vania-janet/multiturn-rag-retrieval-data huggingface dataset:
[Prepare to add a custom domain mapping](https://cloud.ibm.com/docs/codeengine?topic=codeengine-domain-mappingsprepare-custom-domain) (outside of Code Engine).
3. [Configure custom domain mappings](https://cloud.ibm.com/docs/codeengine?topic=codeengine-domain-mappingscustom-domain) (from the Code Engine console or CLI).
4. [Complete the custom domain configuration with your domain registrar](https://cloud.ibm.com/docs/codeengine?topic=codeengine-domain-mappingscompleting-custom-domain-registrar) (outside of Code Engine).



After the custom domain mapping is created, you can [test](https://cloud.ibm.com/docs/codeengine?topic=codeengine-domain-mappingstest-custom-domain), [update](https://cloud.ibm.com/docs/codeengine?topic=codeengine-domain-mappingsupdate-custom-domain), [view](https://cloud.ibm.com/docs/codeengine?topic=codeengine-domain-mappingsview-domain-mapping), or [delete](https://cloud.ibm.com/docs/codeengine?topic=codeengine-domain-mappingsdelete-custom-domain) your custom domain mappings.



 Considerations before you use custom domain mappings in Code Engine 

Before you implement custom domain mappings in Code Engine, be aware of the following considerations:



* Code Engine supports custom domain mappings for domains that are protected with a SSL/TLS certificate, which is signed by a public, trusted certificate authority (CA).
* You can define custom domain mappings that point to public domain names.
* If your domain name can be resolved only by a nonpublic domain name system (DNS), you must provide a certificate that lists the domain name and is signed by a public, trusted CA.
WAF OWASP and Default CIS rule set OWASP and Default CIS rule set OWASP and Advanced CIS rule set OWASP and Premier CIS rule set OWASP and Default CIS rule set 
 Custom certificate 1 uploaded custom certificate per domain 25 included custom certificates <br>Additional certificates can be added at a monthly rate 25 included custom certificates <br>Additional certificates can be added at a monthly rate 25 included custom certificates <br>Additional certificates can be added at a monthly rate 1 uploaded custom certificate per domain 
 Page rules 50 page rules per domain <br><br> * 100 page rules per domain<br> * Additional settings for fine-grained control<br><br><br> <br><br> * 100 page rules per domain<br> * Additional settings for fine-grained control<br><br><br> <br><br> * 100 page rules per domain<br> * Additional settings for fine-grained control<br><br><br> <br><br> * 100 page rules per domain<br> * Additional settings for fine-grained control<br><br><br>
You can provide this information in a file.



Example format for a certificate chain

-----BEGIN CERTIFICATE-----
...certificate...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
...intermediate-certificate...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
...intermediate-certificate...
-----END CERTIFICATE-----

Or, to use an existing TLS secret,



1. Click Select.
2. Select the existing secret from the list that you want to use.



5. Specify the domain name and target component.



* Specify the fully qualified domain name for your custom domain name; for example, www.example.com.
* Select an existing target application; for example, myapp. For this example, the myapp application uses the icr.io/codeengine/helloworld sample image. For more information about the code that is used for this example, see [helloworld](https://github.com/IBM/CodeEngine/tree/main/helloworld).
* Notice the CNAME target field. This value is the CNAME entry that is required when you [complete the custom domain configuration with your domain registrar](https://cloud.ibm.com/docs/codeengine?topic=codeengine-domain-mappingscompleting-custom-domain-registrar) so that traffic that targets your custom domain is routed to the specified application.



6. Click Create to create the custom domain mapping.



Now you have a domain mapping that is created in Code Engine. However, requests that are sent to your application are not (yet) routed to your custom domain. Next, [complete the custom domain configuration with your domain registrar](https://cloud.ibm.com/docs/codeengine?topic=codeengine-domain-mappingscompleting-custom-domain-registrar).
oc get svc -n openshift-ingress
2. Create a custom domain with your DNS provider. If you want to use the same subdomain for multiple services in your cluster, you can register a wildcard subdomain, such as .example.com.
3. Map your custom domain to the Ingress controller services' private IP address by adding the IP addresses as A records.





3. Set up a route based on the [type of TLS termination that your app requires](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_routesroute-types). If you don't have a custom domain, don't include the --hostname option. A route subdomain is generated for you in the format <service_name>-<project>.<cluster_name>-<random_hash>-0000.<region>.containers.appdomain.cloud. If you registered a wildcard subdomain, specify a unique subdomain in each route that you create. For example, you might specify --hostname svc1.example.com in this route, and --hostname svc2.example.com in another route.



* Simple:

oc expose service <app_service_name> [--hostname <subdomain>]
* Passthrough:

oc create route passthrough --service <app_service_name> [--hostname <subdomain>]

Need to handle HTTP/2 connections? After you create the route, run oc edit route <app_service_name> and change the route's targetPort value to https. You can test the route by running curl -I --http2 https://<route> --insecure.
* Edge: If you use a custom domain, include --hostname, --cert, and --key options, and optionally the --ca-cert option.
Show more
<-- </section "id="section-update-cert-examples" "> --><-- </section "id="section-update-cert" "> --><-- <section "id="section-change-priority-custom-cert" "> --> ibmcloud cis certificate-priority-change Change custom certificates' priority for a given DNS domain. ibmcloud cis certificate-priority-change DNS_DOMAIN_ID (--json @JSON_FILE | JSON_STRING) -i, --instance INSTANCE] --output FORMAT]
Deprecated] ibmcloud cis certificate-priority-change DNS_DOMAIN_ID (-s, --json-str JSON_STR | -j, --json-file JSON_FILE) -i, --instance INSTANCE] --output FORMAT] ! !!!!!!
<-- <section "id="section-change-priority-custom-options" "> --> Command options DNS_DOMAIN_ID: The ID of DNS domain. Required.--json: The JSON file or JSON string used to describe the custom certificates' priority. Required.
<-- <ul> -->

* The required fields in JSON data are certificates:

<-- <ul> -->

* certificates: An array of objects with the follow fields.

<-- <ul> -->

* id: Custom certificate identifier.
* priority: The order/priority in which the certificate is used in a request. Higher numbers are tried first.

<-- </ul> -->

<-- </ul> -->

<-- </ul> -->

Sample JSON data: {
"certificates":
{
"id":"5a7805061c76ada191ed06f989cc3dac",
"priority":2
},
{
For the CDN domain cdn.example.com, you can add a CNAME type record to point this domain to IBM CNAME:

Scroll for more

Scroll for more



Table 1. Add CNAME type record to point to CNAME

 Resource Type Host Points to (CNAME) TTL 

 CNAME cdn.example.com example.cdn.appdomain.cloud. 15 minutes 



--------------------





 Challenge domain 

The challenge domain is a new domain, specific for your CDN domain. By setting a CNAME record in your DNS system for the challenge domain, CA can also validate your CDN domain. If you choose this method, you don't need to change the CDN domain's record, therefore it has no effect on the traffic if your domain is running service.

The Challenge domain format is: _acme-challenge.<CDN domain> The Challenge CNAME format is: <CDN domain>.ak-acme-challenge.cdn.appdomain.cloud.

For example, the CDN domain is cdn.example.com, then the challenge domain CNAME record would be:

Scroll for more

Scroll for more



Table 2. Challenge domain CNAME

 Resource Type Host Points to (CNAME) TTL 

 CNAME _acme-challenge.cdn.example.com cdn.example.com.ak-acme-challenge.cdn.appdomain.cloud. 15 minutes 



Using the challenge domain validation method can keep your domain always active in the certificate even after you migrate the CDN domain to others. When using other methods, you would receive an [email alert](https://cloud.ibm.com/docs/CDN?topic=CDN-faq-for-httpsi-received-an-email-indicating-that-my-domain-is-not-pointed-to-IBM-CDN-CNAME) after you migrate to others.

--------------------





 Standard
ibmcloud account domain-cert YOUR_CUSTOM_DOMAIN





 Upload SSL certificate into Datapower 

If you have a urgent need to refresh your SSL certificate but you are not ready to migrate to Secret Manager, you can uploaded new cert for custom domain with the same procedure you were using in the past.

Use IBM command line to perform removal of older SSL certificate (this will remove certificate from Datapower) :

ibmcloud account domain-cert-remove YOUR_CUSTOM_DOMAIN

and then import the new version of certificate via command (this will import new version of certificate into Datapower):

ibmcloud account domain-cert-add YOUR_CUSTOM_DOMAIN

You can determine the SSL certificates uploaded by running the [following command:](https://cloud.ibm.com/docs/data-virtualization?topic=cli-ibmcloud_commands_accountibmcloud_account_domain_cert)

ibmcloud account domain-cert YOUR_CUSTOM_DOMAIN

This is an emergency procedure, you will still be required to migrate your certificate to Secret Manager in the required timeline.
* [Register a custom domain with IBM Cloud Internet Services](https://cloud.ibm.com/docs/Registry?topic=Registry-multi-region-k8s-cismulti-region-k8s-cis-create_cis_instance)
* [Configure Health Check for the Global Load Balancer](https://cloud.ibm.com/docs/Registry?topic=Registry-multi-region-k8s-cismulti-region-k8s-cis-12)
* [Define Origin Pools](https://cloud.ibm.com/docs/Registry?topic=Registry-multi-region-k8s-cismulti-region-k8s-cis-13)



* [One pool for the cluster in Dallas](https://cloud.ibm.com/docs/Registry?topic=Registry-multi-region-k8s-cismulti-region-k8s-cis-14)
* [One pool for the cluster in London](https://cloud.ibm.com/docs/Registry?topic=Registry-multi-region-k8s-cismulti-region-k8s-cis-15)
* [And one pool with both clusters](https://cloud.ibm.com/docs/Registry?topic=Registry-multi-region-k8s-cismulti-region-k8s-cis-16)



* [Create the Global Load Balancer](https://cloud.ibm.com/docs/Registry?topic=Registry-multi-region-k8s-cismulti-region-k8s-cis-17)



* [Secure the application](https://cloud.ibm.com/docs/Registry?topic=Registry-multi-region-k8s-cismulti-region-k8s-cis-secure_via_CIS)



* [Turn the Web Application Firewall On](https://cloud.ibm.com/docs/Registry?topic=Registry-multi-region-k8s-cismulti-region-k8s-cis-20)
* Some users in their DNS forwarding to these custom domains are using only A records, or specific IP addresses, and not CNAME records, like "custom-domain.us-south.cf.cloud.ibm.com" like instructions explain. If you use A record IP addresses ONLY in your DNS forwarding, then this change may cause your application to not forward, even if you upload the SSL certificates.







 Cloud Foundry domains 

You can examine which domains you currently have set up on your IBM Cloud account that might be served by IBM Cloud Foundry applications, using one of the methods below.



 UI method 



1. Log into [cloud.ibm.com](https://cloud.ibm.com/docs/cloud.ibm.com)
2. Go to [https://cloud.ibm.com/account/cloud-foundry](https://cloud.ibm.com/account/cloud-foundry)
3. For each listed org:

a. Click on the ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/icons/action-menu-icon.svg) on the right side, and select "Domains". That will show you the custom domains you have set up for each region pointing to that org.







 CLI method 



1. Login to the ibmcloud using ibmcloud login
2. For each region pointed to by a custom domains:

a. Target an IBM Cloud region using the ibmcloud target --cf-api api.<region>.cf.cloud.ibm.com and reference [Region list](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-endpoints) if needed.

b. After targeting a region, run the command ibmcloud cf orgs.

c. For each org that is listed, target the org using the ibmcloud target -o <orgname> command.

d. Run the command cf domains | grep -v shared.
You can update an error page by re-publishing it.

If CIS cannot load your site, or you have blocked the US in the CIS firewall, publishing and previewing the error page does not work.





 Troubleshooting error pages 



* If you encounter errors while attempting to preview or publish your custom error page, run it through a HTML validator and ensure that it is error free.
* Make sure that the minimum page size is greater than 0. You must add content to your page.
* Make sure that you are serving the custom error page with a 200 status code.
* If we cannot load your site, or you have blocked the US in the IP firewall, publishing and previewing the error page does not work.
For more information about connecting to external networks, see [External connectivity](https://cloud.ibm.com/docs/vpc?topic=vpc-about-networking-for-vpcexternal-connectivity).





 Forwarding DNS queries across VPCs 

You might want to create custom resolvers on multiple VPCs and use these custom resolvers to follow the spoke-and-hub paradigm. In this configuration, you must interconnect the VPCs through a transit gateway in advance.

For more information about interconnecting VPCs using a transit gateway, see [Managing transit gateways](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-adding-connections).

To form the spoke-and-hub topology for custom resolvers across different VPCs, choose one custom resolver as the hub and manage its forwarding rules in the hub custom resolver. You must also edit the default forwarding rule in each spoke custom resolver to forward DNS queries to the hub custom resolver.





 Adding a secondary zone to a custom resolver 

The following sections show some use cases for adding a secondary zone to your custom resolvers.



 Duplicate zone records from on-premises DNS servers to custom resolver locations 

This duplication provides increased availability for zone records. If the on-premises servers become unavailable for any reason, you can make DNS queries to custom resolver locations which then return the same responses as the on-premises servers.

After the zone has been configured, records are automatically updated in the custom resolver locations so that any changes made to on-premises records are reflected in the custom resolver locations.





 DNS queries for secondary zone records can be made within the VPC to custom resolver locations directly 

To increase DNS query response times, you can choose a DNS server that is closer to the source. For instance, if the query is being made in the on-premises network, it can be directed at the on-premises DNS servers. Alternatively, if the query is being made in your VPC network, it can be directed at a configured custom resolver location.
Add-DnsServerResourceRecordA -Name "api-int.ocp.dallas" -ZoneName "ibm.local" -AllowUpdateAny -IPv4Address "10.208.242.132" -CreatePtr -TimeToLive 00:00:10

 Create DNS SRV record for etcd
Add-DnsServerResourceRecord -Srv -ZoneName "ibm.local" -Name "_etcd-server-ssl._tcp.ocp.dallas" -DomainName "etcd-0.ocp.dallas.ibm.local" -Priority 10 -Weight 0 -Port 2380
Add-DnsServerResourceRecord -Srv -ZoneName "ibm.local" -Name "_etcd-server-ssl._tcp.ocp.dallas" -DomainName "etcd-1.ocp.dallas.ibm.local" -Priority 10 -Weight 0 -Port 2380
Add-DnsServerResourceRecord -Srv -ZoneName "ibm.local" -Name "_etcd-server-ssl._tcp.ocp.dallas" -DomainName "etcd-2.ocp.dallas.ibm.local" -Priority 10 -Weight 0 -Port 2380
Show more





 Related links 



* [IBM Cloud for VMware Solutions and Red Hat OpenShift overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-openshift-runbook-runbook-intro)
* [Prerequisites for installation](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-openshift-runbook-runbook-prereq-intro)
* [Red Hat OpenShift NSX configuration](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-openshift-runbook-runbook-nsxedge-intro)
ibmcloud cis edge-functions-triggers DNS_DOMAIN_ID [-i, --instance INSTANCE] [--output FORMAT]



 Command options 

DNS_DOMAIN_ID
: The ID of DNS domain. Required.

-i, --instance
: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.

--output
: Specify output format, only JSON is supported.





 Examples 

List all Edge Functions triggers for domain 31984fea73a15b45779fa0df4ef62f9b.

ibmcloud cis edge-functions-triggers 31984fea73a15b45779fa0df4ef62f9b -i "cis-demo"







 ibmcloud cis edge-functions-trigger 

Show an Edge Functions trigger for a given domain of a service instance.

ibmcloud cis edge-functions-trigger DNS_DOMAIN_ID TRIGGER_ID [-i, --instance INSTANCE] [--output FORMAT]



 Command options 

DNS_DOMAIN_ID
: The ID of DNS domain. Required.

TRIGGER_ID
: The ID of the trigger. Required.

-i, --instance
: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.

--output
: Specify output format, only JSON is supported.





 Examples 

Show details of Edge Functions trigger 9a7806061c88ada191ed06f989cc3dac.

ibmcloud cis edge-functions-trigger 31984fea73a15b45779fa0df4ef62f9b 9a7806061c88ada191ed06f989cc3dac -i "cis-demo"







 ibmcloud cis edge-functions-trigger-create 

Create an Edge Functions trigger for a given domain of a service instance.
* Click Create and choose Secrets Manager as the source service.
* Choose All instances or just the Secrets Manager created earlier.
* Internet Services as the target service.
* Choose All instances or just the CIS created earlier.
* Assign the Manager service access role.
* Click on Authorize.



If your CIS instance supports multiple domains, you can also assign Reader role to the CIS instance and Manager to the specific domain that is you are using for your solution. See [granting service access to specific domains](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-prepare-order-certificatesauthorize-specific-domains) topic.



IBM CIS supports proxying for global load balancers. When a load balancer is proxied, it means that its traffic runs directly through CIS. Load balancers support both DNS-only and HTTP proxy modes, consider which of the two alternatives below best match your use case before proceeding as the traffic routing behavior differs as follows:



* Alternative 1: Traffic that is proxied flows through CIS.
* Alternative 2: Traffic that is non-proxied (DNS-only mode) flows directly from the client to the origin. In DNS-only mode, none of the CIS security, performance, and reliability features are applied.



Zoom

![Traffic flow](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/solution41-vpc-multi-region/vpc-multi-region-alternatives.svg)

Traffic flow

For more information read through the [Proxying DNS records and global load balancers](https://cloud.ibm.com/docs/cis?topic=cis-dns-conceptsdns-concepts-proxying-dns-records) topic.





 Alternative 1: Proxy, traffic flows through CIS 

This first alternative creates a wildcard certificate for example.com and then proxies it in the IBM Cloud Internet Services (CIS) allowing you to take advantage of industry leading security, protection and performance capabilities.
* Code Engine supports custom domain mappings for domains that are protected with a SSL/TLS certificate, which is signed by a public, trusted certificate authority (CA).
* You can define custom domain mappings that point to public domain names.
* If your domain name can be resolved only by a nonpublic domain name system (DNS), you must provide a certificate that lists the domain name and is signed by a public, trusted CA.
* You must provide the entire certificate chain, starting with the certificate that corresponds to the custom domain, followed by all intermediate certificates up to the root certificate.
* You cannot use self-signed certificates.
* You cannot use certificates that are signed by an untrusted or a nonpublic enterprise CA.







 Preparing to add a custom domain mapping 

When you want to use a custom domain mapping with Code Engine application, you must take the following actions outside of Code Engine before you can create the custom domain mapping.



1. From a domain registrar, obtain your custom domain; for example, www.example.com.
2. From your certificate authority (CA), you must obtain a signed SSL/TLS certificate for your custom domain. This certificate is a type of digital certificate that is used to establish communication privacy between a server and a client. Certificates contain information that is used to create trusted and secure connections between endpoints. You must also obtain a matching private key for the TLS certificate. For security reasons, Code Engine supports only custom domain mappings that are configured with a TLS/SSL certificate that is signed by a public, trusted CA.





 How can I obtain a certificate for my custom domain? 

In an enterprise environment, work with your corporate domain administrator to obtain the necessary certificates. However, if the custom domain is within your control and you want quickly create a certificate that is not self-certified, then you can optionally use the [Let's Encrypt](https://letsencrypt.org/) service and [Certbot](https://certbot.eff.org/) to obtain a certificate.



1. Install [Certbot](https://certbot.eff.org/).
Registering new domains 

Effective 30 June 2023, IBM Cloud will no longer support the Domain Name Registration service, which is offered in partnership with Tucows Inc. For more information, see [Domain Name Registration domain transfer](https://cloud.ibm.com/docs/dns?topic=dns-domain-name-registration-domain-transfer).

Follow these steps to register a new domain, either one at a time, or multiple domains at one time.



1. From your browser, open the [IBM Cloud® console](https://cloud.ibm.com/) and log in to your account.
2. Select the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/86dadb3996e7fa2b119c2c09bda56dbc01297416/icons/icon_hamburger.svg), then click Classic Infrastructure.
3. From the Classic Infrastructure menu, select Services > Domain Registration to open the Domains page.
4. Choose the Register tab.

Select the Register Multiple Domains? option within the Register tab if you are registering multiple domains at one time.
5. Enter the new domain name in the Domain Name field.
6. Select the domain type from the Domain list.
7. Select the amount of time to reserve the domain from the Registration Time list.

The price for each time period is displayed next to the amount of time and will be charged to the account when the new domain is registered.
8. If registering multiple domains, select the Add Another option to populate additional blank fields for more domain entries.

Select the Delete icon to delete an entire entry from the page.
9. Click the Check Availability button to check whether the domain names are available. If all domains are available, proceed to the next step. If one or more domains are not available, try again with another domain.
10. Click the Continue button to register the domain.





 Next steps