vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Virtual Private Cloud

Classic infrastructure

Target the API endpoint for IBM Cloud Kubernetes Service. If you don't specify an endpoint, you can view information about the current endpoint that is targeted.

Region-specific endpoints are deprecated. Use the [global endpoint](https://cloud.ibm.com/docs/containers?topic=containers-regions-and-zonesendpoint) instead.

If you need to list and work with resources from one region only, you can use the ibmcloud ks api command to target a regional endpoint instead of the global endpoint.



* Dallas (US South, us-south): https://us-south.containers.cloud.ibm.com
* Frankfurt (EU Central, eu-de): https://eu-de.containers.cloud.ibm.com
* London (UK South, eu-gb): https://eu-gb.containers.cloud.ibm.com
* Osaka (jp-osa): https://jp-osa.containers.cloud.ibm.com
* São Paulo (br-sao): https://br-sao.containers.cloud.ibm.com
* Sydney (AP South, au-syd): https://au-syd.containers.cloud.ibm.com
* Tokyo (AP North, jp-tok): https://jp-tok.containers.cloud.ibm.com
* Toronto (ca-tor): https://ca-tor.containers.cloud.ibm.com
* Washington, D.C. (US East, us-east): https://us-east.containers.cloud.ibm.com



To use the global functionality, you can use the ibmcloud ks api command again to target the global endpoint: https://containers.cloud.ibm.com

ibmcloud ks api --endpoint ENDPOINT [--insecure] [--skip-ssl-validation] [--api-version VALUE] [-q]

Minimum required permissions
: None

Command options:

--endpoint ENDPOINT
: The IBM Cloud Kubernetes Service API endpoint.
Use the [global endpoint](https://cloud.ibm.com/docs/containers?topic=containers-regions-and-zonesendpoint) instead. If you must use regional endpoints, [use the ibmcloud ks api command](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_cli_api).

By using IBM Cloud Kubernetes Service regions, you can create or access Kubernetes clusters in a region other than the IBM Cloud region that you are logged in to. IBM Cloud Kubernetes Service region endpoints refer specifically to the IBM Cloud Kubernetes Service, not IBM Cloud as a whole.

You might want to log in to another IBM Cloud Kubernetes Service region for the following reasons: * You created IBM Cloud services or private Docker images in one region and want to use them with IBM Cloud Kubernetes Service in another region. * You want to access a cluster in a region that is different from the default IBM Cloud region that you are logged in to.

To switch regions, use the ibmcloud ks init[command](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_init).



Corresponding Kubernetes Service and IBM Cloud regions, with zones. Multizone-capable zones are in bold.

 IBM Cloud Kubernetes Service region Corresponding IBM Cloud regions Available zones in the region 

 AP North (standard clusters only) Tokyo che01, sng01, tok02, tok04, tok05 
 AP South Sydney syd01, syd04, syd05 
 EU Central Frankfurt ams03, fra02, fra04, fra05, mil01, par01 
 UK South London lon02, lon04, lon05, lon06 
 US East (standard clusters only) Washington DC mon01, tor01, wdc04, wdc06, wdc07 
 US South Dallas dal10, dal12, dal13, sjc03, sjc04, sao01
To use the global functionality, you can use the ibmcloud ks api command again to target the global endpoint: https://containers.cloud.ibm.com

ibmcloud ks api --endpoint ENDPOINT [--insecure] [--skip-ssl-validation] [--api-version VALUE] [-q]

Minimum required permissions
: None

Command options:

--endpoint ENDPOINT
: The IBM Cloud Kubernetes Service API endpoint. Note: This endpoint is different than the IBM Cloud endpoints. This value is required to set the API endpoint.

--insecure
: Allow an insecure HTTP connection. This option is optional.

--skip-ssl-validation
: Allow insecure SSL certificates. This option is optional.

--api-version VALUE
: Optional: Specify the API version of the service that you want to use.

-q
: Optional: Do not show the message of the day or update reminders.

Example: View information about the current API endpoint that is targeted.

ibmcloud ks api

API Endpoint: https://containers.cloud.ibm.com
API Version: v1
Skip SSL Validation: false
Region: us-south





 init command 

Virtual Private Cloud

Classic infrastructure

Initialize the IBM Cloud Kubernetes Service plug-in or specify the region where you want to create or access Kubernetes clusters.

Region-specific endpoints are deprecated. Use the [global endpoint](https://cloud.ibm.com/docs/containers?topic=containers-regions-and-zonesendpoint) instead.

If you need to list and work with resources from one region only, you can use the ibmcloud ks init command to target a regional endpoint instead of the global endpoint.



* Dallas (US South, us-south): https://us-south.containers.cloud.ibm.com
* Frankfurt (EU Central, eu-de): https://eu-de.containers.cloud.ibm.com
Your worker nodes are controlled by a highly available Kubernetes master that is configured, monitored, and managed by IBM. You can use the IBM Cloud Kubernetes Service API or CLI to work with your cluster infrastructure resources and the Kubernetes API or CLI to manage your deployments and services.

For more information about how your cluster resources are set up, see the [Service architecture](https://cloud.ibm.com/docs/containers?topic=containers-service-arch). To find a list of capabilities and benefits, see [Benefits and service offerings](https://cloud.ibm.com/docs/containers?topic=containers-cs_ov).





 Why should I use IBM Cloud Kubernetes Service? 

IBM Cloud Kubernetes Service is a managed Kubernetes offering that delivers powerful tools, an intuitive user experience, and built-in security for rapid delivery of apps that you can bind to cloud services that are related to IBM Watson®, AI, IoT, DevOps, security, and data analytics. As a certified Kubernetes provider, IBM Cloud Kubernetes Service provides intelligent scheduling, self-healing, horizontal scaling, service discovery and load balancing, automated rollouts and rollbacks, and secret and configuration management. The service also has advanced capabilities around simplified cluster management, container security and isolation policies, the ability to design your own cluster, and integrated operational tools for consistency in deployment.

For a detailed overview of capabilities and benefits, see [Benefits of using the service](https://cloud.ibm.com/docs/containers?topic=containers-cs_ovbenefits).





 Can I get a free cluster? 

The free tier option is deprecated and will be unsupported on 25 July 2023. Existing free tier clusters will be allowed to finish their 30-day trial window. If you want to try IBM Cloud Kubernetes Service, [contact IBM Sales](https://www.ibm.com/account/reg/us-en/signup?formid=MAIL-wcp).

You can have 1 free cluster at a time in IBM Cloud Kubernetes Service, and each free cluster expires in 30 days.
Use the [global endpoint](https://cloud.ibm.com/docs/containers?topic=containers-regions-and-zonesendpoint) instead.

If you need to list and work with resources from one region only, you can use the ibmcloud ks init command to target a regional endpoint instead of the global endpoint.



* Dallas (US South, us-south): https://us-south.containers.cloud.ibm.com
* Frankfurt (EU Central, eu-de): https://eu-de.containers.cloud.ibm.com
* London (UK South, eu-gb): https://eu-gb.containers.cloud.ibm.com
* Osaka (jp-osa): https://jp-osa.containers.cloud.ibm.com
* São Paulo (br-sao): https://br-sao.containers.cloud.ibm.com
* Sydney (AP South, au-syd): https://au-syd.containers.cloud.ibm.com
* Tokyo (AP North, jp-tok): https://jp-tok.containers.cloud.ibm.com
* Toronto (ca-tor): https://ca-tor.containers.cloud.ibm.com
* Washington, D.C. (US East, us-east): https://us-east.containers.cloud.ibm.com



To use the global functionality, you can use the ibmcloud ks init command again to target the global endpoint: https://containers.cloud.ibm.com

ibmcloud ks init [--host HOST] [--insecure] [-p] [-u] [-q]

Minimum required permissions
: None

Command options:

--host HOST
: Optional: The IBM Cloud Kubernetes Service API endpoint to use.

--insecure
: Allow an insecure HTTP connection.

-p
: Your IBM Cloud password.

-u
: Your IBM Cloud username.

-q
: Optional: Do not show the message of the day or update reminders.

Examples:
Keep in mind that some services such as Ingress might require multiple worker nodes for high availability, and you might not be able to run these services or your apps in the smallest size cluster possible.
* Which Kubernetes versions does the service support?

IBM Cloud Kubernetes Service concurrently supports multiple versions of Kubernetes. When a new version (n) is released, versions up to 2 behind (n-2) are supported. Versions more than 2 behind the latest (n-3) are first deprecated and then unsupported.

For more information about supported versions and update actions that you must take to move from one version to another, see [Kubernetes version information](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions)
* Which worker node operating systems does the service support?

For a list of supported worker node operated systems by cluster version, see [Kubernetes version information](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions).
* Where is the service available?

IBM Cloud Kubernetes Service is available worldwide. You can create clusters in every supported IBM Cloud Kubernetes Service region.

For more information about supported regions, see [Locations](https://cloud.ibm.com/docs/containers?topic=containers-regions-and-zonesregions-and-zones).
* Is the service highly available?

Yes. By default, IBM Cloud Kubernetes Service sets up many components such as the cluster master with replicas, anti-affinity, and other options to increase the high availability (HA) of the service. You can increase the redundancy and failure toleration of your cluster worker nodes, storage, networking, and workloads by configuring them in a highly available architecture. For an overview of the default setup and your options to increase HA, see [High availability for IBM Cloud Kubernetes Service](https://cloud.ibm.com/docs/containers?topic=containers-ha).
To log in to the IBM Cloud global API endpoint and target the resource group that your cluster is in:

ibmcloud login -a https://cloud.ibm.com -g <nondefault_resource_group_name>





 Logging in to IBM Cloud Kubernetes Service 

When you log in to IBM Cloud, you can access the Kubernetes Service. To help you get started, check out the following resources for using the IBM Cloud Kubernetes Service CLI and API.

[Install the IBM Cloud CLI](https://cloud.ibm.com/docs/containers?topic=containers-cli-install)[Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)

When you use the new global functionality in the IBM Cloud Kubernetes Service CLI, consider the following changes from the legacy region-based functionality.



* Listing resources:



* When you list resources, such as with the ibmcloud ks cluster ls, ibmcloud ks subnets, or ibmcloud ks zone ls commands, resources in all locations are returned. To filter resources by a specific location, certain commands include a --location option. For example, if you filter clusters for the wdc metro, multizone clusters in that metro and single-zone clusters in data centers (zones) within that metro are returned. If you filter clusters for the wdc06 data center (zone), multizone clusters that have a worker node in that zone and single-zone clusters in that zone are returned. ibmcloud ks cluster ls -l dal.
* Other commands don't return resources in all locations. To run credential set/unset/get, api-key reset, and vlan spanning get commands, you must specify a region in the --region.



* Working with resources:



* When you use the global endpoint, you can work with resources that you have access permissions to in any location, even if you target one region and the resource that you want to work with is in another region.
Your service might not yet support private cloud service endpoints. If you have a private-only cluster, you must use service credentials that use the private cloud service endpoint, or open up the public IP address and port to connect to your service.





 Can I use all IBM Cloud services in my cluster? 

You can use service binding only for services that support service keys so that the service credentials can automatically be created and stored in a Kubernetes secret. To find a list of services that support service keys, see [Enabling external apps to use IBM Cloud services](https://cloud.ibm.com/docs/account?topic=account-externalappexternalapp).

Services that don't support service keys usually provide an API that you can use in your app. The service binding method does not automatically set up API access for your app. Make sure to review the API documentation of your service and implement the API interface in your app.





 Can I bind multiple IBM Cloud services to multiple clusters at once? 

IBM Cloud service binding is on a per-cluster, per-service basis, and works by creating a Kubernetes secret that your pods can mount.

For multiple clusters and services, you can [use IAM trusted profiles instead](https://cloud.ibm.com/docs/containers?topic=containers-pod-iam-identity). In IAM, you create a trusted profile with access policies for the IBM Cloud services that you want. Then, you link the trusted profile with as many clusters as you want, based on conditions such as all the prod Kubernetes namespaces in clusters in a resource group. Finally, your pods mount the Kubernetes service account projected volume to get a token that can be exchanged for an IAM token that your apps use to authenticate with the IBM Cloud services.







 Adding IBM Cloud services to clusters 

Use IBM Cloud service binding to automatically create service credentials for your IBM Cloud services and store these credentials in a Kubernetes secret.

Before you begin:



* Ensure you have the following roles:
Service limitations 

IBM Cloud® Kubernetes Service and the Kubernetes open source project come with default service settings and limitations to ensure security, convenience, and basic functionality. Some limitations you might be able to change where noted.

If you anticipate reaching any of the following IBM Cloud Kubernetes Service limitations, [contact IBM Support](https://cloud.ibm.com/docs/get-support?topic=get-support-using-avatar) and provide the cluster ID, the new quota limit, the region, and infrastructure provider in your support ticket.



 Service and quota limitations 

IBM Cloud Kubernetes Service comes with the following service limitations and quotas that apply to all clusters, independent of what infrastructure provider you plan to use. Keep in mind that the [classic](https://cloud.ibm.com/docs/containers?topic=containers-limitationsclassic_limits) and [VPC](https://cloud.ibm.com/docs/containers?topic=containers-limitationsks_vpc_gen2_limits) cluster limitations also apply.

To view quota limits on cluster-related resources in your IBM Cloud account, use the ibmcloud ks quota ls command.



IBM Cloud Kubernetes Service limitations

 Category Description 

 API rate limits 200 requests per 10 seconds to the IBM Cloud Kubernetes Service API from each unique source IP address. 
 App deployment The apps that you deploy to and services that you integrate with your cluster must be able to run on the operating system of the worker nodes. 
 Calico network plug-in Changing the Calico plug-in, components, or default Calico settings is not supported. For example, don't deploy a new Calico plug-in version, or modify the daemon sets or deployments for the Calico components, default IPPool resources, or Calico nodes.
The IBM Kubernetes service offers a free cluster that can be used for 30 days. Note that the free cluster offers limited storage and transaction throughput, and that it is not possible to migrate data from free clusters to paid clusters. For more information about the differences between the free and paid Kubernetes clusters on IBM Cloud, see [Comparison of free and standard clusters](https://cloud.ibm.com/docs/containers?topic=containers-cs_ovcluster_types).

For instructions on what to do when your Kubernetes cluster expires, see this topic on [Kubernetes cluster expiration](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-manage-consoleibp-console-manage-console-cluster-expiration).







 Create an IBM Blockchain Platform service instance in IBM Cloud 

After you have deployed a Kubernetes cluster on IBM Cloud, you're ready to create an instance of IBM Blockchain Platform for IBM Cloud.

Creating an IBM Blockchain Platform service instance is a two step process.



* Create and name the instance.
* Link the instance to your cluster in IBM Cloud.





 Step one: Create and name the instance 



1. Locate the [Blockchain Platform](https://cloud.ibm.com/catalog/services/blockchain) in the IBM Cloud Catalog, or search for Blockchain on the IBM Cloud Catalog page.
2. We recommend that you rename the Service name for your instance so you can recognize it easily in the future.
3. Choose your region from the drop-down list under Select a region. For a list of available regions, see [Regions](https://cloud.ibm.com/docs/blockchain/reference?topic=blockchain-ibp-regions-locationsibp-regions-locations).
4. You can leave the resource group and tags fields unchanged.
5. Click Create to provision the service instance.







 Step two: Link the instance to your Kubernetes cluster on IBM Cloud
To view detailed system requirements, you can run a [software product compatibility report for IBM Cloud Kubernetes Service](https://www.ibm.com/software/reports/compatibility/clarity/softwareReqsForProduct.html). Note that compliance depends on the underlying [infrastructure provider](https://cloud.ibm.com/docs/containers?topic=containers-infrastructure_providers) for the cluster worker nodes, networking, and storage resources.

Classic infrastructure: IBM Cloud Kubernetes Service implements controls commensurate with the following security standards:



* EU-US Privacy Shield and Swiss-US Privacy Shield Framework
* Health Insurance Portability and Accountability Act (HIPAA)
* Service Organization Control standards (SOC 1 Type 2, SOC 2 Type 2)
* International Standard on Assurance Engagements 3402 (ISAE 3402), Assurance Reports on Controls at a Service Organization
* International Organization for Standardization (ISO 27001, ISO 27017, ISO 27018)
* Payment Card Industry Data Security Standard (PCI DSS)



VPC infrastructure: IBM Cloud Kubernetes Service implements controls commensurate with the following security standards:



* EU-US Privacy Shield and Swiss-US Privacy Shield Framework
* Health Insurance Portability and Accountability Act (HIPAA)
* International Standard on Assurance Engagements 3402 (ISAE 3402), Assurance Reports on Controls at a Service Organization



* Can I use IBM Cloud and other services with my cluster?

You can add IBM Cloud platform and infrastructure services as well as services from third-party vendors to your IBM Cloud Kubernetes Service cluster to enable automation, improve security, or enhance your monitoring and logging capabilities in the cluster.

For a list of supported services, see [Integrating services](https://cloud.ibm.com/docs/containers?topic=containers-supported_integrationssupported_integrations).
* Does IBM support third-party and open source tools that I use with my cluster?

See the [IBM Open Source and Third Party policy](https://www.ibm.com/support/pages/node/737271).
* What am I charged for? Can I estimate and control costs in my cluster?
* [Enabling public or private access to an app by using a network load balancer (NLB) service in a multizone cluster](https://cloud.ibm.com/docs/containers?topic=containers-loadbalancermulti_zone_config).
* [Managing network traffic by using Ingress](https://cloud.ibm.com/docs/containers?topic=containers-managed-ingress-about).
* [Increasing the availability of your app](https://cloud.ibm.com/docs/containers?topic=containers-app).



When you initiate cluster management actions, such as running [ibmcloud ks commands](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-cli), basic information about the cluster, such as name, ID, user, the command is routed through the global endpoint.







 Accessing the global endpoint 

You can organize your resources across IBM Cloud services by using IBM Cloud locations (formerly called regions). For example, you can deploy an app to a cluster by using a private Docker image that is stored in your IBM Cloud Container Registry of the same location. To access these resources, you can use the global endpoints and filter by location.



 Logging in to IBM Cloud 

When you log in to the IBM Cloud (ibmcloud) command line, you are prompted to select a region. However, this region does not affect the IBM Cloud Kubernetes Service plug-in (ibmcloud ks) endpoint, which still uses the global endpoint. Note that you do still need to target the resource group that your cluster is in if it is not in the default resource group.

To log in to the IBM Cloud global API endpoint and target the resource group that your cluster is in:

ibmcloud login -a https://cloud.ibm.com -g <nondefault_resource_group_name>





 Logging in to IBM Cloud Kubernetes Service 

When you log in to IBM Cloud, you can access the Kubernetes Service. To help you get started, check out the following resources for using the IBM Cloud Kubernetes Service CLI and API.
By default, IBM Cloud Kubernetes Service supports the following KMS providers.



* IBM® Key Protect for IBM Cloud® for [public cloud](https://cloud.ibm.com/docs/key-protect?topic=key-protect-getting-started-tutorial) or [on-prem](https://www.ibm.com/docs/en/cloud-private/3.2.0?topic=apis-key-management-service) environments.
* [Hyper Protect Crypto Services](https://cloud.ibm.com/catalog/services/hyper-protect-crypto-services) for keep your own key (KYOK) crypto unit support.



Because adding a different KMS provider requires updating the managed master default configuration, you can't add other KMS providers to the cluster.

You can have one KMS provider enabled in the cluster. You can switch the KMS provider, but you can't disable KMS provider encryption after it is enabled. For example, if you enabled a key management service (KMS) provider in your cluster, but want to use Hyper Protect Crypto Services instead, you can [enable](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkeyprotect) Hyper Protect Crypto Services as the KMS provider.

You can't disable KMS provider encryption. Do not delete root keys in your KMS instance, even if you rotate to use a new key. If you delete a root key that a cluster uses, the cluster becomes unusable, loses all its data, and can't be recovered. Similarly, if you disable a root key, operations that rely on reading secrets fail. Unlike deleting a root key, however, you can reenable a disabled key to make your cluster usable again.





 Controlling encryption 

When you enable a KMS provider in your cluster, your own KMS root key is used to encrypt data encryption keys (DEKs) which are used to encrypt Kubernetes secrets. Using your own encryption root key adds a layer of security to Kubernetes secrets and gives you more granular control of who can access sensitive cluster information.