vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Review steps 4-6 and verify that you retrieved the correct username, password, and certificate.
2. List the secrets in your cluster and look for the secret that holds the credentials of your Databases for etcd service instance.

kubectl get secrets
3. Make sure that the username, password, and certificate are stored as a base64 encoded value in your Kubernetes secret.
4. Verify that you entered the correct name of the secret in the IBM Cloud catalog.



5. If you chose to set up volume encryption with IBM Key Protect, make sure that you created an instance of IBM Key Protect in your IBM Cloud account and that you stored the credentials to access your instance in a Kubernetes secret in the portworx namespace of your cluster. For more information, see [Enabling per-volume encryption for your Portworx volumes](https://cloud.ibm.com/docs/containers?topic=containers-storage_portworx_encryption).



1. Make sure that the API key of your service ID, and the IBM Key Protect instance ID, root key, and API endpoint are stored as base64 values in the Kubernetes secret of your cluster.
2. Make sure that you named your secret px-ibm.
3. Make sure that you created the secret in the portworx namespace of your cluster.









 Step 2: Verifying the cluster setup 

If you entered the correct information on the IBM Cloud catalog page, verify that your cluster is correctly set up for Portworx.



1. Verify that the cluster that you want to use meets the [minimum hardware requirements for Portworx](https://docs.portworx.com/start-here-installation/).
2. If you want to use a virtual machine cluster, make sure that you [added raw, unformatted, and unmounted block storage](https://cloud.ibm.com/docs/openshift?topic=openshift-utilitiesmanual_block) to your cluster so that Portworx can include the disks into the Portworx storage layer.
3.
For example, you might add conditions such as only clusters in a resource group, only clusters with a prod Kubernetes namespace, or only clusters with a trusted-profile Kubernetes service account.
* Specific resources: A particular cluster. Click Add another resource + to select a cluster and fill out conditions such as the Kubernetes namespace or Kubernetes service account that can establish trust.
* Click Continue.



The Kubernetes namespace and service account names that you enter don't have to exist already. Any future namespaces or service accounts with these names can establish trust. To list existing namespaces, log in to your cluster and run kubectl get ns. To list existing service accounts, log in to your cluster and run kubectl get sa -n <namespace>.
7. Grant the trusted profile any access policies to the IAM services and Account management that you want the pod in your cluster to be able to access.



* For example, you might grant access to All Identity and Access enabled services and All resources in those services, with the Editor platform, Writer service, and Viewer resource group access roles.
* Click Add + to add the policy to the profile, and continue adding as many policies as you want.



8. In the Summary pane, review the profile, trust, and access details. Then, click Create.



Your clusters can now establish trust with IBM Cloud IAM. Next, your developers can [configure their application pods to exchange the identity token for an IAM token to authenticate requests to IBM Cloud services](https://cloud.ibm.com/docs/containers?topic=containers-pod-iam-identity&interface=uiiam-identity-pod).





 Configure your application pods to authenticate with IBM Cloud services 

As a developer, you can configure your application pods to authenticate with IBM Cloud services in clusters that are linked to an IAM trusted profile set up.

Before you begin:



* [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.]
Create a Kubernetes secret named px-ibm in the portworx namespace of your cluster to store your IBM Key Protect information.



1. Create a configuration file for your Kubernetes secret with the following content.

apiVersion: v1
kind: Secret
metadata:
name: px-ibm
namespace: portworx
type: Opaque
data:
IBM_SERVICE_API_KEY: <base64_apikey>
IBM_INSTANCE_ID: <base64_guid>
IBM_CUSTOMER_ROOT_KEY: <base64_rootkey>
IBM_BASE_URL: <base64_endpoint>

metadata.name
: Enter px-ibm as the name for your Kubernetes secret. If you use a different name, Portworx does not recognize the secret during installation.

data.IBM_SERVICE_API_KEY
: Enter the base64 encoded IBM Key Protect or Hyper Protect Crypto Services API key that you retrieved earlier.

data.IBM_INSTANCE_ID
: Enter the base64 encoded service instance GUID that you retrieved earlier.

data.IBM_CUSTOMER_ROOT_KEY
: Enter the base64 encoded root key that you retrieved earlier.

data.IBM_BASE_URL
: IBM Key Protect: Enter the base64 encoded API endpoint of your service instance.
: Hyper Protect Crypto Services: Enter the base64 encoded Key Management public endpoint.
2. Create the secret in the portworx namespace of your cluster.

kubectl apply -f secret.yaml
3. Verify that the secret is created successfully.

kubectl get secrets -n portworx
When you require a stable public IP address and more availability for your service, expose your app by using a [network load balancer (NLB) service](https://cloud.ibm.com/docs/containers?topic=containers-loadbalancer) or [Ingress](https://cloud.ibm.com/docs/containers?topic=containers-managed-ingress-about).





 Enabling access to an app by using a NodePort service 

Expose your app as a Kubernetes NodePort service.

Because worker nodes in VPC clusters don't have a public IP address, you can access an app through a NodePort only if you are connected to your private VPC network, such as through a VPN connection. To access an app from the internet, you must use a [VPC load balancer](https://cloud.ibm.com/docs/containers?topic=containers-vpc-lbaas) or [Ingress](https://cloud.ibm.com/docs/containers?topic=containers-managed-ingress-about) service instead.

If you don't already have an app ready, you can use a Kubernetes example app called [Guestbook](https://github.com/kubernetes/examples/blob/master/guestbook/all-in-one/guestbook-all-in-one.yaml).

Before you begin



* [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)
* VPC clusters: [Allow traffic requests that are routed to NodePorts on your worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-security-group).



To use a NodePort,



1. In the configuration file for your app, define a [service](https://kubernetes.io/docs/concepts/services-networking/service/) section.

For the Guestbook example, a front-end service section exists in the configuration file.
3. [Add the image pull secret to the service account for this Kubernetes namespace](https://cloud.ibm.com/docs/containers?topic=containers-registrystore_imagePullSecret) so that all pods in the namespace can use the image pull secret credentials.



5. If image pull secrets are listed in the pod, determine what type of credentials you use to access IBM Cloud Container Registry.



* If the secret has icr in the name, you use an API key to authenticate with the icr.io domain names. Continue with [Troubleshooting image pull secrets that use API keys](https://cloud.ibm.com/docs/Registry?topic=Registry-ts-app-image-pullimg-pull-api-key).
* If you have both types of secrets, then you use both authentication methods. Going forward, use the icr.io domain names in your deployment YAMLs for the container image. Continue with [Troubleshooting image pull secrets that use API keys](https://cloud.ibm.com/docs/Registry?topic=Registry-ts-app-image-pullimg-pull-api-key).







 Troubleshooting image pull secrets that use API keys 

If your pod configuration has an image pull secret that uses an API key, check that the API key credentials are set up correctly.

The following steps assume that the API key stores the credentials of a service ID. If you set up your image pull secret to use an API key of an individual user, you must verify that user's IBM Cloud IAM permissions and credentials.



1. Find the service ID that API key uses for the image pull secret by reviewing the Description. The service ID that is created with the cluster is named cluster-<cluster_ID> and is used in the default Kubernetes namespace. If you created another service ID such as to access a different Kubernetes namespace or to modify IBM Cloud IAM permissions, you customized the description.

ibmcloud iam service-ids

Example output

UUID Name Created At Last Updated Description Locked
ServiceId-aa11...
To update your cluster image pull secret in the default Kubernetes namespace.



1. Get your cluster ID.

ibmcloud ks cluster ls
2. Run the following command to create a service ID for the cluster and assign the service ID an IAM Reader service access role for IBM Cloud Container Registry. The command also creates an API key to impersonate the service ID credentials and stores the API key in a Kubernetes image pull secret in the cluster. The image pull secret is in the default Kubernetes namespace.

ibmcloud ks cluster pull-secret apply --cluster <cluster_name_or_ID>

When you run this command, the creation of IAM credentials and image pull secrets is initiated and can take some time to complete. You can't deploy containers that pull an image from the IBM Cloud Container Registry icr.io domains until the image pull secrets are created.
3. Verify that the image pull secrets are created in your cluster.

kubectl get secrets | grep icr-io

Example output

all-icr-io           kubernetes.io/dockerconfigjson        1         16d
4. Update your [container deployments](https://cloud.ibm.com/docs/containers?topic=containers-appimage) to pull images from the icr.io domain name.
5. Optional: If you have a firewall, make sure you [allow outbound network traffic to the registry subnets](https://cloud.ibm.com/docs/containers?topic=containers-firewallfirewall_outbound) for the domains that you use.
6. Complete your setup by using one of the following options.



* To pull images in Kubernetes namespaces other than default or from other IBM Cloud accounts, [copy or create another image pull secret](https://cloud.ibm.com/docs/containers?topic=containers-registryother).
* To restrict the image pull secret access to particular registry resources such as namespaces or regions:



1.
Setting up custom secrets in Key Protect 

IBM® Key Protect for IBM Cloud® is the service for storing and managing secrets in IBM Cloud. You can upload custom secrets and Key Protect manages them for you. Key Protect ensures that only those users and services whom you explicitly granted permission are able to access and use secrets. Data Engine uses Key Protect as its secure and trusted credential broker for custom access secrets to data resources as the following diagram shows.

Zoom

![Secure Credential Passing in Data Engine.](https://cloud.ibm.com/docs-content/v1/content/9fbd9f26e0f1e4aaa38411d9a81ad7bc6897624d/sql-query/images/accesssecrets_new.svg)

Figure 1. Secure Credential Passing in Data Engine

Make sure that you provisioned or received access to an instance of Key Protect in IBM Cloud. The following description uses the command-line interface to set up a new custom key. Alternatively, you can also use the IBM Cloud console.



1. Log on to IBM Cloud with ibmcloud login --sso.
2. Install the Key Protect CLI plug-in, if it is not already installed: ibmcloud plugin install key-protect -r 'IBM Cloud'. For more information, see the [Key Protect CLI documentation](https://cloud.ibm.com/docs/services/key-protect?topic=key-protect-set-up-cli).
3. List your Key Protect service instances and identify the ID and region of the instance where you want to store the secret: ibmcloud resource service-instances --long --service-name kms. The instance ID is in output column "GUID", the region in column "Location".
4. Select the appropriate target region with ibmcloud kp region-set <region>.
5. Optionally review the existing keys in the instance with following command: ibmcloud kp list -c -i <kp instance id>.
6.
* [Add an IBM Cloud service to your cluster](https://cloud.ibm.com/docs/containers?topic=containers-service-bindingbind-services).





 Mounting the secret as a volume to your pod 

When you mount the secret as a volume to your pod, a file that is named binding is stored in the volume mount directory. The binding file in JSON format includes all the information and credentials that you need to access the IBM Cloud service.



1. List available secrets in your cluster and note the name of your secret. Look for a secret of type Opaque. If multiple secrets exist, contact your cluster administrator to identify the correct service secret.

kubectl get secrets

Example output

NAME TYPE DATA AGE
binding-<service_instance_name> Opaque 1 3m
2. Create a YAML file for your Kubernetes deployment and mount the secret as a volume to your pod.

apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: secret-test
name: secret-test
namespace: <my_namespace>
spec:
selector:
matchLabels:
app: secret-test
replicas: 1
template:
metadata:
labels:
app: secret-test
spec:
containers:
- image: icr.io/ibm/liberty:latest
name: secret-test
volumeMounts:
- mountPath: <mount_path>
name: <volume_name>
volumes:
- name: <volume_name>
secret:
defaultMode: 420
secretName: binding-<service_instance_name>
Show more

volumeMounts.mountPath
: The absolute path of the directory to where the volume is mounted inside the container.

volumeMounts.name and volumes.name
: The name of the volume to mount to your pod.

secret.defaultMode
: The read and write permissions on the secret. Use 420 to set read-only permissions.

secret.secretName
If you select Reader, then you can't use the credentials to create buckets in IBM Cloud Object Storage and write data to it.
5. Optional: In Add Inline Configuration Parameters (Optional), enter {"HMAC":true} to create more HMAC credentials for the IBM Cloud Object Storage service. HMAC authentication adds an extra layer of security to the OAuth2 authentication by preventing the misuse of expired or randomly created OAuth2 tokens. Important: If you have a private-only cluster with no public access, you must use HMAC authentication so that you can access the IBM Cloud Object Storage service over the private network.
6. Click Add. Your new credentials are in the Service Credentials table.
7. Click View credentials.
8. Make note of the apikey to use OAuth2 tokens to authenticate with the IBM Cloud Object Storage service. For HMAC authentication, in the cos_hmac_keys section, note the access_key_id and the secret_access_key.
9. [Store your service credentials in a Kubernetes secret inside the cluster](https://cloud.ibm.com/docs/containers?topic=containers-storage-cos-understandcreate_cos_secret) to enable access to your IBM Cloud Object Storage service instance.







 Creating a secret for the object storage service credentials 

To access your IBM Cloud Object Storage service instance to read and write data, you must securely store the service credentials in a Kubernetes secret. The IBM Cloud Object Storage plug-in uses these credentials for every read or write operation to your bucket.

Follow these steps to create a Kubernetes secret for the credentials of an IBM Cloud Object Storage service instance. If you plan to use a local Cloud Object Storage server or a different s3 API endpoint, create a Kubernetes secret with the appropriate credentials.

Before you begin:



* [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)
* Make sure that you have the Manager service access role for the cluster.
Available options are akamai-ext, cloudflare-ext, or cis-ext. If no provider is specified, a domain is created with the IBM-managed internal provider.

--secret-namespace NAMESPACE
: Optional. The namespace that the TLS secret is created in. If no namespace is specified, the secret is created in the default namespace.

--domain-zone ZONE
: Optional. The Domain ID for your IBM Cloud Internet Services instance. This is a GUID value.



 Example ingress domain create command 

This example command creates a domain registered with the IBM Cloud internal provider. For examples to create domains with different providers, see [Creating your own Ingress domain](https://cloud.ibm.com/docs/containers?topic=containers-ingress-domains).

ibmcloud ks ingress domain create --cluster my-cluster --domain exampledomain







 ibmcloud ks ingress domain credential get 

View the details of the external domain provider credentials that have been added to your cluster.

ibmcloud ks ingress domain credential get --cluster CLUSTER [--output OUTPUT] [-q]

Minimum required permissions
: Viewer platform access role for IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster where the credential is applied.

--output OUPUT
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.



 Example ingress domain credential command 

ibmcloud ks ingress domain credential get --cluster mycluster







 ibmcloud ks ingress domain credential rm 

Remove external domain provider credentials from the cluster.

ibmcloud ks ingress domain credential rm --cluster CLUSTER [-q]

Minimum required permissions
: Operator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster where the credential is applied.

-q
Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)
* Make sure that you are assigned a [service access role](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-perms) that grants the appropriate Kubernetes RBAC role so that you can work with Kubernetes resources in the Kubernetes namespace.
* Optional: [Set a label for the worker pool](https://cloud.ibm.com/docs/containers?topic=containers-add_workersworker_pool_labels) that you want to run the app on.



To deploy apps to specific worker nodes,



1. Get the ID of the worker pool that you want to deploy app pods to.

ibmcloud ks worker-pool ls --cluster <cluster_name_or_ID>
2. List the worker nodes that are in the worker pool, and note one of the Private IP addresses.

ibmcloud ks worker ls --cluster <cluster_name_or_ID> --worker-pool <worker_pool_name_or_ID>
3. Describe the worker node. In the Labels output, note the worker pool ID label, ibm-cloud.kubernetes.io/worker-pool-id.

The steps in this topic use a worker pool ID to deploy app pods only to worker nodes within that worker pool. To deploy app pods to specific worker nodes by using a different label, note this label instead. For example, to deploy app pods only to worker nodes on a specific private VLAN, use the privateVLAN= label.

kubectl describe node <worker_node_private_IP>

Example output

NAME: 10.xxx.xx.xxx
Roles: <none>
Labels: arch=amd64
beta.kubernetes.io/arch=amd64
beta.kubernetes.io/instance-type=b3c.4x16.encrypted
beta.kubernetes.io/os=linux
Example cluster master pod-security set command 

ibmcloud oc cluster master pod-security set --cluster mycluster







 ibmcloud oc cluster master pod-security unset 

Virtual Private Cloud

Classic infrastructure

Remove the [pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission&interface=ui) configuration for a cluster's Kubernetes API server.

ibmcloud oc cluster master pod-security unset --cluster CLUSTER [-q]

Minimum required permissions
: Editor platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

--output json
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.



 Example cluster master pod-security unset command 

ibmcloud oc cluster master pod-security unset --cluster mycluster







 ibmcloud oc cluster master private-service-endpoint allowlist 

Manage a private cloud service endpoint allowlist so that authorized users can access your private cloud service endpoint from only the subnets that are specified in the allowlist.



 ibmcloud oc cluster master private-service-endpoint allowlist add 

Virtual Private Cloud

Classic infrastructure

After you enable a private cloud service endpoint allowlist, add subnets from which authorized users can access your private cloud service endpoint to the allowlist.

For example, to access your cluster's private cloud service endpoint, you must connect to your IBM Cloud classic network or your VPC network through a VPN or IBM Cloud Direct Link. You can add the subnet for the VPN or IBM Cloud Direct Link tunnel so that authorized users in your organization can only access the private cloud service endpoint from that subnet.

Worker node subnets are automatically added to and removed from your allowlist so that worker nodes can always access the master through the private cloud service endpoint.
Developers started by deploying their apps in containers with IBM Cloud Kubernetes Service. They created clusters for a shared Dev environment that allow worldwide Developers to collaboratively deploy app improvements quickly. Containers allow each development team to use the language of their choice.

Security first: The IT Execs chose bare metal clusters. With bare metal for IBM Cloud Kubernetes Service, the sensitive customs workloads now have familiar isolation but within the flexibility of public cloud.

Because the shipping company also wants to work with other ports, app security is crucial. Shipping manifests and customs information are highly confidential. From that secure core, Vulnerability Advisor provides these scans:



* Image vulnerability scans
* Policy scans that are based on ISO 27k



At the same time, IBM Cloud® Identity and Access Management helps to control who has which level of access to the resources.

Developers focus on domain problems, by using existing tools: Instead of Developers that write unique logging and monitoring code, they snap it into apps, by binding IBM Cloud services to clusters. Developers are also freed up from infrastructure management tasks because IBM takes care of Kubernetes and infrastructure upgrades, security, and more.

Compute, storage, and apps run in the public cloud with secure access to shipping data across the globe, as needed. Compute in clusters is tamper-proof and isolated to bare metal.

Technical solution:



* IBM Cloud Kubernetes Service
* IBM Cloud® Functions
* IBM Cloudant
* IBM Secure Gateway





 Step 1: Containerize apps, by using microservices 



* Create a Node.js app or deploy an example.
* Structure apps into a set of cooperative microservices that run within IBM Cloud Kubernetes Service based on functional areas of the app and its dependencies.
* Deploy the manifest and shipment apps to container that run in IBM Cloud Kubernetes Service.
* Provide standardized DevOps dashboards through Kubernetes.
* Use IBM Secure Gateway to maintain secure connections to existing on-premises databases.







 Step 2: Ensure global availability 



* After Developers deploy the apps in their Dev and Test clusters, they use the IBM Cloud® Continuous Delivery toolchains and Helm to deploy country-specific apps into clusters across the globe.