluster.
* Scroll down to subnets section and click a subnet.
* In the Public Gateway section, click Detached to change the state to Attached.
* Click the browser back button to return to the VPC details page.
* Repeat the previous three steps to attach a public gateway to each subnet.
The files are downloaded to <user_home_directory>/.bluemix/plugins/kubernetes-service/clusters/<cluster_name>-admin.

--endpoint ENDPOINT_TYPE
: Optional: Specify the type of endpoint to use to connect to the cluster. If you don't specify this option, the default service endpoint for your cluster is used.



* private: If the private cloud service endpoint is enabled for your cluster, set to private to use the private cloud service endpoint for your cluster context. Note you must be in your IBM Cloud private network or connected to the private network through a [VPC VPN connection](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-onprem-example), or for classic infrastructure, a [classic VPN connection](https://cloud.ibm.com/docs/iaas-vpn?topic=iaas-vpn-getting-started) or [IBM Cloud Direct Link](https://cloud.ibm.com/docs/dl?topic=dl-get-started-with-ibm-cloud-dl).
* vpe: If it is a VPC cluster, set to vpe to use the Virtual Private Endpoint gateway for your cluster context. Note you must be connected to the same VPC where the cluster is deployed through [VPC VPN connection](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-overview).



--network
: Optional: Download the Calico configuration file, TLS certificates, and permission files that are required to run calicoctl commands in your cluster. This option can't be used with the --yaml option.

--skip-rbac
: Skip adding user Kubernetes RBAC roles based on the IBM Cloud IAM service access roles to the cluster configuration. Include this option only if you [manage your own Kubernetes RBAC roles](https://cloud.ibm.com/docs/containers?topic=containers-usersrbac).
The sample code block helps to create the resources of the same type in a sequential order.

 {: codeblock}
resource "ibm_is_vpc" "res_a" {
name = "test1"
}
resource "ibm_is_vpc" "res_b" {
name = "test2"
depends_on = [ibm_is_vpc.res_a]
}

* How do I enable the User list visibility for the IAM in Terraform?

Currently, Schematics do not support enabling user list visibility. For more information, about user list visibility, see [ibm_iam_account_settings](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/iam_account_settings).
* Can I configure the ibm_container_cluster Terraform resource to control the IPs on the IBM Cloud Object Storage bucket?

No, currently, the API does not support IPs on the IBM Cloud Object Storage bucket. For more information, about the argument and attribute reference for the container cluster, see [ibm_container_cluster](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/container_cluster).
* Can I retrieve a list of all the existing Virtual Servers for VPCs from all the regions by using Terraform?

Yes, but the VPC API’s are region specific so ibm_is_vpcs gives only one region VPC. If user requires one or more regions, you should define or use the alias during the resource provisioning, as shown in the code block.

 {: codeblock}
provider "ibm" {
region = "eu-de"
}

provider "ibm" {
alias = "dal"
region = "us-south"
}

data ibm_is_vpcs eu-de{
}
data ibm_is_vpcs dal {
provider = ibm.dal
}

output "vpcs" {
value = concat(
tolist(data.ibm_is_vpcs.eu-de.vpcs),
* [IBM Cloud VPC RYO VMware reference architecture](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vpc-ryo-arch-overview)
* [IBM Cloud Direct Link overview](https://cloud.ibm.com/docs/dl?topic=dl-get-started-with-ibm-cloud-dl)
* [IBM Cloud Transit Gateway overview](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-getting-started)
* [IBM Cloud VPC VPN overview](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-overview)
* [VPC IaaS endpoints](https://cloud.ibm.com/docs/vpc?topic=vpc-service-endpoints-for-vpcinfrastructure-as-a-service-iaas-endpoints)
* [VMware on Bare Metal VPC tutorial](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-bm-vmware)
Core <br><br> * [VPC infrastructure services](https://cloud.ibm.com/docs/vpc?topic=vpc-resource-authorizations-required-for-api-and-cli-calls)[1]<br><br><br> <br><br> * [Satellite](https://cloud.ibm.com/docs/satellite?topic=satellite-iam)<br><br><br> 
 Containers <br><br> * [Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-access_reference)<br> * [Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iam)<br><br><br> <br><br> * [Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/satellite?topic=satellite-iamiam-roles-clusters)[2]<br> * [Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iam)<br><br><br> 
 Networking <br><br> * [VPC infrastructure services](https://cloud.ibm.com/docs/vpc?topic=vpc-resource-authorizations-required-for-api-and-cli-calls)<br> * [Direct Link](https://cloud.ibm.com/docs/dl?topic=dl-iam)<br> * [Transit Gateway](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-iam)<br><br><br>
Services that don't use resource groups like IBM Cloud Container Registry or that don't need service binding like IBM Log Analysis work even if the cluster is in a different resource group.
* Consider giving clusters unique names across resource groups and regions in your account to avoid naming conflicts. You can't rename a cluster.



5. Classic clusters only: Consider [creating a reservation](https://cloud.ibm.com/docs/openshift?topic=openshift-reservations) to lock in a discount over 1 or 3 year terms for your worker nodes. After you create the cluster, add worker pools that use the reserved instances. Typical savings range between 30-50% compared to regular worker node costs.
6. VPC clusters only: Set up your IBM Cloud infrastructure networking to allow worker-to-master and user-to-master communication. Your VPC clusters are created with a public and a private cloud service endpoint by default. Optional: If you want your VPC clusters to communicate with classic clusters over the private network interface, you can choose to set up classic infrastructure access from the VPC that your cluster is in. Note that you can set up classic infrastructure access for only one VPC per region and [Virtual Routing and Forwarding (VRF)](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpointvrf) is required in your IBM Cloud account. For more information, see [Setting up access to your Classic Infrastructure from VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-setting-up-access-to-classic-infrastructure).



Looking for a fast way to create a cluster from the UI? Try out [Automating cluster creation with IBM Cloud Schematics templates](https://cloud.ibm.com/docs/openshift?topic=openshift-templates).





 Deciding on your cluster setup 

After you set up your account to create clusters, decide on the setup for your cluster. You must make these decisions every time that you create a cluster.
Container Container is functionally identical to an isolated stand-alone server with its own IP addresses, processes, files, users, its own version, its own configuration files, its own applications, system libraries, and other server functions. Containers share hardware nodes and the same OS kernel, but they are isolated from each other. Each container has a unique numerical ID starting with 1. 
 Host Operating System Host operating system (or Host) is an operating system that is installed on the hardware node. It is also called container 0, in contrast to real containers that have IDs that start with 1. 
 Template Template (or package set) is a set of original application files that are repackaged for mounting over Virtuozzo File System (VZFS). Two types of templates are available in Virtuozzo: OS templates that can be used to create new containers on their basis and application templates that can be added to containers after their creation. 
 PIM Parallels Infrastructure Manager (or PIM) is a web-based management tool that is designed for Host administrators. 
 PMC Parallels Management Console (or PMC) is a remote management tool with a graphical user interface that is designed for Host administrators. 
 PPP Parallels Power Panel is a web-based management tool that is designed for Container owners.
Figure 1. Architecture diagram of the tutorial

In the diagram above the end user is accessing the applications. The applications are leveraging shared microservices. The company has separate DevOps teams that own application1, application2 and shared. A networking team focuses on connectivity and network security. The DevOps teams manage Virtual Service Instances, VSIs, used to implement the services they create and support.





 Concrete Architecture 

The following architecture implements the isolation and connectivity requirements set by the company. Notice that application1, shared, and application2 are VPCs. The single zone and subnet in each VPC can be expanded to a more detailed multi zone implementation over time.

Zoom

![Architecture of the tutorial](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/solution-tutorials/includes/solution-tutorials/images/solution59-vpc-tg-dns-iam/architecture.png)

Architecture of the tutorial







 Before you begin 

This tutorial requires:



* IBM Cloud CLI with these plugins:



* Transit Gateway (tg)
* IBM Cloud VPC (vpc-infrastructure)
* DNS Services (dns)



* git to clone source code repository.
* terraform CLI to run the Terraform commands.



You will find instructions to download and install these tools for your operating environment in the [Getting started with solution tutorials](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-tutorials) guide.

In addition:



* Check for user permissions. Be sure that your user account has sufficient permissions to create and manage VPC resources, create a IBM Cloud® Transit Gateway and create a IBM Cloud® Transit Gateway services. See the list of [required permissions](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-user-permissions-for-vpc-resources) for VPC.
To see available zones for classic clusters, run ibmcloud ks zone ls. To see available zones for VPC clusters, run ibmcloud ks zone ls --provider vpc-gen2 for Generation 2 compute.

--provider PROVIDER
: Optional: The infrastructure provider for which you want to get flavor information for. Available options are classic, vpc-classic and vpc-gen2.

--show-storage
: Optional: Show additional raw disks that are available for SDS worker node flavors. For more information, see [Software-defined storage (SDS) machines](https://cloud.ibm.com/docs/containers?topic=containers-planning_worker_nodessds).

--output json
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.



 Example flavor ls command 

ibmcloud ks flavor ls --zone us-south-1 --provider vpc-gen2 --show-storage









 messages command 

Virtual Private Cloud

Classic infrastructure

View current messages from the IBM Cloud Kubernetes Service CLI plug-in for the IBMid user.

ibmcloud ks messages

Minimum required permissions
: None

Command options: None





 locations command 

Virtual Private Cloud

Classic infrastructure

List the locations that are supported by IBM Cloud Kubernetes Service. For more information about the locations that are returned, see [IBM Cloud Kubernetes Service locations](https://cloud.ibm.com/docs/containers?topic=containers-regions-and-zoneslocations).

ibmcloud ks locations [--output json]

Minimum required permissions
: None

Command options:

--output json
: Optional: Prints the command output in JSON format.





 versions command 

Virtual Private Cloud

Classic infrastructure

List all the container platform versions that are available for IBM Cloud Kubernetes Service clusters.
The following security groups are applied:



* Default VPC security group (randomly generated name)
* kube-<cluster-id>







 If you only want the cluster security group and not the default VPC security group 

Cluster security group

When you create the cluster specify --cluster-security-group cluster. Do not specify any additional security groups.

Example command to create a VPC cluster with only the kube-<cluster-id> cluster security group:

ibmcloud oc cluster create vpc-gen2 --name <cluster-name> --zone <zone> --vpc-id <vpc-id> --subnet-id <subnet-id> --cluster-security-group cluster

The cluster kube-<cluster-id> security group is applied.





 If you want the cluster security group and your own additional security groups 

Cluster security group

Your own security groups

When you create the cluster, specify --cluster-security-group cluster and up to four additional security groups that you own. You must include a separate --cluster-security-group option for each individual security group you want to add. Note that at maximum of five security groups can be applied to workers, including the security groups that are applied by default.

Example command to create a VPC cluster with the kube-<cluster-id> cluster security group and your own additional security groups:

ibmcloud oc cluster create vpc-gen2 --name <cluster-name> --zone <zone> --vpc-id <vpc-id> --subnet-id <subnet-id> --cluster-security-group cluster --cluster-security-group <group-id-1> --cluster-security-group <group-id-2> --cluster-security-group <group-id-3>

The following security groups are applied:



* kube-<cluster-id>
* Up to four of your own additional security groups, for a maximum of five total security groups.







 If you only want your own security groups 

Your own security groups

When you create the cluster, specify up to five security groups that you own.
* The primary disk has the kernel images to boot your worker node. This disk is unencrypted.
* The secondary disk has the container file system and locally pulled images. This disk is AES 256-bit encrypted with an IBM-managed LUKS encryption key that is unique to the worker node and stored as a Kubernetes secret in your cluster. When you reload or update your worker nodes, the LUKS keys are rotated.







 VPC worker nodes 

VPC infrastructure: By default, the one primary disk of VPC worker nodes is AES-256 bit encrypted at rest by the [underlying VPC infrastructure provider](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-aboutvpc-storage-encryption).

You can manage the encryption of the worker nodes by enabling a KMS provider at the worker pool level.



1. Complete the same [prerequisite steps](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionkms_prereqs) for enabling a KMS provider at the cluster level, including to create your own KMS instance and root key. You don't have to enable encryption at the cluster level, but you might want to so that you manage the encryption of cluster secrets.
2. Make sure that you have [service authorization policies in IBM Cloud IAM](https://cloud.ibm.com/iam/authorizations), created under the account where the KMS instance resides, with the following details:



* Required service access policy for Kubernetes Service and the KMS provider



1. Set the Source account for This account if the cluster you want to authorize accessing KMS resides in the current account, otherwise if the cluster located under a different account, select Other account and provide the account ID.
2. Set the Source service to Kubernetes Service.
3. Set the Target service to your KMS provider, such as Key Protect.
4. Include at least Reader service access.
5. Enable the authorization to be delegated by the source and dependent services.