vania-janet/multiturn-rag-retrieval-data huggingface dataset:
The Kubernetes master configures the resources and deploys containers into pods on the worker nodes with available capacity.
: Define update strategies for your app, including the number of pods that you want to add during a rolling update and the number of pods that can be unavailable at a time. When you perform a rolling update, the deployment checks whether the update is working and stops the rollout when failures are detected.
: A deployment is just one type of workload controller that you can use to manage pods. For help choosing among your options, see [What type of Kubernetes objects can I make for my app?](https://cloud.ibm.com/docs/openshift?topic=openshift-plan_deployobject). For more information about deployments, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/).

Pod
: Every containerized app that is deployed into a cluster is deployed, run, and managed by a Kubernetes resource called a pod. Pods represent small deployable units in a Kubernetes cluster and are used to group the containers that must be treated as a single unit. Usually, each container is deployed in its own pod. However, an app might require a container and other helper containers to be deployed into one pod so that those containers can be addressed by using the same private IP address. For more information, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/pods/).

App
: An app might refer to a complete app or a component of an app. You might deploy components of an app in separate pods or separate worker nodes. For more information, see [Planning app deployments](https://cloud.ibm.com/docs/openshift?topic=openshift-plan_deploy) and [Developing Kubernetes-native apps](https://cloud.ibm.com/docs/containers?topic=containers-app).
The Kubernetes API server validates and processes requests that change the state of Kubernetes resources, such as pods or services, and stores this state in etcd.

konnectivity-server
: The Konnectivity server works with the Konnectivity agent to securely connect the master to the worker node. This connection supports apiserver proxy calls to your pods and services, and kubectl exec, attach, and logs calls to the kubelet.

etcd
: etcd is a highly available key value store that stores the state of all Kubernetes resources of a cluster, such as services, deployments, and pods. Data in etcd is backed up to an encrypted storage instance that IBM manages.

kube-scheduler
: The Kubernetes scheduler watches for newly created pods and decides where to deploy them based on capacity, performance needs, policy constraints, anti-affinity specifications, and workload requirements. If no worker node can be found that matches the requirements, the pod is not deployed in the cluster.

kube-controller-manager
: The Kubernetes controller manager is a daemon that watches the state of cluster resources, such as replica sets. When the state of a resource changes, for example if a pod in a replica set goes down, the controller manager initiates correcting actions to achieve the required state.





 Worker node components 

Each worker node is a physical machine (bare metal) or a virtual machine that runs on physical hardware in the cloud environment. When you provision a worker node, you determine the resources that are available to the containers that are hosted on that worker node. Out of the box, your worker nodes are set up with an IBM-managed container runtime, separate compute resources, networking, and a volume service. The built-in security features provide isolation, resource management capabilities, and worker node security compliance.

The worker nodes and all the worker node components are dedicated only to you, and are not shared with other IBM customers. However, if you use a worker node virtual machine, the underlying hardware might be shared with other customers depending on the level of hardware isolation that you choose.
It is a tool that you can use to deploy components into your cluster.

Whether you deploy components to a paid or free Kubernetes cluster, pay close attention to the amount of available resources in your cluster when you choose to deploy nodes and create

channels. It is your responsibility to manage your Kubernetes cluster and deploy additional resources when necessary. While components will successfully deploy to an IBM Cloud free cluster, the more components you add, the slower your components will run. For more information about component sizings and how the console interacts with your Kubernetes cluster on IBM Cloud, see [Allocating resources](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-adv-deploymentibp-console-adv-deployment-allocate-resources).

If you are using a Kubernetes cluster on IBM Cloud, it is recommended that you provision at least a 4CPU x 16GB RAM cluster to accommodate the components in this tutorial.



 Sample network tutorial series 

This three-part tutorial series guides you through the process of creating and interconnecting a relatively simple, multi-node Hyperledger Fabric network by using the IBM Blockchain Platform console to deploy a network into your Kubernetes cluster and deploy a smart contract.

Note that while this tutorial shows how this process works with a paid Kubernetes cluster on IBM Cloud, the same basic flow applies to free clusters, albeit with a few limitations (for example, you cannot size or resize nodes in a free cluster).



* Build a network tutorial This tutorial guides you through the process of hosting a network by creating two organizations, one for your peer and another for your ordering service, and a channel. Use this tutorial if you want to form a blockchain consortium by creating an ordering service and adding organizations.
* [Join a network tutorial](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-join-networkibp-console-join-network) guides you through the process of joining an existing network by creating a peer and joining it to an existing channel.
Konnectivity agent N/A v0.0.19e_201_iks [Konnectivity](https://kubernetes.io/docs/tasks/extend-kubernetes/setup-konnectivity/) replaces OpenVPN as the network proxy that is used to secure the communication of the Kubernetes API server master to worker nodes in the cluster. See the [Konnectivity release notes](https://github.com/kubernetes-sigs/apiserver-network-proxy/releases/tag/v0.0.19). 
 Konnectivity server N/A v0.0.19e_201_iks [Konnectivity](https://kubernetes.io/docs/tasks/extend-kubernetes/setup-konnectivity/) replaces OpenVPN as the network proxy that is used to secure the communication of the Kubernetes API server master to worker nodes in the cluster. See the [Konnectivity release notes](https://github.com/kubernetes-sigs/apiserver-network-proxy/releases/tag/v0.0.19). 
 Kubernetes v1.20.7 v1.21.1 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.21.1). 
 Kubernetes admission controllers configuration N/A N/A Added DenyServiceExternalIPs to the --enable-admission-plugins option for the cluster's [Kubernetes API server](https://cloud.ibm.com/docs/containers?topic=containers-service-settingskube-apiserver). The update resolves CVE-2020-8554 (see the [IBM security bulletin](https://www.ibm.com/support/pages/node/6428013)).
Configure your app to parse the JSON content and retrieve the information that you need to access your service.









 Referencing the secret in environment variables 

You can add the service credentials and other key value pairs from your Kubernetes secret as environment variables to your deployment.



1. List available secrets in your cluster and note the name of your secret. Look for a secret of type Opaque. If multiple secrets exist, contact your cluster administrator to identify the correct service secret.

kubectl get secrets

Example output

NAME TYPE DATA AGE
binding-<service_instance_name> Opaque 1 3m
2. Get the details of your secret to find potential key value pairs that you can reference as environment variables in your pod. The service credentials are stored in the binding key of your secret.

kubectl get secrets binding-<service_instance_name> --namespace=<namespace> -o yaml

Example output

apiVersion: v1
data:
binding: <binding>
kind: Secret
metadata:
annotations:
service-instance-id: 7123acde-c3ef-4ba2-8c52-439ac007fa70
service-key-id: 9h30dh8a-023f-4cf4-9d96-d12345ec7890
creationTimestamp: 2018-08-07T20:47:14Z
name: binding-<service_instance_name>
namespace: <namespace>
resourceVersion: "6145900"
selfLink: /api/v1/namespaces/default/secrets/binding-mycloudant
uid: 12345a31-9a83-11e8-ba83-cd49014748f
type: Opaque
3. Create a YAML file for your Kubernetes deployment and specify an environment variable that references the binding key.

apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: secret-test
name: secret-test
namespace: <my_namespace>
: You can encrypt the Kubernetes secrets that you create in your cluster by using a key management service (KMS) provider. To get started, see [Encrypt secrets by using a KMS provider](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkeyprotect) and [Verify that secrets are encrypted](https://cloud.ibm.com/docs/containers?topic=containers-encryptionverify_kms).

Microservice traffic encryption
: After you deploy your app, you can set up a service mesh and enable mTLS encryption for traffic between services in the mesh. To get started, [set up the managed Istio add-on](https://cloud.ibm.com/docs/containers?topic=containers-istio). Then, follow the steps in [Securing in-cluster traffic by enabling mTLS](https://cloud.ibm.com/docs/containers?topic=containers-istio-meshmtls).

Pod traffic management
: [Kubernetes network policies](https://cloud.ibm.com/docs/containers?topic=containers-network_policiesisolate_services) protect pods from internal network traffic. For example, if most or all pods don't require access to specific pods or services, and you want to ensure that pods by default can't access those pods or services, you can create a Kubernetes network policy to block ingress traffic to those pods or services. Kubernetes network policies can also help you enforce workload isolation between namespaces by controlling how pods and services in different namespaces can communicate. For clusters that run Kubernetes 1.21 and later, the service account tokens that pods use to communicate with the Kubernetes API server are time-limited, automatically refreshed, scoped to a particular audience of users (the pod), and invalidated after the pod is deleted. To continue communicating with the API server, you must design your apps to read the refreshed token value on a regular basis, such as every minute.
A deployment helps you to manage multiple pods, replicas, pod scaling, rollouts, and more. 
 [ReplicaSet](https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/) A replica set makes sure that multiple replicas of your pod are running, and reschedules a pod if the pod goes down. You might create a replica set to test how pod scheduling works, but to manage app updates, rollouts, and scaling, create a deployment instead. 
 [Deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) A deployment is a controller that manages a pod or [replica set](https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/) of pod templates. You can create pods or replica sets without a deployment to test app features. For a production-level setup, use deployments to manage app updates, rollouts, and scaling. 
 [StatefulSet](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/) Similar to deployments, a stateful set is a controller that manages a replica set of pods. Unlike deployments, a stateful set ensures that your pod has a unique network identity that maintains its state across rescheduling. When you want to run workloads in the cloud, try to [design your app to be stateless](https://cloud.ibm.com/docs/containers?topic=containers-strategycloud_workloads) so that your service instances are independent from each other and can fail without a service interruption. However, some apps, such as databases, must be stateful.
[IKS Sample network structure](https://cloud.ibm.com/docs-content/v1/content/c5288bed34c3820e3a5251d820ee91adcd2591a3/blockchain/images/cloudkubernetes.svg)

Figure 1. Architecture diagram of IBM Blockchain Platform on IBM Cloud Kubernetes Service

Notice how a single instance of the console, also known as Operational Tooling, is created for each IBM Blockchain Platform Service Instance. When a peer, orderer or CA node is deployed by using the console, it is deployed into the Kubernetes Cluster Service Instance.



 IBM Blockchain Platform Kubernetes Cluster Description 

 Operational Tooling Also known as the "console", this is your central user interface for operating all of your blockchain components. With this console you can create CA, peer, and ordering nodes, create channels and use smart contracts. The console is deployed in an IBM-owned cluster. There is no charge for this tooling or the Kubernetes cluster on IBM Cloud where it runs. 





 Kubernetes cluster on IBM Cloud instance Description 

 Operator A Kubernetes operator that is used to deploy the console. 
 Ingress A [Kubernetes object](https://kubernetes.io/docs/concepts/services-networking/ingress/) that allows access to the cluster resources from outside the cluster. 
 Proxy The IBM Blockchain Platform proxy is responsible for routing traffic to the correct peer, CA and ordering nodes by using host header routing. 
 Peers, CAs, ordering nodes These are the nodes that are created. These nodes can also be imported from other consoles. Because the private keys are never stored by IBM, every peer and ordering node includes a gRPC web proxy that allows the console to communicate with each node by using the keys in the wallet. 
 RBAC Role based access control. The IBM Blockchain Platform configures [Kubernetes RBAC](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) in the cluster which is required to manage blockchain components in the cluster.
Configure your app to parse the JSON content and retrieve the information that you need to access your service.









 Referencing the secret in environment variables 

You can add the service credentials and other key value pairs from your Kubernetes secret as environment variables to your deployment.



1. List available secrets in your cluster and note the name of your secret. Look for a secret of type Opaque. If multiple secrets exist, contact your cluster administrator to identify the correct service secret.

oc get secrets

Example output

NAME TYPE DATA AGE
binding-<service_instance_name> Opaque 1 3m
2. Get the details of your secret to find potential key value pairs that you can reference as environment variables in your pod. The service credentials are stored in the binding key of your secret.

oc get secrets binding-<service_instance_name> --namespace=<project> -o yaml

Example output

apiVersion: v1
data:
binding: <binding>
kind: Secret
metadata:
annotations:
service-instance-id: 7123acde-c3ef-4ba2-8c52-439ac007fa70
service-key-id: 9h30dh8a-023f-4cf4-9d96-d12345ec7890
creationTimestamp: 2018-08-07T20:47:14Z
name: binding-<service_instance_name>
namespace: <project>
resourceVersion: "6145900"
selfLink: /api/v1/namespaces/default/secrets/binding-mycloudant
uid: 12345a31-9a83-11e8-ba83-cd49014748f
type: Opaque
3. Create a YAML file for your Kubernetes deployment and specify an environment variable that references the binding key.

apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: secret-test
name: secret-test
namespace: <my_project>
spec:
selector:
container-service[kubernetes-service/ks] 1.0.498 false
cra 1.1.5 false
doi 0.4.1 false
schematics[sch] 1.12.7 true
secrets-manager 0.1.25 true

 ibmcloud dev --version
ibmcloud dev version 2.17.1

 java -version
openjdk version "17.0.5" 2022-10-18
IBM Semeru Runtime Open Edition 17.0.5.0 (build 17.0.5+8)
Eclipse OpenJ9 VM 17.0.5.0 (build openj9-0.35.0, JRE 17 Linux amd64-64-Bit Compressed References 20221018_325 (JIT enabled, AOT enabled)
OpenJ9 - e04a7f6c1
OMR - 85a21674f
JCL - 32d2c409a33 based on jdk-17.0.5+8)

 ant -version
Apache Ant(TM) version 1.10.13 compiled on January 4 2023

 mvn -version
Apache Maven 3.9.0 (9b58d2bad23a66be161c4664ef21ce219c2c8584)
Maven home: /opt/IBM/maven
Java version: 17.0.5, vendor: IBM Corporation, runtime: /usr/local/jdk17
Default locale: en_US, platform encoding: UTF-8
OS name: "linux", version: "5.15.49-linuxkit", arch: "amd64", family: "unix"

 gradle -version

Welcome to Gradle 8.0.2!

Here are the highlights of this release:
- Improvements to the Kotlin DSL
- Fine-grained parallelism from the first build with configuration cache
- Configurable Gradle user home cache cleanup

For more details see https://docs.gradle.org/8.0.2/release-notes.html
A deployment helps you to manage multiple pods, replicas, pod scaling, rollouts, and more. 
 [ReplicaSet](https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/) A replica set makes sure that multiple replicas of your pod are running, and reschedules a pod if the pod goes down. You might create a replica set to test how pod scheduling works, but to manage app updates, rollouts, and scaling, create a deployment instead. 
 [Deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) A deployment is a controller that manages a pod or [replica set](https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/) of pod templates. You can create pods or replica sets without a deployment to test app features. For a production-level setup, use deployments to manage app updates, rollouts, and scaling. 
 [StatefulSet](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/) Similar to deployments, a stateful set is a controller that manages a replica set of pods. Unlike deployments, a stateful set ensures that your pod has a unique network identity that maintains its state across rescheduling. When you want to run workloads in the cloud, try to [design your app to be stateless](https://cloud.ibm.com/docs/openshift?topic=openshift-strategycloud_workloads) so that your service instances are independent from each other and can fail without a service interruption. However, some apps, such as databases, must be stateful.
container-service[kubernetes-service/ks] 1.0.489 false
cra 1.1.3 false
doi 0.4.1 false
schematics[sch] 1.12.7 true
secrets-manager 0.1.25 true

 ibmcloud dev --version
ibmcloud dev version 2.17.0

 java -version
openjdk version "17.0.5" 2022-10-18
IBM Semeru Runtime Open Edition 17.0.5.0 (build 17.0.5+8)
Eclipse OpenJ9 VM 17.0.5.0 (build openj9-0.35.0, JRE 17 Linux amd64-64-Bit Compressed References 20221018_325 (JIT enabled, AOT enabled)
OpenJ9 - e04a7f6c1
OMR - 85a21674f
JCL - 32d2c409a33 based on jdk-17.0.5+8)

 ant -version
Apache Ant(TM) version 1.10.13 compiled on January 4 2023

 mvn -version
Apache Maven 3.9.0 (9b58d2bad23a66be161c4664ef21ce219c2c8584)
Maven home: /opt/IBM/maven
Java version: 17.0.5, vendor: IBM Corporation, runtime: /usr/local/jdk17
Default locale: en_US, platform encoding: UTF-8
OS name: "linux", version: "5.15.49-linuxkit", arch: "amd64", family: "unix"

 gradle -version

Welcome to Gradle 8.0.1!

Here are the highlights of this release:
- Improvements to the Kotlin DSL
- Fine-grained parallelism from the first build with configuration cache
- Configurable Gradle user home cache cleanup

For more details see https://docs.gradle.org/8.0.1/release-notes.html
Understanding Kubernetes storage basics 

Before you get started with provisioning storage, it is important to understand the Kubernetes concepts for storage, dynamic provisioning, static provisioning, as well as the storage classes that are available to you.



 Persistent volumes and persistent volume claims 

Before you get started with provisioning storage, it is important to understand the Kubernetes concepts of a persistent volume and a persistent volume claim and how they work together in a cluster.

The following image shows the storage components in a cluster.

Zoom

![Storage components in a cluster.](https://cloud.ibm.com/docs-content/v1/content/4d497aff9e27b92fbbc2ee4e343a9ec4549cb1d7/containers/images/cs_storage_pvc_pv.svg)

Figure 1. Storage components in a cluster

Cluster
: By default, every cluster is set up with a plug-in to [provision file storage](https://cloud.ibm.com/docs/containers?topic=containers-file_storageadd_file). You can choose to install other add-ons, such as the one for [block storage](https://cloud.ibm.com/docs/containers?topic=containers-block_storage). To use storage in a cluster, you must create a persistent volume claim, a persistent volume and a physical storage instance. When you delete the cluster, you have the option to delete related storage instances.

App
: To read from and write to your storage instance, you must mount the persistent volume claim (PVC) to your app. Different storage types have different read-write rules. For example, you can mount multiple pods to the same PVC for file storage. Block storage comes with a RWO (ReadWriteOnce) access mode so that you can mount the storage to one pod only.

Persistent volume claim (PVC)
: A PVC is the request to provision persistent storage with a specific type and configuration.
This connection supports apiserver proxy calls to your pods and services, and kubectl exec, attach, and logs calls to the kubelet.

kubelet
: The kubelet is a pod that runs on every worker node and is responsible for monitoring the health of pods that run on the worker node and for watching the events that the Kubernetes API server sends. Based on the events, the kubelet creates or removes pods, ensures liveness and readiness probes, and reports back the status of the pods to the Kubernetes API server.

coredns
: By default, Kubernetes schedules a CoreDNS pod (or KubeDNS pod in version 1.12 and earlier) and service on the cluster. Containers automatically use the DNS service's IP to resolve DNS names in their searches for other pods and services.

calico
: Calico manages network policies for your cluster, and comprises a few components as follows.
: calico-cni: The Calico container network interface (CNI) manages the network connectivity of containers and removes allocated resources when a container is deleted.
: calico-ipam: The Calico IPAM manages IP address assignment for containers.
: calico-node: The Calico node is a container that bundles together the various components that are required for networking containers with Calico.
: calico-policy-controller: The Calico policy controller watches inbound and outbound network traffic for compliance with set network policies. If the traffic is not allowed in the cluster, access to the cluster is blocked. The Calico policy controller is also used to create and set network policies for a cluster.

kube-proxy
: The Kubernetes network proxy is a daemon that runs on every worker node and that forwards or load balances TCP and UDP network traffic for services that run in the cluster.

kube-dashboard
: The Kubernetes dashboard is a web-based GUI that allows users to manage and troubleshoot the cluster and applications that run in the cluster.

heapster
: Heapster is a cluster-wide aggregator of monitoring and event data. The Heapster pod discovers all nodes in the cluster and queries usage information from each node's kubelet.