vania-janet/multiturn-rag-retrieval-data huggingface dataset:
For example, a subdomain that you create for an NLB might look like mycluster-a1b2cdef345678g9hi012j3kl4567890-0001.us-south.containers.appdomain.cloud. The following table describes each component of the subdomain.



Table 1. Understanding the NLB subdomain format

 NLB subdomain component Description 

 * The wildcard for the subdomain is registered by default for your cluster. 
 <cluster_name> The name of your cluster. - If the cluster name is 26 characters or fewer and the cluster name is unique in this region, the entire cluster name is included and is not modified: myclustername.<br><br><br><br> * If the cluster name is 26 characters or fewer and there is an existing cluster of the same name in this region, the entire cluster name is included and a dash with six random characters is added: myclustername-ABC123.<br> * If the cluster name is 26 characters or greater and the cluster name is unique in this region, only the first 24 characters of the cluster name are used: myveryverylongclusternam.<br> * If the cluster name is 26 characters or greater and there is an existing cluster of the same name in this region, only the first 17 characters of the cluster name are used and a dash with six random characters is added: myveryverylongclu-ABC123.<br><br><br> 
 <globally_unique_account_HASH> A globally unique HASH is created for your IBM Cloud account. All subdomains that you create for NLBs in clusters in your account use this globally unique HASH. 
 0001 The first and second characters indicate a public or a private (internal) subdomain.
GET/v1/subnets/vlan-spanning View the VLAN spanning status. containers-kubernetes.cluster.read N/A 
 GET/v1/user-config View a user's ability to create clusters in a region and resource group. containers-kubernetes.cluster.read N/A 
 GET/v1/versions List available Red Hat OpenShift on IBM Cloud versions. containers-kubernetes.cluster.read N/A 
 GET/v1/zones List available zones (data centers). N/A N/A 
 GET/v2/getMessages View the current user messages. N/A N/A 
 GET/v2/getQuota View the quota for resources per region in the account. containers-kubernetes.cluster.read N/A 
 GET/v2/getVersions List available Red Hat OpenShift on IBM Cloud versions. containers-kubernetes.cluster.read N/A 
 GET/v2/vpc/getZones List available zones in a region. N/A N/A 
 POST/v1/credentials Set IBM Cloud infrastructure account credentials for your Red Hat OpenShift on IBM Cloud account. containers-kubernetes.cluster.create N/A 
 POST/v1/keys Reset the IAM API key. containers-kubernetes.cluster.create N/A 







 Certificate authority 



Cluster CA certificate API methods, IAM actions, and Activity Tracker events.

 API Method Description IAM action for the API Event sent to Activity Tracker 

 GET/v2/getCACert Get the cluster's CA certificate. containers-kubernetes.cluster.view cluster-ca-certificate.get 
 POST/v2/rotateCACert Rotate the cluster's CA certificate. containers-kubernetes.cluster.create cluster-ca-certificate.rotate 
 POST/v2/createCA Create a CA certificate. cluster-ca-certificate.create containers-kubernetes.cluster.create 







 Cluster
* [Multizone cluster](https://cloud.ibm.com/docs/containers?topic=containers-ha_clustersmz-clusters)



* [Why do I need worker nodes in three zones?](https://cloud.ibm.com/docs/containers?topic=containers-ha_clustersmz-cluster-zones)
* [How is my IBM Cloud Kubernetes Service master set up?](https://cloud.ibm.com/docs/containers?topic=containers-ha_clustersmz-master-setup)
* [Do I have to do anything so that the master can communicate with the workers across zones?](https://cloud.ibm.com/docs/containers?topic=containers-ha_clustersmz-master-communication)
* [Can I convert my single zone cluster to a multizone cluster?](https://cloud.ibm.com/docs/containers?topic=containers-ha_clustersconvert-sz-to-mz)
* [Do my apps automatically spread across zones?](https://cloud.ibm.com/docs/containers?topic=containers-ha_clustersmultizone-apps-faq)



* [Multiple public clusters connected with a global load balancer](https://cloud.ibm.com/docs/containers?topic=containers-ha_clustersmultiple-clusters-glb)



* [Why do I need 3 clusters in three zones?](https://cloud.ibm.com/docs/containers?topic=containers-ha_clustersmulticluster-three-zones)
* [What if I want to set up multiple clusters across regions?](https://cloud.ibm.com/docs/containers?topic=containers-ha_clustersmultiple-regions-setup)
* [What options do I have to load balance workloads across multiple clusters?](https://cloud.ibm.com/docs/containers?topic=containers-ha_clustersmultiple-cluster-lb-options)
* [Public sector or health use cases for Satellite](https://cloud.ibm.com/docs/satellite?topic=satellite-use-caseuse-case-health)



* [On-premises service platform](https://cloud.ibm.com/docs/satellite?topic=satellite-use-caseuse-case-health1)



* [Communications use cases for Satellite](https://cloud.ibm.com/docs/satellite?topic=satellite-use-caseuse-case-communications)



* [Multi-access edge computing (MEC) platform support service](https://cloud.ibm.com/docs/satellite?topic=satellite-use-caseuse-case-communications1)



* [Utilities use cases for Satellite](https://cloud.ibm.com/docs/satellite?topic=satellite-use-caseuse-case-utilities)



* [Expanding the use of smart meters with Satellite](https://cloud.ibm.com/docs/satellite?topic=satellite-use-caseuse-case-utilities1)





[Satellite for resellers](https://cloud.ibm.com/docs/satellite?topic=satellite-tenancy-modeltenancy-model)



* [Account overview](https://cloud.ibm.com/docs/satellite?topic=satellite-tenancy-modeltenancy-account-overview)
* [Managing client locations and clusters](https://cloud.ibm.com/docs/satellite?topic=satellite-tenancy-modellocation-mgmt-tenancy)
* [Understanding responsibilities for your enterprise and your clients](https://cloud.ibm.com/docs/satellite?topic=satellite-tenancy-modelresponsibilities-tenancy)
* [Setting up your account](https://cloud.ibm.com/docs/satellite?topic=satellite-tenancy-modelaccount-setup-tenancy)



* [Creating an enterprise account](https://cloud.ibm.com/docs/satellite?topic=satellite-tenancy-modelcreate-enterprise-tenancy)
You can create context-based restrictions (CBR) for IBM Cloud Kubernetes Service resources or for specific APIs. With Context-based restrictions, you can protect the following resources.

Protect IBM Cloud Kubernetes Service resources
: [Restrict access to clusters, resource groups, or regions](https://cloud.ibm.com/docs/containers?topic=containers-cbr&interface=uiresources-types-cbr).

Protect specific APIs
: Restrict accessing to provisioning and managing clusters and workers. Or, restrict access to Kubernetes APIs such as viewing pods and nodes. For more information, see [Protecting specific APIs](https://cloud.ibm.com/docs/containers?topic=containers-cbr&interface=uiprotect-api-types-cbr).

Applications running on IBM Cloud Kubernetes Service clusters, for example web servers exposed by a Kubernetes LoadBalancer are not restricted by CBR rules.



 Protecting IBM Cloud Kubernetes Service resources 

You can create CBR rules to protect specific regions, and clusters.

Cluster
: Protects a specific IBM Cloud Kubernetes Service cluster. If you select a cluster in your CBR rule, only traffic from resources in the network zones that you associate with the rule can interact with that cluster.
: If you use the CLI, you can specify the --service-instance CLUSTER-ID option to protect a specific cluster.
: If you use the API, you can specify "name": "serviceInstance","value": "CLUSTER-ID" in the resource attributes.

Region
: Protects IBM Cloud Kubernetes Service resources in a specific region. If you select a region in your CBR rule, then only traffic from resources in the network zones that you associate with the rule can interact with resources in that region.
: If you use the CLI, you can specify the --region REGION option to protect resources in a specific region.
: If you use the API, you can specify "name": "region","value": "REGION" field in the resource attributes.

Resource group
For more information, see [Checking user permissions](https://cloud.ibm.com/docs/satellite?topic=satellite-iam-assign-accesschecking-perms).





 Command options 

--cluster CLUSTER
: Optional. The name or ID of the registered cluster that the Kubernetes resource runs in. To list registered clusters, run ibmcloud sat cluster ls.

--limit NUMBER
: Optional. Limit the number of Kubernetes resources that are returned.

--search STRING
: Optional. A string to filter results by, such as the name of a pod, namespace, or other string.

-q
: Optional. Do not show the message of the day or update reminders.





 Example 

ibmcloud sat resource ls









 Service commands 

Use these commands to view the Satellite-enabled IBM Cloud service clusters that are deployed to your Satellite location.



 ibmcloud sat service ls 

List all Satellite-enabled IBM Cloud service clusters in your location to review details such as requested host resources. For more information about how Satellite-enabled IBM Cloud service clusters request resources, see [Using host auto assignment](https://cloud.ibm.com/docs/satellite?topic=satellite-assigning-hostshost-autoassign-ov).

ibmcloud sat service ls --location LOCATION [--output OUTPUT] [-q]



 Minimum required permissions 

IBM Cloud IAM Viewer platform role for the Cluster resource in Satellite. For more information, see [Checking user permissions](https://cloud.ibm.com/docs/satellite?topic=satellite-iam-assign-accesschecking-perms).





 Command options 

--location LOCATION
: Required. Enter the ID or name of the location where the Satellite-enabled IBM Cloud service clusters exist. To retrieve the location ID or name, run ibmcloud sat location ls.

--output JSON
: Optional. Displays the command output in JSON format.

-q
: Optional. Do not show the message of the day or update reminders.





 Example
Cluster
: ClI option: --service-instance
: You can limit the policy to a single cluster. To list your cluster IDs, run ibmcloud ks cluster ls. Note that if you assign a user the Administrator platform access role for only one cluster, you must also assign the user the Viewer platform access role for all clusters in the region within the resource group.

Region
: ClI option: --region
: You can scope the policy to apply to clusters within a particular region. If you don't specify a region or specific cluster ID, the policy applies to all clusters for all regions. To list available regions, review the [previous region](https://cloud.ibm.com/docs/containers?topic=containers-regions-and-zoneszones-mz) column in the IBM Cloud Kubernetes Service locations table.

Role
: ClI option: --role
: Choose the [platform access role](https://cloud.ibm.com/docs/containers?topic=containers-iam-platform-access-roles) that you want to assign. Possible values are: Administrator, Operator, Editor, or Viewer.



1. Assign the platform access for the user.



* Assign an individual user the Viewer platform access role to one cluster in the default resource group and US East region:

ibmcloud iam user-policy-create user@email.com --resource-group-name default --service-name containers-kubernetes --region us-east --service-instance clusterID-1111aa2b2bb22bb3333c3c4444dd4ee5 --roles Viewer
* Assign an individual user Administrator platform access to all clusters in a HR resource group:

ibmcloud iam user-policy-create user@email.com --resource-group-name HR --service-name containers-kubernetes [--region <region>] --roles Administrator
* Assign an auditors group of users the Viewer platform access role to all clusters in all resource groups:

ibmcloud iam access-group-policy-create auditors --service-name containers-kubernetes --roles Viewer



2.
[Creating classic clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-cluster-create-classiccluster-create-classic)



* [Creating a classic cluster in the console](https://cloud.ibm.com/docs/openshift?topic=openshift-cluster-create-classicclusters_ui)
* [Creating a standard classic cluster in the CLI](https://cloud.ibm.com/docs/openshift?topic=openshift-cluster-create-classicclusters_cli_steps)
* [Example commands to create classic clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-cluster-create-classiccluster_create_classic)
* [Creating a single-zone classic cluster with Terraform](https://cloud.ibm.com/docs/openshift?topic=openshift-cluster-create-classiccluster_classic_tf)



[Creating VPC clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-cluster-create-vpc-gen2cluster-create-vpc-gen2)



* [Prerequisites and notes](https://cloud.ibm.com/docs/openshift?topic=openshift-cluster-create-vpc-gen2cluster-create-vpc-prereq)
* [Creating a VPC cluster in the console](https://cloud.ibm.com/docs/openshift?topic=openshift-cluster-create-vpc-gen2clusters_vpcg2_ui)
* [Creating VPC clusters from the CLI](https://cloud.ibm.com/docs/openshift?topic=openshift-cluster-create-vpc-gen2cluster_vpcg2_cli)
Cluster states 

You can view the current cluster state by running the ibmcloud ks cluster ls command and locating the State field.



 Aborted 

Review the following description of the Aborted cluster state. To view the state of your cluster, run ibmcloud ks cluster get --cluster <cluster_name_or_ID>.

You sent a delete request before the Kubernetes master deployment completed. After your cluster is deleted, it is removed from your dashboard. If your cluster is stuck in this state for a long time, open an [IBM Cloud support case](https://cloud.ibm.com/docs/containers?topic=containers-get-help).





 Critical 

Review the following description of the Critical cluster state. To view the state of your cluster, run ibmcloud ks cluster get --cluster <cluster_name_or_ID>.

The Kubernetes master can't be reached or all worker nodes in the cluster are down. If you enabled IBM Key Protect in your cluster, the Key Protect container might fail to encrypt or decrypt your cluster secrets. If so, you can view an error with more information when you run kubectl get secrets.





 Create failed 

Review the following description of the Create failed cluster state. To view the state of your cluster, run ibmcloud ks cluster get --cluster <cluster_name_or_ID>.

The cluster cannot be created. Delete the failed cluster and try to create another one. If the issue persists when creating additional clusters, open an [IBM Cloud support case](https://cloud.ibm.com/docs/containers?topic=containers-get-help).





 Delete failed 

Review the following description of the Delete failed cluster state. To view the state of your cluster, run ibmcloud ks cluster get --cluster <cluster_name_or_ID>.

The Kubernetes master or at least one worker node can't be deleted. List worker nodes by running ibmcloud ks worker ls --cluster <cluster_name_or_ID>.
Why can't I view or work with my cluster? 

Virtual Private Cloud

Classic infrastructure

 What’s happening 

You are not able to find a cluster. When you run ibmcloud ks cluster ls, the cluster is not listed in the output.

Or, you are not able to work with a cluster. When you run ibmcloud ks cluster config or other cluster-specific commands, the cluster is not found.

 Why it’s happening 

In IBM Cloud, each resource must be in a resource group. For example, cluster mycluster might exist in the default resource group.

When the account owner gives you access to resources by assigning you an IBM Cloud IAM platform access role, the access can be to a specific resource or to the resource group. When you are given access to a specific resource, you don't have access to the resource group. In this case, you don't need to target a resource group to work with the clusters you have access to. If you target a different resource group than the group that the cluster is in, actions against that cluster can fail. Conversely, when you are given access to a resource as part of your access to a resource group, you must target a resource group to work with a cluster in that group. If you don't target your CLI session to the resource group that the cluster is in, actions against that cluster can fail.

If you can't find or work with a cluster, you might be experiencing one of the following issues:



* You have access to the cluster and the resource group that the cluster is in, but your CLI session is not targeted to the resource group that the cluster is in.
* You have access to the cluster, but not as part of the resource group that the cluster is in. Your CLI session is targeted to this or another resource group.
* You don't have access to the cluster.



 How to fix it 

To check your user access permissions:



1. List all your user permissions.

ibmcloud iam user-policies <your_user_name>
2. Check if you have access to the cluster and to the resource group that the cluster is in.



1.
* [Manage your IBM CIS for optimal security](https://cloud.ibm.com/docs/cis?topic=cis-manage-your-ibm-cis-for-optimal-securitymanage-your-ibm-cis-for-optimal-security)
* [Kubernetes Service](https://cloud.ibm.com/docs/containers)
* [Building containers from images](https://cloud.ibm.com/docs/containers?topic=containers-images)
* [Best practice to secure traffic and internet application via CIS](https://cloud.ibm.com/docs/cis?topic=cis-manage-your-ibm-cis-for-optimal-securitybest-practice-configure-security-level-selectively)
* [Improving App Availability with Multizone Clusters](https://www.ibm.com/cloud/blog/announcements/improving-app-availability-multizone-clusters)
Procedure to delete clusters from vCenter Server instances 



1. From the IBM Cloud for VMware Solutions console, click Resources > vCenter Server from the left navigation pane.
2. In the vCenter Server table, click the instance that you want to delete clusters from.

Ensure that the instance status is Available. Otherwise, you can't delete clusters from the instance.
3. Click the Infrastructure tab. In the Clusters table, locate the cluster that you want to delete and click the Delete icon ![Delete icon](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/icons/delete.svg) next to the Status column.
4. In the Delete cluster window, confirm that you completed the migration of VMs to other clusters, if needed, and that you want to delete the cluster. Click Delete.







 Related links 



* [Viewing vCenter Server instances](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_viewinginstances)
* [Expanding and contracting capacity for vCenter Server instances](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_addingservers)
-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

--output json
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.



 Example api-key info command 

ibmcloud ks api-key info --cluster my_cluster







 ibmcloud ks api-key reset 

Virtual Private Cloud

Classic infrastructure

Create an IBM Cloud IAM API key that impersonates the user's permissions to authenticate requests for all clusters in the current resource group and region. For more information, see [Understanding how the API key works](https://cloud.ibm.com/docs/containers?topic=containers-access-credsapi_key_about).

If you use the Block Storage for VPC or cluster autoscaler add-ons in your cluster, you must re-create the add-on controller pods after you reset your API key. For more information, see [Block Storage for VPC PVC creation fails after API key reset](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-block-api-key-reset-ts) and [Autoscaling fails after API key reset](https://cloud.ibm.com/docs/openshift?topic=openshift-ts-storage-ca-apikey-reset).

Before you use this command, make sure that the user who runs this command has the required [IBM Cloud Kubernetes Service and IBM Cloud infrastructure permissions](https://cloud.ibm.com/docs/containers?topic=containers-access_referencecluster_create_permissions). Target the resource group and region that you want to set the API key for. When the API key is reset, the previous API key that was used, if any, for the region and resource group is now obsolete. You can then delete the old API key from your list of API keys.
You can create context-based restrictions (CBR) for IBM Cloud Kubernetes Service resources or for specific APIs. With Context-based restrictions, you can protect the following resources.

Protect IBM Cloud Kubernetes Service resources
: [Restrict access to clusters, resource groups, or regions](https://cloud.ibm.com/docs/containers?topic=containers-cbr&interface=cliresources-types-cbr).

Protect specific APIs
: Restrict accessing to provisioning and managing clusters and workers. Or, restrict access to Kubernetes APIs such as viewing pods and nodes. For more information, see [Protecting specific APIs](https://cloud.ibm.com/docs/containers?topic=containers-cbr&interface=cliprotect-api-types-cbr).

Applications running on IBM Cloud Kubernetes Service clusters, for example web servers exposed by a Kubernetes LoadBalancer are not restricted by CBR rules.



 Protecting IBM Cloud Kubernetes Service resources 

You can create CBR rules to protect specific regions, and clusters.

Cluster
: Protects a specific IBM Cloud Kubernetes Service cluster. If you select a cluster in your CBR rule, only traffic from resources in the network zones that you associate with the rule can interact with that cluster.
: If you use the CLI, you can specify the --service-instance CLUSTER-ID option to protect a specific cluster.
: If you use the API, you can specify "name": "serviceInstance","value": "CLUSTER-ID" in the resource attributes.

Region
: Protects IBM Cloud Kubernetes Service resources in a specific region. If you select a region in your CBR rule, then only traffic from resources in the network zones that you associate with the rule can interact with resources in that region.
: If you use the CLI, you can specify the --region REGION option to protect resources in a specific region.
: If you use the API, you can specify "name": "region","value": "REGION" field in the resource attributes.

Resource group
Why can't I view or work with my cluster? 

Virtual Private Cloud

Classic infrastructure

 What’s happening 

You are not able to find a cluster. When you run ibmcloud oc cluster ls, the cluster is not listed in the output.

Or, you are not able to work with a cluster. When you run ibmcloud oc cluster config or other cluster-specific commands, the cluster is not found.

 Why it’s happening 

In IBM Cloud, each resource must be in a resource group. For example, cluster mycluster might exist in the default resource group.

When the account owner gives you access to resources by assigning you an IBM Cloud IAM platform access role, the access can be to a specific resource or to the resource group. When you are given access to a specific resource, you don't have access to the resource group. In this case, you don't need to target a resource group to work with the clusters you have access to. If you target a different resource group than the group that the cluster is in, actions against that cluster can fail. Conversely, when you are given access to a resource as part of your access to a resource group, you must target a resource group to work with a cluster in that group. If you don't target your CLI session to the resource group that the cluster is in, actions against that cluster can fail.

If you can't find or work with a cluster, you might be experiencing one of the following issues:



* You have access to the cluster and the resource group that the cluster is in, but your CLI session is not targeted to the resource group that the cluster is in.
* You have access to the cluster, but not as part of the resource group that the cluster is in. Your CLI session is targeted to this or another resource group.
* You don't have access to the cluster.



 How to fix it 

To check your user access permissions:



1. List all your user permissions.

ibmcloud iam user-policies <your_user_name>
2. Check if you have access to the cluster and to the resource group that the cluster is in.



1.