vania-janet/multiturn-rag-retrieval-data huggingface dataset:
helm uninstall <name> <namespace>
11. Install the ibmcloud-block-storage-plugin Helm chart.

helm install <name> iks-charts/ibmcloud-block-storage-plugin
12. Create an ibm-block-secrets namespace.

oc create ns ibm-block-secrets
13. Create a role binding in the ibm-block-secrets namespace for the block storage plug-in.

oc create rolebinding ibmcloud-block-storage-plugin-byok --clusterrole=ibmcloud-block-storage-plugin-byok --serviceaccount=kube-system:ibmcloud-block-storage-plugin --group system:nodes --namespace=ibm-block-secrets
14. Create a Kubernetes secret named secret.yaml and that includes the credentials to access your root key in your Key Protect service instance.



1. Create a configuration file for the secret.

apiVersion: v1
kind: Secret
metadata:
labels:
kmsConfig: kpc-secretLabel
name: <secret_name> Enter a name for your secret. Example: my_secret
namespace: <namespace> Enter the name of the namespace where you want to create the secret. The secret must be in same namespace where your app is deployed. Example: default
stringData:
config: |-
{
"api_key":"<service_id_api_key>", Enter the API key for the service ID that you created. Example: "AA1aAAaA1a21AAaA1aAAaAa-AA-1AAaaA1aA1aAaaaAA"
"iam_endpoint":"https://iam.cloud.ibm.com",
"key_protect_endpoint":"https://<region>.kms.cloud.ibm.com", Example: "https://us-east.kms.cloud.ibm.com"
For more information, see the tutorial for [Getting started with Terraform on IBM Cloud®](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-getting-started). The plug-in abstracts the IBM Cloud APIs that are used to complete this task.
* Create a Terraform configuration file that is named main.tf. In this file, you add the configuration to create a DNS Services service instance and to assign a user an access policy in Identity and Access Management (IAM) for that instance by using HashiCorp Configuration Language (HCL). For more information, see the [Terraform documentation](https://www.terraform.io/docs/language/index.html).





1. Create a DNS Services instance by using the ibm_resource_instance resource argument in your main.tf file.

The DNS Services DNS zone in the following example is named my-dns-zone and is created with the instance ID of p-dns-instance-id.

data "ibm_resource_group" "rg" {
is_default = true
}

resource "ibm_resource_instance" "test-pdns-instance" {
name = "private-dns-instance-example"
resource_group_id = data.ibm_resource_group.rg.id
location = "global"
service = "dns-svcs"
plan = "standard-dns"
}

resource "ibm_dns_zone" "pdns-1-zone" {
name = "my-dns-zone"
instance_id = ibm_resource_instance.test-pdns-cr-instance.guid
description = "testdescription"
label = "testlabel"
}
Show more
2. After you finish building your configuration file, initialize the Terraform CLI. For more information, see [Initializing Working Directories](https://www.terraform.io/cli/init).

terraform init
3.
2. Click Create workspace.
3. On the Specify template page:



* Enter the URL for the Schematics interface.
* Select the Terraform version that is listed in the readme file.
* Click Next.



4. On the Workspace details page:



* Enter a name for the workspace.
* Select a Resource group.
* Select a Location for your workspace. The workspace location does not have to match the resource location.
* Select Next.



5. Select Create to create your workspace.
6. On the workspace Settings page, in the Input variables section, review the default input variables and provide values that match your solution:



* Your API key
* Your private SSH key from your local machine
* The ID for the SSH key that you created and uploaded to IBM Cloud. Enter the SSH key ID in square brackets and quotation marks, for example [ "ibmcloud_ssh_key_UUID1","ibmcloud_ssh_key_UUID2",... ].
* The floating IP address for your bastion server.
* The Region for your resources
* The Zone for your resources
* Whether to use an existing VPC or create one
* Whether to use an existing subnet
* Whether to create new port only when a new subnet is created
* TCP port range, nimimun and maximum
* VPC name
* Subnet name
* Security group name
* Hostname
* Profile
* Image
* Minimal recommended disk sizes
* SAP HANA main password - This password must be 8 - 14 characters, upper and lowercase letters, a number, and a special character.
* SAP main password - This password must be 10 - 14 characters, upper and lowercase letters, a number, and a special character that is not an exclamation point.
* Click Save changes.
Namespace buckets can include multiple namespace resources from different cloud providers or on-prem buckets. The namespace bucket access key and secret key are used in your s3 apps to configure access to your namespace bucket which then defines read and write policies to namespace resources that you configure. 
 12 Namespace bucket secret key The secret key is used to access your namespace bucket. Namespace buckets can include multiple namespace resources from different cloud providers or on-prem buckets. The namespace bucket access key and secret key are used in your s3 apps to configure access to your namespace bucket which then defines read and write policies to namespace resources that you configure. 







 Feature support by billing type 



Billing plan overview

 Feature support Essentials Advanced 

 Block storage Yes Yes 
 File storage Yes Yes 
 Object storage Yes Yes 
 Node and disk resiliency Yes Yes 
 Operator based automation Yes Yes 
 Compression Yes Yes 
 Local snapshots and cloning Yes Yes 
 Basic Cluster-wide encryption Yes Yes 
 Advanced encryption with KMS No Yes 
 Regional disaster recovery with replication No Yes 
 Stretched Clusters - Metro high availability and disaster recover No Yes 
 Multi-cluster - Metro high availability and disaster recover No Yes 







 Deploying OpenShift Data Foundation 

Review the deployment options for your infrastructure provider.

Virtual Private Cloud (VPC) clusters
: You can deploy ODF by using dynamic provisioning with Block Storage for VPC. For more information, see [Deploying OpenShift Data Foundation on VPC clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-deploy-odf-vpc).

Satellite clusters
: If you want to deploy ODF to Satellite clusters, you can use the Satellite storage template. For more information, see the following links.
: [Deploying the OpenShift Data Foundation template for remote, dynamically provisioned disks](https://cloud.ibm.com/docs/satellite?topic=satellite-storage-odf-remote).
Why don't all my namespaces show in the Resource list? 

My IBM Cloud® Container Registry namespaces don't all show up in the IBM Cloud Resource list page in the IBM Cloud console.

  What’s happening 

When you view your namespaces in the IBM Cloud Resource list page, they don't all show up.

  Why it’s happening 

Only namespaces that are assigned to

resource groupsshow in the IBM Cloud Resource list page.

Namespaces created in version 0.1.485 of the Container Registry CLI or later, or in the IBM Cloud console on or after 29 July 2020, are created in the resource group that you specify. If you don't specify a resource group, and a resource group isn't targeted, the default resource group is used.

Namespaces created in version 0.1.484 of the Container Registry CLI or earlier, or in the IBM Cloud console before 29 July 2020, aren't assigned to resource groups.

  How to fix it 

If you want to see all your namespaces in the IBM Cloud Resource list page, you must assign each namespace to a resource group, see [Assigning existing namespaces to resource groups](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespaceregistry_namespace_assign).
Log in to IBM Cloud with your API key file that you have generated in step 7a in the section [Install the IBM Cloud and OpenShift client Command Line Interfaces (CLI)](https://cloud.ibm.com/docs/sap?topic=sap-rhos-set-up-clusterrhos-jump-host).

ibmcloud login --apikey @myAK4sdh_file
2. Create a new Container Registry namespace, ibmcloud cr namespace-add <my_namespace>. For this example, the namespace name is sdh_cr_os, which is an acronym for SAP Data Hub - Container Registry - OpenShift.

ibmcloud cr namespace-add sdh_cr_os
3. Verify that the namespace is created.

ibmcloud cr namespace-list





 Next Steps 

Complete the setup following Red Hat instructions and then continue to deployment:



* Go to the Red Hat article and do these steps:



* [RHA 3.4.3.2.4. Allow administrator to manage SDH resources](https://access.redhat.com/articles/3630111admin-can-manage-sdh)
* [RHA 3.4.3.2.5. Create privileged tiller service account](https://access.redhat.com/articles/3630111create-privileged-tiller)
* [RHA 3.4.3.2.6. Initialize helm](https://access.redhat.com/articles/3630111helm-init)
* [RHA 3.4.3.2.7. Create sdh project](https://access.redhat.com/articles/3630111create-sdh-project)
* Skip step [RHA 3.4.3.2.8. Granting privileges to sdh admin](https://access.redhat.com/articles/3630111sdhadmin-privileged).
Planning your workspace structure 

You can plan and design your workspace by following queries.



* How to map workspace resource with the Git repository structure?
* How many number of workspaces that you need?
* How to reuse the configuration files across environments and workspaces?
* How to control access and manage your workspaces?





 Designing your workspace and Git repository structure 

Plan out the organizational structure of your workspace to match the microservice and permission structure of your organization. These workspaces uses Terraform templates from private or public Git repositories such as GitHub, GitLab, Bitbucket, and Azure DevOps. The table provides the format of the repositories source.



Git repositories

 Git repositories URL 

 GitHub https://github.com/<your_user_name>/<repo_name>/tree/<branch_name>/<folder_name> 
 GitLab https://gitlab.com/<your_user_name>/<project_name>/tree/<branch_name>/<folder_name> 
 Bitbucket https://bitbucket.org/<your_user_name>/<repo_name>/src/<branch_name>/<folder_name> <br>https://<username>@bitbucket.org/<workspace_name>/tf_cloudless_sleepy/src/master 
 Azure DevOps https://azure.com/<your_user_name>/<repo_name>/src/<branch_name>/<folder_name> <br>https://visualstudio.com/<your_user_name>/<repo_name>/src/<branch_name>/<folder_name> 





 How many workspaces do I need? 

To find out how many workspaces you need in IBM Cloud Schematics, look at the microservices that build your app and the environments that you need to develop, test, and publish your microservice.
For more information, see [What are context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-whatis).

For an example of how to set up context-based restrictions, see the context-based restrictions tutorial [Leveraging context-based restrictions to secure your resources](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-tutorial).

When you set up context-based restrictions, the restrictions apply to everything for the selected service in the account unless you select a subset of resources. To set up your own context-based restrictions for Container Registry, when you're creating a rule, in the Select your resources section, select Container Registry. Container Registry supports the following subset of resources: resource type = namespace and resource id = YOUR_IMAGE_NAMESPACE, where YOUR_IMAGE_NAMESPACE is the namespace of your image.

For example, if your image is in the format uk.icr.io/<my_project>/<my_image>:latest, where <my_project> is the name of your project and <my_image> is the name of the image, the attribute types are as shown in the following table.



Table 1. Example attribute types

 Attribute type Operator Value 

 Region string equals London 
 Resource Type string equals namespace 
 Resource Name string equals <my_project> 



The Resource Name value is a namespace, as shown by the [ibmcloud cr namespace-list](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_namespace_list) command.





 Platform management roles 

The following table details actions that are mapped to platform management roles. Platform management roles enable users to perform tasks on service resources at the platform level, for example assign user access for the service, and create or delete service IDs.



Table 2. IAM user roles and actions

 Platform management roles Description of actions Example actions 

 Viewer Not supported 
 Editor Not supported 
 Operator Not supported 
 Administrator Configure access for other users.<br><br>Apply pull secrets to clusters.
namespace: kube-system
---
apiVersion: v1
kind: ConfigMap
metadata:
name: ibm-user-custom-configurator
namespace: kube-system
data:
89-hugepages.conf: 
vm.nr_hugepages=<<NUMBER_OF_HUGEPAGES>>
configure.sh: 
!/usr/bin/env bash
set -x
cp -f /scripts/ibm-user-custom-configuration.sh /host-usr-local-bin/ibm-user-custom-configuration.sh
chmod 0755 /host-usr-local-bin/ibm-user-custom-configuration.sh
cp -f /scripts/ibm-user-custom-configuration.service /host-etc-systemd-dir/ibm-user-custom-configuration.service
chmod 0644 /host-etc-systemd-dir/ibm-user-custom-configuration.service
if [ -f /scripts/89-hugepages.conf ]]; then
cp -f /scripts/89-hugepages.conf /host-etc-systctld-dir/89-hugepages.conf
fi
nsenter -t 1 -m -u -i -n -p -- systemctl daemon-reload
nsenter -t 1 -m -u -i -n -p -- systemctl enable ibm-user-custom-configuration.service
nsenter -t 1 -m -u -i -n -p -- systemctl start ibm-user-custom-configuration.service
ibm-user-custom-configuration.sh: 
!/usr/bin/env bash
set -x
cat >/tmp/ibm-user-config.conf <<EOF
START USER CONFIG
cpuManagerPolicy: static
END USER CONFIG
EOF
sed -i '/START USER CONFIG/,/END USER CONFIG/d' /etc/kubernetes/kubelet.conf
namespace: <namespace_name>
stringData:
encrypted: <true_or_false>
data
encryptionKey: <encryption_key>

name
: Enter a name for your secret.

namespace
: Enter the namespace where you want to create your secret.

encrypted
: In the parameters, enter true to set up encryption for your Block Storage for Classic volumes.

encryptionKey
: In the parameters, enter the root key CRN of your Key Protect service instance that you want to use to encrypt your Block Storage for Classic volume. To use your root key CRN in a secret, you must first convert it to base64 by running echo -n "<root_key_CRN>" | base64.
6. Follow steps 4-9 in [Adding Block Storage for VPC to your apps](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-blockvpc-block-add) to create a PVC with your customized storage class to provision Block Storage for VPC that is configured for encryption with your Key Protect root key. Then, mount this storage to an app pod.

Your app might take a few minutes to mount the storage and get into a Running state.
7. Verify that your data is encrypted. List your Block Storage for Classic volumes and note the ID of the instance that you created. The storage instance Name equals the name of the PV that was automatically created when you created the PVC.

ibmcloud is vols

Example output

ID Name Status Capacity IOPS Profile Attachment type Created Zone Resource group
a395b603-74bf-4703-8fcb-b68e0b4d6960 pvc-479d590f-ca72-4df2-a30a-0941fceeca42 available 10 3000 5iops-tier data 2019-08-17T12:29:18-05:00 us-south-1 a8a12accd63b437bbd6d58fb6a462ca7
8.
To see which roles are required to perform each operation, check out the following table.



Table 2. Which roles can perform which operations?

 Action Reader Writer Manager 

 functions.namespaces.update <br>Update a namespace. Yes 
 functions.namespaces.delete <br>Delete a namespace. Yes 
 functions.namespaces.read <br>View the available namespaces. Yes Yes Yes 
 functions.entities.create <br>Create an entity within a Functions namespace, such as a package, action, trigger, or rule. Yes Yes 
 functions.entities.update <br>Update an entity within a Functions namespace, such as a package, action, trigger, or rule. Yes Yes 
 functions.entities.delete <br>Delete an entity from a Functions namespace, such as a package, action, trigger, or rule. Yes Yes 
 functions.entities.read <br>View the available entities within a namespace, such as package, action, trigger, or rule. Yes Yes Yes 
 functions.entities.activate <br>Activate an entity within a namespace. Activate entities, for example, by invoking an action, firing a trigger, or enabling or disabling a rule. Yes Yes Yes 







 Setting access policies for a service ID 

When you create an IAM-based namespace, it is assigned a service ID. You can set an access policy for this ID so that the API key of that service ID can be used to generate an IAM token. Then, use the token in an action code to call other services, such as IBM Cloud Object Storage.



 Setting access policies for a service ID in the console 

You can set an access policy for a service ID by using the IAM console.



1. Open the [IAM Service ID page](https://cloud.ibm.com/iam/serviceids).
2. In the Service IDs list, select your Cloud Functions namespace.
3. On the Manage page, click Access policies, then click Assign access.
4. Next, select an Access Type. You can choose from the following options.
* Access: When you set up multiple namespaces, you must configure proper RBAC policies for each namespace to ensure resource isolation. RBAC policies are complex and require in-depth Kubernetes knowledge.
* Privileged pods: If one tenant in a multi-tenant cluster requires to run privileged pods, this pod can access other namespaces in the cluster or damage the shared compute host. Controlling privileged pods is a complex task that requires effort and deep technical expertise. Use [pod security policies (PSPs)](https://cloud.ibm.com/docs/containers?topic=containers-psp) to control what resources your tenants can deploy in the cluster.
* Network policies: Because your worker nodes are connected to the same private network, you must make sure that you have strict network policies in place to prevent pods from accessing pods in other namespaces.
* Compute resource limitation: To ensure that every team has the necessary resources to deploy services and run apps in the cluster, you must set up [resource quotas](https://kubernetes.io/docs/concepts/policy/resource-quotas/) for every namespace. Resource quotas determine the deployment constraints for a namespace, such as the number of Kubernetes resources that you can deploy, and the amount of CPU and memory that can be consumed by those resources. After you set a quota, users must include resource requests and limits in their deployments.
* Shared cluster resources: If you run multiple tenants in one cluster, some cluster resources, such as the Ingress application load balancer (ALB) or available portable IP addresses are shared across tenants. Smaller services might have a hard time using shared resources if they must compete against large services in the cluster.
* Updates: You can run one Kubernetes API version at a time only. All apps that run in a cluster must comply with the current Kubernetes API version independent of the team that owns the app. When you want to update a cluster, you must ensure that all teams are ready to switch to a new Kubernetes API version and that apps are updated accordingly. This also means that individual teams have less control over the Kubernetes API version they want to run.
* [Prerequisites](https://cloud.ibm.com/docs/openshift?topic=openshift-loadbalancer-v2ipvs_provision)
* [Setting up an NLB 2.0 in a multizone cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-loadbalancer-v2ipvs_multi_zone_config)
* [Setting up an NLB 2.0 in a single-zone cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-loadbalancer-v2ipvs_single_zone_config)
* [Scheduling algorithms](https://cloud.ibm.com/docs/openshift?topic=openshift-loadbalancer-v2scheduling)



* [Supported scheduling algorithms](https://cloud.ibm.com/docs/openshift?topic=openshift-loadbalancer-v2scheduling_supported)
* [Unsupported scheduling algorithms](https://cloud.ibm.com/docs/openshift?topic=openshift-loadbalancer-v2scheduling_unsupported)





[Registering a DNS subdomain for an NLB](https://cloud.ibm.com/docs/openshift?topic=openshift-loadbalancer_hostnameloadbalancer_hostname)



* [Registering NLB IPs with a DNS subdomain](https://cloud.ibm.com/docs/openshift?topic=openshift-loadbalancer_hostnameloadbalancer_hostname_dns)
* [Understanding the subdomain format](https://cloud.ibm.com/docs/openshift?topic=openshift-loadbalancer_hostnameloadbalancer_hostname_format)
For more information about the detailed parameters to create workspace, see [ibm_schematics_workspace](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/schematics_workspace) resource.



Supported parameters for creating Schematics Workspaces with Terraform.

 Parameter Description 

 description The description of the workspace. 
 location The location where you want to create your Schematics Workspaces and run Schematics Actions. 
 resource_group The ID of the resource group where you want to provision the workspace. 
 name The name of your workspace. The name can be up to 128 characters long and can include alphanumeric characters, spaces, dashes, and underscores. When you create a workspace for your own Terraform template, consider including the microservice component that you set up with your Terraform template and the IBM Cloud environment where you want to deploy your resources in your name. 
 tags A list of tags that are associated with the workspace. 
 template_env_settings A list of environment variables that you want to apply during the execution of a Terraform action. 
 template_git_url The Git repository URL, where you have the configuration details to provision the resource. 
 template_type Specify the Terraform version that you want to apply in Schematics Workspace. 



3. Initialize the Terraform CLI.

terraform init

If the environment variable path for Terraform is not set, you can see command not found: terraform error. Fix the error by setting the path to your [Terraform installed directory](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-getting-startedtf_installation).
4. Create a Terraform execution plan. The Terraform execution plan summarizes all the actions that need to be run to create the Schematics Workspaces in your account.

terraform plan
5. Create the Schematics Workspaces instance and IAM access policy in IBM Cloud.

terraform apply
Navigate to the [IBM Cloud Schematics](https://cloud.ibm.com/schematics/overview) overview page and click Create a workspace.
2. On the page, enter the link to our GitHub repository where our Terraform template for this tutorial is stored, https://github.com/IBM-Cloud/vmware-solutions-shared.
3. Select terraform_v1.1 as the Terraform version. Click Next.
4. Enter the workspace name for your workspace, for example vmware-tutorial.
5. Select the resource group and location of the workspace, you can also add tags and description as needed.
6. Click Next and then Create to create your workspace. Your workspace is created and the workspace Settings page opens.
7. In the Input variables section, enter the information that was previously captured from the VMware vCloud Director console.

Some values have defaults which are appropriate to keep for this tutorial.

Set the Sensitive flag for the vcd-password variable to that the value is not displayed in the workspace and/or logs.
8. Scroll to the top of the page and click on Generate Plan to create the execution plan, review the logs and confirm it was successful.
9. Click on Apply plan to create the resources. Review the logs and confirm it was successful. Capture the information provided under the Outputs section.









 Step 4: Access deployed virtual machine and test 



1. Connect to the virtual machine with ssh using the user root and the password as shown in the logs above. You are required to change the password on the first login.
2. Test connectivity to the Internet by pinging known addresses on the Internet, for example ping 8.8.8.8.
3.