vania-janet/multiturn-rag-retrieval-data huggingface dataset:
You must add the containers-kubernetes to your network zones for rules created against the following services.

IAM Identity service
: Allow IBM Cloud Kubernetes Service to create tokens and API Keys like the cluster API Key and the IBM Cloud Container Registry token and API Key.

IAM Access Management Service
: Allow IBM Cloud Kubernetes Service to create an IAM Access Policy for Reader service access role to IBM Cloud Container Registry.

IAM Access Groups Service
: Allow IBM Cloud Kubernetes Service to look up access groups when syncing IAM access policies with RBAC in the cluster.

User Management
: Allow IBM Cloud Kubernetes Service to access user information when syncing IAM access policies with RBAC in the cluster.

Key protect:
: Allow IBM Cloud Kubernetes Service to enable encryption on the cluster.







 Creating network zones 

Network zones act as allowlists for the target resources you define when you create CBR rules. After you create a network zone, or allowlist, you can create rules that define which resources the network zone can access.

Make sure to add the containers-kubernetes service to your network zones for rules that apply to other IBM Cloud resources, such as a rule that protects IBM Cloud Object Storage or some cluster operations might fail. For more information, see [Allowing IBM Cloud Kubernetes Service to access other IBM Cloud resources by using CBR](https://cloud.ibm.com/docs/containers?topic=containers-cbr&interface=clicbr-integrations).

Review the [limitations](https://cloud.ibm.com/docs/containers?topic=containers-cbr&interface=clicbr-limitations) before you create network zones.



 Creating network zones from the API 

You can create network zones by using the /v1/zones API. For more information, see the [API docs](https://cloud.ibm.com/apidocs/context-based-restrictionscreate-zone). You can add the containers-kubernetes service to your network zones to allow IBM Cloud Kubernetes Service to access resources and services in your account.

You can include multiple address types in your network zone payload.
Cluster architecture when only the public cloud service endpoint is enabled





 VRF-enabled account with private and public cloud service endpoints 

The following image shows the components of your cluster and how they interact in a VRF-enabled account when the [public and private cloud service endpoints are enabled](https://cloud.ibm.com/docs/containers?topic=containers-plan_basicsworkeruser-master).

Zoom

![IBM Cloud Kubernetes Service architecture when public and private cloud service endpoints are enabled](https://cloud.ibm.com/docs-content/v1/content/4d497aff9e27b92fbbc2ee4e343a9ec4549cb1d7/containers/images/cs_org_ov_both_ses.svg)

Figure 1. Cluster architecture when public and private cloud service endpoints are enabled





 Kubernetes master components 

The Kubernetes master is tasked with managing all compute, network, and storage resources in the cluster, and ensures that your containerized apps and services are equally deployed to the worker nodes in the cluster. Depending on how you configure your app and services the master determines the worker node that has sufficient resources to fulfill the app's requirements.

The Kubernetes master and all the master components are dedicated only to you, and are not shared with other IBM customers.

The following table describes the components of the Kubernetes master.

kube-apiserver
: The Kubernetes API server serves as the main entry point for all cluster management requests from the worker node to the Kubernetes master. The Kubernetes API server validates and processes requests that change the state of Kubernetes resources, such as pods or services, and stores this state in etcd.

konnectivity-server
: The Konnectivity server works with the Konnectivity agent to securely connect the master to the worker node. This connection supports apiserver proxy calls to your pods and services, and kubectl exec, attach, and logs calls to the kubelet.

etcd
You must add the containers-kubernetes to your network zones for rules created against the following services.

IAM Identity service
: Allow IBM Cloud Kubernetes Service to create tokens and API Keys like the cluster API Key and the IBM Cloud Container Registry token and API Key.

IAM Access Management Service
: Allow IBM Cloud Kubernetes Service to create an IAM Access Policy for Reader service access role to IBM Cloud Container Registry.

IAM Access Groups Service
: Allow IBM Cloud Kubernetes Service to look up access groups when syncing IAM access policies with RBAC in the cluster.

User Management
: Allow IBM Cloud Kubernetes Service to access user information when syncing IAM access policies with RBAC in the cluster.

Key protect:
: Allow IBM Cloud Kubernetes Service to enable encryption on the cluster.







 Creating network zones 

Network zones act as allowlists for the target resources you define when you create CBR rules. After you create a network zone, or allowlist, you can create rules that define which resources the network zone can access.

Make sure to add the containers-kubernetes service to your network zones for rules that apply to other IBM Cloud resources, such as a rule that protects IBM Cloud Object Storage or some cluster operations might fail. For more information, see [Allowing IBM Cloud Kubernetes Service to access other IBM Cloud resources by using CBR](https://cloud.ibm.com/docs/containers?topic=containers-cbrcbr-integrations).

Review the [limitations](https://cloud.ibm.com/docs/containers?topic=containers-cbrcbr-limitations) before you create network zones.



 Creating network zones from the API 

You can create network zones by using the /v1/zones API. For more information, see the [API docs](https://cloud.ibm.com/apidocs/context-based-restrictionscreate-zone). You can add the containers-kubernetes service to your network zones to allow IBM Cloud Kubernetes Service to access resources and services in your account.

You can include multiple address types in your network zone payload.
For the shipping company to work with global partners, the routing and scheduling systems required local modifications to fit each region’s language, regulations, and unique port logistics. IBM Cloud Kubernetes Service offers global coverage in multiple regions, including North America, Europe, Asia, and Australia so that the apps reflected the needs of its partners, in each country.

IoT devices stream data that IBM® Event Streams for IBM Cloud® distributes to the regional port apps and associated Customs and Container manifest data stores. IBM® Event Streams for IBM Cloud® is landing point for IoT events. It distributes the events based on the managed connectivity that the Watson IoT Platform offers to IBM® Event Streams for IBM Cloud®.

After events are in IBM® Event Streams for IBM Cloud®, they're persisted for immediate use in port transit apps and for any point in the future. Apps that require the lowest latency directly consume in real time from the event stream (IBM® Event Streams for IBM Cloud®). Other future apps, such as analytics tools, can choose to consume in a batch mode from the event store with IBM Cloud® Object Storage.

Since shipping data is shared with the customers of the company, the Developers ensure that the customers can use APIs to surface shipping data in their own apps. Examples of those apps are mobile tracking apps or web e-commerce solutions. The Developers are also busy with building and maintaining the regional port apps that gather and disseminate the customs records and shipping manifests. In short, they need to focus on coding instead of managing the infrastructure. Thus, they chose IBM Cloud Kubernetes Service because IBM simplifies infrastructure management.



* Managing Kubernetes master, IaaS, and operational components, such as Ingress and storage
* Monitoring health and recovery for worker nodes
* Providing global compute, so Developers aren't responsible for infrastructure in several regions where they need workloads and data to reside



To achieve global availability, the Development, Test, and Production systems were deployed across the globe in several data centers. For HA, they use a combination of multiple clusters in different geographic regions as well as multizone clusters. They can easily deploy the port app to meet business needs.



* In Frankfort clusters to comply with the local European regulations
1.2.25 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server). 
 1.2.33 IBM Cloud Kubernetes Service can optionally [enable a Kubernetes Key Management Service (KMS) provider](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkms). 
 1.2.34 IBM Cloud Kubernetes Service can optionally [enable a Kubernetes Key Management Service (KMS) provider](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkms). 
 1.3.6 IBM Cloud Kubernetes Service rotates certificates on every worker node reload or update. 
 3.2.1 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server). 
 3.2.2 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server). 
 4.2.6 IBM Cloud Kubernetes Service does not protect kernel defaults to allow customers to [tune kernel parameters](https://cloud.ibm.com/docs/containers?topic=containers-kernel). 
 4.2.8 IBM Cloud Kubernetes Service ensures that the hostname matches the name issued by the infrastructure. 
 4.2.11 IBM Cloud Kubernetes Service rotates certificates on every worker node reload or update. 
 4.2.12 IBM Cloud Kubernetes Service rotates certificates on every worker node reload or update. 
 5.1.2 IBM Cloud Kubernetes Service deploys some system components that could have their Kubernetes secret access further restricted.
* IBM Blockchain Platform is compatible with a Kubernetes cluster on IBM Cloud running Kubernetes v1.24 - v1.26.
* The default storage that is pre-selected for you when you provision a Kubernetes cluster in IBM Cloud is Gold. If you do not want to use the default File Storage that is pre-selected for you when you provision a Kubernetes cluster in IBM Cloud, you can provision storage of your choice. See this topic on [Persistent storage considerations](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-v2-deploy-iksibp-console-storage) to learn more.
* If you decide to include IBM Cloud multi-zone support in your Kubernetes cluster, you must provision your own storage. See [Using Multizone (MZR) clusters with IBM Blockchain Platform](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-v2-deploy-iksibp-console-mzr) for more details.
* Kubernetes clusters that are configured with private VLANs are not supported.







 Video tutorial 

Watch the following [video series](http://ibm.biz/BlockchainPlatformSeries) to learn more about the IBM Blockchain Platform console and how you can get started to deploy IBM Blockchain Platform for IBM Cloud.





 Before you begin 

Before you begin:



* Ensure that you have an [IBM Cloud paid account](https://cloud.ibm.com/catalog/services/blockchain). If you do not have an account:



1. Click the Sign up button.
2. After you create a free trial account, upgrade it to a Pay-As-You-Go type by going to Manage > Billing and Usage > Billing in the IBM Cloud console, and clicking Add Credit Card.
3. Ensure that the user has both Administrator and Manager roles for the Kubernetes cluster that they will link to their blockchain service instance.
Deploy from IBM Cloud 

ATTENTION!! IBM Blockchain Platform SaaS Edition is being replaced by IBM Support for Hyperledger Fabric!! IBM Blockchain Platform SaaS Edition will no longer be supported after July 31, 2023. Customers have been directed to migrate their networks by July 31, 2023. After this date, IBM Blockchain Platform SaaS networks that are not migrated to IBM Support for Hyperledger Fabric will be at risk for potential security vulnerabilities. A migration tool is provided from your console, and the disruption to your network is minimal. See [Migrating to IBM Support for Hyperledger Fabric](https://cloud.ibm.com/docs/blockchain?topic=blockchain-migrating-to-hlf-support) for details.

Learn how to get started with IBM Blockchain Platform for IBM Cloud from the IBM Cloud Catalog.

Target audience: This topic is designed for system administrators who are responsible for setting up a Kubernetes cluster on IBM Cloud and for deploying IBM Blockchain Platform.



 Deploy a Kubernetes cluster on IBM Cloud 

If you don't already have an existing Kubernetes cluster on IBM Cloud in a supported region, you must create one. For information about locations where the IBM Blockchain Platform can be deployed, see [Supported regions](https://cloud.ibm.com/docs/blockchain/reference?topic=blockchain-ibp-regions-locationsibp-regions-locations).

In the Cloud Catalog, find the Kubernetes Service tile and click it. Note that you have two types of Kubernetes clusters you can deploy: an IBM Kubernetes Service cluster or an OpenShift cluster. The IBM Blockchain Platform can be linked to either one. Your choice of cluster will be based on your use case.

For more information about the IBM Kubernetes Service, see [Getting started with IBM Cloud Kubernetes Service](https://cloud.ibm.com/docs/containers?topic=containers-getting-started).
Accessing clusters 

After your IBM Cloud® Kubernetes Service cluster is created, you can begin working with your cluster by accessing the cluster.



 Prerequisites 



1. [Install the required CLI tools](https://cloud.ibm.com/docs/containers?topic=containers-cli-install), including the IBM Cloud CLI, Kubernetes Service plug-in (ibmcloud ks), and Kubernetes CLI (kubectl). For quick access to test features in your cluster, you can also use the [IBM Cloud Shell](https://cloud.ibm.com/docs/containers?topic=containers-cli-install).
2. [Create your IBM Cloud Kubernetes Service cluster](https://cloud.ibm.com/docs/containers?topic=containers-clusters).
3. If your network is protected by a company firewall, [allow access](https://cloud.ibm.com/docs/containers?topic=containers-firewallcorporate) to the IBM Cloud and IBM Cloud Kubernetes Service API endpoints and ports. For private cloud service endpoint-only clusters, you can't test the connection to your cluster until you [configure access to the cloud service endpoint subnet](https://cloud.ibm.com/docs/containers?topic=containers-access_clusteraccess_private_se).
4. Check that your cluster is in a healthy state by running ibmcloud ks cluster get -c <cluster_name_or_ID>. If your cluster is not in a healthy state, review the [Debugging clusters](https://cloud.ibm.com/docs/containers?topic=containers-debug_clusters) guide for help. For example, if your cluster is provisioned in an account that is protected by a firewall gateway appliance, you must [configure your firewall settings to allow outgoing traffic to the appropriate ports and IP addresses](https://cloud.ibm.com/docs/containers?topic=containers-firewall).
5.
For more information about the locations that are returned, see [IBM Cloud Kubernetes Service locations](https://cloud.ibm.com/docs/containers?topic=containers-regions-and-zoneslocations).

ibmcloud ks locations [--output json]

Minimum required permissions
: None

Command options:

--output json
: Optional: Prints the command output in JSON format.





 versions command 

Virtual Private Cloud

Classic infrastructure

List all the container platform versions that are available for IBM Cloud Kubernetes Service clusters. Update your [cluster master](https://cloud.ibm.com/docs/cli?topic=cli-kubernetes-service-clics_cluster_update) and [worker nodes](https://cloud.ibm.com/docs/cli?topic=cli-kubernetes-service-clics_worker_update) to the default version for the latest, stable capabilities.

The kube-versions alias for this command is deprecated.

ibmcloud ks versions [--show-version (KUBERNETES|OPENSHIFT)] [--output json] [-q]

Minimum required permissions
: None

Command options:

--show-version (KUBERNETES|OPENSHIFT)
: Show only the versions for the specified container platform. Supported values are kubernetes or openshift.

--output json
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.

Example:

ibmcloud ks versions





 api command 

Virtual Private Cloud

Classic infrastructure

Target the API endpoint for IBM Cloud Kubernetes Service. If you don't specify an endpoint, you can view information about the current endpoint that is targeted.

Region-specific endpoints are deprecated. Use the [global endpoint](https://cloud.ibm.com/docs/containers?topic=containers-regions-and-zonesendpoint) instead.
3.2.1 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server). 
 3.2.2 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server). 
 4.2.6 IBM Cloud Kubernetes Service does not protect kernel defaults to allow customers to [tune kernel parameters](https://cloud.ibm.com/docs/containers?topic=containers-kernel). 
 4.2.8 IBM Cloud Kubernetes Service ensures that the hostname matches the name issued by the infrastructure. 
 4.2.11 IBM Cloud Kubernetes Service rotates certificates on every worker node reload or update. 
 4.2.12 IBM Cloud Kubernetes Service rotates certificates on every worker node reload or update. 
 5.1.2 IBM Cloud Kubernetes Service deploys some system components that could have their Kubernetes secret access further restricted. 
 5.1.3 IBM Cloud Kubernetes Service deploys some system components that could have their Kubernetes resource access further restricted. 
 5.1.5 IBM Cloud Kubernetes Service does not set [automountServiceAccountToken: false](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/use-the-default-service-account-to-access-the-api-server) for each default service account. 
 5.1.6 IBM Cloud Kubernetes Service deploys some system components that could set [automountServiceAccountToken: false](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/use-the-default-service-account-to-access-the-api-server).
Similar to the previous scenario, in this scenario you allow different IP addresses to access the respective public or private service endpoint for IBM Cloud Kubernetes Service clusters. However, in this scenario, access is further restricted by specific API types for the cluster and management APIs. For more information about the API types, see [Protecting specific APIs](https://cloud.ibm.com/docs/containers?topic=containers-cbr&interface=cliprotect-api-types-cbr).



1. Create four network zones, one for each of the IP addresses you want to allow to access either the public or private cluster APIs or the public or private management APIs. Note that you can include multiple IP addresses or CIDRs, separated by a comma, that you want to allow to access your clusters.

ibmcloud cbr zone-create --addresses 1.2.3.4,12.12.12.0/24 --description "Allowed Public IP Addresses for IKS and ROKS APIs" --name "public-mgmt-zone"

ibmcloud cbr zone-create --addresses 10.20.20.20,10.10.10.0/24 --description "Allowed Private IP Addresses IKS and ROKS APIs" --name "private-mgmt-zone"

ibmcloud cbr zone-create --addresses 11.11.11.0/24 --description "Allowed Public IP Addresses for cluster apiserver" --name "public-cluster-zone"

ibmcloud cbr zone-create --addresses 10.30.30.30 --description "Allowed Private IP Addresses for cluster apiserver" --name "private-cluster-zone"
2. Get the IDs of the zones you created in the previous step.

ibmcloud cbr zones

Example output

OK
id name address_count
c14c0839c13d8aa0afa8383e2be2e124 public-mgmt-zone 2
f9676ca6ef37685315fa254b89d73159 public-cluster-zone 1
Service interface Classic clusters are fully supported in the Kubernetes Service [v1 API](https://containers.cloud.ibm.com/global/swagger-global-api//), [CLI](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-cli), and [console](https://cloud.ibm.com/kubernetes/clusters). 
 Service compliance See the classic section in [What standards does the service comply to?](https://cloud.ibm.com/docs/openshift?topic=openshift-faqsstandards). 
 Service limitations See [Service limitations](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_limitationstech_limits). Feature-specific limitations are documented by section. 







 Troubleshooting and support 

Classic, VPC, and Satellite clusters are supported through the same IBM Cloud Support processes.



* For cluster issues, check out the [Debugging your clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-debug_clusters) guide.
* For Satellite-specific issues, see [Troubleshooting errors](https://cloud.ibm.com/docs/satellite?topic=satellite-sitemap&interface=clisitemap_troubleshooting_errors).
* For VPC-specific topics. For questions, try posting in the [Slack channel](https://cloud.ibm.com/kubernetes/slack).
In addition, you can choose to enable the public cloud service endpoint by using the --public-service-endpoint option to access your cluster over the internet. If you enable the private cloud service endpoint only, you must be connected to the private VLAN to communicate with your Kubernetes master. After you enable a private cloud service endpoint, you can't later disable it. After you create the cluster, you can get the endpoint by running ibmcloud ks cluster get --cluster <cluster_name_or_ID>.

--public-service-endpoint
: Enable the [public cloud service endpoint](https://cloud.ibm.com/docs/containers?topic=containers-plan_basicsworkeruser-master) so that your Kubernetes master can be accessed over the public network, for example to run kubectl commands from your command line. If you have an [account that is enabled with VRF and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint) and also include the --private-service-endpoint option, master-worker node communication goes over the private and the public network. You can later disable the public cloud service endpoint if you want a private-only cluster. After you create the cluster, you can get the endpoint by running ibmcloud ks cluster get --cluster <cluster_name_or_ID>.

--workers WORKER
: Optional: Specify the number of worker nodes to include in the cluster. If you don't specify this option, a cluster with the minimum value of 1 is created. For more information, see [What is the smallest size cluster that I can make?](https://cloud.ibm.com/docs/containers?topic=containers-faqssmallest_cluster). If you create a cluster with only one worker node per zone, you might experience issues with Ingress. For high availability, create a cluster with at least two workers per zone. Every worker node is assigned a unique worker node ID and domain name that must not be manually changed after the cluster is created.