vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* Adds the --location option to the cluster ls and zone ls commands to filter resources by one or more locations. - Adds the --region option to the credential set/unset/get, api-key reset, and vlan spanning get commands. To run these commands, you must specify a region in the --region option.









 Version 0.2 

Review the following changes for 0.2 versions of the CLI plug-in.

Version 0.2 of the CLI plug-in is deprecated. To update to the latest version, see [Updating to version 1.0 of the plug-in](https://cloud.ibm.com/docs/containers?topic=containers-cs_cli_changelogchangelog_beta).



 Version 0.2.102 

Version 0.2.102 of the CLI was released on 15 April 2019.



* Adds the [ibmcloud ks nlb-dns group of commands](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clinlb-dns) for registering and managing a subdomain for network load balancer (NLB) IP addresses, and the [ibmcloud ks nlb-dns monitor group of commands](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_nlb-dns-monitor-configure) for creating and modifying health check monitors for NLB subdomains. For more information, see [Registering NLB IPs with a DNS subdomain](https://cloud.ibm.com/docs/containers?topic=containers-loadbalancer_hostnameloadbalancer_hostname_dns).







 Version 0.2.99 

Version 0.2.99 of the CLI was released on 9 April 2019.



* Updates help text.
* Updates the Go version to 1.12.2.







 Version 0.2.95 

Version 0.2.95 of the CLI was released on 3 April 2019.



* Adds versioning support for managed cluster add-ons.
In this tutorial, you learned the following:



* The differences between VMs, containers, and Kubernetes.
* How to define clusters for different environment types (dev, test, and production).
* How to handle data storage and the importance of persistent data storage.
* Apply the 12-factor principles to your app and use secrets for credentials in Kubernetes.
* Build container images and push them to IBM Cloud Container Registry.
* Create Kubernetes deployment files and deploy the container image to Kubernetes.







 Put everything learned to practice, run the JPetStore app in your cluster 

To put everything you've learned in practice, follow the [demonstration](https://github.com/IBM-Cloud/jpetstore-kubernetes/) to run the JPetStore app on your cluster and apply the concepts learned. The JPetStore app has some extended functionality to allow you to extend an app in Kubernetes by running image classification as a separate microservice.





 Related Content 



* [Get started](https://developer.ibm.com/learningpaths/get-started-containers/) with Kubernetes and Kubernetes Service.
* Kubernetes Service labs on [GitHub](https://github.com/IBM/container-service-getting-started-wt).
* Kubernetes main [docs](https://kubernetes.io/).
* [Persistent storage](https://cloud.ibm.com/docs/containers?topic=containers-storage-plan) in Kubernetes Service.
* [Best practices solution guide](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-users-teams-applicationsusers-teams-applications) for organizing users, teams and apps.
* [Analyze logs and monitor application health](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-application-log-analysisapplication-log-analysis).
The following sections detail the best practices you can use to secure your Kubernetes cluster and the nodes of your network:



* [Kubernetes cluster security](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-securityibp-security-Kubernetes-security)
* [Network security](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-securityibp-security-Kubernetes-network)
* [Internet Ports](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-securityibp-security-Kubernetes-ports)
* [Cluster and Operating System (OS)](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-securityibp-security-Kubernetes-container-os)
* [Keys and cluster access information](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-securityibp-security-Kubernetes-keys)
* [Membership Service Providers (MSPs)](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-securityibp-security-kubernetes-msp)
* [Storage](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-securityibp-security-kubernetes-storage)
* [Data privacy](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-securityibp-security-kubernetes-privacy)
* [GDPR](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-securityibp-security-kubernetes-gdpr)





 Kubernetes cluster security 

The best place to start is to learn about the security features of the underlying Kubernetes infrastructure.
For example, to prepare your cluster for HA/DR scenarios, follow the guidance in [High availability for IBM Cloud Kubernetes Service](https://cloud.ibm.com/docs/containers?topic=containers-ha). Note that persistent storage of data such as application logs and cluster metrics are not set up by default.<br><br><br> 







 Applications and data 

You are completely responsible for the applications, workloads, and data that you deploy to IBM Cloud. However, IBM provides various tools to help you set up, manage, secure, integrate and optimize your apps as described in the following table.



Table 7. Applications and data

 Resource How IBM helps What you can do 

 Applications <br><br> * Provision clusters with Kubernetes components installed so that you can access the Kubernetes API to deploy and manage your containerized apps.<br> * Provide a number of managed add-ons to extend your app's capabilities, such as [Istio](https://cloud.ibm.com/docs/containers?topic=containers-istio) or the Diagnostics and Debug Tool. Maintenance is simplified for you because IBM provides the installation and updates for the managed add-ons.<br> * Provide cluster integration with select third-party partnership technologies, such as Log Analysis, Monitoring, and Portworx.<br> * Provide automation to enable service binding to other IBM Cloud services.<br> * Create clusters with image pull secrets so that your deployments in the default Kubernetes namespace can pull images from IBM Cloud Container Registry.<br> * Provide access to Kubernetes APIs that you can use to set up Operators to add community, third-party, and your own services to your cluster.
[Enhance cloud security by applying context-based restrictions](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-cbr-enhanced-security)Enhance cloud security by applying context-based restrictions

This tutorial walks you through the process of implementing context-based restrictions (CBRs) in your IBM Cloud account. CBRs help you to secure the cloud environment further and move towards a zero trust security model.

Kubernetes service Object Storage

+7

Activity Tracker hosted event search,Container Registry,Secrets Manager,App ID,Cloudant,Key Protect,Log Analysis



* 2 hours
* 2023-06-28



[Apply end to end security to a cloud application](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-cloud-e2e-security)Apply end to end security to a cloud application

This tutorial walks you through key security services available in the IBM Cloud® catalog and how to use them together. An application that provides file sharing will put security concepts into practice.

Kubernetes service Object Storage

+8

Activity Tracker hosted event search,Container Registry,Secrets Manager,App ID,Cloudant,Key Protect,Log Analysis,Cloud Internet Services (CIS)



* 2 hours
* 2023-05-05



[Continuous Deployment to Kubernetes](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-continuous-deployment-to-kubernetes)Continuous Deployment to Kubernetes

This tutorial walks you through the process setting up a continuous integration and delivery pipeline for containerized applications running on the Kubernetes Service. You will learn how to set up source control, then build, test and deploy the code to different deployment stages. Next, you will add integrations to other services like Slack notifications.

Kubernetes service Container Registry

+1

Continuous Delivery



* 1 hour
* 2023-05-08
Logging for clusters 

Set up logging in IBM Cloud® Kubernetes Service to help you troubleshoot issues and improve the health and performance of your Kubernetes clusters and apps.

Continuous monitoring and logging is the key to detecting attacks on your cluster and troubleshooting issues as they arise. By continuously monitoring your cluster, you're able to better understand your cluster capacity and the availability of resources that are available to your app. With this insight, you can prepare to protect your apps against downtime.

You can configure custom settings for the logging agents that are deployed to your cluster such custom inclusion rules, logging directories, and more. For more information, see [Configuring a logging agent](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-log_analysis_agentlog_analysis_agent_configure)



 Choosing a logging solution 

By default, logs are generated and written locally for all the following IBM Cloud Kubernetes Service cluster components: worker nodes, containers, applications, persistent storage, Ingress application load balancer, Kubernetes API, and the kube-system namespace. Several logging solutions are available to collect, forward, and view these logs.

You can choose your logging solution based on which cluster components you need to collect logs for. A common implementation is to choose a logging service that you prefer based on its analysis and interface capabilities, such as IBM Log Analysis or a third-party service. You can then use IBM Cloud Activity Tracker to audit user activity in the cluster.

IBM® Log Analysis
: Manage pod container logs by deploying an instance of IBM Log Analysis and configuring this instance for your cluster in Kubernetes Service. A logging agent collects logs with the extension .log and extensionless files that are stored in the /var/log directory of your pod from all namespaces, including kube-system. The agent then forwards the logs to your IBM Log Analysis service instance. For more information about the service, see the [IBM Log Analysis](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-getting-started) documentation.
You should already have an IBM Blockchain Platform service instance deployed and configured with peers, CAs, and ordering service nodes running and ready for monitoring before you attempt this tutorial.





 Step one: Provision an instance of the IBM Cloud Monitoring service 

Deploy an instance of the IBM Cloud Monitoring service in your IBM Cloud account. Complete the steps in the [Monitoring getting started tutorial](https://cloud.ibm.com/docs/monitoring?topic=monitoring-getting-started) tutorial.

After you provision the monitoring service, if you click Edit sources in the Monitoring tab, a curl command is provided to easily configure monitoring of your Kubernetes cluster. Simply login to your Kubernetes cluster from the CLI and run the curl command to configure the monitoring service for your cluster. In Step two below, your monitoring instance should be ready to go. If the curl command fails, ensure that your kubectl version is 1.14 or higher.





 Step two: Configure the Open Dashboard for monitoring your IBM Blockchain Platform nodes 

After you have provisioned the IBM Cloud Monitoring service, click View Open Dashboard from the Monitoring tab of the Open Dashboard in IBM Cloud.



1. On the Welcome to IBM Cloud Monitoring panel click Next.
2. Choose Kubernetes | GKE | OpenShift as the installation method.
3. If you have not already configured the instance, you can do so now by following the instructions. Otherwise after the service is provisioned and you can click Go to next step! then Let’s get started to launch the Open Dashboard.







 Step three: Create a new dashboard 

A good place to start monitoring your IBM Blockchain Platform is the Dashboards tab where you can copy and tailor default dashboards according to your monitoring requirements. A dashboard shows groups of metrics that report on the health, performance, and state of your infrastructure, applications, and services for a single host or a group of hosts. Dashboards offer a specialized insight into network data, application data, topology, services, hosts, and containers. Use dashboards to monitor your infrastructure, applications, and services.
Adding services by using IBM Cloud service binding 

Add IBM Cloud services to enhance your Kubernetes cluster with extra capabilities in areas such as Watson AI, data, security, and Internet of Things (IoT).



 About service binding 

Review the following frequently asked questions about service binding.



 What types of services can I bind to my cluster? 

When you add IBM Cloud services to your cluster, you can choose between services that are enabled for IBM Cloud Identity and Access Management (IAM) and services that are based on Cloud Foundry. IAM-enabled services offer more granular access control and can be managed in an IBM Cloud resource group. Cloud Foundry services must be added to a Cloud Foundry organization and space, and can't be added to a resource group. To control access to your Cloud Foundry service instance, you use Cloud Foundry roles. For more information about IAM-enabled services and Cloud Foundry services, see [Managing access to resources](https://cloud.ibm.com/docs/account?topic=account-assign-access-resources).

To find a list of supported IBM Cloud services, see the [IBM Cloud catalog](https://cloud.ibm.com/catalog).





 What is IBM Cloud service binding? 

Service binding is a quick way to create service credentials for an IBM Cloud service by using its public cloud service endpoint and storing these credentials in a Kubernetes secret in your cluster. To bind a service to your cluster, you must provision an instance of the service first. Then, you use the ibmcloud ks cluster service bind[command](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_cluster_service_bind) to create the service credentials and the Kubernetes secret. The Kubernetes secret is automatically encrypted in etcd to protect your data.

Want to make your secrets even more secured? Ask your cluster admin to [enable a key management service provider](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkeyprotect) in your cluster to encrypt new and existing secrets, such as the secret that stores the credentials of your IBM Cloud service instances.
The tutorial features a sample application that enables groups of users to upload files to a common storage pool and to provides access to those files via shareable links. The application is written in Node.js and deployed as a container to the Kubernetes Service. It leverages several security-related services and features to improve the application's security posture.

This tutorial will work with a Kubernetes cluster running in Classic Infrastructure or VPC Infrastructure.

Zoom

![Architecture](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/solution34-cloud-e2e-security/architecture-e2e-security.svg)

Figure 1. Architecture diagram of the tutorial



1. User connects to the application.
2. If using a custom domain and a TLS certificate, the certificate is managed by and deployed from the Secrets Manager.
3. App ID secures the application and redirects the user to the authentication page. Users can also sign up.
4. The application runs in a Kubernetes cluster from an image stored in the Container Registry. This image is automatically scanned for vulnerabilities.
5. Uploaded files are stored in Object Storage with accompanying metadata stored in IBM Cloudant.
6. Object storage buckets, App ID, and Secrets Manager services leverage a user-provided key to encrypt data.
7. Application management activities are logged by IBM Cloud Activity Tracker.







 Before you begin 

This tutorial requires:



* IBM Cloud CLI,



* IBM Cloud Kubernetes Service plugin (kubernetes-service),
* Container Registry plugin (container-registry),



* kubectl to interact with Kubernetes clusters,
* git to clone source code repository.
Optionally build the application to produce a container image.
3. Optionally the image is pushed to a namespace in the IBM Cloud Container Registry.
4. The application is deployed to a Kubernetes cluster.
5. Users access the application.







 Before you begin 

This tutorial requires:



* IBM Cloud CLI,



* IBM Cloud Kubernetes Service plugin (kubernetes-service),



* kubectl to interact with Kubernetes clusters,
* Helm 3 to deploy charts.



You will find instructions to download and install these tools for your operating environment in the [Getting started with tutorials](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-tutorials) guide.

To avoid the installation of these tools you can use the [Cloud Shell](https://cloud.ibm.com/shell) from the IBM Cloud console.

In addition, make sure you:



* [set up a registry namespace](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespaceregistry_namespace_setup)
* and [understand the basics of Kubernetes](https://kubernetes.io/docs/tutorials/kubernetes-basics/).







 Step 1: Create a Kubernetes cluster 

Kubernetes Service delivers powerful tools by combining Docker and Kubernetes technologies, an intuitive user experience, and built-in security and isolation to automate the deployment, operation, scaling, and monitoring of containerized apps in a cluster of compute hosts.

A minimal cluster with one (1) zone, one (1) worker node and the smallest available size (Flavor) is sufficient for this tutorial.

Open the [Kubernetes clusters](https://cloud.ibm.com/kubernetes/clusters) and click Create cluster. See the documentation referenced below for more details based on the cluster type. Summary:



* Click Standard tier cluster
Securing Kubernetes secrets 

You can use IBM Cloud® Secrets Manager with IBM Cloud Kubernetes Service or Red Hat OpenShift on IBM Cloud to manage the application secrets that are stored in your clusters. Check out the following scenario to learn more about this use case.



 Scenario: Integrate secrets from Secrets Manager to your Kubernetes cluster 

You're a security architect for a large, financial institution that competes regionally with global institutions for clients and opportunities. To maintain and extend its competitive advantage, your company wants to deliver powerful new experiences to its customers at a faster rate. But, the development velocity in your organization has slowed over time, as its services and applications are built on traditional tools and infrastructure that often rely on manual processes. You need to increase velocity, but cannot sacrifice security. You have no tolerance for putting customers in harm's way.

After much deliberation, your organization chooses IBM Cloud in a major initiative to accelerate velocity within its IT division. Your teams start their transition by using [IBM Cloud Kubernetes Service](https://cloud.ibm.com/docs/containers?topic=containers-getting-started) to containerize their apps and move them to the cloud. As part of their automation, they need the ability to generate, secure, and reference thousands of Kubernetes Service application secrets. Rather than to inject those secrets at deployment time, you want the ability to secure them in an external secrets management service, and then retrieve them seamlessly at application run time.

You look to Secrets Manager as a solution to store secrets in a central repository. By extending the Kubernetes API with the [External Secrets Operator](https://external-secrets.io/latest/) open source project, your team is able to use IBM Cloud Secrets Manager to securely add secrets to Kubernetes.

This scenario features a third-party tool that can impact the compliance readiness of workloads that run in your Kubernetes cluster. If you add a community or third-party tool, keep in mind that you are responsible for maintaining the compliance of your apps and working with the appropriate provider to troubleshoot any issues.
* UI
* API







 Authorizing pods in your cluster to IBM Cloud services with IAM trusted profiles 

Virtual Private Cloud

Classic infrastructure

Satellite

Give application pods that run in your IBM Cloud® Kubernetes Service cluster access to IBM Cloud services by creating a trusted profile in IBM Cloud Identity and Access Management (IAM).

You can enable IAM trusted profiles by running the [ibmcloud ks cluster master refresh](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_apiserver_refresh) command.

In IAM
: Start by creating an IAM trusted profile. Then, link the trusted profile with your IBM Cloud Kubernetes Service compute resource by selecting conditions to match with your clusters, including a Kubernetes namespace and service account in the clusters. Finally, assign access policies to the IBM Cloud services that you want your apps to use.

In your cluster
: Through [Kubernetes service account token volume projection](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/service-account-token-volume-projection), the apps that run in your linked cluster's [Kubernetes namespace](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/) and use the namespace's service account can exchange the service account public key to get an IBM Cloud IAM access token. Your app can use this access token to authenticate API requests to IBM Cloud services, such as databases, Watson, or VPC infrastructure. Through the access policies of the trusted profile, you control what actions the token lets the app perform.



 Prerequisites 

To use IBM Cloud IAM identities for pods in your cluster, verify that you meet the prerequisites.

Minimum required permissions
This tutorial walks you through the process setting up a continuous integration and delivery pipeline for containerized applications running on the Kubernetes Service. You will learn how to set up source control, then build, test and deploy the code to different deployment stages. Next, you will add integrations to other services like Slack notifications.

Kubernetes service Container Registry

+1

Continuous Delivery



* 1 hour
* 2023-05-08



[Accelerate a dynamic website using Dynamic Content Acceleration](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-dynamic-content-cdn)Accelerate a dynamic website using Dynamic Content Acceleration

Web applications are composed of static content like text, images, cascading style sheets, and JavaScript files. The tutorial Accelerate delivery of static files using a CDN shows how to host and serve static assets (images, videos, and documents) of a website from IBM Cloud Object Storage with IBM® Content Delivery Network (CDN).

Content Delivery Network (CDN) Kubernetes service

+2

Container Registry,Domain Name Registration



* 2 hours
* 2023-06-14



[Resilient and secure multi-region Kubernetes clusters with IBM Cloud Internet Services](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-multi-region-k8s-cis)Resilient and secure multi-region Kubernetes clusters with IBM Cloud Internet Services

This tutorial highlights how Cloud Internet Services (CIS), a uniform platform to configure and manage the Domain Name System (DNS), Global Load Balancing (GLB), Web Application Firewall (WAF), and protection against Distributed Denial of Service (DDoS) for internet applications, can be integrated with Kubernetes clusters to support this scenario and to deliver a secure and resilient solution across multiple locations.

Kubernetes service Container Registry

+1

Cloud Internet Services (CIS)



* 2 hours
* 2023-05-10