vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Activity Tracker hosted event search,Container Registry,Secrets Manager,App ID,Cloudant,Key Protect,Log Analysis



* 2 hours
* 2023-06-28



[Apply end to end security to a cloud application](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-cloud-e2e-security)Apply end to end security to a cloud application

This tutorial walks you through key security services available in the IBM Cloud® catalog and how to use them together. An application that provides file sharing will put security concepts into practice.

Kubernetes service Object Storage

+8

Activity Tracker hosted event search,Container Registry,Secrets Manager,App ID,Cloudant,Key Protect,Log Analysis,Cloud Internet Services (CIS)



* 2 hours
* 2023-05-05



[Plan, create and update deployment environments](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-plan-create-update-deployments)Plan, create and update deployment environments

Multiple deployment environments are common when building a solution. They reflect the lifecycle of a project from development to production. This tutorial introduces tools like the IBM Cloud CLI and Terraform to automate the creation and maintenance of these deployment environments.

Kubernetes service Virtual Servers for Classic

+5

Object Storage,Cloudant,,Activity Tracker hosted event search,Monitoring



* 2 hours
* 2023-05-05



[Resource sharing across accounts](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-resource-sharing)Resource sharing across accounts

This tutorial walks you through different options on how to share cloud-based resources across accounts.

Virtual Private Cloud (VPC) Log Analysis

+6

Activity Tracker hosted event search,Secrets Manager,App ID,Key Protect,Hyper Protect Crypto Services,Object Storage



* 1 hour
* 2023-05-05
Optional: Compare the service credentials that you decoded in the previous step with the service credentials that you find for your service instance in the IBM Cloud dashboard.



6. Now that your service is bound to your cluster, you must configure your app to [access the service credentials in the Kubernetes secret](https://cloud.ibm.com/docs/containers?topic=containers-service-bindingadding_app).







 Accessing service credentials from your apps 

To access an IBM Cloud service instance from your app, you must make the service credentials that are stored in the Kubernetes secret available to your app.

The credentials of a service instance are base64 encoded and stored inside your secret in JSON format. To access the data in your secret, choose among the following options:



* [Mount the secret as a volume to your pod](https://cloud.ibm.com/docs/containers?topic=containers-service-bindingmount_secret)
* [Reference the secret in environment variables](https://cloud.ibm.com/docs/containers?topic=containers-service-bindingreference_secret)



Before you begin:



* Ensure you have the [Writer or Manager IBM Cloud IAM service access role](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-perms) for the kube-system namespace.
* [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)
* [Add an IBM Cloud service to your cluster](https://cloud.ibm.com/docs/containers?topic=containers-service-bindingbind-services).





 Mounting the secret as a volume to your pod 

When you mount the secret as a volume to your pod, a file that is named binding is stored in the volume mount directory. The binding file in JSON format includes all the information and credentials that you need to access the IBM Cloud service.



1. List available secrets in your cluster and note the name of your secret.
After reviewing the [overview](https://cloud.ibm.com/docs/containers?topic=containers-responsibilities_iksoverview-by-resource), see what tasks you and IBM share responsibility for each area and resource when you use IBM Cloud Kubernetes Service.



 Incident and operations management 

You and IBM share responsibilities for the set up and maintenance of your IBM Cloud Kubernetes Service cluster environment for your application workloads. You are responsible for incident and operations management of your application data.



Table 2. Responsibilities for incident and operations management

 Resource IBM responsibilities Your responsibilities 

 Worker nodes <br><br> * Deploy a fully managed, highly available dedicated master in a secured, IBM-owned infrastructure account for each cluster.<br> * Provision worker nodes in your IBM Cloud infrastructure account.<br> * Ensure that worker nodes successfully provision when the user account and permissions are correctly set up, and sufficient quota exists.<br> * Fulfill requests for more infrastructure, such as adding, reloading, updating, and removing worker nodes.<br> * Provide tools, such as the [cluster autoscaler](https://cloud.ibm.com/docs/containers?topic=containers-cluster-scaling-classic-vpc), to extend your cluster infrastructure.<br> * Integrate ordered infrastructure resources to work automatically with your cluster architecture and become available to your deployed apps and workloads.<br> * Fulfill automation requests to help recover worker nodes.<br><br><br> <br><br> * Use the provided API, CLI, or console tools to adjust [compute](https://cloud.ibm.com/docs/containers?topic=containers-add_workers) and [storage](https://cloud.ibm.com/docs/containers?topic=containers-storage-plan) capacity to meet the needs of your workload.<br> * Use the provided API, CLI, or console tools to request that worker nodes are rebooted, reloaded, or replaced, and troubleshoot issues such as when the worker nodes are in an [unhealthy state](https://cloud.ibm.com/docs/containers?topic=containers-debug_worker_nodes).<br><br><br>
The following key principles are required:



* Codebase - All source code and configuration files are tracked inside a version control system (for example a GIT repository), this is required if using DevOps pipeline for deployment.
* Build, release, run - The 12-factor app uses strict separation between the build, release, and run stages. This can be automated with an integrated DevOps delivery pipeline to build and test the app before deploying it to the cluster. Check out the [Continuous Deployment to Kubernetes tutorial](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-continuous-deployment-to-kubernetescontinuous-deployment-to-kubernetes) to learn how to set up a continuous integration and delivery pipeline. It covers the set up of source control, build, test and deploy stages and shows you how to add integrations such as security scanners, notifications, and analytics.
* Config - All configuration information is stored in environment variables. No service credentials are hard-coded within the app code. To store credentials, you can use Kubernetes secrets. More on credentials covered below.







 Store credentials in Kubernetes secrets 

It's never good practice to store credentials within the app code. Instead, Kubernetes provides so-called [secrets](https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/) that hold sensitive information, such as passwords, OAuth tokens, or SSH keys. Kubernetes secrets are encrypted by default which makes secrets a safer and a more flexible option to store sensitive data than to store this data verbatim in a pod definition or in a container image.

One way of using secrets in Kubernetes is by doing something like this:



1. Create a file called cloud-secrets.txt and store the service credentials of any cloud service inside it.

{
"url": "<SERVICE_URL>",
"api_key": <API_Key>
}
2.
Connecting an IBM Cloud application 

Applications running in IBM Cloud can be bound to your IBM Cloud® Databases for PostgreSQL deployment.



 Connecting a Kubernetes Service application 

There are two steps to connecting a Cloud databases deployment to a Kubernetes Service application. First, your deployment needs to be bound to your cluster and its connection strings that are stored in a secret. The second step is configuring your application to use the connection strings.

The sample app in the [Connecting a Kubernetes Service Tutorial](https://cloud.ibm.com/docs/databases-for-postgresql?topic=cloud-databases-tutorial-k8s-app) provides a sample application that uses Node.js and demonstrates how to bind the sample application to a Cloud Databases deployment.

Before connecting your Kubernetes Service application to a deployment, make sure that the deployment and cluster are both in the same region and resource group.



 Binding your deployment 

Public Endpoints - If you are using the default public service endpoint to connect to your deployment, you can run the cluster service bind command with your cluster name, the resource group, and your deployment name.

ibmcloud ks cluster service bind <your_cluster_name> <resource_group> <your_database_deployment>

OR Private Endpoints - If you want to use a private endpoint (if one is enabled on your deployment), then create a service key for Kubernetes to use when binding to the database.

ibmcloud resource service-key-create <your-private-key> --instance-name <your_database_deployment> --service-endpoint private

The private service endpoint is selected with --service-endpoint private. After that, you bind the database to the Kubernetes cluster through the private endpoint with the cluster service bind command.

ibmcloud ks cluster service bind <your_cluster_name> <resource_group> <your_database_deployment> --key <your-private-key>

Verify - Verify that the Kubernetes secret was created in your cluster namespace. Running the following command, you get the API key for accessing the instance of your deployment that is provisioned in your account.
Observability <br><br> * Provide the ability to integrate IBM Cloud Activity Tracker with your cluster to audit the actions that users take in the cluster.<br><br><br> <br><br> * Set up IBM Cloud Activity Tracker or other capabilities to track user activity in the cluster.<br><br><br> 







 Security and regulation compliance 

IBM is responsible for the security and compliance of IBM Cloud Kubernetes Service. Compliance to industry standards varies depending on the infrastructure provider that you use for the cluster, such as classic or VPC. You are responsible for the security and compliance of any workloads that run in the cluster and your application data. For more information, see [What standards does the service comply to?](https://cloud.ibm.com/docs/containers?topic=containers-faqsstandards).



Table 5. Responsibilities for security and regulation compliance

 Resource IBM responsibilities Your responsibilities 

 General <br><br> * Maintain controls commensurate to [various industry compliance standards](https://cloud.ibm.com/docs/containers?topic=containers-updateupdate), such as PCI DSS. Compliance to industry standards varies depending on the infrastructure provider of the cluster, such as classic or VPC.<br> * Monitor, isolate, and recover the cluster master.<br> * Provide highly available replicas of the Kubernetes master API server, etcd, scheduler, and controller manager components to protect against a master outage.<br> * Provide options for cluster network connectivity, such as public and private cloud service endpoints.<br> * Provide options for compute isolation, such as dedicated virtual machines or bare metal.<br> * Integrate Kubernetes role-based access control (RBAC) with IBM Cloud Identity and Access Management (IAM).<br><br><br> <br><br> * Set up and maintain security and regulation compliance for your apps and data.
: Updated the ALB [nginx-ingress image to build 519](https://cloud.ibm.com/docs/containers?topic=containers-cluster-add-ons-changelogkube_ingress_changelog) for a custom-ports bug fix.





 19 August 2019 

New! Virtual Private Cloud
: You can create standard Kubernetes clusters on classic infrastructure in the next generation of the IBM Cloud platform, in your Virtual Private Cloud. VPC gives you the security of a private cloud environment with the dynamic scalability of a public cloud. Classic on VPC clusters are available for only standard, Kubernetes clusters and are not supported in free or Red Hat OpenShift clusters.
: With classic clusters in VPC, IBM Cloud Kubernetes Service introduces version 2 of the API, which supports multiple infrastructure providers for your clusters. Your cluster network setup also changes, from worker nodes that use public and private VLANs and the public cloud service endpoint to worker nodes that are on a private subnet only and have the private cloud service endpoint enabled. For more information, check out the following links.



* [Overview of Classic and VPC infrastructure providers](https://cloud.ibm.com/docs/containers?topic=containers-infrastructure_providers)
* [About the v2 API](https://cloud.ibm.com/docs/containers?topic=containers-cs_api_installapi_about)
* [Understanding network basics of VPC clusters](https://cloud.ibm.com/docs/containers?topic=containers-plan_vpc_basics)



: Ready to get started? Try out the [Creating a classic cluster in your VPC tutorial](https://cloud.ibm.com/docs/containers?topic=containers-vpc_ks_tutorial).

Kubernetes 1.14
: [Kubernetes 1.14](https://cloud.ibm.com/docs/containers?topic=containers-cs_versionscs_versions_available) is now the default version.





 17 August 2019 

IBM Cloud® Activity Tracker
Setting capacity quotas for apps that use IBM Cloud Object Storage 

Virtual Private Cloud

Classic infrastructure

With IBM Cloud Object Storage, you can dynamically provision buckets for apps running in your IBM Cloud Kubernetes Service clusters. You can also dynamically set capacity quotas on those buckets during provisioning. Quotas can help you manage the resources your workloads use while also avoiding unnecessary charges.



 Objectives 

In this tutorial, you install the Object Storage plug-in in your cluster and enable quotas for any persistent volume claims (PVC) created with the plug-in.

Then, you create a PVC which dynamically creates a bucket with a quota limit in your Object Storage instance.

After that, you upload a file to your bucket and deploy a simple app to your cluster that mounts the bucket and prints the contents of that file.





 Prerequisites 

Before beginning this tutorial make sure you have created or installed the following resources and tools.



* An IBM Cloud account. For more information, see [Creating an account](https://cloud.ibm.com/docs/account?topic=account-account-getting-started).
* The CLI tools including the IBM Cloud CLI, the Containers service CLI plug-in, and the Helm CLI. For more information, see [Getting started with the IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-getting-started).
* An IBM Cloud Kubernetes Service cluster. If you have a VPC cluster, make sure your VPC has a public gateway attached. For more information, see [Creating clusters](https://cloud.ibm.com/docs/containers?topic=containers-clusters)
* An Object Storage instance in the same region as your cluster. For more information, see [Provision an instance of Object Storage](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-provision).







 Step 1: Creating a set of service credentials 



1.
* Delete any unused images by using ibmcloud cr image-rm <respository>:<tag>.
* Rerun the build or deploy job that failed.



For more information, see [Freeing up used storage and changing service plans or quota limits to stay within given quota limits](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_quotaregistry_quota_freeup).





 Accessing Kubernetes logs 

If the app isn't running and you can't access the health endpoint, try looking at the logs in the cluster.



* Install the [IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-getting-started) if you don't already have it.
* Log in to IBM Cloud by using ibmcloud login, and point it to the space that you're in.
* List your clusters by using ibmcloud cs clusters,
* Point to your corresponding cluster by using ibmcloud cs cluster-config <cluster-name>.
* Export the environment variable that is listed.
* View your pods by using kubectl get pods. If you need to install kubectl, see [Install and set up kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/).
* You can view the logs in your app by using kubectl logs <pod-name>.







 Starting docker fails with file not found message 

 What’s happening 

When you try to start Docker, the following error message is displayed:

An error exec: "docker": executable file not found in $PATH was encountered while the Docker image is building.

 Why it’s happening 

The Docker client isn't installed, or it's installed but not started.

 How to fix it 

Ensure [Docker](https://docs.docker.com/install/) is installed, and start it.
Therefore, no pre-configured Kubernetes storage classes are set up by default in your clusters to store your application data in a Kubernetes persistent volume that is backed by storage device. For options to set up a storage provider, see [Understanding Satellite storage templates](https://cloud.ibm.com/docs/satellite?topic=satellite-storage-template-ov). 
 Worker nodes Worker nodes run on hosts in your own infrastructure environments. The hosts must meet [host](https://cloud.ibm.com/docs/satellite?topic=satellite-host-reqs) and provider-specific requirements, such as for [AWS](https://cloud.ibm.com/docs/satellite?topic=satellite-aws), [Azure](https://cloud.ibm.com/docs/satellite?topic=satellite-azure), [GCP](https://cloud.ibm.com/docs/satellite?topic=satellite-gcp), and [IBM Cloud](https://cloud.ibm.com/docs/satellite?topic=satellite-ibm) (testing and demonstration purposes only). You are responsible for [managing the infrastructure lifecycle of your hosts](https://cloud.ibm.com/docs/satellite?topic=satellite-host-update-location), including adding and [updating worker nodes](https://cloud.ibm.com/docs/satellite?topic=satellite-host-update-workers). As such, worker node operations like ibmcloud oc worker add, update, replace, reload commands are not supported. 
 Worker pools To use operations like resize, your worker pool uses [host labels](https://cloud.ibm.com/docs/satellite?topic=satellite-assigning-hostshost-autoassign-ov) that must match available (unassigned) hosts in the Satellite location. 







 Unsupported features and operators in Red Hat OpenShift on IBM Cloud 

The following features and operators are not supported in Red Hat OpenShift on IBM Cloud.

Instead of tuning worker node performance with MachineConfig files in Red Hat OpenShift, you can modify the host with a daemonset file.
Ask your cluster admin to [enable a key management service provider](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkeyprotect) in your cluster to encrypt new and existing secrets.





 How can I make sure that my app has the correct resources? 

When you [specify your app YAML file](https://cloud.ibm.com/docs/containers?topic=containers-appapp_yaml), you can add Kubernetes functionalities to your app configuration that help your app get the correct resources. In particular, [set resource limits and requests](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) for each container that is defined in your YAML file.

Additionally, your cluster admin might set up resource controls that can affect your app deployment, such as the following.



* [Resource quotas](https://kubernetes.io/docs/concepts/policy/resource-quotas/)
* [Pod priority](https://cloud.ibm.com/docs/containers?topic=containers-pod_priority)







 How can I add capabilities to my app configuration? 

See [Specifying your app requirements in your YAML file](https://cloud.ibm.com/docs/containers?topic=containers-appapp_yaml) for descriptions of what you might include in a deployment. The example includes the following options.



* [Replica sets](https://cloud.ibm.com/docs/containers?topic=containers-appreplicaset)
* [Labels](https://cloud.ibm.com/docs/containers?topic=containers-applabel)
* [Affinity](https://cloud.ibm.com/docs/containers?topic=containers-appaffinity)
* [Image policies](https://cloud.ibm.com/docs/containers?topic=containers-appimage)
* [Ports](https://cloud.ibm.com/docs/containers?topic=containers-appport)
Complete the following steps from the [IBM Cloud Kubernetes Service console](https://cloud.ibm.com/kubernetes/clusters):



1. Select the cluster for which you want to create a logging logging configuration.
2. On the cluster Overview page, in the Logging section, click Connect.

The page Connect an existing IBM Log Analysis with logging instance opens.
3. Select the region where the logging instance is provisioned.
4. Select the IBM Log Analysis instance that you want to use to analyze your logs.
5. If your account is VRF-enabled, check the box Use private endpoint to keep all network traffic to your service instance on the private network.

Your cluster must be set up with a private service endpoint to use this option. To enable the private service endpoint, use the cluster Overview page.

To check if your account is VRF-enabled, run the following command:

ibmcloud account show
6. Click Connect.







 Deploy the logging agent by using ob commands 

To configure the logging agent in a cluster, complete the following steps:



1. [Pre-req] Install the IBM Cloud Kubernetes Service observability CLI plug-in (ibmcloud ob).

ibmcloud plugin install observe-service
2. Set the cluster context.

Open a terminal to log in to IBM Cloud.

ibmcloud login -a cloud.ibm.com

Select the account where you provisioned the IBM Log Analysis instance.

List the clusters to find out in which region and resource group the cluster is available.

ibmcloud ks clusters

Set the resource group and region.

ibmcloud target -g RESOURCE_GROUP -r REGION

Where

RESOURCE_GROUP is the name of the resource group where the cluster is available, for example, default.

REGION is the region where the cluster is available, for example, us-south.

Set the cluster where you want to configure logging as the context for this session.

ibmcloud ks cluster config --cluster <cluster_name_or_ID>
3.
Kubernetes service Virtual Private Cloud (VPC)



* 30 minutes
* 2023-07-07



[Migrating an app from Cloud Foundry to a cluster](https://cloud.ibm.com/docs/containers?topic=containers-cf_tutorial)Migrating an app from Cloud Foundry to a cluster

Take an app that you deployed previously by using Cloud Foundry and deploy the same code in a container to an IBM Cloud Kubernetes Service.

Kubernetes service



* 30 minutes
* 2023-07-07



[Using Calico network policies to control traffic on Classic clusters](https://cloud.ibm.com/docs/containers?topic=containers-policy_tutorial)Using Calico network policies to control traffic on Classic clusters

Learn how to use Calico policies to allow network traffic from and to certain IP addresses.

Kubernetes service



* 60 minutes
* 2023-07-07



[Setting capacity quotas for apps that use IBM Cloud Object Storage](https://cloud.ibm.com/docs/containers?topic=containers-storage-cos-tutorial-quota)Setting capacity quotas for apps that use IBM Cloud Object Storage

With IBM Cloud Object Storage, you can dynamically provision buckets for apps running in your IBM Cloud Kubernetes Service clusters. You can also dynamically set capacity quotas on those buckets during provisioning. Quotas can help you manage the resources your workloads use while also avoiding unnecessary charges.

Kubernetes service Object Storage



* 45 minutes
* 2023-02-16



[Part 4: Set up a Continuous Compliance (CC) toolchain](https://cloud.ibm.com/docs/devsecops?topic=devsecops-tutorial-cc-toolchain)Part 4: Set up a Continuous Compliance (CC) toolchain

This tutorial is part 4 of a 4-part tutorial series where you learn IBM Cloud® DevSecOps best practices by using a complete reference implementation that is available as a service and powered by IBM Cloud® Continuous Delivery.