vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Setting up IBM Cloud Object Storage 

[IBM Cloud Object Storage](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-getting-started-cloud-object-storage) is persistent, highly available storage that you can mount to your apps. The plug-in is a Kubernetes Flex-Volume plug-in that connects Cloud Object Storage buckets to pods in your cluster. Information stored with IBM Cloud Object Storage is encrypted in transit and at rest, dispersed across many geographic locations, and accessed over HTTP by using a REST API.

If you want to use IBM Cloud Object Storage in a private cluster without public network access, you must set up your IBM Cloud Object Storage service instance for HMAC authentication. If you don't want to use HMAC authentication, you must open up all outbound network traffic on port 443 for the plug-in to work properly in a private cluster.



 Creating your object storage service instance 

Before you can start using object storage in your cluster, you must provision an IBM Cloud Object Storage service instance in your account.

The IBM Cloud Object Storage plug-in works with any s3 API endpoint. For example, you might want to use a local Cloud Object Storage server, such as [Minio](https://min.io/), or connect to an s3 API endpoint that you set up at a different cloud provider instead of an IBM Cloud Object Storage service instance.

Follow these steps to create an IBM Cloud Object Storage service instance. If you plan to use a local Cloud Object Storage server or a different s3 API endpoint, see the provider documentation to set up your Cloud Object Storage instance.



1. Open the [IBM Cloud Object Storage catalog page](https://cloud.ibm.com/objectstorage/create).
2. Enter a name for your service instance, such as cos-backup, and select the same resource group that your cluster is in. To view the resource group of your cluster, run ibmcloud oc cluster get --cluster <cluster_name_or_ID>.
3.
For more information, about how network traffic flows when a public and a private service endpoint is enabled, see Worker-to-master and user-to-master communication: Service endpoints in [IBM Cloud Kubernetes Service](https://cloud.ibm.com/docs/containers?topic=containers-plan_clusters) and [Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-plan_clustersworkeruser-master).



Keep in mind that creating a cluster incurs costs. Make sure to review [What am I charged for when I use IBM Cloud Kubernetes Service?](https://cloud.ibm.com/docs/containers?topic=containers-faqscharges) or [What am I charged for when I use Red Hat OpenShift on IBM Cloud?](https://cloud.ibm.com/docs/openshift?topic=openshift-faqscharges) before you proceed.



 Objectives 

In this tutorial, you will:



* Learn how to create a single zone IBM Cloud Kubernetes Service or Red Hat OpenShift on IBM Cloud cluster with Terraform on IBM Cloud.
* Convert your single zone cluster into a multizone cluster for higher availability.
* Add a new worker pool to the cluster.
* Remove the default worker pool that is automatically set up during cluster creation.







 Audience 

This tutorial is intended for system administrators that want to learn how to create an IBM Cloud Kubernetes Service or Red Hat OpenShift on IBM Cloud cluster and spread this cluster across zones.





 Prerequisites 



* If you do not have one, create an [IBM Cloud Pay-As-You-Go or Subscription IBM Cloud account](https://cloud.ibm.com/registration).
* Install the [IBM Cloud command line and the IBM Cloud Kubernetes Service command line plug-in](https://cloud.ibm.com/docs/cli?topic=cli-getting-started).
These charts are not verified to work in IBM Cloud Kubernetes Service or IBM Cloud Private clusters.
* kubernetes-incubator: Helm charts that are provided by the Kubernetes community and considered incubator by the community governance. These charts are not verified to work in IBM Cloud Kubernetes Service or IBM Cloud Private clusters.
* entitled: Helm charts of licensed software that you must purchase and for which you must set up cluster access with an entitlement key. For more information, see [Setting up a cluster to pull entitled software](https://cloud.ibm.com/docs/containers?topic=containers-registrysecret_entitled_software).



Helm charts from the iks-charts, ibm-charts, and, if licensed, entitled repositories are fully integrated into the IBM Cloud support organization. If you have a question or an issue with using these Helm charts, you can use one of the IBM Cloud Kubernetes Service support channels. For more information, see [Getting help and support](https://cloud.ibm.com/docs/containers?topic=containers-get-help). [Install the latest release of Helm v3](https://cloud.ibm.com/docs/containers?topic=containers-helminstall_v3).







 Installing Helm v3 in your cluster 

Set up Helm v3 and the IBM Cloud Helm repositories in your cluster.

Before you begin: [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)



1. Install the latest release of the version 3 [Helm CLI](https://github.com/helm/helm/releases) on your local machine.
2. Add the IBM Cloud Helm repositories to your Helm instance.
* IBM Cloud Kubernetes Service or Red Hat OpenShift on IBM Cloud clusters. When you create IBM Cloud Kubernetes Service and Red Hat OpenShift on IBM Cloud clusters, one service ID is automatically created for each cluster. If you want more than one service ID, you can create them manually.
* Kubernetes and Red Hat® OpenShift® clusters that aren't on IBM Cloud. You must create your own service ID, API key, and pull secret.
* Docker CLI and other clients. You must create your own service ID and API key.





 Creating a service ID API key manually 

Create a service ID API key that you can use to log in to the registry.

To create a service ID API key, complete the following steps:



1. Create a service ID, see [ibmcloud iam service-id-create](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iamibmcloud_iam_service_id_create).
2. Assign service policies to the service ID to control the level of access that is allowed when the service ID is used to authenticate with IBM Cloud Container Registry, see [Managing access to resources](https://cloud.ibm.com/docs/account?topic=account-assign-access-resources).
3. Create a service ID API key, see [Managing service ID API keys](https://cloud.ibm.com/docs/account?topic=account-serviceidapikeys) and [ibmcloud iam service-api-key-create](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iamibmcloud_iam_service_api_key_create).







 Creating a user API key manually 

Create a user API key that you can use to log in to the registry.

If you create a user API key, the user's access policies are used.
4.2.8 IBM Cloud Kubernetes Service ensures that the hostname matches the name issued by the infrastructure. 
 4.2.11 IBM Cloud Kubernetes Service rotates certificates on every worker node reload or update. 
 4.2.12 IBM Cloud Kubernetes Service rotates certificates on every worker node reload or update. 
 5.1.2 IBM Cloud Kubernetes Service deploys some system components that could have their Kubernetes secret access further restricted. 
 5.1.3 IBM Cloud Kubernetes Service deploys some system components that could have their Kubernetes resource access further restricted. 
 5.1.5 IBM Cloud Kubernetes Service does not set [automountServiceAccountToken: false](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/use-the-default-service-account-to-access-the-api-server) for each default service account. 
 5.1.6 IBM Cloud Kubernetes Service deploys some system components that could set [automountServiceAccountToken: false](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/use-the-default-service-account-to-access-the-api-server). 
 5.2.1 IBM Cloud Kubernetes Service can optionally configure [Pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/).
Your worker nodes are controlled by a highly available Red Hat OpenShift master that is configured, monitored, and managed by IBM. You can use the IBM Cloud Kubernetes Service API or CLI to work with your cluster infrastructure resources and the Kubernetes API or CLI to manage your deployments and services.

For more information about how your cluster resources are set up, see the [Service architecture](https://cloud.ibm.com/docs/containers?topic=containers-service-arch). To find a list of capabilities and benefits, see [Benefits and service offerings](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_ov).
* Why should I use Red Hat OpenShift on IBM Cloud?

Red Hat OpenShift on IBM Cloud is a managed Red Hat OpenShift offering that delivers powerful tools, an intuitive user experience, and built-in security for rapid delivery of apps that you can bind to cloud services that are related to IBM Watson®, AI, IoT, DevOps, security, and data analytics. As a certified Kubernetes provider, Red Hat OpenShift on IBM Cloud provides intelligent scheduling, self-healing, horizontal scaling, service discovery and load balancing, automated rollouts and rollbacks, and secret and configuration management. The service also has advanced capabilities around simplified cluster management, container security and isolation policies, the ability to design your own cluster, and integrated operational tools for consistency in deployment.

For a detailed overview of capabilities and benefits, see [Benefits of using the service](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_ovbenefits).
* What container platforms are available for my cluster?

With IBM Cloud, you can create clusters for your containerized workloads from two different container management platforms: the IBM version of community Kubernetes and Red Hat OpenShift on IBM Cloud. The container platform that you select is installed on your cluster master and worker nodes. Later, you can [update the version](https://cloud.ibm.com/docs/containers?topic=containers-updateupdate) but can't roll back to a previous version or switch to a different container platform.
Ingress in IBM Cloud 

Ingress is a Kubernetes service discovery method that exposes the services in your cluster to the public or private network by forwarding requests to your apps and balancing network traffic workloads. Ingress manages external access to your services based on a set of routing rules that you configure and that are applied to all incoming traffic.

When you provision an IBM Cloud Kubernetes Service cluster, IBM provides all the components required to use Ingress. Then, when you are ready to get started, you create an Ingress resource to specify how these components work together.

For more information about Kubernetes Ingress, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/services-networking/ingress/).



 IBM-provided Ingress components 

All the components required to use Ingress are provided for you when you create a cluster. You specify these components when you create your Ingress resource.



* Ingress domain
* Ingress class
* Application Load Balancers (ALBs)
* TLS certificate



If you do not want to use the IBM-provided components, you can [create custom components](https://cloud.ibm.com/docs/containers) that you specify in your Ingress resource instead.



 Ingress domain 

The default Ingress domain is used to form a unique URL for each app in your cluster, and is the domain that is referenced by the IP addresses of any ALBs in your cluster. When you create a cluster, a unique Ingress subdomain is automatically created and registered as the default domain. You can [change the default domain](https://cloud.ibm.com/docs/containers?topic=containers-ingress-domainsingress-domain-manage-default) to any domain that exists in your cluster.

You can also [create or add your own domain](https://cloud.ibm.com/docs/containers?topic=containers-ingress-domains) registered with IBM Cloud's internal domain provider, or a domain registered with an external provider. Currently, IBM Cloud supports external domains registered with IBM Cloud Internet Services, Akamai, or Cloudflare.
Deployment Journey Overview 

IBM Cloud Kubernetes Service(IKS) is a managed offering to create your own Kubernetes cluster of compute hosts to deploy and manage containerized apps on IBM Cloud. As a certified Kubernetes provider, IBM Cloud Kubernetes Service provides intelligent scheduling, self-healing, horizontal scaling, service discovery and load balancing, automated rollouts and rollbacks, and secret and configuration management for your apps. Combined with an intuitive user experience, built-in security and isolation, and advanced tools to secure, manage, and monitor your cluster workloads, you can rapidly deliver highly available and secure containerized apps in the public cloud.

Welcome to the Deployment Journey for Cloud Native on IBM Cloud! Use the sidebar on the left to navigate between the journey points.



 Journey Map 

![Architecture](https://cloud.ibm.com/docs-content/v1/content/b7b9235ce6abd45b66931867c388cf107d38e15b/cloud-native-journey/kubernetes-on-vpc/images/overview/journey-map.png)





 Assumptions 

This deployment guide will be assuming the following points. Please note that while your circumstance may not be exactly identical, you will still benefit from the overall journey steps and concepts covered in this guide.



* You are already familar with the concepts introduced in the "Tour IBM Cloud" videos available on the [Getting Started with IBM Cloud](https://cloud.ibm.com/cloud/get-started) page.
* Access groups will need to be defined so only certain users have the ability to create and manage the VPC network settings (i.e. CIDR ranges, Subnet ACLs rules, etc.).
* When you create your cluster, you must choose a VPC networking setup so that certain cluster components can communicate with each other and with networks or services outside of the cluster.



* Worker-to-worker communication: All worker nodes must be able to communicate with each other on the private network through VPC subnets.
When you enable this integration, a Reader[service-to-service authorization policy](https://cloud.ibm.com/docs/account?topic=account-serviceauth) between IBM Cloud Kubernetes Service and Key Protect is automatically created for your cluster, if the policy does not already exist. If you have a cluster that runs an earlier version, [update your cluster](https://cloud.ibm.com/docs/containers?topic=containers-update) and then [re-enable KMS encryption](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkeyprotect) to register your cluster with Key Protect again.

Worker node versions
: Worker node fix pack update change log documentation is available.
: Kubernetes version [1.19.4_1528](https://cloud.ibm.com/docs/containers?topic=containers-changelog_1191194_1528), [1.18.12_1534](https://cloud.ibm.com/docs/containers?topic=containers-118_changelog11812_1534), [1.17.14_1546](https://cloud.ibm.com/docs/containers?topic=containers-117_changelog11714_1546), and [1.16.15_1553](https://cloud.ibm.com/docs/containers?topic=containers-116_changelog11615_1553)..





 3 December 2020 

Cluster autoscaler add-on
: Patch update 1.0.1_146 is released. For more information, see the [Cluster autoscaler add-on change log](https://cloud.ibm.com/docs/openshift?topic=openshift-ca_changelog).

Istio add-on
5.1.5 IBM Cloud Kubernetes Service does not set [automountServiceAccountToken: false](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/use-the-default-service-account-to-access-the-api-server) for each default service account. 
 5.1.6 IBM Cloud Kubernetes Service deploys some system components that could set [automountServiceAccountToken: false](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/use-the-default-service-account-to-access-the-api-server). 
 5.2.1 IBM Cloud Kubernetes Service can optionally configure [pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 5.2.2 IBM Cloud Kubernetes Service can optionally configure [pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 5.2.3 IBM Cloud Kubernetes Service can optionally configure [pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/).
5.1.5 IBM Cloud Kubernetes Service does not set [automountServiceAccountToken: false](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/use-the-default-service-account-to-access-the-api-server) for each default service account. 
 5.1.6 IBM Cloud Kubernetes Service deploys some system components that could set [automountServiceAccountToken: false](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/use-the-default-service-account-to-access-the-api-server). 
 5.2.1 IBM Cloud Kubernetes Service can optionally configure [Pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 5.2.2 IBM Cloud Kubernetes Service can optionally configure [Pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 5.2.3 IBM Cloud Kubernetes Service can optionally configure [Pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/).
IBM Log Analysis 

IBM Cloud includes the IBM Log Analysis service which is useful for viewing and parsing the logs of your IBM® Blockchain Platform nodes and smart contract containers.

This tutorial describes how to configure IBM Log Analysis service to work with your IBM Blockchain Platform service instance. First, you need to configure cluster-level logging for you Kubernetes cluster. Then, you can access the Open Dashboard from the Logging tab of the Observability dashboard in IBM Cloud.



 Step one: Configure cluster-level logging 

You need to deploy an instance of the IBM Log Analysis service in your IBM Cloud account. Complete the steps in the [Managing Kubernetes cluster logs with IBM Log Analysis](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-kube) tutorial. If you are using an OpenShift cluster on IBM Cloud you will need to configure the IBM Log Analysis agent. Refer to these [instructions](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-config_agent_os_cluster).





 Step two: View the logs for your IBM Blockchain Platform nodes 

Using the IBM Log Analysis service makes viewing your IBM Blockchain Platform node logs simple. The search input box located at the end of the IBM Log Analysis page can be used to filter the logs. See the following examples.



 View node logs 

When you deploy a peer, Certificate Authority (CA), or ordering node, a new pod is created in your Kubernetes cluster. You can use the name of the pod to filter the logs by node. For example, to view the logs of a peer node simply add the text pod:<pod_name_of_peer_node> to the search input box, replacing <pod_name_of_peer_node> with the name of the peer node pod. The pod name of your node can be obtained by using kubectl commands such as kubectl get pod, or it is visible in your Kubernetes dashboard.

kubectl get po
* [About Helm in IBM Cloud Kubernetes Service](https://cloud.ibm.com/docs/containers?topic=containers-helmabout-helm)



* [What is Helm and how do I use it?](https://cloud.ibm.com/docs/containers?topic=containers-helmwhat-is-helm)
* [What Helm charts are supported in IBM Cloud Kubernetes Service?](https://cloud.ibm.com/docs/containers?topic=containers-helmsupported-charts)



* [Installing Helm v3 in your cluster](https://cloud.ibm.com/docs/containers?topic=containers-helminstall_v3)



[Adding services by using IBM Cloud service binding](https://cloud.ibm.com/docs/containers?topic=containers-service-bindingservice-binding)



* [About service binding](https://cloud.ibm.com/docs/containers?topic=containers-service-bindingsvc-bind-about)



* [What types of services can I bind to my cluster?](https://cloud.ibm.com/docs/containers?topic=containers-service-bindingsvc-bind-types)
* [What is IBM Cloud service binding?](https://cloud.ibm.com/docs/containers?topic=containers-service-bindingsvc-bind-what)
* [I already have an IBM Cloud service. Can I still use IBM Cloud service binding?](https://cloud.ibm.com/docs/containers?topic=containers-service-bindingsvc-bind-existing)
* [What if I want to use service credentials that use the private cloud service endpoint?](https://cloud.ibm.com/docs/containers?topic=containers-service-bindingsvc-bind-private-cse)
* [Can I use all IBM Cloud services in my cluster?](https://cloud.ibm.com/docs/containers?topic=containers-service-bindingsvc-bind-which)
Why does binding a service to a cluster results in service not found error? 

Virtual Private Cloud

Classic infrastructure

 What’s happening 

When you run ibmcloud oc cluster service bind --cluster <cluster_name> --namespace <project> --service <service_instance_name>, you see the following message.

Binding service to a namespace...
FAILED

The specified IBM Cloud service could not be found. If you just created the service, wait a little and then try to bind it again. To view available IBM Cloud service instances, run 'ibmcloud service list'. (E0023)

 Why it’s happening 

To bind services to a cluster, you must have the Cloud Foundry developer user role for the space where the service instance is provisioned.

In addition, you must have the IBM Cloud IAM Editor platform access to IBM Cloud Kubernetes Service. To access the service instance, you must be logged in to the space where the service instance is provisioned.

 How to fix it 

Complete the following steps based on your role.



 Cluster user 



1. Log in to IBM Cloud.

ibmcloud login
2. Target the org and the space where the service instance is provisioned.

ibmcloud target -o <org> -s <space>
3. Verify that you are in the correct space by listing your service instances.

ibmcloud service list
4. Try binding the service again. If you get the same error, then contact the account administrator and verify that you have sufficient permissions to bind services (see the following account admin steps).







 As the account admin 



1. Verify that the user who experiences this problem has [Editor permissions for IBM Cloud Kubernetes Service](https://cloud.ibm.com/docs/openshift?topic=openshift-userschecking-perms).
2.