vania-janet/multiturn-rag-retrieval-data huggingface dataset:
To limit VPN traffic to a certain namespace,



1. Create a Calico global network policy named allow-non-vpn-outbound.yaml. This policy allows all namespaces to continue to send outbound traffic to all destinations, except to the remote subnet that the strongSwan VPN accesses. Replace <remote.subnet> with the remote.subnet that you specified in the Helm values.yaml configuration file. To specify multiple remote subnets, see the [Calico documentation](https://docs.tigera.io/calico/latest/reference/resources/globalnetworkpolicy).

apiVersion: projectcalico.org/v3
kind: GlobalNetworkPolicy
metadata:
name: allow-non-vpn-outbound
spec:
selector: has(projectcalico.org/namespace)
egress:
- action: Allow
destination:
notNets:
- <remote.subnet>
order: 900
types:
- Egress
2. Apply the policy.

calicoctl apply -f allow-non-vpn-outbound.yaml --config=filepath/calicoctl.cfg
3. Create another Calico global network policy named allow-vpn-from-namespace.yaml. This policy allows only a specified namespace to send outbound traffic to the remote subnet that the strongSwan VPN accesses. Replace <namespace> with the namespace that can access the VPN and <remote.subnet> with the remote.subnet that you specified in the Helm values.yaml configuration file. To specify multiple namespaces or remote subnets, see the [Calico documentation](https://docs.tigera.io/calico/latest/reference/resources/globalnetworkpolicy).

apiVersion: projectcalico.org/v3
kind: GlobalNetworkPolicy
metadata:
name: allow-vpn-from-namespace
spec:
openshift.io/cluster-monitoring: "true"
name: openshift-storage
2. Create the openshift-storage namespace by using the YAML file that you saved.

oc create -f os-namespace.yaml
3. Verify that the namespace is created.

oc get namespaces | grep storage
4. Create an IBM Cloud Object Storage service instance.

ibmcloud resource service-instance-create noobaa-store cloud-object-storage standard global
5. Create HMAC credentials. Make a note of your credentials.

ibmcloud resource service-key-create cos-cred-rw Writer --instance-name noobaa-store --parameters '{"HMAC": true}'
6. Create the Kubernetes secret named ibm-cloud-cos-creds in the openshift-storage namespace that uses your Object Storage HMAC credentials. When you run the command, specify your Object Storage HMAC access key ID and secret access key. Note that your secret must be named ibm-cloud-cos-creds.

oc -n 'openshift-storage' create secret generic 'ibm-cloud-cos-creds' --type=Opaque --from-literal=IBM_COS_ACCESS_KEY_ID=<access_key_id> --from-literal=IBM_COS_SECRET_ACCESS_KEY=<secret_access_key>
7. Verify that your secret is created.

oc get secrets -A | grep cos







 Optional: Setting up encryption by using Hyper Protect Crypto Services 

If you want to set up encryption, create an instance of Hyper Protect Crypto Services or Key Protect. Then, create a root key, and a Kubernetes secret that uses your Hyper Protect Crypto Services or Key Protect credentials.

Storage class encryption is available only for versions 4.10.0 and later of OpenShift Data Foundation.



1.
* [Setting up NodeLocal DNS cache](https://cloud.ibm.com/docs/containers?topic=containers-cluster_dnsdns_cache)



* [Enable NodeLocal DNS cache](https://cloud.ibm.com/docs/containers?topic=containers-cluster_dnsdns_enablecache)
* [Disable NodeLocal DNS cache](https://cloud.ibm.com/docs/containers?topic=containers-cluster_dnsdns_disablecache)



* [Customizing NodeLocal DNS cache](https://cloud.ibm.com/docs/containers?topic=containers-cluster_dnsdns_nodelocal_customize)



* [Editing the node-local-dns ConfigMap for general configuration updates](https://cloud.ibm.com/docs/containers?topic=containers-cluster_dnsdns_nodelocal_customize_configmap)
* [Editing the node-local-dns-config ConfigMap to extend with stub domains or upstream servers](https://cloud.ibm.com/docs/containers?topic=containers-cluster_dnsdns_nodelocal_customize_stub_upstream)



* [Setting up zone-aware DNS](https://cloud.ibm.com/docs/containers?topic=containers-cluster_dnsdns_zone_aware)



* [Setting up zone-aware DNS](https://cloud.ibm.com/docs/containers?topic=containers-cluster_dnsdns_zone_aware_deploy)
* [Disabling and deleting zone-aware DNS](https://cloud.ibm.com/docs/containers?topic=containers-cluster_dnsdns_zone_aware_delete)











 Logging and monitoring 

[Logging for clusters](https://cloud.ibm.com/docs/containers?topic=containers-healthhealth)
: To set your account as the scope, use "" as the value.

To set a namespace, repository, digest, or tag as the scope, enter the value in one of the following formats:



* namespace
* namespace/repository
* namespace/repository:tag
* namespace/repository@digest



--issue-type ISSUE_TYPE
: The issue type of the exemption for the security issue that you want to remove. To find the issue types for your exemptions, run ibmcloud cr exemption-list.

--issue-id ISSUE_ID
: The ID of the exemption for the security issue that you want to remove. To find the issue IDs for your exemptions, run ibmcloud cr exemption-list.





 Examples 

Delete a CVE exemption for CVE with ID CVE-2018-17929 for all images in the us.icr.io/birds/bluebird repository.

ibmcloud cr exemption-rm --scope us.icr.io/birds/bluebird --issue-type cve --issue-id CVE-2018-17929

Delete an account-wide CVE exemption for CVE with ID CVE-2018-17929.

ibmcloud cr exemption-rm --scope "" --issue-type cve --issue-id CVE-2018-17929

Delete a configuration issue exemption for issue application_configuration:nginx.ssl_protocols for a single image with the tag us.icr.io/birds/bluebird:1.

ibmcloud cr exemption-rm --scope us.icr.io/birds/bluebird:1 --issue-type configuration --issue-id application_configuration:nginx.ssl_protocols

Delete a configuration issue exemption for issue application_configuration:nginx.ssl_protocols for a single image with the digest us.icr.io/birds/bluebird@sha256:101010101010.
If you are using the [public repository](https://github.com/IBM-Cloud/hpc-cluster-lsf) that is provided by IBM Cloud, then set this variable as template_repo_request_model['url'] = 'https://github.com/IBM-Cloud/hpc-cluster-lsf'; otherwise, set it to the private repository you are using.



4. Inside the schematics_service.create_workspace function, provide the following parameters:



* Provide an optional description.
* Provide a name to identify your Schematics workspace, for example, terraform-dev-workspace.
* Change the type parameter to the Terraform version that you are using to create IBM Cloud resources, for example, terraform_v0.13.
* Change the location to a region where your Schematics workspace needs to be created, for example, us-south.
* Change the resource group to the resource group where your resources should be grouped, for example, Default for a default resource group.
* If you are using a private GitHub repository, provide your personal GitHub access token that you set up in [Setting up the IBM Cloud Schematics](https://cloud.ibm.com/docs/ibm-spectrum-lsf?topic=ibm-spectrum-lsf-setting-up-api) prerequisites in the x_github_token= "<github-api-token>" parameter. If you are using the public repository that is provided by IBM Cloud, you do not need to specify this parameter.
* Optional: Provide the tags if you want to filter resources by using the tag.



5. Run the Python script by using python3 <python-file-name> to create a Schematics workspace in the IBM Cloud.
6. You get a successful response if the parameters passed as part of the request are valid and you should be able to see the Schematics workspace that you created in the IBM Cloud console. If you don’t get a successful response, the error response contains the errors that you need to resolve.
"__netrc__":"'example.com', 'user1', 'pass1']'example1.com', 'user2' , 'pass2']]"
}
],



 Using private modules with templates 

Schematics internally creates the .netrc file based on the env_values configured in the JSON file. Here is a syntax and sample testexample.json example file to clone all the files to create and apply the Schematics Workspaces through command-line and API.

Syntax with the description:

{
"name": "<workspace_name>",
"shared_data": {
"region": "<region_name>"
},
"type": [
"<terraform_version>"
],
"description": "<description of the workspace>",
"template_repo": {
"url": "<your Git repository with the module>"
},
"template_data": [
{
"folder": ".",
"type": "<terraform_version>",
"env_values":
{
"__netrc__":"'<git repository>','<git username>','<git_password>']]"
}
]
}
]
}
Show more

Example testexample.json with netrc payload:

{
"name": "testnetrcworkspaceexample",
"shared_data": {
"region": "us-south"
},
"type": [
"terraform_v1.0"
],
"description": "terraform workspace",
"template_repo": {
"url": "https://github.com/xxxx/test-template-private-module"
},
"template_data": [
{
: If you want to add or remove namespaces, you must have the Manager role, see [Access roles for configuring Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iamaccess_roles_configure).





 24 June 2020 

Restoring all tags for a digest in a repository is now an option
: When you want to restore an image, you can restore either by tag or by digest. Restoring by digest restores the digest and all its tags in the repository that aren't already in the live repository. You can restore an image by running the [ibmcloud cr image-restore](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_image_restore) command.

For more information, see [Restoring images](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_images_registry_images_restore).





 18 May 2020 

Retaining untagged images is now an option when you clean up your namespaces
: Retention policies now include untagged images by default when they calculate what to retain. You can use the retain-untagged option for the [ibmcloud cr retention-policy-set](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_retention_policy_set) and [ibmcloud cr retention-run](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_retention_run) commands to keep all untagged images and delete only tagged images. You can view the value of retain-untagged for each retention policy by running the [ibmcloud cr retention-policy-list](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_retention_policy_list) command.

For more information, see [Cleaning up your namespaces](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_retention).





 30 April 2020
If you have multiple namespaces in your pipeline, you can apply different retention criteria for each namespace to best suit your requirements.

Consider a typical delivery pipeline with development, staging, and production environments. As code is delivered, continuous integration and continuous deployment pushes images into the registry and then deploys them straight to your development environment. After testing, some builds from development are promoted to staging, and then potentially onto production. In this scenario, the rate of image change is fastest in development and slowest in production. If all your environments pull images from the same namespace, it can be difficult to choose an appropriate number of images to retain due to this difference in velocity.

A good approach is to deliver all images into a development namespace, for example, project-development, and then to use the [ibmcloud cr image-tag](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_image_tag) command to tag the image into a different namespace when it is promoted to a higher stage of the pipeline. In the previous example, you can have three namespaces: development, project-development, staging, project-staging, and production, project-production. When you are promoting from development to staging, images are tagged from the project-development namespace into the project-staging namespace, and the images from the project-staging namespace are used for deployment. Similarly, when you are promoting from staging to production, images are tagged from the project-staging namespace into the project-production namespace, and the project-production namespace images are used in the production deployment.

You gain the following advantages by using this technique:



* You can choose different retention settings for development, staging, and production namespaces.
* You minimize the chances of accidentally removing an image that might be in use in your staging or production environments, when compared with using a single namespace for all images.
* You can use different [IAM](https://cloud.ibm.com/docs/Registry?topic=Registry-iam) policies. For example, you can have more restrictive access to production images.
* You can sign production images, but leave development and staging images unsigned.
1.0.44 16 July 2020 <br><br> * Fixed a bug that is associated with namespace target command and improved the error messages.<br><br><br> 
 1.0.43 8 July 2020 <br><br> * Fixed IAM namespace targeting so that you can target a namespace without first targeting an org and space.<br> * Updated the default version for Golang actions.<br><br><br> 
 1.0.40 30 May 2020 <br><br> * Added new ibmcloud fn namespace target command to allow users to target any IAM or CF-based namespaces.<br> * Added print out information to notify users the region under which namespaces are listed when users issue ibmcloud fn namespace list command.<br> * Disallow users to set apihost by using the ibmcloud fn property set --apihost command.<br><br><br> 
 1.0.39 22 April 2020 <br><br> * Fixed a bug that is related to wsk deploy actions in IAM namespaces.<br><br><br> 
 1.0.38 2 March 2020 <br><br> * Introduced two new flags for trigger commands, --trigger-param and --feed-param. With these flags, you can distinguish between trigger parameters and trigger feed parameters, making trigger create and update commands more flexible. For more information, see [Create trigger command](https://cloud.ibm.com/docs/openwhisk?topic=cloud-functions-cli-plugin-functions-clicli_trigger_create).<br> * Resolved a bug that is related to wsk deploy APIs where wsk deploy ignores require-whisk-auth annotation when you deploy APIs based on actions with require-whisk-auth annotations.<br> * Improved the messages for service bind command with the --verbose flag.<br> * Improved error messages for ibmcloud fn property set --namespace CFnamespace.<br> * Changes for wsk deploy and Travis environment compatibility.<br><br><br>
* Select a Location for your workspace. The workspace location does not have to match the resource location.



3. Set the required deployment variables. Review the input parameters and provide values that match your solution. Some parameters have default values. The values that you must specify include:



 Component type Parameter values needed 

 User-specific information <br><br> * API key<br> * SSH key name. For example, "ibmcloud_ssh_key_name1,ibmcloud_ssh_key_name2,..."<br> * Resource Group<br> * IP address. Enter the IP address in the format: "public_ip_address1/32,public_ip_address2/32,...". For example, "103.42.91.78/32"<br> * Your local machine OS<br> * Prefix to add to resource names<br><br><br> 
 Zone The zone where resources are deployed 
 Image ID to use for region VSIs <br><br> * Bastion Server<br> * App Server<br> * Web Server<br> * Db Server <br> Images are region-specific. To find the image IDs for your region, open the IBM Cloud shell and enter ibmcloud target -r < region_name > to set your region, then ibmcloud is images to see a list of images for that region.<br><br><br> 



4. Set the optional deployment variables. These include parameters for optional features.



 Component type Parameter values needed 

 Auto scale App VSI parameters <br><br> * Min server<br> * Max servers<br> * CPU threshold<br><br><br> 
 Auto scale web VSI parameters <br><br> * Min server<br> * Max servers<br> * CPU threshold<br><br><br> 
 VSI spread strategy (host or power spread) <br><br> * App spread strategy<br> * web spread strategy<br> * Db spread strategy<br><br><br>
Create a Terraform configuration file that is named main.tf. In this file, you add the configuration to create a Container Registry namespace and to assign a user an IAM

access policyin Identity and Access Management (IAM) for that namespace by using HashiCorp Configuration Language (HCL). For more information, see the [Terraform Language Documentation](https://developer.hashicorp.com/terraform/language).

The following example creates a namespace in the default

resource groupwith a name of your choice and attaches an image retention policy to that namespace that retains 10 images. To retrieve the ID of the default resource group, the ibm_resource_group data source is used. Then, the user user@ibm.com is assigned the Manager role in the IAM access policy for the namespace for a particular region. The region is retrieved from the terraform.tfvars file that you created in step 1.

data "ibm_resource_group" "group" {
name = "default"
}

resource "ibm_cr_namespace" "cr_namespace" {
name = "<namespace_name>"
resource_group_id = data.ibm_resource_group.group.id
}

resource "ibm_cr_retention_policy" "cr_retention_policy" {
namespace = ibm_cr_namespace.cr_namespace.id
images_per_repo = 10
}

resource "ibm_iam_user_policy" "policy" {
ibm_id = "user@ibm.com"
roles = ["Manager"]

resources {
service = "container-registry"
resource = ibm_cr_namespace.cr_namespace.id
resource_type = "namespace"
region = var.region
}
}
Show more

Updating a namespace by using Terraform is not supported. You can use Terraform to create and remove namespaces only.
3. Initialize the Terraform CLI.

terraform init
4. Create a Terraform execution plan.
For more information about VPC prefixes and about creating prefixes, see [Bring your own subnet](https://cloud.ibm.com/docs/vpc?topic=vpc-configuring-address-prefixes).





 Related links 



* [IBM Cloud VPC getting started](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started)
* [IBM Cloud VPC Bare Metal Servers](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-for-bare-metal-servers)
* [IBM Cloud VPC RYO VMware reference architecture](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vpc-ryo-arch-overview)
* [IBM Cloud Direct Link overview](https://cloud.ibm.com/docs/dl?topic=dl-get-started-with-ibm-cloud-dl)
* [IBM Cloud Transit Gateway overview](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-getting-started)
* [IBM Cloud VPC VPN overview](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-overview)
* [VPC IaaS endpoints](https://cloud.ibm.com/docs/vpc?topic=vpc-service-endpoints-for-vpcinfrastructure-as-a-service-iaas-endpoints)
* [VMware on Bare Metal VPC tutorial](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-bm-vmware)
If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)
* Ensure you that have the [Manager IBM Cloud IAM service access role](https://cloud.ibm.com/docs/openshift?topic=openshift-usersadd_users) for all namespaces.
* To assign access to individual users or users in an access group, ensure that the user or group has been assigned at least one [IBM Cloud IAM platform access role](https://cloud.ibm.com/docs/openshift?topic=openshift-usersadd_users) at the Red Hat OpenShift on IBM Cloud service level.



To create custom RBAC permissions,



1. Create the role or cluster role with the access that you want to assign.



1. Create a .yaml file to define the role or cluster role.

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
namespace: default
name: my_role
rules:
- apiGroups: [""]
resources: ["pods"]
verbs: ["get", "watch", "list"]
- apiGroups: ["apps", "extensions"]
resources: ["daemonsets", "deployments"]
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]



Table 3. Understanding the YAML parameters

 Parameter Description 

 kind Use Role to grant access to resources within a specific namespace. Use ClusterRole to grant access to cluster-wide resources such as worker nodes, or to namespace-scoped resources such as pods in all namespaces.
* clusterName is the name of your cluster
* date is the current date
* namespace is the namespace where you deployed your agent. This is normally ibm-observe.







 Step 4. Create the namespace ibm-observe 

This step is only required if you installed the prior logging agent in a namespace that is different from ibm-observe.

To check if the namespace exists, run the following command:

kubectl get namespaces

Verify the ibm-observe namespace is active.

If you need to create the namespace, run the following command:

kubectl create namespace ibm-observe





 Step 5. Delete the logging agent version 2 

If you are running the logging agent 2.0 or earlier, do the following:



1. Delete the old agent by running the following command:

kubectl delete daemonset.apps/logdna-agent
2. Delete the secret in the default namespace by running the following command:

kubectl delete secret logdna-agent-key

Make sure you change to the default context before running this command.



If you are running the logging agent 2.1 or later, delete the old agent by running the following command:

kubectl delete -f <YOUR_FILE_NAME>

Where YOUR_FILE_NAME is the name of the yaml file you used to deploy the old agent. This is the file you obtained in [Step 3](# upgrade_log_analysis_agent_3_step3).





 Step 6. Preparing the version 3 yaml file to run the agent as non-root 

When you deploy a logging agent version 3 by using the yaml that is provided, you configure the agent with the feature stateful lookback enabled. This feature helps avoid log loss or duplication of data when the agent restarts. Stateful lookback requires the logging agent to run as root.

If you run in a secured environment or a highly regulated environment, the logging agent should run as non-root. To do this, you must edit the yaml you must edit the yaml file that is provided.
Specify akamai-ext for Akamai or cloudflare-ext for Cloudflare.

--secret-namespace NAMESPACE
: Optional. The namespace that the domain TLS secret is created in. If no namespace is specified, the secret is created in the default namespace.







 Managing domains 

Learn how to manage the domains that exist in your cluster.



 Viewing domains in a cluster 

You can view the status of all domains in your cluster, or you can view details of a single domain. After you create a new domain or attach an existing domain in your cluster, the domain might remain in a pending state for a few minutes.



 List all domains in a cluster. 

For more details and command options, see the [CLI reference](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-cli&interface=uiingress-domain-ls).

ibmcloud ks ingress domain ls --cluster CLUSTER





 Get the details of a single domain. 

For more details and command options, see the [CLI reference](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-cli&interface=uiingress-domain-get).

ibmcloud ks ingress domain credential get --cluster CLUSTER







 Removing a domain from a cluster 

If you delete a domain from a cluster, the domain cannot be recovered. If you later need the domain, you must reprovision it with the ibmcloud ks ingress domain create command. Note that you cannot delete a cluster's default domain. If you want to delete the domain that is currently registered as the default, you must first [assign a different default domain](https://cloud.ibm.com/docs/containers?topic=containers-ingress-domainsingress-domain-manage-default).

If you delete a domain that is registered with the IBM internal provider, you cannot reuse the domain name.