vania-janet/multiturn-rag-retrieval-data huggingface dataset:
For example, to access your cluster's private cloud service endpoint, you must connect to your IBM Cloud classic network or your VPC network through a VPN or IBM Cloud Direct Link. You can add the subnet for the VPN or Direct Link tunnel so that only authorized users in your organization can access the private cloud service endpoint from that subnet.

A private cloud service endpoint allowlist can also help prevent users from accessing your cluster after their authorization is revoked. When a user leaves your organization, you remove their IBM Cloud IAM permissions that grant them access to the cluster. However, the user might have copied the API key that contains a functional ID's credentials, which contain the necessary IAM permissions for your cluster. That user can still use those credentials and the private cloud service endpoint address to access your cluster from a different subnet, such as from a different IBM Cloud account. If you create an allowlist that includes only the subnets for your VPN tunnel in your organization's IBM Cloud account, the user's attempted access from another IBM Cloud account is denied.

Worker node subnets are automatically added to and removed from your allowlist so that worker nodes can always access the master through the private cloud service endpoint.

By default, private cloud service endpoint allowlists are limited to 20 subnets. If you need more than 20 subnets in your allowlist, you can [open a support ticket](https://cloud.ibm.com/docs/containers?topic=containers-get-helphelp-support) to increase the limit to 75.

If the public cloud service endpoint is enabled for your cluster, authorized requests are still permitted through the public cloud service endpoint. Therefore, the private cloud service endpoint allowlist is most effective for controlling access to clusters that have only the private cloud service endpoint enabled.

Before you begin:



* [Access your cluster through the private cloud service endpoint](https://cloud.ibm.com/docs/containers?topic=containers-access_clusteraccess_private_se).
* [Grant users access to your cluster through IBM Cloud IAM](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-perms).
From the Role drop-down list, select the [Object Storage access role](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-iamiam-roles) for the actions that you want storage users in your cluster to have access to. You must select at least Writer service access role to use the auto-create-bucket dynamic provisioning feature. If you select Reader, then you can't use the credentials to create buckets in IBM Cloud Object Storage and write data to it.
5. Optional: In Add Inline Configuration Parameters (Optional), enter {"HMAC":true} to create more HMAC credentials for the IBM Cloud Object Storage service. HMAC authentication adds an extra layer of security to the OAuth2 authentication by preventing the misuse of expired or randomly created OAuth2 tokens.
6. Click Add. Your new credentials are in the Service Credentials table.
7. Click View credentials.
8. Make note of the apikey to use OAuth2 tokens to authenticate with the IBM Cloud Object Storage service. For HMAC authentication, in the cos_hmac_keys section, note the access_key_id and the secret_access_key.
9. [Store your service credentials in a Kubernetes secret inside the cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-storage-cos-understandcreate_cos_secret) to enable access to your IBM Cloud Object Storage service instance.







 Creating a secret for the object storage service credentials 

To access your IBM Cloud Object Storage service instance to read and write data, you must securely store the service credentials in a Kubernetes secret. The IBM Cloud Object Storage plug-in uses these credentials for every read or write operation to your bucket.

Follow these steps to create a Kubernetes secret for the credentials of an IBM Cloud Object Storage service instance. If you plan to use a local Cloud Object Storage server or a different s3 API endpoint, create a Kubernetes secret with the appropriate credentials.

Before you begin:
To deploy apps, the user and service accounts must all be authorized by the pod security policies that are required to deploy pods.

Trying to control which users have access to the IBM Cloud Kubernetes Service? See [Assigning cluster access](https://cloud.ibm.com/docs/containers?topic=containers-usersusers) to set IBM Cloud IAM and infrastructure permissions.





 Are any policies set by default? What can I add? 

By default, IBM Cloud Kubernetes Service configures the PodSecurityPolicy admission controller with [resources for IBM cluster management](https://cloud.ibm.com/docs/containers?topic=containers-pspibm_psp) that you can't delete or modify. You also can't disable the admission controller.

Pod actions are not locked down by default. Instead, two role-based access control (RBAC) resources in the cluster authorize all administrators, users, services, and nodes to create privileged and unprivileged pods. Additional RBAC resources are included for portability with IBM Cloud Private packages that are used for hybrid deployments.

If you want to prevent certain users from creating or updating pods, you can [modify these RBAC resources or create your own](https://cloud.ibm.com/docs/containers?topic=containers-pspcustomize_psp).





 How does policy authorization work? 

When you as a user create a pod directly and not by using a controller such as a deployment, your credentials are validated against the pod security policies that you are authorized to use. If no policy supports the pod security requirements, the pod is not created.

When you create a pod by using a resource controller such as a deployment, Kubernetes validates the pod's service account credentials against the pod security policies that the service account is authorized to use. If no policy supports the pod security requirements, the controller succeeds, but the pod is not created.

For common error messages, see [Pods fail to deploy because of a pod security policy](https://cloud.ibm.com/docs/containers?topic=containers-psp).
Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)
7. Create the secret in your cluster.

kubectl apply -f ibm-cloud-credentials.yaml
8. Restart the driver pods by disabling and re-enabling the add-on.



1. Disable the add-on.

ibmcloud ks cluster addon disable vpc-block-csi-driver
2. Re-enable the add-on.

ibmcloud ks cluster addon enable vpc-block-csi-driver --cluster CLUSTER --version VERSION







 Automatically creating a secret by using a Shell script 



1. Save the following script to a file called generate-secret.sh.

!/bin/bash

IBMCLOUD_AUTHTYPE=
SECRET=

error() {
if [! $? = 0 ]]; then
echo $1; exit 1
fi
}

validate_options validates the options provided to the script
validate_options() {
if [ "$" -eq 1 ]]; then
if [ "$1" == "-h" ]] || [ "$1" == "--help" ]]; then
usage; exit 1
fi
fi

number of options provided to the script must be 2
if [ "$" -ne 2 ]]; then
echo "Invalid number of options provided"
usage; exit 1
fi

1st option must be 'iam' or 'pod-identity'
if [! "$1" = "iam" ]] && [! "$1" = "pod-identity" ]]; then
echo "Provide a valid auth-type"
usage; exit 1
fi

IBMCLOUD_AUTHTYPE=$1
SECRET=$2
}

usage - prints the usage for execution of script
usage() {
echo "USAGE:
Granting Satellite Config access to your clusters 

By default, clusters that you create in a Satellite location have Satellite Config components automatically installed. However, you must grant the service accounts that Satellite Config uses the appropriate access to view and manage Kubernetes resources in each cluster.

Satellite Config requires admin access to your clusters to manage them. You can configure access in one of the following ways.



* Automatically during cluster creation. Choose this option if you want to use Satellite storage templates.
* Manually after cluster creation. Choose this option if you want more controlled access and do not plan on using Satellite storage templates.



If you do not grant Satellite Config access, you cannot later use the Satellite Config functionality to view or deploy Kubernetes resources for your clusters.



 Automatically granting Satellite Config access to your clusters 

You can give Satellite Config access to your cluster by specifying the relevant option when you create the cluster.

To give Satellite Config access to manage Kubernetes resources from the console, select Enable cluster admin access for Satellite Config when you create the cluster. To set up access with the CLI, specify the --enable-config-admin option when you create the cluster.

If you didn't give Satellite Config access at cluster creation time, follow the steps in [Manually granting Satellite Config access to your clusters](https://cloud.ibm.com/docs/satellite?topic=satellite-setup-clusters-satconfigmanual-setup-clusters-satconfig).





 Manually granting Satellite Config access to your clusters 

If you did not grant Satellite Config access to your cluster during cluster creation time, you can still set up the access manually.

Choose from the following options.



* Admin access when you create a Satellite cluster: You can enable admin permissions when you create the cluster in the console or in the CLI by using the --enable-config-admin option in the ibmcloud oc cluster create satellite command. After creating the cluster, you must perform a one-time login by running ibmcloud ks cluster config in the command line.
Then, you use the ibmcloud oc cluster service bind[command](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_cluster_service_bind) to create the service credentials and the Kubernetes secret. The Kubernetes secret is automatically encrypted in etcd to protect your data.

Want to make your secrets even more secured? Ask your cluster admin to [enable a key management service provider](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionkeyprotect) in your cluster to encrypt new and existing secrets, such as the secret that stores the credentials of your IBM Cloud service instances.





 I already have an IBM Cloud service. Can I still use IBM Cloud service binding? 

Yes, you can use services that meet naming requirements and reuse the service credentials.



* Naming: Make sure that the service name is in the following regex format. Example permitted names are myservice or example.com. Characters that are not allowed include spaces and underscores.

[a-z0-9]([-a-z0-9][a-z0-9])?(.[a-z0-9]([-a-z0-9][a-z0-9])?)
* Service credentials: To use your existing service credentials, specify the --key option in the ibmcloud oc cluster service bind command and provide the name of your service credentials. IBM Cloud service binding automatically creates a Kubernetes secret with your existing service credentials.







 What if I want to use service credentials that use the private cloud service endpoint? 

By default, the ibmcloud oc cluster service bind command creates service credentials with the public cloud service endpoint. To use the private cloud service endpoint, you must manually create service credentials for your service that use the private cloud service endpoint, and then use the --key option to specify the name of the existing service credentials.

Your service might not yet support private cloud service endpoints.





 Can I use all IBM Cloud services in my cluster?
* UI
* CLI
* API







 Protecting IBM Cloud Kubernetes Service resources with context-based restrictions 

Context-based restrictions give account owners and administrators the ability to define and enforce access restrictions for IBM Cloud® resources based on the context of access requests. Access to IBM Cloud Kubernetes Service resources can be controlled with context-based restrictions and identity and access management policies.

These restrictions work with traditional IAM policies, which are based on identity, to provide an extra layer of protection. Unlike IAM policies, context-based restrictions don't assign access. Context-based restrictions check that an access request comes from an allowed context that you configure. Since both IAM access and context-based restrictions enforce access, context-based restrictions offer protection even in the face of compromised or mismanaged credentials. For more information, see [What are context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-whatis).

A user must have the Administrator role on the IBM Cloud Kubernetes Service service to create, update, or delete rules. And a user must have either the Editor or Administrator role on the Context-based restrictions service to create, update, or delete network zones.

Any Activity Tracker or audit log events generated come from the context-based restrictions service, and not IBM Cloud Kubernetes Service. For more information, see [Monitoring context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-cbr-monitor).

Attempts to access the cluster control plane, which can be restricted by using the Cluster API type, do not generate Activity Tracker or audit log events.



 How IBM Cloud Kubernetes Service integrates with context-based restrictions 

You can create context-based restrictions (CBR) for IBM Cloud Kubernetes Service resources or for specific APIs. With Context-based restrictions, you can protect the following resources.

Protect IBM Cloud Kubernetes Service resources
: [Restrict access to clusters, resource groups, or regions](https://cloud.ibm.com/docs/containers?topic=containers-cbr&interface=cliresources-types-cbr).
ibmcloud ks cluster master private-service-endpoint allowlist get --cluster CLUSTER [-q]

Minimum required permissions
: Viewer platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

-q
: Optional: Do not show the message of the day or update reminders.



 Example cluster master private-service-endpoint allowlist get command 

ibmcloud ks cluster master private-service-endpoint allowlist get --cluster mycluster







 ibmcloud ks cluster master private-service-endpoint allowlist rm 

Virtual Private Cloud

Classic infrastructure

Remove subnets that you previously added to the allowlist for a cluster's private cloud service endpoint.

After a subnet is removed, any requests that originate from this subnet to the cluster master through the private cloud service endpoint are denied.

ibmcloud ks cluster master private-service-endpoint allowlist rm --cluster CLUSTER --subnet SUBNET [--subnet SUBNET ...] [-q]

Minimum required permissions
: Editor platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

--subnet SUBNET
: Required: The subnet CIDR. Specify more than one subnet by using multiple repeated options.

-f
: Optional: Force the command to run without user prompts.

-q
: Optional: Do not show the message of the day or update reminders.







 Example cluster master private-service-endpoint allowlist rm command 

ibmcloud ks cluster master private-service-endpoint allowlist rm --cluster mycluster
--subnet 1.1.1.1/16





 ibmcloud ks cluster master private-service-endpoint disable 

Classic infrastructure

Disable the [private cloud service endpoint](https://cloud.ibm.com/docs/containers?topic=containers-plan_basicsworkeruser-master) to remove private accessibility to your cluster master.
ibmcloud ks cluster master private-service-endpoint allowlist get --cluster CLUSTER [-q]

Minimum required permissions
: Viewer platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

-q
: Optional: Do not show the message of the day or update reminders.



 Example cluster master private-service-endpoint allowlist get command 

ibmcloud ks cluster master private-service-endpoint allowlist get --cluster mycluster







 ibmcloud ks cluster master private-service-endpoint allowlist rm 

Virtual Private Cloud

Classic infrastructure

Remove subnets that you previously added to the allowlist for a cluster's private cloud service endpoint.

After a subnet is removed, any requests that originate from this subnet to the cluster master through the private cloud service endpoint are denied.

ibmcloud ks cluster master private-service-endpoint allowlist rm --cluster CLUSTER --subnet SUBNET [--subnet SUBNET ...] [-q]

Minimum required permissions
: Editor platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

--subnet SUBNET
: Required: The subnet CIDR. Specify more than one subnet by using multiple repeated options.

-f
: Optional: Force the command to run without user prompts.

-q
: Optional: Do not show the message of the day or update reminders.



 Example cluster master private-service-endpoint allowlist rm command 

ibmcloud ks cluster master private-service-endpoint allowlist rm --cluster mycluster
--subnet 1.1.1.1/16









 ibmcloud ks cluster master private-service-endpoint disable 

Classic infrastructure

Disable the [private cloud service endpoint](https://cloud.ibm.com/docs/containers?topic=containers-plan_basicsworkeruser-master) to remove private accessibility to your cluster master.
* UI
* CLI
* API







 Protecting IBM Cloud Kubernetes Service resources with context-based restrictions 

Context-based restrictions give account owners and administrators the ability to define and enforce access restrictions for IBM Cloud® resources based on the context of access requests. Access to IBM Cloud Kubernetes Service resources can be controlled with context-based restrictions and identity and access management policies.

These restrictions work with traditional IAM policies, which are based on identity, to provide an extra layer of protection. Unlike IAM policies, context-based restrictions don't assign access. Context-based restrictions check that an access request comes from an allowed context that you configure. Since both IAM access and context-based restrictions enforce access, context-based restrictions offer protection even in the face of compromised or mismanaged credentials. For more information, see [What are context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-whatis).

A user must have the Administrator role on the IBM Cloud Kubernetes Service service to create, update, or delete rules. And a user must have either the Editor or Administrator role on the Context-based restrictions service to create, update, or delete network zones.

Any Activity Tracker or audit log events generated come from the context-based restrictions service, and not IBM Cloud Kubernetes Service. For more information, see [Monitoring context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-cbr-monitor).

Attempts to access the cluster control plane, which can be restricted by using the Cluster API type, do not generate Activity Tracker or audit log events.



 How IBM Cloud Kubernetes Service integrates with context-based restrictions 

You can create context-based restrictions (CBR) for IBM Cloud Kubernetes Service resources or for specific APIs. With Context-based restrictions, you can protect the following resources.

Protect IBM Cloud Kubernetes Service resources
: [Restrict access to clusters, resource groups, or regions](https://cloud.ibm.com/docs/containers?topic=containers-cbr&interface=uiresources-types-cbr).
* UI
* CLI
* API







 Protecting IBM Cloud Kubernetes Service resources with context-based restrictions 

Context-based restrictions give account owners and administrators the ability to define and enforce access restrictions for IBM Cloud® resources based on the context of access requests. Access to IBM Cloud Kubernetes Service resources can be controlled with context-based restrictions and identity and access management policies.

These restrictions work with traditional IAM policies, which are based on identity, to provide an extra layer of protection. Unlike IAM policies, context-based restrictions don't assign access. Context-based restrictions check that an access request comes from an allowed context that you configure. Since both IAM access and context-based restrictions enforce access, context-based restrictions offer protection even in the face of compromised or mismanaged credentials. For more information, see [What are context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-whatis).

A user must have the Administrator role on the IBM Cloud Kubernetes Service service to create, update, or delete rules. And a user must have either the Editor or Administrator role on the Context-based restrictions service to create, update, or delete network zones.

Any Activity Tracker or audit log events generated come from the context-based restrictions service, and not IBM Cloud Kubernetes Service. For more information, see [Monitoring context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-cbr-monitor).

Attempts to access the cluster control plane, which can be restricted by using the Cluster API type, do not generate Activity Tracker or audit log events.



 How IBM Cloud Kubernetes Service integrates with context-based restrictions 

You can create context-based restrictions (CBR) for IBM Cloud Kubernetes Service resources or for specific APIs. With Context-based restrictions, you can protect the following resources.

Protect IBM Cloud Kubernetes Service resources
: [Restrict access to clusters, resource groups, or regions](https://cloud.ibm.com/docs/containers?topic=containers-cbrresources-types-cbr).
* Service access roles: Determine the [Kubernetes RBAC role](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) that is assigned to the user and the actions that a user can run against the Kubernetes API server. With RBAC roles, users can create Kubernetes resources, such as app deployments, namespaces, or configmaps. For more information about the corresponding RBAC roles that are assigned to a user and associated permissions, see [IBM Cloud IAM service access roles](https://cloud.ibm.com/docs/containers?topic=containers-iam-service-access-roles).
* Classic infrastructure: Enables access to your classic IBM Cloud infrastructure resources. Example actions that are permitted by classic infrastructure roles are viewing the details of cluster worker node machines or editing networking and storage resources.
* VPC infrastructure: Enables access to VPC infrastructure resources. Example actions that are permitted by VPC infrastructure roles are creating a VPC, adding subnets, changing floating IP addresses, and creating VPC Block Storage instances.



For more information about access control in a cluster, see [Assigning cluster access](https://cloud.ibm.com/docs/openshift?topic=openshift-users).

Pod access via service account token
: For clusters that run Kubernetes 1.21 and later, the service account tokens that pods use to communicate with the Kubernetes API server are time-limited, automatically refreshed, scoped to a particular audience of users (the pod), and invalidated after the pod is deleted. To continue communicating with the API server, you must design your apps to read the refreshed token value on a regular basis, such as every minute. For more information, see [Bound Service Account Tokens](https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/1205-bound-service-account-tokens/README.md).

Admission controllers
: Admission controllers are implemented for specific features in Kubernetes and IBM Cloud Kubernetes Service.