vania-janet/multiturn-rag-retrieval-data huggingface dataset:
(https://cloud.ibm.com/docs/containers?topic=containers-faqssmallest_cluster). This value is optional.

--operating-system SYSTEM
: Optional. The operating system of the worker nodes you want to provision in your cluster. For a list of available operating systems by cluster version, see [IBM Cloud Kubernetes Service version information](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions).
: If no option is specified, the default [operating system version that corresponds to the cluster version is used.

--cluster-security-group <group_ID>
: Optional. Specify additional security group IDs to apply to all workers on the cluster. You must include a separate --cluster-security-group option for each individual security group you want to add. To apply the IBM-created kube-clusterID, use --cluster-security-group cluster. If no value is specified, only the kube-clusterID and the default VPC security group are applied. A maximum of five security groups can be applied to workers, including the default security groups. Note that the VPC security group is only applied if no other security groups are specified. For more information, see [Adding VPC security groups to clusters and worker pools during create time](https://cloud.ibm.com/docs/containers?topic=containers-vpc-security-groupvpc-sg-cluster).

The security groups applied to a cluster cannot be changed once the cluster is created. You can [change the rules of the security groups](https://cloud.ibm.com/docs/containers?topic=containers-vpc-security-groupvpc-sg-create-rules) that are applied to the cluster, but you cannot add or remove security groups at the cluster level. If you apply the incorrect security groups at cluster create time, you must delete the cluster and create a new one.
VPC Gen 2 cluster flavors with instance storage are available for allowlisted accounts. To get added to the allowlist, [open a case](https://cloud.ibm.com/unifiedsupport/cases/form) with support.

Your VPC cluster is created with both a public and a private cloud service endpoint. Public service endpoints can't later be disabled, and therefore, you can't convert a public cluster to a private cluster.

ibmcloud oc cluster create vpc-gen2 --name NAME --zone ZONE --vpc-id VPC_ID --subnet-id VPC_SUBNET_ID --flavor WORKER_FLAVOR [--cluster-security-group GROUP_ID] [--operating-system (REDHAT_7_64|REDHAT_8_64)] [--version 4.11_openshift] --cos-instance COS_CRN --workers NUMBER_WORKERS_PER_ZONE [--disable-public-service-endpoint] [--pod-subnet SUBNET] [--service-subnet SUBNET] [--entitlement cloud_pak] [--kms-account-id ID] [--kms-instance KMS_INSTANCE_ID] [--crk ROOT_KEY_ID] [--sm-group GROUP] [--sm-instance INSTANCE] [-q] [--secondary-storage STORAGE]

Minimum required permissions
: [Administrator platform access role for VPC Infrastructure](https://cloud.ibm.com/docs/vpc?topic=vpc-iam-getting-started).
: [Administrator platform access role](https://cloud.ibm.com/docs/openshift?topic=openshift-userschecking-perms) for IBM Cloud Kubernetes Service at the account level.
: [Writer or Manager service access role](https://cloud.ibm.com/docs/openshift?topic=openshift-userschecking-perms) for IBM Cloud Kubernetes Service.
List the PVs in your cluster and look for the PV that belongs to your Block Storage for VPC device. The PV is in a released state.

oc get pv
2. Remove the PV.

oc delete pv <pv_name>



5. Create a configuration file for your PV. Include the ID, Size, Zone, and IOPS that you retrieved earlier.

apiVersion: v1
kind: PersistentVolume
metadata:
name: <pv_name> Example: my-persistent-volume
spec:
accessModes:
- ReadWriteOnce
capacity:
storage: <vpc_block_storage_size> Example: 20Gi
csi:
driver: vpc.block.csi.ibm.io
fsType: ext4
volumeAttributes:
iops: "<vpc_block_storage_iops>" Example: "3000"
volumeId: <vpc_block_storage_ID> Example: a1a11a1a-a111-1111-1a11-1111a11a1a11
zone: "<vpc_block_zone>" Example: "eu-de-3"
region: "<vpc_block_region>"
volumeHandle: <vpc_block_storage_ID>
nodeAffinity:
required:
nodeSelectorTerms:
- matchExpressions:
- key: failure-domain.beta.kubernetes.io/zone
operator: In
values:
- <worker_node_zone> Example: eu-de-3
- key: failure-domain.beta.kubernetes.io/region
operator: In
values:
- <worker_node_region> Example: eu-de
- key: kubernetes.io/hostname
operator: In
values:
- <worker_node_primary_IP>
persistentVolumeReclaimPolicy: Retain
storageClassName: ""
volumeMode: Filesystem
Show more

name
: [Administrator platform access role for VPC Infrastructure](https://cloud.ibm.com/docs/vpc?topic=vpc-iam-getting-started).
: [Administrator platform access role](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-perms) for IBM Cloud Kubernetes Service at the account level.
: [Writer or Manager service access role](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-perms) for IBM Cloud Kubernetes Service.
: [Administrator platform access role](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-perms) for IBM Cloud Container Registry at the account level.

Command options:

--name NAME
: Required: The name for the cluster. The name must start with a letter, can contain letters, numbers, periods (.), and hyphen (-), and must be 35 characters or fewer. Use a name that is unique across regions. The cluster name and the region in which the cluster is deployed form the fully qualified domain name for the Ingress subdomain. To ensure that the Ingress subdomain is unique within a region, the cluster name might be truncated and appended with a random value within the Ingress domain name.

--zone ZONE
: Required: Select a zone to deploy the initial cluster worker pool in. If you create the cluster in a multizone metro, you can add a zone to the worker pool later. To list available VPC zones, run ibmcloud ks zone ls --provider vpc-gen2.

When you select a zone that is located outside your country, keep in mind that you might require legal authorization before data can be physically stored in a foreign country.

--vpc-id VPC_ID
: Required: The ID of the VPC in which to create the cluster and worker nodes. To list available IDs, run ibmcloud ks vpcs.

--subnet-id VPC_SUBNET_ID
: Required: The VPC subnet to assign the cluster.
kubectl label nodes $1 "topology.kubernetes.io/region"=$3
kubectl label nodes $1 "topology.kubernetes.io/zone"=$4
}

function verify_node()
{
kubectl get nodes | grep $1
if (( $? == 0 ))
then
return 0
else
return 1
fi
}

if (( $ < 4 ))
then
help
fi

node=$1
instanceID=$2
region=$3
zone=$4

verify_node $node
if (( $? == 0 ))
then
apply_labels $node $instanceID $region $zone
else
echo "Node " '$node' " not found in the cluster, please check the node or passing correct parameters while executing script"
help
fi
Show more
3. Label your worker nodes by running the shell script and specifying the parameters that you retrieved earlier. Repeat this step for each worker node in your cluster.

sh setup.sh <node-name> <instanceID> <region-of-instanceID> <zone-of-instanceID>







 Retrieving IAM and VPC details 

To create the Kubernetes secret that is used in the Block Storage for VPC ConfigMap, you must retrieve your IAM and VPC details.



1. Retrieve the following configuration parameter values. These values are used to create the Kubernetes secret that is required for Block Storage for VPC.



* <g2_api_key> - The IAM API key. You can use your existing API key or you can create an API key by running the ibmcloud iam api-key-create NAME command.
* <g2_riaas_endpoint> - The VPC regional endpoint of your VPC cluster in the format https://<region>.iaas.cloud.ibm.com. Example: https://eu-de.iaas.cloud.ibm.com.
* [Accessing clusters through the public cloud service endpoint](https://cloud.ibm.com/docs/containers?topic=containers-access_clusteraccess_public_se)
* [Accessing clusters through the private cloud service endpoint](https://cloud.ibm.com/docs/containers?topic=containers-access_clusteraccess_private_se)



* [Accessing VPC clusters through the private cloud service endpoint](https://cloud.ibm.com/docs/containers?topic=containers-access_clustervpc_private_se)
* [Accessing classic clusters through the private cloud service endpoint](https://cloud.ibm.com/docs/containers?topic=containers-access_clusterclassic_private_se)
* [Creating an allowlist for the private cloud service endpoint](https://cloud.ibm.com/docs/containers?topic=containers-access_clusterprivate-se-allowlist)



* [Accessing VPC clusters through the Virtual Private Endpoint Gateway](https://cloud.ibm.com/docs/containers?topic=containers-access_clustervpc_vpe)



[Accessing the cluster master with admission controllers and webhooks](https://cloud.ibm.com/docs/containers?topic=containers-access_webhooksaccess_webhooks)



* [What are the default admission controllers in my cluster?](https://cloud.ibm.com/docs/containers?topic=containers-access_webhooksaccess_webhooks-default-controllers)
* [Can I create my own admission controllers?](https://cloud.ibm.com/docs/containers?topic=containers-access_webhooksaccess_webhooks_create_controllers)
* [What are the best practices for using webhooks?](https://cloud.ibm.com/docs/containers?topic=containers-access_webhookswebhook-best-practice)
* [What other types of apps use admission controllers?]
- apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
annotations:
version: 2.0.3_354
labels:
addonmanager.kubernetes.io/mode: Reconcile
app: ibm-vpc-block-csi-driver
name: vpc-block-external-attacher-role
rules:
- apiGroups:
- ""
resources:
- persistentvolumes
verbs:
- get
- list
- watch
- update
- patch
- apiGroups:
- ""
resources:
- nodes
verbs:
- get
- list
- watch
- apiGroups:
- csi.storage.k8s.io
resources:
- csinodeinfos
verbs:
- get
- list
- watch
- apiGroups:
- storage.k8s.io
resources:
- volumeattachments
verbs:
- get
- list
- watch
- update
- patch
- apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
annotations:
version: 2.0.3_354
labels:
addonmanager.kubernetes.io/mode: Reconcile
app: ibm-vpc-block-csi-driver
name: vpc-block-external-attacher-binding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: vpc-block-external-attacher-role
subjects:
- kind: ServiceAccount
name: ibm-vpc-block-controller-sa
namespace: kube-system
- apiVersion: storage.k8s.io/v1beta1
kind: CSIDriver
metadata:
name: vpc.block.csi.ibm.io
spec:
1. List the PVs in your cluster and look for the PV that belongs to your Block Storage for VPC device. The PV is in a released state.

kubectl get pv
2. Remove the PV.

kubectl delete pv <pv_name>



5. Create a configuration file for your PV. Include the ID, Size, Zone, and IOPS that you retrieved earlier.

apiVersion: v1
kind: PersistentVolume
metadata:
name: <pv_name> Example: my-persistent-volume
spec:
accessModes:
- ReadWriteOnce
capacity:
storage: <vpc_block_storage_size> Example: 20Gi
csi:
driver: vpc.block.csi.ibm.io
fsType: ext4
volumeAttributes:
iops: "<vpc_block_storage_iops>" Example: "3000"
volumeId: <vpc_block_storage_ID> Example: a1a11a1a-a111-1111-1a11-1111a11a1a11
zone: "<vpc_block_zone>" Example: "eu-de-3"
region: "<vpc_block_region>"
volumeHandle: <vpc_block_storage_ID>
nodeAffinity:
required:
nodeSelectorTerms:
- matchExpressions:
- key: failure-domain.beta.kubernetes.io/zone
operator: In
values:
- <worker_node_zone> Example: eu-de-3
- key: failure-domain.beta.kubernetes.io/region
operator: In
values:
- <worker_node_region> Example: eu-de
- key: kubernetes.io/hostname
operator: In
values:
- <worker_node_primary_IP>
persistentVolumeReclaimPolicy: Retain
storageClassName: ""
volumeMode: Filesystem
Show more
* UI
* CLI







 Creating a private-only cluster in VPC by using a Schematics template 

Automate the creation of a secure cluster in Red Hat® OpenShift® on IBM Cloud® by using an IBM Cloud Schematics template.

The secure cluster template is available as a technical preview only, and isn't intended for production workloads.

What do I get when I deploy the secure cluster template?
: When you create a secure cluster by using the Schematics template, you get a multizone, private-only cluster with logging and monitoring enabled as well as IBM Cloud Activity Tracker and IBM Cloud Object Storage instances. The secure cluster doesn't have public network access, so to access your cluster, you must [set up a VPN connection](https://cloud.ibm.com/docs/openshift?topic=openshift-cluster-access-wireguard). For more information and specifications, see [Resources that are created from the template](https://cloud.ibm.com/docs/openshift?topic=openshift-templatessch-tf-resources-created). To read an IBM blog about setting up a VPN connection, see [Setting up a VPN](https://cms.ibm.com/cloud/blog/setting-up-a-vpn-between-ibm-cloud-vpc-and-your-home-office).



 Resources that are created from the template 

When you create a cluster with the template, the following resources are created by default in your IBM Cloud account, unless you customize the template.

For more details, review the [workspace in IBM Cloud Schematics](https://cloud.ibm.com/schematics/workspaces) if you created the cluster from the UI. Or, if you created the cluster from the CLI, review the [IBM Cloud Provider Plug-in for Terraform template](https://github.com/terraform-ibm-modules/terraform-ibm-cluster/tree/master/examples/secure-roks-cluster).

The following resources are provisioned by default, but you can customize some resources, for example worker node flavor.
For more information, see [VPC Profiles](https://cloud.ibm.com/docs/vpc?topic=vpc-profiles). string bx2-2x8 
 cluster_prefix Prefix that is used to name the Symphony Multi cluster and IBM Cloud resources that are provisioned to build the Symphony Multi cluster instance. You cannot create more than one instance of the Symphony Multi cluster with the same name. Make sure that the name is unique. Enter a prefix name, such as my-hpcc. string hpcc-smc 
 dns_domain IBM Cloud DNS Services domain name to be used for the Symphony Multi Cluster host. string smc.ibmhpc.com 
 login_cidr_block IBM Cloud VPC address prefixes that are needed for VPC creation. For more information, see [Bring your own subnet](https://cloud.ibm.com/docs/vpc?topic=vpc-configuring-address-prefixes). list(string) 10.10.4.0/28 
 resource_group Resource group name from your IBM Cloud account where the VPC resources are deployed. Resource group is populated when you create the workspace. For more information, see [Resource Groups](https://cloud.ibm.com/docs/account?topic=account-rgs). string Default 
 primary_cidr_block IBM Cloud VPC address prefixes that are needed for VPC creation. Provide a CIDR address prefix for Primary VPC creation. For more information, see [Bring your own subnet](https://cloud.ibm.com/docs/vpc?topic=vpc-configuring-address-prefixes). string 10.10.0.0/24 
 secondary_cidr_block IBM Cloud VPC address prefixes that are needed for VPC creation. Provide a CIDR address prefix for Secondary VPC creation.
Planning your cluster network setup 

Design a network setup for your IBM Cloud® Kubernetes Service cluster that meets the needs of your workloads and environment.

Get started by planning your setup for a VPC or a classic cluster.



* With [IBM Cloud Kubernetes Service clusters in VPC](https://cloud.ibm.com/docs/containers?topic=containers-plan_vpc_basics), you can create your cluster in the next generation of the IBM Cloud platform, in [Virtual Private Cloud](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpc) for Generation 2 compute resources. VPC gives you the security of a private cloud environment with the dynamic scalability of a public cloud.
* With [IBM Cloud Kubernetes Service classic clusters](https://cloud.ibm.com/docs/containers?topic=containers-plan_basics), you can create your cluster on classic infrastructure. Classic clusters include all the IBM Cloud Kubernetes Service mature and robust features for compute, networking, and storage.



Review the following cluster configurations and take the appropriate action in your account before provisioning your clusters. For more information, see [Preparing to create clusters at the account level](https://cloud.ibm.com/docs/containers?topic=containers-clusters&interface=ui).



* For VPC Clusters that don't require Classic Infrastructure Access, no account changes are required.
* For VPC Clusters that require Classic Infrastructure Access, you must [enable VRF](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint&interface=uivrf) & [service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint&interface=uiservice-endpoint) in your account.
When you create your VPC cluster, you can also attach additional security groups alongside, or instead of, the default VPC security groups. The security groups applied to the workers in the cluster are a combination of the security groups applied when you create the cluster and [when you create the worker pool](https://cloud.ibm.com/docs/containers?topic=containers-vpc-security-group&interface=uivpc-sg-worker-pool). A total of five security groups can be applied to workers, including the default security groups and any security groups applied to the worker pool. Note that these security group options are only available in the CLI.

The security groups applied to a cluster cannot be changed once the cluster is created. You can [change the rules of the security groups](https://cloud.ibm.com/docs/containers?topic=containers-vpc-security-groupvpc-sg-create-rules) that are applied to the cluster, but you cannot add or remove security groups at the cluster level. If you apply the incorrect security groups at cluster create time, you must delete the cluster and create a new one.



 If you only want the default VPC and cluster security groups and no additional security groups 

VPC security group

Cluster security group

Note that this is the default behavior at cluster create time.

When you create your cluster, do not specify any additional security groups.

Example command to create a VPC cluster with only the default VPC and kube-<cluster-id> cluster security groups:

ibmcloud ks cluster create vpc-gen2 --name <cluster-name> --zone <zone> --vpc-id <vpc-id> --subnet-id <subnet-id>

The following security groups are applied:



* Default VPC security group (randomly generated name)
* kube-<cluster-id>







 If you only want the cluster security group and not the default VPC security group 

Cluster security group

When you create the cluster specify --cluster-security-group cluster. Do not specify any additional security groups.

Example command to create a VPC cluster with only the kube-<cluster-id> cluster security group:
VPC clusters: Why can't my app connect via Ingress? 

Virtual Private Cloud

 What’s happening 

You exposed your app by creating an Ingress resource for your app in your VPC cluster. When you tried to connect to your app by using the Ingress subdomain, the connection failed or timed out.

 Why it’s happening 

When you create a VPC cluster, one public and one private VPC load balancer are automatically created outside of your cluster in your VPC.

The VPC load balancer routes requests to the apps that the routers expose. Requests can't be routed to your app in the following situations:



* A VPC security group is blocking incoming traffic to your worker nodes, including incoming requests to your app.
* The VPC load balancer is offline, such as due to load balancer provisioning errors or VSI connection errors.
* The VPC load balancer is deleted through the VPC console or the CLI.
* The VPC load balancer's DNS entry is still registering.



 How to fix it 

Verify that no VPC security groups are blocking traffic to your cluster and that the VPC load balancer is available.



1. Install the infrastructure-service plug-in. The prefix for running commands is ibmcloud is.

ibmcloud plugin install infrastructure-service
2. Verify that the VPC load balancer for your routers exists. In the output, look for the VPC load balancer Name that starts with kube-crtmgr-<cluster_ID>. If you did not install the infrastructure-service plug-in, install it by running ibmcloud plugin install infrastructure-service.

ibmcloud is load-balancers



* If the VPC load balancer is not listed, it was deleted through the VPC console or the CLI. [Open an IBM Cloud support case](https://cloud.ibm.com/unifiedsupport/cases/add) and include your cluster ID.



3.
(https://cloud.ibm.com/docs/openshift?topic=openshift-ts-pod-security-resetts-pod-security-reset)

[Why does the cluster master return a VPN server error?](https://cloud.ibm.com/docs/openshift?topic=openshift-rhoks_ts_openvpn_loginrhoks_ts_openvpn_login)

[VPC: Why is no VPC available when I create a cluster in the console?](https://cloud.ibm.com/docs/openshift?topic=openshift-ts_no_vpcts_no_vpc)

[Why can't the cluster pull images from IBM Cloud Container Registry during creation?](https://cloud.ibm.com/docs/openshift?topic=openshift-ts_image_pull_createts_image_pull_create)

[Why do cluster master operations fail due to a broken webhook?](https://cloud.ibm.com/docs/openshift?topic=openshift-webhooks_updatewebhooks_update)

[Deleting webhooks from a cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-ts-delete-webhooksts-delete-webhooks)

[Why is my Portieris cluster image security enforcement installation canceled?](https://cloud.ibm.com/docs/openshift?topic=openshift-portieris_enableportieris_enable)

[Why does my cluster stay in a pending state?](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_cluster_pendingcs_cluster_pending)

[Why can't I view or work with my cluster?](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_cluster_accesscs_cluster_access)
* and [understand the basics of Kubernetes](https://kubernetes.io/docs/tutorials/kubernetes-basics/).







 Step 1: Deploy an application to one location 

This tutorial deploys a Kubernetes application to clusters in multiple locations. You will start with one location, Dallas, and then repeat these steps for London.



 Create a Kubernetes cluster 

A minimal cluster with one (1) zone, one (1) worker node and the smallest available size (Flavor) is sufficient for this tutorial.

When creating the Kubernetes cluster below:



1. Set Cluster name to my-us-cluster.
2. Locate in North America and Dallas



Open the [Kubernetes clusters](https://cloud.ibm.com/kubernetes/clusters) and click Create cluster. See the documentation referenced below for more details based on the cluster type. Summary:



* Click Standard tier cluster
* For Kubernetes on VPC infrastructure see reference documentation [Creating VPC clusters](https://cloud.ibm.com/docs/containers?topic=containers-cluster-create-vpc-gen2&interface=ui).



* Click Create VPC:



* Enter a name for the VPC.
* Chose the same resource group as the cluster.
* Click Create.



* Attach a Public Gateway to each of the subnets that you create:



* Navigate to the [Virtual private clouds](https://cloud.ibm.com/vpc-ext/network/vpcs).
* Click the previously created VPC used for the cluster.
* Scroll down to subnets section and click a subnet.
* In the Public Gateway section, click Detached to change the state to Attached.
* Click the browser back button to return to the VPC details page.
* Repeat the previous three steps to attach a public gateway to each subnet.





* For Kubernetes on Classic infrastructure see reference documentation [Creating classic cluster](https://cloud.ibm.com/docs/containers?topic=containers-cluster-create-classic&interface=ui).