vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* [ibmcloud ks cluster subnet add](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_cluster_subnet_add)
* [ibmcloud ks cluster subnet create](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_cluster_subnet_create)
* [ibmcloud ks cluster subnet detach](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_cluster_subnet_detach)
* [Deprecated: ibmcloud ks cluster user-subnet add](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_cluster_user_subnet_add)
* [Deprecated: ibmcloud ks cluster user-subnet rm](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_cluster_user_subnet_rm)



* [Beta: dedicated commands](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clidedicated_commands)



* [Beta: ibmcloud ks dedicated flavors](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clidedicated_flavors)
* [Beta: ibmcloud ks dedicated host create](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clidedicated_host_create)
* [Beta: ibmcloud ks dedicated host get](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clidedicated_host_get)
* [Beta: ibmcloud ks dedicated host ls](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clidedicated_host_ls)
* Persistent Storage: Storage for each node is dynamically provisioned from the Kubernetes cluster default storage class every time a node is deployed.









 (Optional) Add additional users to the console 

By default, the console uses [IBM Cloud Identity and Access Management (IAM)](https://cloud.ibm.com/docs/account?topic=account-iamoverview) as the IBM Cloud identity service provider. Your IBM Blockchain Platform console is provisioned by configuring the email address of the IBM owner as the Administrator of the console. As an Administrator, this user is authorized to grant other users access to the console via their email addresses. See these instructions on how to [add and remove users from the console](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-manage-consoleibp-console-manage-console-add-remove) for more information.





 Next steps 



* Before you create any nodes, you need to decide on the storage plug-in for your Kubernetes cluster. If you are just getting started and trying things out, Bronze file storage is suitable. However, if your cluster is running Kubernetes v1.19 or higher, Gold File Storage is preselected for your cluster by default. To change the default storage for your cluster, see this topic on [Persistent storage considerations](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-v2-deploy-iksibp-console-storage) to learn more.
* Now that your console is ready to use, you can go ahead to the [Build a network tutorial](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-build-networkibp-console-build-network). Consider bookmarking the URL of your console so you can come back at a later time if needed.
Annotations: oc.kubernetes.io/last-applied-configuration: {"apiVersion":"v1","kind":"PersistentVolumeClaim","metadata":{"annotations":{},"name":"csi-block-pvc-good","namespace":"default"},"spec":{...
volume.beta.kubernetes.io/storage-provisioner: vpc.block.csi.ibm.io
Finalizers: [kubernetes.io/pvc-protection]
Capacity: 10Gi
Access Modes:
VolumeMode: Filesystem
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal ExternalProvisioning 9s (x3 over 18s) persistentvolume-controller waiting for a volume to be created, either by external provisioner "vpc.block.csi.ibm.io" or manually created by system administrator
Mounted By: <none>
7. Create a deployment configuration file for your app and mount the PVC to your app.

apiVersion: apps/v1
kind: Deployment
metadata:
name: <deployment_name>
labels:
app: <deployment_label>
spec:
selector:
matchLabels:
app: <app_name>
template:
metadata:
labels:
app: <app_name>
spec:
containers:
- image: <image_name>
name: <container_name>
volumeMounts:
- name: <volume_name>
mountPath: /<file_path>
volumes:
- name: <volume_name>
persistentVolumeClaim:
claimName: <pvc_name>
Show more

labels.app
: In the metadata section, enter a label for the deployment.

matchLabels.app and labels.app
: In the spec selector and template metadata sections, enter a label for your app.

image
Classic infrastructure

View the pod security admission configuration for a cluster's Kubernetes API server.

ibmcloud ks cluster master pod-security get --cluster CLUSTER [--output OUTPUT] [-q]

Minimum required permissions
: Viewer platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

--output json
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.



 Example cluster master pod-security get command 

ibmcloud ks cluster master pod-security get --cluster mycluster







 ibmcloud ks cluster master pod-security policy disable 

Virtual Private Cloud

Classic infrastructure

Disable the pod security policy for a cluster's Kubernetes API server.

ibmcloud ks cluster master pod-security policy disable --cluster CLUSTER [-q]

Minimum required permissions
: Administrator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

-q
: Optional: Do not show the message of the day or update reminders.



 Example cluster master pod-security policy disable command 

ibmcloud ks cluster master pod-security policy disable --cluster mycluster







 ibmcloud ks cluster master pod-security policy enable 

Virtual Private Cloud

Classic infrastructure

Enable the pod security policy for a cluster's Kubernetes API server. Note that pod security policies are not available in clusters that run version 1.25 or later.

ibmcloud ks cluster master pod-security policy enable --cluster CLUSTER [--output OUTPUT] [-q]

Minimum required permissions
: Administrator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

--output json
: Optional: Prints the command output in JSON format.

-q
Kubernetes v1.16.8 v1.16.9 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.16.9). 
 Ubuntu 18.04 packages N/A N/A Updated worker node images with package updates for [CVE-2018-1000876](https://nvd.nist.gov/vuln/detail/CVE-2018-1000876), [CVE-2018-10372](https://nvd.nist.gov/vuln/detail/CVE-2018-10372), [CVE-2018-10373](https://nvd.nist.gov/vuln/detail/CVE-2018-10373), [CVE-2018-10534](https://nvd.nist.gov/vuln/detail/CVE-2018-10534), [CVE-2018-10535](https://nvd.nist.gov/vuln/detail/CVE-2018-10535), [CVE-2018-12641](https://nvd.nist.gov/vuln/detail/CVE-2018-12641), [CVE-2018-12697](https://nvd.nist.gov/vuln/detail/CVE-2018-12697), [CVE-2018-12698](https://nvd.nist.gov/vuln/detail/CVE-2018-12698), [CVE-2018-12699](https://nvd.nist.gov/vuln/detail/CVE-2018-12699), [CVE-2018-12700](https://nvd.nist.gov/vuln/detail/CVE-2018-12700), [CVE-2018-12934
Kubernetes v1.11.3 v1.12.2 See the [Kubernetes release notes]([https://github.com/kubernetes/kubernetes/releases/tag/v1.12.2](https://github.com/kubernetes/kubernetes/releases/tag/v1.12.2)]{: external}. 
 Kubernetes configuration N/A N/A Added three new IBM pod security policies and their associated cluster roles. For more information, see [Understanding default resources for IBM cluster management](https://cloud.ibm.com/docs/containers?topic=containers-pspibm_psp). 
 Kubernetes Dashboard v1.8.3 v1.10.0 See the [Kubernetes Dashboard release notes](https://github.com/kubernetes/dashboard/releases/tag/v1.10.0). <br>If you access the dashboard via kubectl proxy, the SKIP button on the login page is removed. Instead, [use a Token to log in](https://cloud.ibm.com/docs/containers?topic=containers-deploy_appcli_dashboard). Additionally, you can now scale up the number of Kubernetes Dashboard pods by running kubectl -n kube-system scale deploy kubernetes-dashboard --replicas=3. 
 Kubernetes DNS 1.14.10 1.14.13 See the [Kubernetes DNS release notes]([https://github.com/kubernetes/dns/releases/tag/1.14.13](https://github.com/kubernetes/dns/releases/tag/1.14.13)]{: external}.
* [What are some guidelines for developing stateless, cloud-native apps?](https://cloud.ibm.com/docs/containers?topic=containers-plan_deploy12factor)
* [What about serverless apps?](https://cloud.ibm.com/docs/containers?topic=containers-plan_deployapps_serverless)
* [I already have an app. How can I migrate it to IBM Cloud Kubernetes Service?](https://cloud.ibm.com/docs/containers?topic=containers-plan_deploymigrate_containerize)



* [Understanding Kubernetes objects for apps](https://cloud.ibm.com/docs/containers?topic=containers-plan_deploykube-objects)



* [I thought that I needed to put my app in a container. Now what's all this stuff about pods?](https://cloud.ibm.com/docs/containers?topic=containers-plan_deploydeploy_pods)
* [So if I can use a pod, why do I need all these different types of objects?](https://cloud.ibm.com/docs/containers?topic=containers-plan_deploydeploy_objects)
* [What type of Kubernetes objects can I make for my app?](https://cloud.ibm.com/docs/containers?topic=containers-plan_deployobject)
* [What if I want my app configuration to use variables? How do I add these variables to the YAML?](https://cloud.ibm.com/docs/containers?topic=containers-plan_deployvariables)
* [How can I make sure that my app has the correct resources?](https://cloud.ibm.com/docs/containers?topic=containers-plan_deployresources)
* [How can I add capabilities to my app configuration?](https://cloud.ibm.com/docs/containers?topic=containers-plan_deploycapabilities)
kube-hou02-pa1a59e9fd92f44af9b4147a27a31db5c4-w1 199.199.99.999 10.76202.188 free normal Ready hou02 1.10.11_1536

Now you can access the application from the Public IP from port 30082.

The clouddatabases-helloworld app displays the contents of an examples database. To demonstrate that the app is connected to your service, add some words to the database. The words are displayed as you add them, with the most recently added words displayed first.







 Code Structure 



Table 1. Code structure

 File Description 

 server.js Establishes a connection to the database by using credentials from BINDING (the name that we created in the Kubernetes deployment file to display the credentials) and handles create and read operations on the database. 
 main.js Handles user input for a PUT command and parses the results of a GET command to output the contents of the database. 



The app uses a PUT and a GET operation:



* PUT



* Takes user input from main.js.
* Adds the user input to the database.



* GET



* Retrieves the contents of the database.
* Returns the response of the database command to main.js.
Why does binding a service to a cluster results in service does not support service keys error? 

Virtual Private Cloud

Classic infrastructure

  What’s happening 

When you run ibmcloud ks cluster service bind --cluster <cluster_name> --namespace <namespace> --service <service_instance_name>, you see the following message.

This service doesn't support creation of keys

  Why it’s happening 

Some services in IBM Cloud, such as IBM® Key Protect don't support the creation of service credentials, also referred to as service keys. Without the support of service keys, the service can't be bound to a cluster. To find a list of services that support service keys, see [Enabling external apps to use IBM Cloud services](https://cloud.ibm.com/docs/account?topic=account-externalappexternalapp).

  How to fix it 

To integrate services that don't support service keys, check if the service provides an API that you can use to access the service directly from your app. For example, if you want to use IBM® Key Protect, see the [API reference](https://cloud.ibm.com/apidocs/key-protect).
Why does binding a service to a cluster results in service not found error? 

Virtual Private Cloud

Classic infrastructure

 What’s happening 

When you run ibmcloud ks cluster service bind --cluster <cluster_name> --namespace <namespace> --service <service_instance_name>, you see the following message.

Binding service to a namespace...
FAILED

The specified IBM Cloud service could not be found. If you just created the service, wait a little and then try to bind it again. To view available IBM Cloud service instances, run 'ibmcloud service list'. (E0023)

 Why it’s happening 

To bind services to a cluster, you must have the Cloud Foundry developer user role for the space where the service instance is provisioned.

In addition, you must have the IBM Cloud IAM Editor platform access to IBM Cloud Kubernetes Service. To access the service instance, you must be logged in to the space where the service instance is provisioned.

 How to fix it 

Complete the following steps based on your role.



 Cluster user 



1. Log in to IBM Cloud.

ibmcloud login
2. Target the org and the space where the service instance is provisioned.

ibmcloud target -o <org> -s <space>
3. Verify that you are in the correct space by listing your service instances.

ibmcloud service list
4. Try binding the service again. If you get the same error, then contact the account administrator and verify that you have sufficient permissions to bind services (see the following account admin steps).







 As the account admin 



1. Verify that the user who experiences this problem has [Editor permissions for IBM Cloud Kubernetes Service](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-perms).
2. Verify that the user who experiences this problem has the [Cloud Foundry developer role for the space](https://cloud.ibm.com/docs/account?topic=account-mngcfupdate_cf_access) where the service is provisioned.
Connecting an IBM Cloud application 

Applications running in IBM Cloud can be bound to your IBM Cloud® Databases for Redis deployment.



 Connecting a Kubernetes Service application 

There are two steps to connecting a Cloud databases deployment to a Kubernetes Service application. First, your deployment needs to be bound to your cluster and its connection strings stored in a secret. The second step is configuring your application to use the connection strings.

The sample app in the [Connecting a Kubernetes Service Tutorial](https://cloud.ibm.com/docs/databases-for-redis?topic=cloud-databases-tutorial-k8s-app) provides a sample application that uses Node.js and demonstrates how to bind the sample application to a Cloud Databases deployment.

Before connecting your Kubernetes Service application to a deployment, make sure that the deployment and cluster are both in the same region and resource group.



 Binding your deployment 

Public Endpoints - If you are using the default public service endpoint to connect to your deployment, you can run the cluster service bind command with your cluster name, the resource group, and your deployment name.

ibmcloud ks cluster service bind <your_cluster_name> <resource_group> <your_database_deployment>

OR
Private Endpoints - If you want to use a private endpoint (if one is enabled on your deployment), then first you need to create a service key for your database so Kubernetes can use it when binding to the database.

ibmcloud resource service-key-create <your-private-key> --instance-name <your_database_deployment> --service-endpoint private

The private service endpoint is selected with --service-endpoint private. After that, you bind the database to the Kubernetes cluster through the private endpoint with the cluster service bind command.

ibmcloud ks cluster service bind <your_cluster_name> <resource_group> <your_database_deployment> --key <your-private-key>

Verify - Verify that the Kubernetes secret was created in your cluster namespace. Running the following command, you get the API key for accessing the instance of your deployment that is provisioned in your account.
Setting up IBM Cloud Object Storage 

[IBM Cloud Object Storage](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-getting-started-cloud-object-storage) is persistent, highly available storage that you can mount to your apps. The plug-in is a Kubernetes Flex-Volume plug-in that connects Cloud Object Storage buckets to pods in your cluster. Information stored with IBM Cloud Object Storage is encrypted in transit and at rest, dispersed across many geographic locations, and accessed over HTTP by using a REST API.

If you want to use IBM Cloud Object Storage in a private cluster without public network access, you must set up your IBM Cloud Object Storage service instance for HMAC authentication. If you don't want to use HMAC authentication, you must open up all outbound network traffic on port 443 for the plug-in to work properly in a private cluster.



 Creating your object storage service instance 

Before you can start using object storage in your cluster, you must provision an IBM Cloud Object Storage service instance in your account.

The IBM Cloud Object Storage plug-in works with any s3 API endpoint. For example, you might want to use a local Cloud Object Storage server, such as [Minio](https://min.io/), or connect to an s3 API endpoint that you set up at a different cloud provider instead of an IBM Cloud Object Storage service instance.

Follow these steps to create an IBM Cloud Object Storage service instance. If you plan to use a local Cloud Object Storage server or a different s3 API endpoint, see the provider documentation to set up your Cloud Object Storage instance.



1. Open the [IBM Cloud Object Storage catalog page](https://cloud.ibm.com/objectstorage/create).
2. Enter a name for your service instance, such as cos-backup, and select the same resource group that your cluster is in. To view the resource group of your cluster, run ibmcloud ks cluster get --cluster <cluster_name_or_ID>.
3. Review the [plan options](https://cloud.ibm.com/objectstorage/create) for pricing information and select a plan.
* You are responsible for the management of health monitoring, security, and logging of your Kubernetes cluster. See this [information](https://cloud.ibm.com/docs/containers?topic=containers-responsibilities_iks) for details on what IBM Cloud manages and what you are responsible for.
* You are also responsible for monitoring the resource usage of your Kubernetes cluster by using the Kubernetes dashboard. If you need to increase storage capacity of your cluster, see this information on how to modify your existing volume:



* [IBM File Storage](https://cloud.ibm.com/docs/FileStorage?topic=FileStorage-expandCapacity)
* [Portworx](https://docs.portworx.com/portworx-install-with-kubernetes/storage-operations/create-pvcs/resize-pvc/)
* [Block storage](https://cloud.ibm.com/docs/BlockStorage?topic=BlockStorage-expandingcapacityexpandingcapacity)



* You are responsible for managing and securing your certificates and private keys. IBM does not store your certificates in the Kubernetes cluster.
* IBM Blockchain Platform is available in select regions. Refer to this topic on [IBM Blockchain Platform locations](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-regions-locations) for an updated list.
* IBM Blockchain Platform is compatible with a Kubernetes cluster on IBM Cloud running Kubernetes v1.24 - v1.26.
* The default storage that is pre-selected for you when you provision a Kubernetes cluster in IBM Cloud is Gold. If you do not want to use the default File Storage that is pre-selected for you when you provision a Kubernetes cluster in IBM Cloud, you can provision storage of your choice.
Why does binding a service to a cluster results in service does not support service keys error? 

Virtual Private Cloud

Classic infrastructure

  What’s happening 

When you run ibmcloud oc cluster service bind --cluster <cluster_name> --namespace <project> --service <service_instance_name>, you see the following message.

This service doesn't support creation of keys

  Why it’s happening 

Some services in IBM Cloud, such as IBM® Key Protect don't support the creation of service credentials, also referred to as service keys. Without the support of service keys, the service can't be bound to a cluster. To find a list of services that support service keys, see [Enabling external apps to use IBM Cloud services](https://cloud.ibm.com/docs/account?topic=account-externalappexternalapp).

  How to fix it 

To integrate services that don't support service keys, check if the service provides an API that you can use to access the service directly from your app. For example, if you want to use IBM® Key Protect, see the [API reference](https://cloud.ibm.com/apidocs/key-protect).
Connecting an IBM Cloud application 

Applications running in IBM Cloud can be bound to your IBM Cloud® Databases for etcd deployment.



 Connecting a Kubernetes Service application 

There are two steps to connecting a Cloud databases deployment to a Kubernetes Service application. First, your deployment needs a to be bound to your cluster and its connection strings that are stored in a secret. The second step is configuring your application to use the connection strings.

The sample app in the [Connecting a Kubernetes Service Tutorial](https://cloud.ibm.com/docs/databases-for-etcd?topic=cloud-databases-tutorial-k8s-app) provides a sample application that uses Node.js and demonstrates how to bind the sample application to a Cloud Databases deployment.

Before connecting your Kubernetes Service application to a deployment, make sure that the deployment and cluster are both in the same region and resource group.



 Binding your deployment 

Public Endpoints - If you are using the default public service endpoint to connect to your deployment, you can run the cluster service bind command with your cluster name, the resource group and your deployment name.

ibmcloud ks cluster service bind <your_cluster_name> <resource_group> <your_database_deployment>

OR
Private Endpoints - If you want to use a private endpoint (if one is enabled on your deployment), then first you need to create a service key for your database so Kubernetes can use it when binding to the database.

ibmcloud resource service-key-create <your-private-key> --instance-name <your_database_deployment> --service-endpoint private

The private service endpoint is selected with --service-endpoint private. After that, you bind the database to the Kubernetes cluster through the private endpoint with the cluster service bind command.

ibmcloud ks cluster service bind <your_cluster_name> <resource_group> <your_database_deployment> --key <your-private-key>

Verify - Verify that the Kubernetes secret was created in your cluster namespace. Running the following command, you get the API key for accessing the instance of your deployment that's provisioned in your account.