vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Automatically attached to each worker node in a cluster created in the VPC.<br> * Allows all outbound traffic by default.<br><br><br> 
 VPC cluster security group kube-<cluster-ID> <br><br> * Automatically created when the VPC cluster is created. Automatically attached to each worker node in a cluster created in the VPC.<br> * Allows traffic necessary for the cluster infrastructure to function.<br><br><br> 







 Security groups applied to VPE gateways and VPC ALBs 

Do not modify the rules in the kube-<vpc-id> security group as doing so might cause disruptions in network connectivity between the workers of the cluster and the control cluster. However, you can [remove the default security group from the VPC ALB](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-referencesecurity-group-target-remove) and [replace it with a security group](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-referencesecurity-group-target-add) that you create and manage.



Table 1. VPC security groups
The table shows the three types of security groups that are automatically created for VPCs. The first column includes the type of security group. The second column includes the naming format of the security group. The third column includes details on when and where the security group is created and what type of traffic it allows.

 Security group type Name Details 

 Red Hat OpenShift on IBM Cloud security group kube-<vpc-id> <br><br> * Automatically created and attached to any cluster-related VPE gateways in the VPC.<br> * Automatically created and attached to each VPC ALB that is created in the VPC.<br> * Allows traffic necessary for the cluster infrastructure to function.<br><br><br> 









 Viewing VPC security groups in the CLI 

Follow the steps to view details about the VPC security groups.



1. List your clusters and note the ID of the cluster that you are working in.
Supported infrastructure providers 

With IBM Cloud® Kubernetes Service, you can create a cluster from the following infrastructure providers. All the worker nodes in a cluster must be from the same provider. Originally, IBM Cloud Kubernetes Service provisioned your worker nodes in a single provider, classic infrastructure.

Virtual Private Cloud

: Create your cluster on the next generation of IBM Cloud infrastructure virtual servers in your own Virtual Private Cloud (VPC).

Classic infrastructure

: Create your cluster on a classic compute, networking, and storage environment in IBM Cloud infrastructure.



 Virtual Private Cloud (VPC) 

Virtual Private Cloud



Table 1. VPC infrastructure overview.

 Component Description 

 Compute and worker node resources Worker nodes are created as virtual machines by using either shared infrastructure or dedicated hosts. Unlike classic clusters, VPC cluster worker nodes on shared hardware don't appear in your infrastructure portal or a separate infrastructure bill. Instead, you manage all maintenance and billing activity for the worker nodes through IBM Cloud Kubernetes Service. Your worker node instances are connected to certain VPC instances that do reside in your infrastructure account, such as the VPC subnet or storage volumes. For dedicated hosts, the dedicated host price covers the vCPU, memory, and any instance storage to be used by any workers placed on the host. For dedicated hosts, the dedicated host price covers the vCPU, memory, and any [instance storage](https://cloud.ibm.com/docs/vpc?topic=vpc-instance-storage) to be used by any workers placed on the host. Note that all Intel® x86-64 servers have Hyper-Threading enabled by default. For more information, see [Intel Hyper-Threading Technology](https://cloud.ibm.com/docs/vpc?topic=vpc-profilesvpc-intel-hyper-threading). 
 Security Clusters on shared hardware run in an isolated environment in the public cloud. Clusters on dedicated hosts do not run in a shared environment, instead only your clusters are present on your hosts. Network access control lists protect the subnets that provide the floating IPs for your worker nodes.
See [VPC profiles](https://cloud.ibm.com/docs/vpc?topic=vpc-profilescompute) for a full list of supported profiles.

If the VPC+ tool encounters a profile during discovery that doesn't match a supported profile, the closest matching profile is selected. You can change the selection when editing the discovered resources.

VPC+ Cloud Migration does not currently support GPU profiles.





 Instance groups for auto scaling 

The VPC+ tool discovers virtual server instances that are associated with instance groups. You can migrate these instances with the VPC+ tool, but the tool does not set up auto scale policies in VPC. It's recommended that you migrate only one virtual server instance that is associated with an instance group and then set up auto scale policies with that virtual server instance. For more information, see [Creating an instance group for auto scaling](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-auto-scale-instance-group).







 Data storage considerations for attached, block, and file storage 

The VPC+ tool can discover the three types of storage used by virtual server instances in IBM Cloud classic infrastructure:



1. Portable storage
2. Network file storage
3. Network-attached block storage (iSCSI) with file systems



With VPC+ tool, you have the option to choose which data volumes to migrate. Only the volumes that you select will be migrated.

If you have a virtual server instance that has already been migrated where you want to migrate secondary data volumes, use the Content Data Migrator in the VPC+ tool.

As an alternative to the Content Data Migrator, you can migrate the data on the block or file volumes to VPC by yourself by using rsync or other tools of your choice (scp or other third-party tools). For more information on using rsync to migrate your data, see [Migrating data from IBM Cloud classic infrastructure to VPC](https://cloud.ibm.com/docs/cloud-infrastructure?topic=cloud-infrastructure-data-migration-classic-to-vpc).



 Prerequisites for storage migration
Automatically attached to each worker node in a cluster created in the VPC.<br> * Allows all outbound traffic by default.<br><br><br> 
 VPC cluster security group kube-<cluster-ID> <br><br> * Automatically created when the VPC cluster is created. Automatically attached to each worker node in a cluster created in the VPC.<br> * Allows traffic necessary for the cluster infrastructure to function.<br><br><br> 







 Security groups applied to VPE gateways and VPC ALBs 

Do not modify the rules in the kube-<vpc-id> security group as doing so might cause disruptions in network connectivity between the workers of the cluster and the control cluster. However, you can [remove the default security group from the VPC ALB](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-referencesecurity-group-target-remove) and [replace it with a security group](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-referencesecurity-group-target-add) that you create and manage.



Table 1. VPC security groups
The table shows the three types of security groups that are automatically created for VPCs. The first column includes the type of security group. The second column includes the naming format of the security group. The third column includes details on when and where the security group is created and what type of traffic it allows.

 Security group type Name Details 

 Kubernetes Service security group kube-<vpc-id> <br><br> * Automatically created and attached to any cluster-related VPE gateways in the VPC.<br> * Automatically created and attached to each VPC ALB that is created in the VPC.<br> * Allows traffic necessary for the cluster infrastructure to function.<br><br><br> 









 Viewing VPC security groups in the CLI 

Follow the steps to view details about the VPC security groups.



1. List your clusters and note the ID of the cluster that you are working in.
No, the smc-zone parameter supports a maximum of 3 zones, entered as a list, for example, ["us-south-1","eu-gb-3","jp-tok-2"].
* Does SMC allow there to be more than three existing vpcs or more than three existing regions for VPCs?

No, SMC supports maximum of 3 existing VPCs in lone_vpc_name and 3 existing regions for VPCs in lone_vpc_region. The VPC names and VPC regions are provided in a list and must be in the same order. For example, there are three VPCs in three regions, "vpc-east" in "us-east". "vpc-south" in "us-south", and "vpc-tor" in "ca-tor". For this example, lone_vpc_name = ["vpc-east" , "vpc-south" "vpc-tor"] and lone_vpc_region = [ "us-east","us-south","ca-tor"].
* When one of the joined lone symphony clusters with SMC fails to participate in workload placement after execution of symping command, what should I do?

Run a few more iterations of workload placement by running jobs, the lone symphony cluster will join back automatically.
* Where are the Terraform files that are used by the offering located?

The Terraform-based templates can be found in this public [GitHub repository](https://github.com/IBM-Cloud/hpc-cluster-symphony).
* What Spectrum Symphony and Spectrum Scale versions are used in cluster nodes deployed with this offering?

Cluster nodes that are deployed with this offering include IBM Spectrum Symphony 7.3.2 Advanced Edition. See the following for a summary of the features associated with each edition: [IBM Spectrum Symphony editions](https://www.ibm.com/docs/en/spectrum-symphony/7.3.1?topic=foundations-spectrum-symphony-editions).

If the cluster uses Spectrum Scale storage, the storage nodes include IBM Spectrum Scale 5.1.7.0 software.
[VPC gateway cluster](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/vpc-ryo-diagrams-nsx-t-edges.svg)

Figure 1. VPC gateway cluster

For more information about NSX-T Designs, see [NSX-T Reference Design Guide 3-0](https://nsx.techzone.vmware.com/resource/nsx-t-reference-design-guide-3-0).



 Tier-0 logical router 

An NSX-T Tier-0 logical gateway provides a gateway service between the logical NSX-T overlay segments and VPC subnets, for example, for north-south traffic. In this architecture, a highly available T0 gateway is deployed in the NSX-T gateway cluster. Because of a VMware® NSX-T limitation, this gateway cluster can host only a single T0 Logical Router, which runs in Active-Standby mode. Active-Standby mode is required, for example, to have High Availability VIPs in the T0.

Zoom

![T0 Logical Router in VPC gateway cluster](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/vpc-ryo-diagrams-nsx-t-edges-routing.svg)

Figure 2. T0 Logical Router in VPC gateway cluster

Currently, Active-Active mode with T0 is not supported in IBM Cloud® Virtual Private Cloud.

When T0 is run in Active-Standby mode, both participating Edge Transport Node has their own uplink. High availability between these uplinks uses a High Availability VIP.

The T0 is configured with two uplink types: two uplinks for private use and two uplinks for public use. HA VIPs are assigned to both public and private uplinks for high availability.
For more information about network segmentation options for VPC subnets, see [this cluster security topic](https://cloud.ibm.com/docs/openshift?topic=openshift-securitynetwork_segmentation_vpc).

Subnets provide a channel for connectivity among the worker nodes within the cluster. Additionally, any system that is connected to any of the private subnets in the same VPC can communicate with workers. For example, all subnets in one VPC can communicate through private layer 3 routing with a built-in VPC router.

If you have multiple clusters that must communicate with each other, you can create the clusters in the same VPC. However, if your clusters don't need to communicate, you can achieve better network segmentation by creating the clusters in separate VPCs. You can also create [access control lists (ACLs)](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-network-policy) for your VPC subnets to mediate traffic on the private network. ACLs consist of inbound and outbound rules that define which ingress and egress is permitted for each VPC subnet.





 VPC networking limitations 

When you create VPC subnets for your clusters, keep in mind the following features and limitations.



* The default CIDR size of each VPC subnet is /24, which can support up to 253 worker nodes. If you plan to deploy more than 250 worker nodes per zone in one cluster, consider creating a subnet of a larger size.
* After you create a VPC subnet, you can't resize it or change its IP range.
* Multiple clusters in the same VPC can share VPC subnets. However, custom pod and service subnets can't be shared between multiple clusters.
* VPC subnets are bound to a single zone and can't span multiple zones or regions.
* After you create a subnet, you can't move it to a different zone, region, or VPC.
* If you have worker nodes that are attached to an existing subnet in a zone, you can't change the subnet for that zone in the cluster.
Setting up VPC VPN connectivity 

This VPN information is specific to VPC clusters. For VPN information for classic clusters, see [Setting up VPN connectivity](https://cloud.ibm.com/docs/containers?topic=containers-vpn).

Securely connect apps and services in a VPC cluster in IBM Cloud® Kubernetes Service to on-premises networks, other VPCs, and IBM Cloud classic infrastructure resources. You can also connect apps that are external to your cluster to an app that runs inside your cluster.

The following table compares the connection options that are available based on the type of destination that you want to connect your VPC cluster to.



Comparison of connection options based on destination type

 Destination IBM Cloud VPC VPN Transit Gateway Direct Link Classic-access VPC 

 [On-premises networks](https://cloud.ibm.com/docs/containers?topic=containers-vpc-vpnaasonprem) Yes Yes 
 [Other VPCs](https://cloud.ibm.com/docs/containers?topic=containers-vpc-vpnaasvpc-vpc) Yes Yes 
 [Classic infrastructure resources](https://cloud.ibm.com/docs/containers?topic=containers-vpc-vpnaasvpc-classic) Yes Yes 





 Communication with resources in on-premises data centers 

To connect your cluster with your on-premises data center, you can use the IBM Cloud® Virtual Private Cloud VPN or IBM Cloud® Direct Link.

You might have subnet conflicts with the IBM-provided default 172.30.0.0/16 range for pods and 172.21.0.0/16 range for services. You can avoid subnet conflicts when you [create a cluster from the CLI](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clicli_cluster-create-vpc-gen2) by specifying a custom subnet CIDR for pods in the --pod-subnet option and a custom subnet CIDR for services in the --service-subnet option.
For supported regions, see [Creating a VPC in a different region](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-in-a-different-region). The cluster's resource group can differ from the VPC resource group.

VPC Gen 2 cluster flavors with instance storage are available for allowlisted accounts. To get added to the allowlist, [open a case](https://cloud.ibm.com/unifiedsupport/cases/form) with support.

ibmcloud ks cluster create vpc-gen2 --name NAME --zone ZONE --vpc-id VPC_ID --subnet-id VPC_SUBNET_ID --flavor WORKER_FLAVOR [--cluster-security-group GROUP_ID] [--operating-system UBUNTU_20_64|UBUNTU_18_64] [--version MAJOR.MINOR.PATCH] [--workers NUMBER_WORKERS_PER_ZONE] [--disable-public-service-endpoint] [--pod-subnet SUBNET] [--service-subnet SUBNET] [--kms-account-id ID] [--kms-instance KMS_INSTANCE_ID] [--crk ROOT_KEY_ID] [--sm-group GROUP] [--sm-instance INSTANCE] [-q] [--secondary-storage STORAGE]

Minimum required permissions
: [Administrator platform access role for VPC Infrastructure](https://cloud.ibm.com/docs/vpc?topic=vpc-iam-getting-started).
: [Administrator platform access role](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-perms) for IBM Cloud Kubernetes Service at the account level.
: [Writer or Manager service access role](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-perms) for IBM Cloud Kubernetes Service.
Figure 1.Network setup for a VPC cluster that extends an on-prem data center



 Worker-to-worker communication 

To achieve this setup, you create VPC subnets in each zone where you want to deploy worker nodes. No public gateways are required for these subnets. Then, you create a VPC cluster that uses these VPC subnets.

Note that you might have subnet conflicts between the default ranges for workers nodes, pods, and services, and the subnets in your on-premises networks. When you create your VPC subnets, you can choose [custom address prefixes](https://cloud.ibm.com/docs/vpc?topic=vpc-configuring-address-prefixes) and then create your cluster by using these subnets. Additionally, you can specify a custom subnet CIDR for pods and services by using the --pod-subnet and --service-subnet options in the ibmcloud ks cluster create command when you create your cluster.





 Worker-to-master and user-to-master communication 

When you create the cluster, you enable private cloud service endpoint only to allow worker-to-master and user-to-master communication over the private network. Cluster users must either be in your VPC network or connect through a [VPC VPN connection](https://cloud.ibm.com/docs/containers?topic=containers-vpc-vpnaas).





 Worker communication to other services or networks 

To connect your cluster with your on-premises data center, you can set up the VPC VPN service. The IBM Cloud VPC VPN connects your entire VPC to an on-premises data center. If your app workload requires other IBM Cloud services that support private cloud service endpoints, your worker nodes can automatically, securely communicate with these services over the private VPC network.





 External communication to apps that run on worker nodes 

After you test your app, you can expose it to the private network by creating a private Kubernetes LoadBalancer service or using the default private Ingress application load balancers (ALBs). The VPC load balancer that is automatically created in your VPC outside of your cluster when you use one of these services routes traffic to your app.
Public Gateway attached to the management subnet can be used to download updates for vCenter Server and VMware ESXi™ hosts.



 vCenter Server cluster specification 

With this design, you can cluster the vSphere ESXi hosts that you use as part of your deployment in your VPC. However, before clusters can be created, a data center object must be created that signifies the location of the vSphere ESXi hosts and the Zone within a IBM Cloud® MZR. A cluster can be created after the data center object is created. The cluster can be deployed with VMware vSphere High Availability (HA) and VMware vSphere Distributed Resource Scheduler (DRS) enabled when you use of the available shared storage options.





 vSphere Distributed Resource Scheduler 

The design recommends that you use vSphere Distributed Resource Scheduling (DRS) in the clusters to place VMs. Also, you must use DRS in extra clusters to dynamically migrate VMs to achieve balanced clusters. The automation level can be set to fully automated so that initial placement and migration recommendations are run automatically by vSphere. Additionally, the migration threshold can be set to moderate so that vCenter applies priority 1, 2, 3 recommendations to achieve at least a decent improvement in the load balance of the cluster.

One of the available shared storage options is needed for clusters that are enabled for DRS.





 vSphere High Availability 

The design recommends that you use vSphere High Availability (HA) in the cluster to detect compute failures and recover VMs that run in a cluster. The vSphere HA feature is configured with both the Host Monitoring and Admission Control options that are enabled in the cluster. Additionally, the initial cluster reserves one node resources as spare capacity for the admission control policy.

One of the available shared storage options is needed for clusters that are enabled for HA.

You are responsible to adjust the admission control policy when the cluster is later expanded or contracted.





 Enhanced vMotion Compatibility 

To simplify vMotion compatibility across cluster nodes with potentially differing CPU capabilities, Enhanced vMotion Compatibility (EVC) mode can be enabled at the highest available level that is supported by the vSphere version. This setting ensures vMotion compatibility across cluster nodes when newer processors arrive within IBM Cloud VPC inventory.
Get the Worker Zones and VPCs that your cluster is created in.

ibmcloud oc cluster get -c <cluster>

Example output

...
Worker Zones: us-south-1, us-south-2, us-south-3
Ingress Subdomain: vpc-prod.us-south.containers.appdomain.cloud
Ingress Secret: vpc-prod
Creator: -
Public Service Endpoint URL: https://c2.us-south.containers.cloud.ibm.com:20267
Private Service Endpoint URL: https://c2.private.us-south.containers.cloud.ibm.com:20267
Pull Secrets: enabled in the default namespace
VPCs: ff537d43-a5a4-4b65-9627-17eddfa5237b
...
3. For the worker zones and VPC that you found, ensure that you [enabled a public gateway on the VPC subnets in each worker zone](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-vpc-resources-with-cli-and-api&interface=cliattach-public-gateway-cli).
4. List the public gateways for the subnets. In the output, for the zones and VPC that your cluster is in, note the gateway Floating IP addresses for the subnets. These IP addresses must be added to your allowlist.

ibmcloud is public-gateways

Example output

ID Name Status Floating IP VPC Zone
5d308ea5-9f32-43b3-aaae-194d5723a3e5 pgw-b9d45630-c053-11e9-b2f8-79328ce05e7e available 169.XX.XXX.XX test-vpc us-south-1
(https://cloud.ibm.com/docs/containers?topic=containers-securityonprem-network-setup)
* [Network segmentation and privacy for VPC clusters](https://cloud.ibm.com/docs/containers?topic=containers-securitynetwork_segmentation_vpc)
* [What network traffic is allowed for my VPC cluster by default?](https://cloud.ibm.com/docs/containers?topic=containers-securityvpc-network-traffic-default)
* [What is network segmentation and how can I set it up for a VPC cluster?](https://cloud.ibm.com/docs/containers?topic=containers-securitynetwork-segment-what-is)
* [What else can I do to reduce the surface for external attacks for VPC clusters?](https://cloud.ibm.com/docs/containers?topic=containers-securityvpc-external-what-else)
* [Securely expose apps with LoadBalancer and Ingress services](https://cloud.ibm.com/docs/containers?topic=containers-securitynetwork_lb_ingress)
* [Can I use security groups to manage my cluster's network traffic?](https://cloud.ibm.com/docs/containers?topic=containers-securitycan-i-use-security-groups)
* [How can I secure the source IP within the cluster?](https://cloud.ibm.com/docs/containers?topic=containers-securitysecure-source-ip-cluster)
* [How can I do TLS termination with LoadBalancer and Ingress services?](https://cloud.ibm.com/docs/containers?topic=containers-securitytls-termination-lb)



* [Persistent storage](https://cloud.ibm.com/docs/containers?topic=containers-securitystorage)
* [Monitoring and logging](https://cloud.ibm.com/docs/containers?topic=containers-securitymonitoring_logging)