vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* proactively pre-fetch contents from origin servers so that users can access these contents rapidly from the edge
* extend the duration of TCP connections for multiple requests
* automatically compress images for lower latency.





 Objectives 



* Deploy a sample dynamic web application to a Kubernetes Service cluster.
* Make static content globally available with IBM® Content Delivery Network.
* Enable the Dynamic Content Acceleration (DCA) capability for performance optimization of non-static content.



Zoom

![Architecture](https://cloud.ibm.com/docs-content/v1/content/006fd22ab2811b7d19804c763a00568b3da4c03a/CDN/includes/solution-tutorials/includes/solution-tutorials/images/solution52-cdn-dca/solution_52_architecture.svg)

Figure 1. Architecture diagram of the tutorial



1. The developer creates a simple dynamic application and produces a Docker container image.
2. The image is pushed to a namespace in Container Registry.
3. The application is deployed to Kubernetes Service.
4. User accesses the application.
5. The application is accelerated through the Dynamic Content Acceleration capability of IBM® Content Delivery Network.
6. IBM® Content Delivery Network interacts with the application to fetch dynamic contents.







 Before you begin 

This tutorial requires:



* IBM Cloud CLI,



* IBM Cloud Kubernetes Service plugin (kubernetes-service),
* Container Registry plugin (container-registry),
* dev plugin,



* a Docker engine,
* kubectl to interact with Kubernetes clusters,
* git to clone source code repository.



You will find instructions to download and install these tools for your operating environment in the [Getting started with solution tutorials](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-tutorials) guide.
Installing the API Connect V5 Toolkit 

Duration: 15 mins
Skill level: Beginner



 Prerequisites 



1. Node.js: An asynchronous, event-driven JavaScript runtime that is used to build and run scalable network applications.
2. Node package manager (npm): A JavaScript package manager and software registry.
3. IBM® API Connect for IBM Cloud® Lite: A free version of API Connect that is hosted on your laptop.







 Install node.js 



1. Download and install node.js from one of the following sources:



* [https://nodejs.org/en/download/](https://nodejs.org/en/download/) (Note: Download the LTS version for your platform, not the latest, or you might experience errors.)
* [https://developer.ibm.com/node/sdk/v6/)](https://developer.ibm.com/node/sdk/v6/)



Installing node.js also installs the npm (Node Package Manager).
2. Make sure that node.js is in your PATH. ![verify-path.png](https://cloud.ibm.com/docs-content/v1/content/78bb71851d95d7580503eb9ba10cf3ae31490ade/apiconnect/tutorials/images/verify-path.png)
3. Update npm by running the following commnad: npm install -g npm Setting npm --engine-strict or npm config set engine-strict true prevents the installation from completing.
4. Check the installed version and path. ![screenshot_install_apic-1.png](https://cloud.ibm.com/docs-content/v1/content/78bb71851d95d7580503eb9ba10cf3ae31490ade/apiconnect/tutorials/images/screenshot_install_apic-1.png)
effect: "NoExecute"
thanosQuerier:
tolerations:
- key: "logging-monitoring"
operator: "Equal"
value: "node"
effect: "NoExecute"
Show more



2. Create the user-workload-monitoring-config ConfigMap in the openshift-user-workload-monitoring project with the following configuration. For more information, see the [Configuring the monitoring stack](https://docs.openshift.com/container-platform/4.6/monitoring/configuring-the-monitoring-stack.htmlconfiguring-the-monitoring-stack_configuring-the-monitoring-stack). The sample code configures the monitoring stack to complete the following tasks:





* Run the user workload monitoring stack on the provisioned worker pool.
* Add a retention period of 1 year.
* Add a 100 GB persistent volume to Prometheus.



data:
config.yaml: 
prometheus:
retention: 1y
volumeClaimTemplate:
spec:
storageClassName: ibmc-vpc-block-retain-general-purpose
volumeMode: Filesystem
resources:
requests:
storage: 100Gi
tolerations:
- key: "logging-monitoring"
operator: "Equal"
value: "node"
effect: "NoExecute"
Show more







 Step 4: Configure monitoring for a user-defined Red Hat OpenShift on IBM Cloud project 

If you are running your applications within Red Hat OpenShift on IBM Cloud, you can configure the monitoring stack to monitor your user-defined project.



1. [Create a ServiceMonitor](https://docs.openshift.com/container-platform/4.6/monitoring/managing-metrics.htmlspecifying-how-a-service-is-monitored_managing-metrics) for each of your projects where you want to collect metrics.
You will see an Add node to ordering service button. Click this button. After the node has been added to the ordering service, the node is now part of the system channel.

Note that it will take a few minutes for the new node to sync with ordering service in the system channel. During this time, you may see a message that your ordering service is down. This is normal --- the ordering service must come down while the new node is syncing. After the node tile status is green, proceed to the next section.





 Export components 

In your Region 1 blockchain console, you have now configured a CA for the ordering service and registered the orderer organization admin as well as an orderer user for the ordering nodes. You created an organization MSP definition that was used to deploy a single-node ordering service and then added a second node from Region 1 to the ordering service. Next, we need to export these components to your file system so they can be imported to the blockchain consoles in the Region 2 and Region 3 clusters.

When you created the orderer organization MSP, you already exported the Multiregion OS MSP definition and the Multiregion OS MSP Admin identity, you also need to export the CA and the ordering service:



1. From the Nodes tab, open the Multiregion OS CA tile and click Export![export icon](https://cloud.ibm.com/docs-content/v1/content/icons/download.svg).
2. From the Nodes tab, open the Multiregion Ordering Service tile and click Export![export icon](https://cloud.ibm.com/docs-content/v1/content/icons/download.svg).



These actions download the components in JSON format to your local file system. You will need to share these four files with the operators of the blockchain console in Region 2 and Region 3.







 Step 2: Add a new ordering node in Region 2 

Now that the ordering service is available, we can add nodes to it from the two other regions.

In this section, we create a third ordering node and then add it to the system channel (if applicable) as highlighted in yellow in the diagram below:

Zoom

!
24 May 2019 

Raft consensus protocol

The five node Raft ordering service, recommended for production networks, is now available. In addition, for development and testing purposes, you can deploy a single node Raft ordering service.





 9 May 2019 

Introducing IBM Blockchain Platform Console APIs

APIs are now available to provision, edit, and delete peer, orderer, and CA nodes, making it possible to script the building of your blockchain network. Use the documentation in the [IBM Cloud API documentation repository](https://cloud.ibm.com/apidocs/blockchainintroduction) to learn more about the APIs and try them out. In addition, see the topic on [Building a network with APIs](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-v2-apis) for instructions on how to use the APIs to build out your network.

Channel governance

Channel governance updates allow policies to be reconfigured. You can also control which channel members need to sign a channel update and you can orchestrate signature collection.





 17 April 2019 

Ability to size and scale node resources

When you deploy a node you now have the ability to specify the amount of CPU, memory, and storage to your containers, where applicable. You can later scale their resources up or down at a later time according to usage patterns. For more information, see [Allocating resources](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-adv-deploymentibp-console-adv-deployment-allocate-resources).

Use of IBM Cloud Identity and Access Management (IAM)

IAM is used to control user access to the console UI as well as restricting the actions they can perform in the UI. See this topic for information on how to [add and remove users from the console](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-manage-consoleibp-console-manage-console-add-remove).





 3 April 2019 

Support for external CA
But the console does not prevent you from configuring peers and ordering nodes that belong to a single same organization MSP. While it might seem that a single organization MSP for all your nodes would greatly simplify deployment of your network, this configuration is problematic. Because the process to renew certificates is different for peer and ordering nodes, when the renewal process is attempted after the node certificates expire in one year, certificate renewal will fail. For that reason, using the same MSP for your peers and ordering nodes is strongly discouraged.

In this Build a network tutorial, we build only a portion of the network above, a simple network that can be used to host an ordering service and a single peer organization and peer on a single channel. The following illustration shows the portion of the network above that we will build:

Zoom

![Simple network structure](https://cloud.ibm.com/docs-content/v1/content/c5288bed34c3820e3a5251d820ee91adcd2591a3/blockchain/images/ibp2-simple-network.svg)

Figure 2. Simple network structure

This configuration is useful for quickly getting started and testing a smart contract but is not very meaningful until you add other organizations to transact with, creating a truly distributed network. Therefore, in the subsequent [Join a network](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-join-networkibp-console-join-network) tutorial, we show you how to create additional peer organizations and peers, and how to add a new organization to the channel.

Throughout this tutorial we supply recommended values for the fields in the console. This allows the names and identities to be easier to recognize in the tabs and drop-down lists. These values are not mandatory, but you will find them helpful, especially since you will have to remember certain values like IDs and secrets of registered users that you input in previous steps. As these values are not stored in the console, if you forget them, you will have to register additional users and start the process over again.
IBM Cloud RBAC Operator b68ea92 945df65 Updated image for [CVE-2021-33194](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33194). 
 Key Management Service provider v2.3.5 v2.3.6 Updated universal base image (UBI) to the latest version to resolve CVEs. 







 Change log for worker node fix pack 1.18.29_1558, released 19 July 2021 

The following table shows the changes that are in the worker node fix pack 1.18.29_1558. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.18.20_1557

 Component Previous Current Description 

 Ubuntu 16.04 packages N/A N/A Updated worker node images with kernel package updates. 
 Ubuntu 18.04 packages N/A N/A Updated worker node images with kernel package updates. 







 Change log for worker node fix pack 1.18.20_1557, released 6 July 2021 

The following table shows the changes that are in the worker node fix pack 1.18.20_1557. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.18.19_1555

 Component Previous Current Description
Or select a one-to-one virtual data center to networking edge mapping based on use case and bandwidth. When you put VMware workloads on the public and private IBM Cloud network, use NSX-T edge services firewalls, OS or application firewalls, and OS or application security configurations to protect workloads from threats and attacks. 
 Workload monitoring Forward to customer any network intrusion notifications detected. Triage virtualization and backup-related errors to determine whether the customer issue needs assistance. Remediate all hardware failures, notification of potential workload impact. Monitor and respond to OS or software failures, backup, and replication jobs. Engage IBM Support as required. 
 Full state backup and recovery Back up all management component configurations that support customer instances. Regularly back up workload deployments and establish the ability to re-create workload deployments. 
 Incident management Communicate unplanned incidents with customer impact through the CIE process. If you are an impacted customer, obtain a report about the incident upon request. 







 Change management 

Change management includes tasks such as deployment, configuration, upgrades, patching, configuration changes, and deletion.



Table 2. Responsibilities for change management
The rows are read from left to right. The first column describes the task that a customer or IBM might be responsibility for. The second column describes IBM responsibilities for that task. The third column describes your responsibilities as the customer for that task.

 Item IBM responsibilities Your responsibilities 

 Updates, fixes, and new features Provide regular updates, bug fixes, and new features, following a continuous delivery model in a way that is transparent to you for all infrastructure tools, VMware components, IBM deployed cloud services and IBM management, monitoring, and automation tools. Post notifications for changes that impact you. Set preferences to receive email notifications. Monitor the IBM Cloud status page for general announcements. Use best practices and keep application operating systems and workload applications patched and secure with the most recent security patches. 







 Identity and access management 

Identity and access management includes tasks such as authentication, authorization, access control policies, and approving, granting, and revoking access.



Table 3. Responsibilities for identity and access management
The rows are read from left to right.
The remote syslog server is specified in the Syslog.global.logHost attribute.



NSX Flow Monitoring can be used in NSX Manager to determine which flows are approved and which flows are blocked. If required, then port mirroring can be configured for a vSphere Distributed Switch.





 Monitoring of NSX-T 

To monitor NSX-T™, the following tools are implemented:



* VMware Aria Operations Manager
* VMware Aria Operations for Logs



The VMware SDDC Health Management Pack monitors the following components:



* Logical Switches - Monitors admin state of the logical switches.
* Controller Cluster - Monitors the deployed cluster node count for HA and maintains quorum.
* Controller Nodes - Monitors node connectivity with controller cluster and manager node.
* Edge Nodes - Monitors edge node running state and its connectivity with controller cluster and manager nodes.
* NSX-T Management Services.
* T0 Router Service - Monitors static route, NAT, BGP, BFD, and route redistribution services.
* T1 Router Service - Monitors static route, NAT, and route advertisement services.







 Monitoring of VMware Aria Operations Manager 

The VMware SDDC Health Management Pack has Alert definitions for the following events:



* Current sizing of the VMware Aria Operations Manager nodes are not sufficient for given load.
* Cluster node configuration does not follow the VMware Aria Operations Manager sizing guideline.
* Current sizing of the Remote Collector is not sufficient for given load.
* Remote Collector configuration does not follow the VMware Aria Operations Manager sizing guideline.
* VMware Aria Operations Cluster has exceeded the recommended number of analytic nodes.







 Monitoring of VMware Aria Operations for Logs 

VMware Aria Operations for Logs supports alerts that trigger notifications about its health and generates notifications when an important system event occurs, for example, when the disk space is almost exhausted and VMware Aria Operations for Logs must start deleting or archiving old log files.







 System requirements 

The design uses the following quantity and size of appliances:



Table 1. Operation tooling summary system requirements

 VMware Aria Operations VMware Aria Operations for Logs VMware Aria Operations for Networks Proxy
Caching concepts 

This document contains some concepts and definitions related to caching and how it affects your IBM Cloud® Internet Services deployment.



 What is caching? 

Caching is the process of storing files on our edge servers, which we do for the purpose of improving the response time when serving those files to customers. By storing the files closer to the customers, we can decrease the time it takes for the data to stream across the network, which commonly is called the latency.

Cached files have a specified expiration time, Time-to-live (TTL) after which they are purged from the cache. It also is possible to purge files from the cache manually. After files are removed from the cache, CIS goes back to your origin server to reload your files and update the cache with the latest versions.

A deeper explanation of the cache settings and your caching options is located in the [Caching and Page Rules](https://cloud.ibm.com/docs/cis?topic=cis-use-page-rules-with-caching) section.



 Cached content 

By default, we cache static files, which include many types of image and text files (non-HTML files). This only includes files from your websites and not third party resources from social networking sites, etc. Also, we currently do not cache by MIME type.





 Caching HTML 

We do not cache HTML files by default because we do not consider them to be static; however, if static HTML can be clearly distinguished from dynamic HTML it is possible to cache HTML files [using the Page Rules feature](https://cloud.ibm.com/docs/cis?topic=cis-use-page-rules).







 Default caching behavior 

CIS caches static content depending on where your visitors come from, which CIS data center your visitors reach, and how often visitors request a resource at the specific data center.

CIS only caches a resource within the CIS data center that serves the request and doesn’t cache:



* off-site or third-party resources (for example, Facebook and Flickr)
* content hosted on unproxied DNS records



By default, CIS respects the origin web server’s cache headers in the following manner unless overridden by an edge cache TTL page rule:
Network segmentation also limits the access that is provided to an insider or third-party software and can limit the range of malicious activities.

Red Hat OpenShift on IBM Cloud provides IBM Cloud VPC subnets that ensure quality network performance and network isolation for worker nodes. A VPC subnet consists of a specified private IP address range (CIDR block) and configures a group of worker nodes and pods as if they were attached to the same physical wire. VPC subnets are dedicated to your IBM Cloud account and not shared across IBM customers.

VPC subnets provide a channel for connectivity among the worker nodes within the cluster. Any system that is connected to any of the private subnets in the same VPC can communicate with workers. For example, all subnets in one VPC can communicate through private layer 3 routing with a built-in VPC router. If your clusters don't need to communicate, you can achieve the best network segmentation by creating the clusters in separate VPCs. If you have multiple clusters that must communicate with each other, you can create the clusters in the same VPC. Although subnets within one VPC can be shared by multiple clusters in that VPC, you can achieve better network segmentation by using different subnets for clusters within one VPC.

To achieve further private network segmentation between VPC subnets for your account, you can set up custom network policies with VPC access control lists (ACLs). When you create a VPC, a default ACL is created in the format allow-all-network-acl-<VPC_ID> for the VPC. Any subnet that you create in the VPC is attached to this ACL by default. The ACL includes an inbound rule and an outbound rule that allow all traffic between your worker nodes on a subnet and any system on the subnets in the same VPC. If you want to specify which private network traffic is permitted to the worker nodes on your VPC subnets, you can create a custom ACL for each subnet in the VPC.
Modified Konnectivity agent CPU and memory resource requests and memory resource limit and removed the CPU resource limit. 
 Konnectivity server v0.0.23_245_iks v0.0.24_262_iks See the [Konnectivity release notes](https://github.com/kubernetes-sigs/apiserver-network-proxy/releases/tag/v0.0.24). 







 Change log for worker node fix pack 1.21.5_1537, released 25 October 2021 

The following table shows the changes that are in the worker node fix pack patch update 1.21.25_1537. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.21.5_1533

 Component Previous Current Description 

 Ubuntu 18.04 packages N/A N/A Updated worker node images with package updates. Contains fix for cloud-init performance problem. 
 Worker-pool taint automation N/A N/A Fixes known issue related to worker-pool taint automation that prevents workers from getting providerID. 







 Change log for worker node fix pack 1.21.5_1533, released 11 October 2021 

The following table shows the changes that are in the worker node fix pack patch update 1.21.5_1533. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.21.5_1532

 Component Previous Current Description 

 Containerd v1.5.5 v1.5.7 See the [security bulletin](https://www.ibm.com/support/pages/node/6501867) and the [change log](https://github.com/containerd/containerd/releases/tag/v1.5.7).
Gateway-enabled cluster controller 1444 1510 Updated image for [CVE-2021-3711](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3711) and [CVE-2021-3712](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3712). 
 GPU device plug-in and installer 8c8bcdf 58d7589 Updated to use Go version 1.16.7. 
 IBM Cloud Controller Manager v1.21.4-1 v1.21.5-1 Updated to support the Kubernetes 1.21.5 release and to use Go version 1.16.8 and calicoctl version 3.19.3. Fixed a bug that may cause node initialization to fail when a new node reuses the name of a deleted node. 
 IBM Cloud File Storage for Classic plug-in and monitor 398 400 Updated to use Go version 1.16.7. Updated universal base image (UBI) to the latest 8.4-208 version to resolve CVEs. 
 IBM Cloud RBAC Operator 945df65 e3cb629 Updated to use Go version 1.16.7. 
 Konnectivity agent v0.0.21e_231_iks v0.0.23_245_iks See the [Konnectivity release notes](https://github.com/kubernetes-sigs/apiserver-network-proxy/releases/tag/v0.0.23). 
 Konnectivity server v0.0.21e_231_iks v0.0.23_245_iks See the [Konnectivity release notes](https://github.com/kubernetes-sigs/apiserver-network-proxy/releases/tag/v0.0.23).