vania-janet/multiturn-rag-retrieval-data huggingface dataset:
You have different options that depend on your cluster type. For more information, see [Planning networking services](https://cloud.ibm.com/docs/containers?topic=containers-cs_network_planningexternal).



* Standard cluster: You can expose your app by using a [NodePort, load balancer, or Ingress service](https://cloud.ibm.com/docs/containers?topic=containers-cs_network_planningexternal).
* Cluster that is made private by using Calico: You can expose your app by using a [NodePort, load balancer, or Ingress service](https://cloud.ibm.com/docs/containers?topic=containers-cs_network_planningprivate_both_vlans). You also must use a Calico preDNAT network policy to block the public node ports.
* Private VLAN-only standard cluster: You can expose your app by using a [NodePort, load balancer, or Ingress service](https://cloud.ibm.com/docs/containers?topic=containers-cs_network_planningplan_private_vlan). You also must open the port for the service's private IP address in your firewall.



As you plan how many Service objects you need in your cluster, keep in mind that Kubernetes uses iptables to handle networking and port forwarding rules. If you run many services in your cluster, such as 5000, performance might be impacted.







 Securing apps 

As you plan and develop your app, consider the following options to maintain a secure image, ensure that sensitive information is encrypted, encrypt traffic between app microservices, and control traffic between your app pods and other pods and services in the cluster.

Image security
: To protect your app, you must protect the image and establish checks to ensure the image's integrity. Review the [image and registry security topic](https://cloud.ibm.com/docs/containers?topic=containers-securityimages_registry) for steps that you can take to ensure secure container images. For example, you might use Vulnerability Advisor to check the security status of container images.
* [Account classic infrastructure permissions](https://cloud.ibm.com/docs/account?topic=account-mngclassicinfra)
* [IBM Cloud Kubernetes Service classic infrastructure roles](https://cloud.ibm.com/docs/containers?topic=containers-classic-roles)



5. To change or assign new access policies, see [Customizing infrastructure permissions](https://cloud.ibm.com/docs/containers?topic=containers-access-credsinfra_access).











 Removing user permissions 

If a user no longer needs specific access permissions, or if the user is leaving your organization, the IBM Cloud account owner can remove that user's permissions.



 Checking if the user's credentials are used for infrastructure permissions 

Before you remove a user's specific access permissions or remove a user from your account completely, ensure that the user's infrastructure credentials are not used to set the API key or for the ibmcloud ks credential set command. Otherwise, the other users in the account might lose access to the IBM Cloud infrastructure portal and infrastructure-related commands might fail.

To avoid this issue for future users, consider using a functional ID user for the API key owner instead of a personal user. In case the person leaves the team, the functional ID user remains the API key owner.



1. Target your CLI context to a region and resource group where you have clusters.

ibmcloud target -g <resource_group_name> -r <region>
2. Check the owner of the API key or infrastructure credentials set for that region and resource group.



* If you use the [API key to access the IBM Cloud infrastructure portfolio](https://cloud.ibm.com/docs/containers?topic=containers-access-credsdefault_account):

ibmcloud ks api-key info --cluster <cluster_name_or_id>
* If you set [infrastructure credentials to access the IBM Cloud infrastructure portfolio](https://cloud.ibm.com/docs/containers?topic=containers-access-credscredentials):

ibmcloud ks credential get --region <region>
Securing your connection 

With IBM Cloud Satellite, you bring IBM Cloud to your own infrastructure environment by creating a Satellite location. This setup means that you do not need [IBM Cloud service endpoints](https://cloud.ibm.com/docs/account?topic=account-service-endpoints-overview) to access IBM Cloud. Instead, IBM Cloud needs a Satellite Link endpoint to access your infrastructure environment. You can access services in your Satellite location by creating Satellite Link endpoints, using the cluster URL, or creating a route or similar service for workloads in a cluster.



 Access to resources that run in your Satellite location 

You can access the resources that run in your Satellite location in several ways, depending on what users need to access: service-instance clusters in your Satellite location, a resource in your Satellite location from the IBM private network, or an application workload in a cluster in your Satellite location.



 Service-instance clusters 

A cluster service URL is automatically created for any [Satellite-enabled IBM Cloud service](https://cloud.ibm.com/docs/satellite?topic=satellite-managed-services) that you run in your location, such as a Red Hat OpenShift on IBM Cloud cluster. These URLs allow you to access your IBM Cloud service that runs in your location over the public network or from within your hosts' private network, depending on whether your location hosts have public and private or private only connectivity.

For example, when you create an IBM Cloud Satellite cluster, the cluster is accessible through a URL that consists one of the subdomains for your location and a port, such as https://pacfd8bdae2d04696301d-6b64a6ccc9c596bf59a86625d8fa2202-ce00.us-east.satellite.appdomain.cloud:32200. When you access your cluster, such as by using the ibmcloud oc cluster config --cluster <cluster_name_or_ID> --admin command or by getting a login token from the Red Hat OpenShift web console, this URL is automatically used for your connection to the cluster master.
Minimum required permissions
: Editor platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

--alb ALB_ID
: Required: The ID for an ALB. To view the IDs for the ALBs in a cluster, run ibmcloud ks ingress alb ls --cluster CLUSTER.

-c, --cluster CLUSTER
: The name or ID of the cluster.

--ip IP_ADDRESS
: Optional: Specify an IP address that is on a VLAN in the zone that the ALB was created in. The ALB is enabled with and uses this public or private IP address. This IP address must not be in use by another load balancer or ALB in the cluster. If no IP address is provided, the ALB is deployed with a public or private IP address from the portable public or private subnet that was provisioned automatically when you created the cluster, or if you re-enable an ALB that was previously enabled, the public or private IP address that was previously assigned to the ALB.

--version IMAGE_VERSION
: Optional: The version of the image that you want the ALB to run. To list available versions, run ibmcloud ks ingress alb versions. To specify a version other than the default, you must first disable automatic updates by running the ibmcloud ks ingress alb autoupdate disable command. If you omit this option, the ALB runs the default version of the same image that the ALB previously ran: either the Kubernetes Ingress image or the IBM Cloud Kubernetes Service Ingress image.

-q
: Optional: Do not show the message of the day or update reminders.



 Example ingress alb enable classic command 

ibmcloud ks ingress alb enable classic --alb private-cr18a61a63a6a94b658596aa93a087aaa9-alb1 --cluster mycluster --ip 169.XX.XXX.XX --version 1.1.2_2507_iks







 ibmcloud ks ingress alb enable vpc-gen2 

Virtual Private Cloud
[Webhook-create commands](https://cloud.ibm.com/docs/cli?topic=cli-kubernetes-service-clics_webhook_create) Register a webhook in a cluster. 
 [API-key commands](https://cloud.ibm.com/docs/cli?topic=cli-kubernetes-service-cliapi_key-commands) View information about the API key for a cluster or reset it to a new key. 
 [Credential commands](https://cloud.ibm.com/docs/cli?topic=cli-kubernetes-service-clicredential) Set and unset credentials that allow you to access the IBM Cloud classic infrastructure portfolio through your IBM Cloud account. 
 [Infra-permissions commands](https://cloud.ibm.com/docs/cli?topic=cli-kubernetes-service-cliinfra-commands) Check classic IBM Cloud infrastructure permissions that are used in IBM Cloud Kubernetes Service. 
 [KMS commands](https://cloud.ibm.com/docs/cli?topic=cli-kubernetes-service-cliks_kms) Enable a key management service (KMS) provider in your cluster to encrypt the etcd component and Kubernetes secrets with a root key that you control. 
 [Quota commands](https://cloud.ibm.com/docs/cli?topic=cli-kubernetes-service-clics_quota) View the quota and limits for cluster-related resources in your IBM Cloud account. 
 [Subnets commands](https://cloud.ibm.com/docs/cli?topic=cli-kubernetes-service-clics_subnets) List available subnets in your IBM Cloud infrastructure account. 
 [VLAN commands](https://cloud.ibm.com/docs/cli?topic=cli-kubernetes-service-clivlan) List public and private VLANs for a zone and view the VLAN spanning status.
Create a cluster See [Permissions to create a cluster](https://cloud.ibm.com/docs/containers?topic=containers-access_referencecluster_create_permissions). 
 Cluster administrator [Administrator platform access role for a cluster](https://cloud.ibm.com/docs/containers?topic=containers-iam-platform-access-roles), [Manager service access role not scoped to a namespace (for the whole cluster)](https://cloud.ibm.com/docs/containers?topic=containers-iam-service-access-roles). 
 DevOps operator [Operator platform access role for a cluster](https://cloud.ibm.com/docs/containers?topic=containers-iam-platform-access-roles), [Writer service access role not scoped to a namespace (for the whole cluster)](https://cloud.ibm.com/docs/containers?topic=containers-iam-service-access-roles), [Cloud Foundry developer space role](https://cloud.ibm.com/docs/containers?topic=containers-cloud-foundry-roles). 
 Operator or site reliability engineer [Administrator platform access role for a cluster, region, or resource group](https://cloud.ibm.com/docs/containers?topic=containers-iam-platform-access-roles), [Reader service access role for a cluster or region](https://cloud.ibm.com/docs/containers?topic=containers-iam-service-access-roles) or [Manager service access role for all cluster namespaces](https://cloud.ibm.com/docs/containers?topic=containers-iam-service-access-roles) to be able to use kubectl top nodes,pods commands. 







 Where can I find a list of security bulletins that affect my cluster? 

If vulnerabilities are found in Kubernetes, Kubernetes releases CVEs in security bulletins to inform users and to describe the actions that users must take to remediate the vulnerability.
Example cluster master pod-security unset command 

ibmcloud ks cluster master pod-security unset --cluster mycluster







 ibmcloud ks cluster master private-service-endpoint allowlist 

Manage a private cloud service endpoint allowlist so that authorized users can access your private cloud service endpoint from only the subnets that are specified in the allowlist.



 ibmcloud ks cluster master private-service-endpoint allowlist add 

Virtual Private Cloud

Classic infrastructure

After you enable a private cloud service endpoint allowlist, add subnets from which authorized users can access your private cloud service endpoint to the allowlist.

For example, to access your cluster's private cloud service endpoint, you must connect to your IBM Cloud classic network or your VPC network through a VPN or IBM Cloud Direct Link. You can add the subnet for the VPN or IBM Cloud Direct Link tunnel so that authorized users in your organization can only access the private cloud service endpoint from that subnet.

Worker node subnets are automatically added to and removed from your allowlist so that worker nodes can always access the master through the private cloud service endpoint.

ibmcloud ks cluster master private-service-endpoint allowlist add --cluster CLUSTER --subnet SUBNET [--subnet SUBNET ...] [-q]

Minimum required permissions
: Editor platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

--subnet SUBNET
: Required: The subnet in CIDR format. Specify more than one subnet by using multiple repeated options.

-q
: Optional: Do not show the message of the day or update reminders.



 Example cluster master private-service-endpoint allowlist add command 

ibmcloud ks cluster master private-service-endpoint allowlist add --cluster mycluster --subnet 1.1.1.1/16







 ibmcloud ks cluster master private-service-endpoint allowlist disable 

Virtual Private Cloud

Classic infrastructure

Disable the subnet allowlist feature for a cluster's private cloud service endpoint.
The pod subnet is in the 172.30.0.0/16 range by default.

--disable-disk-encrypt
: Worker nodes feature AES 256-bit [disk encryption by default](https://cloud.ibm.com/docs/containers?topic=containers-securityencrypted_disk). If you want to disable encryption, include this option.

--sm-group GROUP
: The secret group ID of the Secrets Manager instance where your secrets are persisted. To get a secret group ID, see the [Secrets Manager CLI reference](https://cloud.ibm.com/docs/secrets-manager-cli-plugin?topic=secrets-manager-cli-plugin-secrets-manager-clisecrets-manager-cli-secret-groups-command).

--sm-instance INSTANCE
: The CRN of the Secrets Manager instance. To get the CRN of an instance, run ibmcloud ks ingress instance ls --cluster CLUSTER.
8. Verify that the creation of the cluster was requested. For virtual machines, it can take a few minutes for the worker node machines to be ordered, and for the cluster to be set up and provisioned in your account. Bare metal physical machines are provisioned by manual interaction with IBM Cloud infrastructure, and can take more than one business day to complete.

ibmcloud ks cluster ls

When the provisioning of your Kubernetes master is completed, the State of your cluster changes to normal. After your Kubernetes master is ready, the provisioning of your worker nodes is initiated.

NAME ID State Created Workers Zone Version Resource Group Name Provider
mycluster blrs3b1d0p0p2f7haq0g normal 20170201162433 3 dal10 1.26.6_1526 Default classic

Is your cluster not in a normal state? Check out the [Debugging clusters](https://cloud.ibm.com/docs/containers?topic=containers-debug_clusters) guide for help.
Verify your connection by logging in to IBM Cloud through this API endpoint.

ibmcloud login -a https://cloud.ibm.com/
3. Allow access to containers.cloud.ibm.com on port 443 in your allowlist.
4. Verify your connection. If access is configured correctly, messages similar to the following are displayed in the output.

curl https://containers.cloud.ibm.com/global/v1/versions

Example output

{"kubernetes":[{"major":1,"minor":19,"patch":16,"default":false,"end_of_service":""},{"major":1,"minor":20,"patch":13,"default":false,"end_of_service":""},{"major":1,"minor":21,"patch":7,"default":true,"end_of_service":""},{"major":1,"minor":22,"patch":4,"default":false,"end_of_service":""}],"openshift":[{"major":3,"minor":11,"patch":542,"default":false,"end_of_service":"2022-06-06T12:00:00+0000"},{"major":4,"minor":6,"patch":47,"default":false,"end_of_service":""},{"major":4,"minor":7,"patch":37,"default":false,"end_of_service":""},{"major":4,"minor":8,"patch":21,"default":true,"end_of_service":""}]}
5. Allow access to the [IBM Cloud Container Registry regions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_regions) that you plan to use on port 443 in your allowlist.
ibmcloud ks cluster master private-service-endpoint allowlist rm --cluster mycluster
--subnet 1.1.1.1/16





 ibmcloud ks cluster master private-service-endpoint disable 

Classic infrastructure

Disable the [private cloud service endpoint](https://cloud.ibm.com/docs/containers?topic=containers-plan_basicsworkeruser-master) to remove private accessibility to your cluster master.

Important: Before you disable the private endpoint, you first must complete the following steps to enable the public cloud service endpoint:



1. Enable the public cloud service endpoint by running ibmcloud ks cluster master public-service-endpoint enable --cluster <cluster_name>.
2. Follow the prompt in the CLI to refresh the Kubernetes master API server.
3. [Reload all the worker nodes in your cluster to pick up the public endpoint configuration.](https://cloud.ibm.com/docs/cli?topic=cli-kubernetes-service-clics_worker_reload)



ibmcloud ks cluster master private-service-endpoint disable --cluster CLUSTER [-f] [-q] [-y]

Minimum required permissions
: Administrator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-f
: Optional: Force the command to run with no user prompts.

-q
: Optional: Do not show the message of the day or update reminders.

-y
: Optional: Refresh the cluster master and reload worker nodes with no user prompts.



 Example cluster master private-service-endpoint disable command 

ibmcloud ks cluster master private-service-endpoint disable --cluster my_cluster







 ibmcloud ks cluster master private-service-endpoint enable 

Classic infrastructure

Enable the [private cloud service endpoint](https://cloud.ibm.com/docs/containers?topic=containers-plan_basicsworkeruser-master) to make your cluster master privately accessible.

To run this command:



1.
If you need more of the resource, [contact IBM Support](https://cloud.ibm.com/docs/get-support?topic=get-support-using-avatar). In the support case, include the new quota limit for the region and infrastructure provider that you want. 
 IAM access groups You can't scope IBM Cloud IAM service access roles to an IAM access group because the roles are not synced to the RBAC roles within the cluster. If you want to scope RBAC roles to a group of users, you must [manually set up groups of users](https://docs.openshift.com/container-platform/4.11/authentication/understanding-authentication.html) in your cluster instead of using IAM access groups. You can still manage individual users and service accounts with IAM service access roles. You can also still scope IAM platform access roles to IAM access groups to control actions like ordering worker nodes, because platform access roles are never synced to RBAC roles. 
 Kubernetes Make sure to review the [Kubernetes project limitations](https://kubernetes.io/docs/setup/best-practices/cluster-large/). 
 KMS provider Customizing the IP addresses that are allowed to connect to your IBM® Key Protect for IBM Cloud® instance is not supported. 
 Red Hat OpenShift Make sure to review the [OpenShift Container Platform limitations](https://docs.openshift.com/container-platform/4.11/scalability_and_performance/planning-your-environment-according-to-object-maximums.html) for your version. 
 Kubernetes pod logs To check the logs for individual app pods, you can use the command line to run oc logs <pod name>. Do not use the Kubernetes dashboard to stream logs for your pods, which might cause a disruption in your access to the Kubernetes dashboard. 
 Monitoring <br><br> * Because IBM manages your cluster master, event alerting for the master is disabled. IBM monitors your cluster master and fixes issues as they are detected.
If the region is correct, verify that you have the correct [permissions](https://cloud.ibm.com/docs/containers?topic=containers-clusters&interface=ui) to view and work with your cluster. Make sure that you select a cluster that meets the [minimum hardware requirements for Portworx](https://docs.portworx.com/start-here-installation/).
13. Optional: From the Portworx secret store type drop down list, choose the secret store type that you want to use to store the volume encryption key.



* Kubernetes Secret: Choose this option if you want to store your own custom key to encrypt your volumes in a Kubernetes Secret in your cluster. The secret must not be present before you install Portworx. You can create the secret after you install Portworx. For more information, see the [Portworx documentation](https://docs.portworx.com/key-management/kubernetes-secrets/configuring-kubernetes-secrets-with-portworx).
* IBM Key Protect: Choose this option if you want to use root keys in IBM Key Protect to encrypt your volumes. Make sure that you follow the [instructions](https://cloud.ibm.com/docs/containers?topic=containers-storage_portworx_encryption) to create your IBM Key Protect service instance, and to store the credentials for how to access your service instance in a Kubernetes secret in the portworx namespace before you install Portworx.



14. Optional: If you want to set up a journal device or KVDB devices, enter the device details in the Advanced Options field. Choose from the following options for journal devices.



* Enter j;auto to allow Portworx to automatically create a 3 GB partition on one of your block storage devices to use for the journal.
* Enter j;</device/path> to use a specific device for the journal. For example, enter j;/dev/vde to use the disk located at /dev/vde.
* [ibmcloud ks credential get](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_credential_get)
* [ibmcloud ks credential set classic](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_credentials_set)
* [ibmcloud ks credential unset](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_credentials_unset)



* [infra-permissions commands](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-cliinfra-commands)



* [ibmcloud ks infra-permissions get](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-cliinfra_permissions_get)



* [kms commands](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-cliks_kms)



* [ibmcloud ks kms crk ls](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-cliks_kms_crk_ls)
* [ibmcloud ks kms enable](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-cliks_kms_enable)
* [ibmcloud ks kms instance ls](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-cliks_kms_instance_ls)



* [quota commands](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_quota)