vania-janet/multiturn-rag-retrieval-data huggingface dataset:
--disable-public-service-endpoint
: Include this option in your command to create your VPC cluster with a private cloud service endpoint only. If you don't include this option, your cluster is set up with a public and a private cloud service endpoint. The service endpoint determines how your Red Hat OpenShift master and the worker nodes communicate, how your cluster access other IBM Cloud services and apps outside the cluster, and how your users connect to your cluster. For more information, see [Planning your cluster network setup](https://cloud.ibm.com/docs/openshift?topic=openshift-plan_clusters). If you include this option, your cluster is created with routers and Ingress controllers that expose your apps on the private network only by default. If you later want to expose apps to a public network, you must manually create public routers and Ingress controllers.

--kms-account-id <KMS_acount_ID>
: Optional: Must be included if the --kms-instance-id and --crk options are provided and the KMS instance resides in an account different from the cluster's account, otherwise it can be omitted. Setting up encryption by using a KMS from a different account is available for allowlisted accounts only. To get added to the allowlist, [open a case](https://cloud.ibm.com/unifiedsupport/cases/form) with support.

--kms-instance <KMS_instance_ID>
: Optional: Include the ID of a key management service (KMS) instance to use to encrypt the local disk on the worker nodes in the default worker pool. To list available KMS instances, run ibmcloud oc kms instance ls. If you include this option, you must also include the --crk option. Before you can use KMS encryption, you must create a KMS instance and set up the required service authorization in IAM. See [Managing encryption](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionworker-encryption) for the worker nodes in your cluster.
* [Enabling public or private access to an app by using a network load balancer (NLB) service in a multizone cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-loadbalancermulti_zone_config).
* [Managing network traffic by using Ingress](https://cloud.ibm.com/docs/containers?topic=containers-managed-ingress-about).
* [Increasing the availability of your app](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_apps).



When you initiate cluster management actions, such as running [ibmcloud oc commands](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-cli), basic information about the cluster, such as name, ID, user, the command is routed through the global endpoint.







 Satellite regions 

To see a list of the supported Managed from regions for Satellite clusters, [Supported Satellite locations](https://cloud.ibm.com/docs/satellite?topic=satellite-sat-regions).





 Accessing the global endpoint 

You can organize your resources across IBM Cloud services by using IBM Cloud locations (formerly called regions). For example, you can deploy an app to a cluster by using a private Docker image that is stored in your IBM Cloud Container Registry of the same location. To access these resources, you can use the global endpoints and filter by location.



 Logging in to IBM Cloud 

When you log in to the IBM Cloud (ibmcloud) command line, you are prompted to select a region. However, this region does not affect the Red Hat OpenShift on IBM Cloud plug-in (ibmcloud oc) endpoint, which still uses the global endpoint. Note that you do still need to target the resource group that your cluster is in if it is not in the default resource group.

To log in to the IBM Cloud global API endpoint and target the resource group that your cluster is in:
Your responsibilities with using IBM Cloud Kubernetes Service 

Learn about cluster management responsibilities that you have when you use IBM Cloud® Kubernetes Service. For overall terms of use, see [Cloud Services terms](https://cloud.ibm.com/docs/overview/terms-of-use?topic=overview-termsterms).



 Overview of shared responsibilities 

IBM Cloud Kubernetes Service is a managed service in the [IBM Cloud shared responsibility model](https://cloud.ibm.com/docs/overview/terms-of-use?topic=overview-shared-responsibilities). Review the following table of who is responsible for particular cloud resources when using IBM Cloud Kubernetes Service. Then, you can view more granular tasks for shared responsibilities in [Tasks for shared responsibilities by area](https://cloud.ibm.com/docs/containers?topic=containers-responsibilities_ikstask-responsibilities).

If you use other IBM Cloud products such as Object Storage, responsibilities that are marked as yours in the following table, such as disaster recovery for Data, might be IBM's or shared. Consult those products' documentation for your responsibilities.



Table 1. Responsibilities by resource.

 Resource [Incident and operations management](https://cloud.ibm.com/docs/containers?topic=containers-responsibilities_iksincident-and-ops) [Change management](https://cloud.ibm.com/docs/containers?topic=containers-responsibilities_ikschange-management) [Identity and access management](https://cloud.ibm.com/docs/containers?topic=containers-responsibilities_iksiam-responsibilities) [Security and regulation compliance](https://cloud.ibm.com/docs/containers?topic=containers-responsibilities_ikssecurity-compliance) [Disaster Recovery](https://cloud.ibm.com/docs/containers?topic=containers-responsibilities_iksdisaster-recovery) 

 [Data](https://cloud.ibm.com/docs/containers?topic=containers-responsibilities_iksapplications-and-data) You You You You You
Then, use [Satellite subscription commands](https://cloud.ibm.com/docs/cli?topic=cli-satellite-cli-referencesat-config-subscription-commands) to specify the Red Hat OpenShift on IBM Cloud clusters where you want to deploy your Kubernetes resources. For more information, see [Deploying Kubernetes resources across clusters with Satellite configurations](https://cloud.ibm.com/docs/satellite?topic=satellite-setup-clusters-satconfig).



 ibmcloud sat config create 

Create a Satellite configuration. After you create a configuration, you can add Kubernetes resource definitions as versions to the configuration.

ibmcloud sat config create (--data-location LOCATION | --provider PROVIDER) --name NAME [-q]



 Minimum required permissions 

IBM Cloud IAM Editor platform role for the Configuration resource in Satellite. For more information, see [Checking user permissions](https://cloud.ibm.com/docs/satellite?topic=satellite-iam-assign-accesschecking-perms).





 Command options 

--name NAME
: Required. The name for your configuration.

--data-location LOCATION
: The location to store the data associated with the Satellite configuration, such as the definitions of Kubernetes resources to be deployed to your clusters. For example: tok. For a list of Satellite locations, see [Supported IBM Cloud locations](https://cloud.ibm.com/docs/satellite?topic=satellite-sat-regionsunderstand-supported-regions). This option is used when you create a Direct Upload configuration. You can specify either --data-location LOCATION or --provider PROVIDER\. You can not specify both.

--provider PROVIDER
: The remote GitOps provider for the Satellite configuration. This provider stores your Kubernetes resource definitions. This option is used when you create a GitOps configuration. You can specify either --data-location LOCATION or --provider PROVIDER\. You can not specify both.

-q
: Optional.
Kubernetes <br><br> * v1.24 - v1.26<br><br><br> 
 Orchestration Service <br><br> * Kubernetes<br> * OpenShift Container Platform on IBM Cloud 4.9, 4.10, 4.11, 4.12<br><br><br> 
 Infrastructure <br><br> * Classic<br><br><br> 
 Hardware Security Module<br><br>(HSM) <br><br> * Tested with [Cloud HSM ](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-hsm-gemalto)<br><br><br> 
 VLAN <br><br> * [VLAN spanning](https://cloud.ibm.com/docs/vlans?topic=vlans-vlan-spanningmanage-vlan-spanning) must be enabled for multi-zone clusters.<br> * Because private ingress is not supported, a cluster with only private VLANs is not supported as a public internet connection is required for a connection between the IBM Blockchain cluster and the customer Kubernetes cluster. A cluster with private and public VLANs configured is supported.<br><br><br> 
 Storage <br><br> * File<br> * Block<br> * Portworx<br> * Object (For backups only, not intended for live storage)<br><br><br> 





 Fabric Component Support 

Support for Hyperledger Fabric v1.4 is now deprecated, and support for Fabric v1.4 will be removed from IBM Blockchain Platform on March 31, 2023. Users should therefore [upgrade to Fabric v2.2](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-govern-componentsibp-console-govern-components-upgrade) as soon as possible. Your applications may require changes as a result of upgrading to v2.2, so please plan for appropriate testing.
If you enable only the private cloud service endpoint, you can use the Kubernetes dashboard or temporarily enable the public cloud service endpoint to create the private NLB.



1. Get the private cloud service endpoint URL and port for your cluster.

ibmcloud ks cluster get -c <cluster_name_or_ID>

In this example output, the Private Service Endpoint URL is https://c1.private.us-east.containers.cloud.ibm.com:25073.

NAME: setest
ID: b8dcc56743394fd19c9f3db7b990e5e3
State: normal
Status: healthy cluster
Created: 2019-04-25T16:03:34+0000
Location: wdc04
Master URL: https://c1.private.us-east.containers.cloud.ibm.com:25073
Public Service Endpoint URL: -
Private Service Endpoint URL: https://c1.private.us-east.containers.cloud.ibm.com:25073
Master Location: Washington D.C.
...
2. Create a YAML file named kube-api-via-nlb.yaml. This YAML creates a private LoadBalancer service and exposes the private cloud service endpoint through that NLB. Replace <private_service_endpoint_port> with the port you found in the previous step.

apiVersion: v1
kind: Service
metadata:
name: kube-api-via-nlb
annotations:
service.kubernetes.io/ibm-load-balancer-cloud-provider-ip-type: private
namespace: default
spec:
type: LoadBalancer
ports:
- protocol: TCP
port: 8080 Or, the <private_service_endpoint_port> that you found earlier.
targetPort: 8080 Optional. By default, the targetPort is set to match the port value unless specified otherwise.
---
kind: Endpoints
apiVersion: v1
IBM Cloud Kubernetes Service supports only trusted profiles for versions 1.21 and newer. Free IBM Cloud Kubernetes Service clusters create only earlier versions. You have the choice to create clusters with an earlier version with the standard plan, so be sure to select version 1.21 or newer.



1. Create a trusted profile by running the following command:

ibmcloud iam trusted-profile-create sample-compute-profile -d "sample trusted profile for compute resources"

For more information, see the [CLI reference](https://cloud.ibm.com/docs/account?topic=cli-ibmcloud_commands_iamibmcloud_iam_trusted_profile_create).
2. Create conditions for your trusted profile by using the ibmcloud iam trusted-profile-rule-create command:

ibmcloud iam trusted-profile-rule-create sample-compute-profile --name cr-rule --type Profile-CR --conditions claim:namespace,operator:EQUALS,value:default --conditions claim:crn,operator:EQUALS,value:crn:test:bluemix:public:containers-kubernetes:us-south:a/test:: --cr-type IKS_SA

For more information, see the [CLI reference](https://cloud.ibm.com/docs/account?topic=cli-ibmcloud_commands_iamibmcloud_iam_trusted_profile_rule_create).

You can also create a direct link:

ibmcloud iam trusted-profile-link-create sample-compute-profile --name my_link --cr-type IKS_SA --link-name default --link-namespace default --link-crn my_compute_resource_crn

For more information, see the [CLI reference](https://cloud.ibm.com/docs/account?topic=cli-ibmcloud_commands_iamibmcloud_iam_trusted_profile_link_create).
3. Create an access policy by running the following command:

ibmcloud iam trusted-profile-policy-create --roles Viewer
Then, use [Satellite subscription commands](https://cloud.ibm.com/docs/satellite?topic=satellite-satellite-cli-referencesat-config-subscription-commands) to specify the Red Hat OpenShift on IBM Cloud clusters where you want to deploy your Kubernetes resources. For more information, see [Deploying Kubernetes resources across clusters with Satellite configurations](https://cloud.ibm.com/docs/satellite?topic=satellite-setup-clusters-satconfig).



 ibmcloud sat config create 

Create a Satellite configuration. After you create a configuration, you can add Kubernetes resource definitions as versions to the configuration.

ibmcloud sat config create (--data-location LOCATION | --provider PROVIDER) --name NAME [-q]



 Minimum required permissions 

IBM Cloud IAM Editor platform role for the Configuration resource in Satellite. For more information, see [Checking user permissions](https://cloud.ibm.com/docs/satellite?topic=satellite-iam-assign-accesschecking-perms).





 Command options 

--name NAME
: Required. The name for your configuration.

--data-location LOCATION
: The location to store the data associated with the Satellite configuration, such as the definitions of Kubernetes resources to be deployed to your clusters. For example: tok. For a list of Satellite locations, see [Supported IBM Cloud locations](https://cloud.ibm.com/docs/satellite?topic=satellite-sat-regionsunderstand-supported-regions). This option is used when you create a Direct Upload configuration. You can specify either --data-location LOCATION or --provider PROVIDER\. You can not specify both.

--provider PROVIDER
: The remote GitOps provider for the Satellite configuration. This provider stores your Kubernetes resource definitions. This option is used when you create a GitOps configuration. You can specify either --data-location LOCATION or --provider PROVIDER\. You can not specify both.

-q
: Optional.
The newly generated API key can be immediately saved to a secrets vault.





 Single cluster deployment target 

With this option, you can deploy your application to an existing Kubernetes cluster on IBM Cloud. The toolchain currently supports Kubernetes cluster that is managed by IBM Cloud Kubernetes Service or a Red Hat OpenShift cluster. After the IBM Cloud API Key field is completed, select the Resource group and Cluster region field where your target cluster is created. Select the target Cluster name after you choose the appropriate value for the resource group and cluster region fields.

Provide the name of Cluster namespace where you want to deploy your application. If the namespace exists, your application is deployed in that namespace, else toolchain creates a new namespace with the name during the first deployment of the application.





 Multiple clusters deployment target 

With this option, you can deploy your application to a group of IBM Cloud Kubernetes Service clusters or Red Hat OpenShift clusters on IBM Cloud.

The toolchain uses [Satellite Config](https://cloud.ibm.com/docs/satellite?topic=satellite-cluster-config) to group multiple clusters in a cluster group and simultaneously deploy the application to all the clusters. [Learn more](https://cloud.ibm.com/docs/satellite?topic=satellite-setup-clusters-satconfigsetup-clusters-satconfig-groups) about setting up cluster groups for multiple clusters.

After your cluster group is set up, provide the name of Cluster namespace where you want to deploy your application. If the namespace exists, your application is deployed in that namespace. Otherwise, elthese toolchain creates a new namespace with the name during the first deployment of the application.





 Custom target 

With this option, you can customize the deployment step to deploy your application to any target other than a Kubernetes cluster (for example, Virtual Server Instances (VSI)). This option requires you to provide the IBM Cloud API key that can later be used within deployment scripts within the pipeline to access various cloud resources.





 Change request management 

Use an IBM Cloud-hosted Git Repos and Issue Tracking repository to manage change requests.
By default, the ibmc Helm plug-in automatically retrieves your cluster location and creates the storage classes by using the IBM Cloud Object Storage private cloud service endpoint that matches your cluster location. If your classic cluster is in a multizone metro, such as dal10, the IBM Cloud Object Storage private cloud service endpoint for the multizone metro, for example Dallas. To verify that the service endpoint in your storage classes matches the service endpoint of your service instance, run kubectl describe storageclass < storageclassname>. Make sure that you enter your service endpoint in the format https://< s3fs_private_service_endpoint> for private cloud service endpoints, or http://< s3fs_public_service_endpoint> for public cloud service endpoints. If the service endpoint in your storage class matches the service endpoint of your IBM Cloud Object Storage service instance, don't include the ibm.io/endpoint option in your PVC YAML file.

ibm.io/add-mount-param
: Enter mount options for your s3fs Fuse volumes. For example ibm.io/add-mount-param: "del_cache,retries=6". For a list of option, see the [s3fs man pages](https://manpages.ubuntu.com/manpages/xenial/man1/s3fs.1.html)

ibm.io/access-policy-allowed-ips
: Enter a comma-separated list of IPs that can access your volumes. For example, ibm.io/access-policy-allowed-ips: "XX.XXX.XX.XXX, XX.XX.XX.XXX, XX.XX.XX.XX.

storage
: In the spec resources requests section, enter a size for your IBM Cloud Object Storage bucket in gigabytes. The actual space that you use in IBM Cloud Object Storage might be different and is billed based on the [pricing table](https://cloud.ibm.com/objectstorage/create). If you enabled quotas when you installed the plug-in , the quota for your bucket is equal to this size.

storageClassName
Satellite Config is not supported on locations that are enabled for Red Hat CoreOS.

Satellite Config access to modify Kubernetes resources within a cluster
: By default, Satellite Config is limited to what Kubernetes resources it can read and modify in your clusters. You must grant Satellite Config access in each cluster where you want to use Satellite Config to manage your Kubernetes resources.
: Choose from the following options.



* Opt in to cluster admin access when you create the cluster in the [console](https://cloud.ibm.com/docs/openshift?topic=openshift-satellite-clusterssatcluster-create-console) or [CLI](https://cloud.ibm.com/docs/openshift?topic=openshift-satellite-clusterssatcluster-create-cli) with the --enable-admin-agent option. Note that you must perform a one-time oc login in each cluster to synchronize the admin permissions.
* To opt in after creating a cluster or to scope the access, see [Granting Satellite Config access to your clusters](https://cloud.ibm.com/docs/satellite?topic=satellite-setup-clusters-satconfig).



Satellite Config and IBM Cloud IAM
: You cannot scope access policies for Satellite Config resources (configuration, subscription, cluster, or cluster group) to an IBM Cloud resource group. Satellite Config uses the open source Razee project, which authenticates users by using the organization. The organization supports only the account ID, not resource groups.
: You cannot scope access policies to particular configuration or subscription resources. When you assign a policy in the IBM Cloud IAM console, leave the Resource field blank for configurations or subscriptions. Instead, you can scope the access policy to a cluster group for more control of how your Satellite Config resources are deployed.
: To let users view the Kubernetes resources that run in clusters with Satellite Config, you must assign an access policy with the appropriate role (Administrator, Manager, or Reader) to IBM Cloud Satellite (and not scoped to a particular resource or resource type).
Mixed protocol load balancer services are not supported in IBM Cloud Kubernetes Service. You cannot specify both TCP and UDP ports your in load balancer definition.



 Traffic flow in a single-zone cluster 

The following diagram shows how an NLB 1.0 directs communication from the internet to an app in a single-zone cluster.

Zoom

![Expose an app in a single-zone cluster by using an NLB 1.0.](https://cloud.ibm.com/docs-content/v1/content/bce0f0917a9eea684d1b4b704ac6343a1f65f446/openshift/images/cs_loadbalancer_planning.png)

Figure 1. Expose an app in a single-zone cluster by using an NLB 1.0



1. A request to your app uses the public IP address of your NLB and the assigned port on the worker node. Note that if you [create a DNS subdomain](https://cloud.ibm.com/docs/openshift?topic=openshift-loadbalancer_hostname) for your NLB, users can access your app through the NLB's subdomain instead. A DNS system service resolves the subdomain to the portable public IP address of the NLB.
2. The NLB receives the request and forwards it to the private IP address of the app pod over the private network. The source IP address of the request package is changed to the public IP address of the worker node where the NLB pod runs. If multiple app instances are deployed in the cluster, the NLB routes the requests between the app pods.
3. When the app returns a response packet, it uses the IP address of the worker node where the NLB that forwarded the client request exists. The NLB then sends the response packet to the client.







 Traffic flow in a multizone cluster 

The following diagram shows how a network load balancer (NLB) 1.0 directs communication from the internet to an app in a multizone cluster.

Zoom

!
Then, you link the trusted profile with as many clusters as you want, based on conditions such as all the prod Kubernetes namespaces in clusters in a resource group. Finally, your pods mount the Kubernetes service account projected volume to get a token that can be exchanged for an IAM token that your apps use to authenticate with the IBM Cloud services.







 Adding IBM Cloud services to clusters 

Use IBM Cloud service binding to automatically create service credentials for your IBM Cloud services and store these credentials in a Kubernetes secret.

Before you begin:



* Ensure you have the following roles:



* [Editor or Administrator IBM Cloud IAM platform access role](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-perms) for the cluster where you want to bind a service
* [Writer or Manager IBM Cloud IAM service access role](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-perms) for the Kubernetes namespace where you want to bind the service
* For Cloud Foundry services: [Developer Cloud Foundry role](https://cloud.ibm.com/docs/account?topic=account-mngcfmngcf) for the space where you want to provision the service



* [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)



To add an IBM Cloud service to your cluster:



1. [Create an instance of the IBM Cloud service](https://cloud.ibm.com/docs/account?topic=account-externalappexternalapp).



* Some IBM Cloud services are available only in select regions. You can bind a service to your cluster only if the service is available in the same region as your cluster. In addition, if you want to create a service instance in the Washington DC zone, you must use the CLI.
* For IAM-enabled services: You must create the service instance in the same resource group as your cluster.