vania-janet/multiturn-rag-retrieval-data huggingface dataset:
The allowlist includes subnets that you manually added and subnets that are automatically added and managed by IBM, such as worker node subnets.

ibmcloud ks cluster master private-service-endpoint allowlist get --cluster <cluster_name_or_ID>



Your authorized users can now continue with [Accessing clusters through the private cloud service endpoint](https://cloud.ibm.com/docs/containers?topic=containers-access_clusteraccess_private_se).







 Accessing VPC clusters through the Virtual Private Endpoint Gateway 

[Virtual Private Endpoint Gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe) is created for VPC clusters automatically. The Kubernetes master is accessible through this Virtual Private Endpoint gateway if authorized cluster users are connected to the same VPC where the cluster is deployed, such as through a [IBM Cloud VPC VPN](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-overview). In this case, the kubeconfig is configured with the Virtual Private Endpoint (VPE) URL which is private DNS name and could be resolved only by the IBM Cloud VPC Private DNS service. The IBM Cloud VPC Private DNS server addresses are 161.26.0.7 and 161.26.0.8.



1. Set up your IBM Cloud VPC VPN and connect to your VPC through VPN.



1. Configure a [client-to-site](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-client-to-site-overview) or [site-to-site](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-onprem-example) VPN to your VPC. For example, you might choose to set up a client-to-site connection with an OpenVPN Client.
2.
For more detailed steps and information about creating clusters, see [Creating VPC clusters](https://cloud.ibm.com/docs/containers?topic=containers-cluster-create-vpc-gen2&interface=clicluster_create_vpc). For information about planning your cluster set up, see [Preparing to create clusters](https://cloud.ibm.com/docs/containers?topic=containers-clusters&interface=cli).

Create a VPC cluster with three worker nodes.

ibmcloud ks cluster create vpc-gen2 --name my_cluster --zone us-east-1 --vpc-id <VPC_ID> --subnet-id <VPC_SUBNET_ID> --flavor bx2.4x16 --workers 3

For a VPC multizone cluster, after you created the cluster in a [multizone metro](https://cloud.ibm.com/docs/containers?topic=containers-regions-and-zoneszones-vpc), [add zones](https://cloud.ibm.com/docs/containers?topic=containers-add_workersvpc_add_zone).

ibmcloud ks zone add vpc-gen2 --zone <zone> --cluster <cluster_name_or_ID> --worker-pool <pool_name> --subnet-id <VPC_SUBNET_ID>





 Deploying an app to your cluster 

After you create a [classic](https://cloud.ibm.com/docs/containers?topic=containers-getting-startedclusters_gs) or a [VPC](https://cloud.ibm.com/docs/containers?topic=containers-getting-startedvpc-gen2-gs) cluster with a public gateway, deploy your first app. You can use a sample websphere-liberty Java application server that IBM provides and deploy the app to your cluster by using the Kubernetes dashboard.

The [Kubernetes dashboard](https://github.com/kubernetes/dashboard) is a web console component that is provided by the open source community and installed in your cluster by default.
* [Isolate app services within a namespace](https://cloud.ibm.com/docs/containers?topic=containers-vpc-kube-policiesservices_one_ns)
* [Isolate app services between namespaces](https://cloud.ibm.com/docs/containers?topic=containers-vpc-kube-policiesservices_across_ns)



[Opening required ports and IP addresses in other network allowlists](https://cloud.ibm.com/docs/containers?topic=containers-vpc-firewallvpc-firewall)



* [Opening ports in a corporate allowlist](https://cloud.ibm.com/docs/containers?topic=containers-vpc-firewallvpc-corporate)



* [Running ibmcloud, ibmcloud ks, and ibmcloud cr commands from behind an allowlist](https://cloud.ibm.com/docs/containers?topic=containers-vpc-firewallvpc-firewall_bx)
* [Running kubectl commands from behind an allowlist](https://cloud.ibm.com/docs/containers?topic=containers-vpc-firewallvpc-firewall_kubectl)
* [Running calicoctl commands from behind an allowlist](https://cloud.ibm.com/docs/containers?topic=containers-vpc-firewallvpc-firewall_calicoctl)



* [Allowing traffic from your cluster in other services' allowlists or in on-premises allowlists](https://cloud.ibm.com/docs/containers?topic=containers-vpc-firewallvpc-allowlist_workers)



* [Allowing ingress from a cluster to another service](https://cloud.ibm.com/docs/containers?topic=containers-vpc-firewallvpc-allowlist_workers_ingress)
* [Allowing egress to a cluster from another service](https://cloud.ibm.com/docs/containers?topic=containers-vpc-firewallvpc-allowlist_workers_egress)
* UI
* CLI
* Terraform







 Creating VPC clusters 

Virtual Private Cloud

Use the IBM Cloud CLI or the IBM Cloud console to create a standard VPC cluster, and customize your cluster to meet the high availability and security requirements of your apps.

Do not delete the subnets that you attach to your cluster during cluster creation or when you add worker nodes in a zone. If you delete a VPC subnet that your cluster used, any load balancers that use IP addresses from the subnet might experience issues, and you might be unable to create new load balancers.



 Prerequisites and notes 



* If worker nodes must access public endpoints, attach a public gateway to each subnet in your VPC.
* A public network gateway is required when you want your cluster to access public endpoints, such as a public URL of another app or an IBM Cloud service that supports public cloud service endpoints only. Make sure to review the [VPC networking basics](https://cloud.ibm.com/docs/containers?topic=containers-plan_vpc_basics) to understand when a public network gateway is required and how you can set up your cluster to limit public access to one or more subnets only.
* Before you can use KMS encryption, you must create a KMS instance and set up the required service authorization in IAM. For more information, see [Managing encryption for the worker nodes in your cluster](https://cloud.ibm.com/docs/containers?topic=containers-encryptionworker-encryption).
* By default, your cluster is provisioned with a VPC security group and a cluster-level security group. If you want to attach additional security groups or change which default security groups are applied when you create the cluster, you must [create your VPC cluster in the CLI](https://cloud.ibm.com/docs/containers?topic=containers-cluster-create-vpc-gen2cluster_vpcg2_cli).







 Creating a VPC cluster in the console 



1.
* [Worker-to-master and user-to-master communication using Virtual private endpoints or cloud service endpoints](https://cloud.ibm.com/docs/containers?topic=containers-plan_vpc_basicsvpc-workeruser-master)
* [Worker-to-master communication in VPC clusters](https://cloud.ibm.com/docs/containers?topic=containers-plan_vpc_basicsworker-to-master-comms)
* [User-to-master communication in VPC clusters](https://cloud.ibm.com/docs/containers?topic=containers-plan_vpc_basicsuser-to-master-comms)
* [Worker communication to other services or networks](https://cloud.ibm.com/docs/containers?topic=containers-plan_vpc_basicsvpc-worker-services-onprem)
* [Communication with other IBM Cloud services over the private or public network](https://cloud.ibm.com/docs/containers?topic=containers-plan_vpc_basicsvpc-worker-services-onprem-cloud-service)
* [Communication with resources in on-premises data centers](https://cloud.ibm.com/docs/containers?topic=containers-plan_vpc_basicsvpc-worker-services-onprem-resources)



* [Communication with resources in other VPCs](https://cloud.ibm.com/docs/containers?topic=containers-plan_vpc_basicsvpc-worker-services-onprem-other-vpcs)
* [Communication with IBM Cloud classic resources](https://cloud.ibm.com/docs/containers?topic=containers-plan_vpc_basicsvpc-worker-services-onprem-classic)



* [External communication to apps that run on worker nodes](https://cloud.ibm.com/docs/containers?topic=containers-plan_vpc_basicsvpc-external-workers)
Yes, the Spectrum Symphony offering supports multiple single key pairs that can be provided for access to all of the nodes that are part of the cluster. In addition, Spectrum Symphony has a feature where each node of the cluster can be accessed through passwordless SSH.





 What storage types are available through this offering? 

In the Spectrum Symphony offering, you can use Spectrum Scale scratch storage or persistent storage. A scratch storage configuration uses virtual server instances with instance storage. A persistent storage configuration uses bare metal servers with locally attached NVMe storage.





 Which Linux operating system is supported for worker nodes? 

The solution supports custom images based on RHEL 8.6 for virtual server instance worker nodes, and it supports the use of the stock RHEL 8.6 VPC images for bare metal worker nodes. At this time, custom images are not supported for use with VPC bare metal servers.





 Can I use a custom resolver that is already associated with a VPC? 

Yes, the solution supports the use of a custom resolver that is already associated to a VPC. If a VPC already has a custom resolver, the automation makes uses of it and the DNS service and associates the new DNS domain that is created from the solution for hostname resolution.





 Can I associate a single VPC with multiple DNS zones that have the same name? 

No, adding the same permitted network (for example, VPC) to two DNS zones of the same name is not allowed as mentioned [here](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-managing-permitted-networks&interface=uiadding-permitted-networks-ui). Therefore, when you select values for vpc_scale_storage_dns_domain and vpc_worker_dns_domain, ensure that they are unique and that there are no DNS zones that use either of those names that are already associated with the VPC that you might have specified in vpc_name.
Make sure that you use a zone that your worker nodes are connected to. To list VPC zones that your worker nodes use, run ibmcloud oc cluster get --cluster <cluster_name_or_ID> and look at the Worker Zones field in your CLI output. If you don't specify a zone, one of the worker node zones is automatically selected for your Block Storage for VPC instance.

region
: The region of the worker node where you want to attach storage.

tags
: In the parameters, enter a space-separated list of tags to apply to your Block Storage for VPC instance. Tags can help you find instances more easily or group your instances based on common characteristics, such as the app or the environment that it is used for.

iops
: If you entered custom for the profile, enter a value for the IOPs that you want your Block Storage for VPC to use. Refer to the [Block Storage for VPC custom IOPs profile](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-profilescustom) table for a list of supported IOPs ranges by volume size.

reclaimPolicy
: Enter the reclaim policy for your storage class. If you want to keep the PV, the physical storage device and your data when you remove the PVC, enter Retain. If you want to delete the PV, the physical storage device and your data when you remove the PVC, enter Delete.

allowVolumeExpansion
: Enter the volume expansion policy for your storage class. If you want to allow volume expansion, enter true. If you don't want to allow volume expansion, enter false.

volumeBindingMode
: Choose if you want to delay the creation of the Block Storage for VPC instance until the first pod that uses this storage is ready to be scheduled. To delay the creation, enter WaitForFirstConsumer. To create the instance when you create the PVC, enter Immediate.
3. Create the customized storage class in your cluster.

oc apply -f custom-storageclass.yaml
4. Verify that your storage class is available in the cluster.
When you create your VPC cluster, you can also attach additional security groups alongside, or instead of, the default VPC security groups. The security groups applied to the workers in the cluster are a combination of the security groups applied when you create the cluster and [when you create the worker pool](https://cloud.ibm.com/docs/containers?topic=containers-vpc-security-groupvpc-sg-worker-pool). A total of five security groups can be applied to workers, including the default security groups and any security groups applied to the worker pool. Note that these security group options are only available in the CLI.

The security groups applied to a cluster cannot be changed once the cluster is created. You can [change the rules of the security groups](https://cloud.ibm.com/docs/containers?topic=containers-vpc-security-groupvpc-sg-create-rules) that are applied to the cluster, but you cannot add or remove security groups at the cluster level. If you apply the incorrect security groups at cluster create time, you must delete the cluster and create a new one.



 If you only want the default VPC and cluster security groups and no additional security groups 

VPC security group

Cluster security group

Note that this is the default behavior at cluster create time.

When you create your cluster, do not specify any additional security groups.

Example command to create a VPC cluster with only the default VPC and kube-<cluster-id> cluster security groups:

ibmcloud ks cluster create vpc-gen2 --name <cluster-name> --zone <zone> --vpc-id <vpc-id> --subnet-id <subnet-id>

The following security groups are applied:



* Default VPC security group (randomly generated name)
* kube-<cluster-id>







 If you only want the cluster security group and not the default VPC security group 

Cluster security group

When you create the cluster specify --cluster-security-group cluster. Do not specify any additional security groups.

Example command to create a VPC cluster with only the kube-<cluster-id> cluster security group:
These links provide additional information about IBM Cloud® VPE for VPC:



* [VPE CLI reference](https://cloud.ibm.com/docs/vpc?topic=vpc-infrastructure-cli-plugin-vpc-referencevpe-clis)
* [VPE API reference](https://cloud.ibm.com/apidocs/vpc/latest?list-endpoint-gateways=list-endpoint-gateways)
* [FAQs for virtual private endpoints](https://cloud.ibm.com/docs/vpc?topic=vpc-faqs-vpe)
* [VPE for VPC infrastructure resources for Terraform](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/is_virtual_endpoint_gateway) (VPC infrastructure > Resources)
* [Troubleshooting VPE gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-troubleshoot-create-reserved-ip)
* [VPE Activity Tracker events](https://cloud.ibm.com/docs/vpc?topic=vpc-at-eventsevents-vpe)
Overview of network security options 

Virtual Private Cloud

This information is specific to VPC clusters. For network policy information for classic clusters, see [Classic: Controlling traffic with network policies](https://cloud.ibm.com/docs/containers?topic=containers-network_policies).

Control traffic to and from your cluster and traffic between pods in your cluster by creating network rules and policies.

Control traffic to and from your cluster with VPC access control lists (ACLs) and VPC security groups, and control traffic between pods in your cluster with Kubernetes network policies.



 Comparison of network security options 

The following table describes the basic characteristics of each network security option that you can use for your VPC cluster in IBM Cloud Kubernetes Service.



Network security options for VPC clusters

 Policy type Application level Default behavior Use case Limitations 

 [VPC security groups](https://cloud.ibm.com/docs/containers?topic=containers-vpc-security-group) (Recommended) Worker node Version 1.19 and later: The default security groups for your cluster allow incoming traffic requests to the 30000 - 32767 port range on your worker nodes. You can add rules to the default security group that is applied to your worker nodes. However, because your worker nodes exist in a service account and are not listed in the VPC infrastructure dashboard, you can't add more security groups and apply them to your worker nodes. 
 [VPC security groups](https://cloud.ibm.com/docs/vpc?topic=vpc-alb-integration-with-security-groups) Load balancer If you don't specify a security group when you create a load balancer, then the default security group is used. Allow inbound traffic from all sources to the listener port on a public load balancer. None 
 [VPC access control lists (ACLs)](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-acls) (Not recommended) VPC subnet The default ACL for the VPC, allow-all-network-acl-<VPC_ID>, allows all traffic to and from your subnets.
[Configuring VPC subnets](https://cloud.ibm.com/docs/containers?topic=containers-vpc-subnetsvpc-subnets)



* [Overview of VPC networking in IBM Cloud Kubernetes Service](https://cloud.ibm.com/docs/containers?topic=containers-vpc-subnetsvpc_basics)



* [Subnets](https://cloud.ibm.com/docs/containers?topic=containers-vpc-subnetsvpc_basics_subnets)
* [Public gateways](https://cloud.ibm.com/docs/containers?topic=containers-vpc-subnetsvpc_basics_pgw)
* [Virtual private endpoints (VPE)](https://cloud.ibm.com/docs/containers?topic=containers-vpc-subnetsvpc_basics_vpe)
* [Network segmentation](https://cloud.ibm.com/docs/containers?topic=containers-vpc-subnetsvpc_basics_segmentation)
* [VPC networking limitations](https://cloud.ibm.com/docs/containers?topic=containers-vpc-subnetsvpc_basics_limitations)



* [Creating a VPC subnet and attaching a public gateway](https://cloud.ibm.com/docs/containers?topic=containers-vpc-subnetscreate_vpc_subnet)



* [Creating a VPC subnet in the console](https://cloud.ibm.com/docs/containers?topic=containers-vpc-subnetscreate_vpc_subnet_ui)
* [Creating a VPC subnet in the CLI](https://cloud.ibm.com/docs/containers?topic=containers-vpc-subnetscreate_vpc_subnet_cli)



* [Creating VPC subnets for classic access](https://cloud.ibm.com/docs/containers?topic=containers-vpc-subnetsclassic_access_subnets)
![solution tutorial icon](https://cloud.ibm.com/media/docs/images/homepage/solution-tutorial.svg) [Scale workloads in shared and dedicated VPC environments](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-scaling-dedicated-compute)Scale workloads in shared and dedicated VPC environments Solution tutorial

Isolate workloads by provisioning a dedicated host, attaching an encrypted data volume to a VSI, expanding the attached data volume, and resizing the VSI after the fact.

![solution tutorial icon](https://cloud.ibm.com/media/docs/images/homepage/solution-tutorial.svg) [Securely access remote instances with a bastion host](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-secure-management-bastion-server)Securely access remote instances with a bastion host Solution tutorial

This tutorial walks you through the deployment of a bastion host to securely access remote instances within a Virtual Private Cloud (VPC). A bastion host is an instance that is provisioned with a public IP address and can be accessed via SSH. Once set up, the bastion host acts as a jump server, allowing secure connection to instances provisioned without a public IP address.

![solution tutorial icon](https://cloud.ibm.com/media/docs/images/homepage/solution-tutorial.svg) [Serverless web app and eventing for data retrieval and analytics](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-serverless-github-traffic-analytics)Serverless web app and eventing for data retrieval and analytics Solution tutorial

In this tutorial, you create an application to automatically collect GitHub traffic statistics for repositories and provide the foundation for traffic analytics. GitHub only provides access to the traffic data for the last 14 days. If you want to analyze statistics over a longer period of time, you need to download and store that data yourself.
* UI
* CLI
* Terraform







 Creating VPC clusters 

Virtual Private Cloud

Use the IBM Cloud CLI or the IBM Cloud console to create a standard VPC cluster, and customize your cluster to meet the high availability and security requirements of your apps.

Do not delete the subnets that you attach to your cluster during cluster creation or when you add worker nodes in a zone. If you delete a VPC subnet that your cluster used, any load balancers that use IP addresses from the subnet might experience issues, and you might be unable to create new load balancers.



 Prerequisites and notes 



* If worker nodes must access public endpoints, attach a public gateway to each subnet in your VPC.
* A public network gateway is required when you want your cluster to access public endpoints, such as a public URL of another app or an IBM Cloud service that supports public cloud service endpoints only. Make sure to review the [VPC networking basics](https://cloud.ibm.com/docs/containers?topic=containers-plan_vpc_basics) to understand when a public network gateway is required and how you can set up your cluster to limit public access to one or more subnets only.
* Before you can use KMS encryption, you must create a KMS instance and set up the required service authorization in IAM. For more information, see [Managing encryption for the worker nodes in your cluster](https://cloud.ibm.com/docs/containers?topic=containers-encryptionworker-encryption).
* By default, your cluster is provisioned with a VPC security group and a cluster-level security group. If you want to attach additional security groups or change which default security groups are applied when you create the cluster, you must [create your VPC cluster in the CLI](https://cloud.ibm.com/docs/containers?topic=containers-cluster-create-vpc-gen2&interface=clicluster_vpcg2_cli).







 Creating a VPC cluster in the console 



1.
In general, data that is stored on instance storage is ephemeral so stopping the storage node results in data loss. However, instance storage data is not lost when an instance is rebooted. For more information, see [Lifecycle of instance storage](https://cloud.ibm.com/docs/vpc?topic=vpc-instance-storageinstance-storage-lifecycle).
* Why do I see xxxhiddenxxx in the deployment output log instead of a variable name that I provided?

The solution provides useful information in the Terraform output log regarding the cluster and how to access cluster nodes (for example, SSH command, region, trusted profile ID, and so on).

The solution is integrated with the IBM Cloud catalog tile, and input that's provided there triggers Schematics to deploy the VPC resources that form the cluster. When passing sensitive information such as username and password, if that value matches with data in the deployment logs, Schematics outputs the value as xxxhiddenxxx according to a security policy that has been implemented.



IBM Spectrum Symphony



* Is it possible to submit jobs during a failover in-progress?

Yes, if SMC is not available for any reason, submitted jobs are scheduled in respective Lone symphony cluster.
* How do I check the SMC host logs?



1. Change the directory to /data/<cluster_id>/sym731/multicluster/smc/logs.
2. Run command tail -f smc-<host-file-name>.log.



* Does SMC allow there to be more than three zones in a region selected for deployment (smc_zone parameter to have more than 3 zones)?

No, the smc-zone parameter supports a maximum of 3 zones, entered as a list, for example, ["us-south-1","eu-gb-3","jp-tok-2"].
* Does SMC allow there to be more than three existing vpcs or more than three existing regions for VPCs?

No, SMC supports maximum of 3 existing VPCs in lone_vpc_name and 3 existing regions for VPCs in lone_vpc_region.