vania-janet/multiturn-rag-retrieval-data huggingface dataset:
CIS provides Global Load Balancer (GLB), Caching, Web Application Firewall (WAF) and Page rule to secure your applications while ensuring the reliability and performance for your cloud applications.

To configure a global load balancer, you will need:



* to point a custom domain to CIS name servers,
* to retrieve the IP addresses or hostnames of the VPC load balancers,
* to configure health checks to validate the availability of your application,
* and to define origin pools pointing to the VPC load balancers.





 Add a custom domain to IBM Cloud Internet Services 

The first step is to create an instance of CIS and to point your custom domain to CIS name servers.



1. If you do not own a domain, you can buy one from a registrar.
2. Navigate to [IBM Cloud Internet Services](https://cloud.ibm.com/catalog/services/internet-services) in the IBM Cloud catalog.
3. Set the service name, and click Create to create an instance of the service.
4. When the service instance is provisioned, click on Add domain.
5. Enter your domain name and click Next.
6. Setup your DNS records is an optional step and can be skipped for this tutorial. click on Next.
7. When the name servers are assigned, configure your registrar or domain name provider to use the name servers listed.
8. At this point you can click on Cancel to get back to the main page, after you've configured your registrar or the DNS provider, it may require up to 24 hours for the changes to take effect.

When the domain's status on the Overview page changes from Pending to Active, you can use the dig <your_domain_name> ns command to verify that the new name servers have taken effect.







 Configure Health Check for the Global Load Balancer 

A health check helps gain insight into the availability of pools so that traffic can be routed to the healthy ones. These checks periodically send HTTP/HTTPS requests and monitor the responses.



1. In the IBM Cloud Internet Services dashboard, navigate to Reliability > Global Load Balancers.
2.
In this section, you will configure IBM Cloud Internet Services (CIS) to distribute the load between the two clusters. CIS is a one stop-shop service providing Global Load Balancer (GLB), Caching, Web Application Firewall (WAF) and Page rule to secure your applications while ensuring the reliability and performance for your Cloud applications.

To configure a global load balancer, you will need:



* to point a custom domain to CIS name servers,
* to retrieve the Ingress Subdomain of the Kubernetes clusters,
* to configure health checks to validate the availability of your application,
* and to define origin pools pointing to the clusters.





 Register a custom domain with IBM Cloud Internet Services 

The first step is to create an instance of CIS and to point your custom domain to CIS name servers.



1. If you do not own a domain, you can buy one from a registrar.
2. Navigate to [IBM Cloud Internet Services](https://cloud.ibm.com/catalog/services/internet-services) in the IBM Cloud catalog.
3. Set the service name, and click Create to create an instance of the service.
4. When the service instance is provisioned, click on Add domain.
5. Enter your domain name and click Next.
6. Setup your DNS records is an optional step and can be skipped for this tutorial. click on Next
7. When the name servers are assigned, configure your registrar or domain name provider to use the name servers listed.
8. After you've configured your registrar or the DNS provider, it may require up to 24 hours for the changes to take effect.

When the domain's status on the Overview page changes from Pending to Active, you can use the dig <your_domain_name> ns command to verify that the new name servers have taken effect.







 Configure Health Check for the Global Load Balancer 

Health Checks monitor responses to HTTP/HTTPS requests from origin pools on a set interval. They are used with origin pools to determine if the pools are still running properly.



1.
Create a DNS zone for each environment (for example, production, staging, development, testing). When creating the zone, be sure to include a description indicating what environment the zone is for. The zone name is the same for each zone (for example, testing.com). A single DNS Services instance can only contain 10 zones.
3. Add a zone to the instance of DNS Services.
4. In each respective zone, add specific VPCs as permitted networks. For example, for a development VPC, create a permitted network with the development VPC ID in the DNS zone for the development environment. While duplicate zone names are allowed in an account, duplicate zones cannot be associated with a single permitted network.
5. The result is that traffic from the development VPC only sees records from the development DNS zone and similarly for all the other environments. This way, you can use the same zone name in all environments, with the results tailored to each respective environment.



* Can I add the same permitted network (for example, a VPC) to two DNS zones of the same name?

No, adding the same permitted network (for example, a VPC) to two DNS zones of the same name is not allowed.
* What are the authoritative servers for the DNS Services zones? Can I resolve the private DNS zones iteratively?

Unlike public DNS zones, DNS Services does not expose authoritative servers for private DNS zones. Clients must send their recursive DNS queries to the DNS resolvers provided by the service. DNS Services does not allow iterative resolution of private DNS zones.
* Can I create a DNS zone with same name as a Public DNS zone?

DNS Services allows creating a private DNS zone that can have the same name as the public DNS zone. See a [detailed explanation](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-about-dns-servicesresolving-dns-names-with-dns-services) of this scenario, referred to as Split Horizon.
* Are there any limits on global load balancer usage?
* IBM-provided domain: Create a DNS entry for the service's VPC hostname. When you run the following command, the subdomain that you specified in step 2 is automatically generated, and is registered with the Ingress controller service.

ibmcloud oc nlb-dns create vpc-gen2 --cluster <cluster_name_or_ID> --lb-host <router_VPC_hostname> --type public



6. Optional: If you want to use Ingress controller sharding so that specific routes are handled by a specific Ingress controller, for example private routes be admitted only to a private router, then you can use either route labels or namespace labels to specify the sharding method. To add the selector during creation time, include it in the ingresscontroller yaml under spec. For example, to allow an Ingress controller to only handle ingress/routes with label type=sharded, you can add a routeSelector. For more information, see [Ingress controller sharding](https://docs.openshift.com/container-platform/4.8/networking/ingress-operator.htmlnw-ingress-sharding_configuring-ingress).

routeSelector:
matchLabels:
type: sharded



1. To add selectors to an existing Ingress controller, get a list of Ingress controllers.

oc get ingresscontroller -n openshift-ingress-operator
2. Add the selectors to Ingress controllers where you want to use sharding.

oc patch -n openshift-ingress-operator IngressController/<name> --type='merge' -p '{"spec":{"routeSelector":{"matchLabels":{"type":"sharded"}}}}'
3. Note that no selectors are added to the default IngressController, so all routes are still admitted to the default Ingress controller on the cluster. You can use the relevant route or a namespace label selectors to change this behavior.
For more information about adding a custom domain, see the [Configuring a Custom Domain for Your IBM Cloud Code Engine Application](https://www.ibm.com/cloud/blog/configuring-a-custom-domain-for-your-ibm-cloud-code-engine-application) blog. 



For more terms and capabilities for Code Engine, see [Learn about Code Engine](https://cloud.ibm.com/docs/codeengine?topic=codeengine-about).



 Next steps 



1. Just starting your migration? Check out [Getting started](https://cloud.ibm.com/docs/codeengine?topic=codeengine-migrate-cf-ce-getstart).
2. Compare Cloud Foundry terminology with Code Engine (current page)
3. [Try out Code Engine with a local build tutorial](https://cloud.ibm.com/docs/codeengine?topic=codeengine-migrate-cf-ce-local).
4. Does your application use service bindings? Check out [Migrating your service bindings](https://cloud.ibm.com/docs/codeengine?topic=codeengine-migrate-cf-ce-bind).
5. Learn about [scaling and traffic management](https://cloud.ibm.com/docs/codeengine?topic=codeengine-migrate-cf-ce-scale).
6. Find [Code Engine equivalents to Cloud Foundry commands](https://cloud.ibm.com/docs/codeengine?topic=codeengine-migrate-cf-ce-cmd).
7. Still have questions? Try the [Migrating Cloud Foundry applications to Code Engine FAQ](https://cloud.ibm.com/docs/codeengine?topic=codeengine-migrate-cf-ce-faq).



Other information



* Find out about [Code Engine pricing](https://cloud.ibm.com/docs/codeengine?topic=codeengine-pricing).
ibmcloud cis logpush-jobs DNS_DOMAIN_ID -i, --instance INSTANCE] --output FORMAT] ! ! ! ! ! !
<-- <section "id="section-command-options-logpush-jobs" "> --> Command options DNS_DOMAIN_ID: The ID of DNS domain. Required.-i , --instance value: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.-output value: Specify output format, only JSON is supported.<-- </section "id="section-command-options-logpush-jobs" "> --><-- <section "id="section-command-example-logpush-jobs" "> --> Examples Get all log push jobs for domain 31984fea73a15b45779fa0df4ef62f9b. ibmcloud cis logpush-jobs 31984fea73a15b45779fa0df4ef62f9b -i cis-demo --output JSON
<-- </section "id="section-command-example-logpush-jobs" "> --><-- </section "id="section-logpush-jobs" "> --><-- <section "id="section-logpush-job" "> --> ibmcloud cis logpush-job Get the details of a log push job for a given domain (Enterprise plan only). ibmcloud cis logpush-job DNS_DOMAIN_ID --dataset DATASET] --jobid JOB_ID] -i, --instance INSTANCE] --output FORMAT] ! ! ! ! ! !
<-- <section "id="section-command-options-logpush-job" "> --> Command options DNS_DOMAIN_ID: The ID of DNS domain. Required.--dataset value: The category of logs you want to receive. This value cannot be changed after the job is created.
The Common Name, or fully qualified domain name of the certificate, can't exceed 64 characters in length. A wildcard can be selected as the Common Name.



1. In the Common name section, from your list of domains, select the Common Name of the certificate.



15. Click Next.
16. Review the details of your certificate.
17. Click Add.
18. Check the issuance details of your certificate by clicking the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/actions-icon-vertical.svg)> View details.
19. Click Challenges to access the TXT record name and value that are associated with each of your domains. You need them to complete the challenges.
20. To validate the ownership of your domains, manually add the TXT records that are provided for each of your domains to your DNS provider account. You must address only the challenges that are not validated before the expiration date.

If you order a certificate for a subdomain, for example, sub1.sub2.domain.com, you need to add the TXT records to your registered domain domain.com.
21. Verify that the TXT records that you added to your domains are propagated. Depending on your DNS provider, it can take some time to complete.
22. After you confirm that the records are propagated, click Validate to request Let's Encrypt to validate the challenges to your domains and create a public certificate.

If the order fails because the TXT records were not successfully propagated, you must start a new order to proceed.
23. When your certificate is issued, clean up and remove the TXT records from the domains in your DNS provider account.







 Ordering public certificates with your own DNS provider by using the API 

To create a public certificate by using a manual DNS provider, complete the following steps.



1.
About domains 

IBM Cloud® offers domain management for all customers, by using the [IBM Cloud console](https://cloud.ibm.com/). There is no need to register, renew, and manage your domains with a third party. You can register, renew, transfer, and manage a domain using the same tool.



  Reverse DNS 

Reverse DNS is a method of resolving an IP address into a domain name, just as the domain name system (DNS) resolves domain names into associated IP addresses. One application of reverse DNS is a spam filter. Typically, a spammer uses an invalid IP address that does not match the domain name. A reverse DNS lookup program inputs IP addresses of incoming messages to a DNS database. If no valid name is found to match the IP address, the server blocks the message. Reverse DNS is also used for things like network troubleshooting calls (such as ping) and for network monitoring tools.





  Secondary domains 

A secondary domain is a domain that IBM Cloud DNS servers transfer from your server to our authoritative DNS servers, ns1.softlayer.com and ns2.softlayer.com.

To set up a secondary domain, you need three pieces of information: the domain, the IP address of the master DNS server we're transferring from and how often, in minutes, you'd like the domain transferred.

After a secondary domain is configured, you'll have the ability to change the master server's IP address and the transfer interval. You are also able to view the domain as we're transferring, request a manual transfer, convert your secondary domain to a primary domain, and view any error messages we logged during the transfer process.
Getting started configuring your domains using [IBM Cloud® Internet Services](https://cloud.ibm.com/docs/cis?topic=cis-resolve-override-cos). When creating redirect rules, you will be adding a CNAME, a "canonical (domain) name", or alias. Just like files on an operating system can have an alias for convenience, your hosted static website can be just as convenient.

The process for delivering static content through dedicated networks starts with this [overview of CDN options](https://www.ibm.com/cloud/cdn). Content Delivery moves your static content closer to your customer's own location, extending your reach without having to manage copies of your content.







 Endpoints for hosting static website content 

The following tables match most of the regions, locations, and type of connections used in IBM Cloud Object Storage to the new specific endpoints used for sourcing and testing hosted static websites. For tethered endpoints not listed here, find more information on [using tethered endpoints](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-advanced-endpoints).



 Regional endpoints 

Public

Private

Direct



Table 1. Regional Endpoints

 Region Hosted Static Website Endpoint 

 US South s3-web.us-south.cloud-object-storage.appdomain.cloud 
 US East s3-web.us-east.cloud-object-storage.appdomain.cloud 
 EU United Kingdom s3-web.eu-gb.cloud-object-storage.appdomain.cloud 
 EU Germany s3-web.eu-de.cloud-object-storage.appdomain.cloud 
 AP Australia s3-web.au-syd.cloud-object-storage.appdomain.cloud 
 AP Tokyo s3-web.jp-tok.cloud-object-storage.appdomain.cloud 
 AP Osaka s3-web.jp-osa.cloud-object-storage.appdomain.cloud 







 Cross Region endpoints 

Public

Private

Direct



Table 2. Cross Region Endpoints
Origins Name: Zone1 /n Address: fully qualified domain name (without http://) /n Weight: 0.5 /n Click Add origin /n Name: Zone2 /n Address: fully qualified domain name (without http://) /n Weight: 0.5 



10. Click Add to add the origin pool.
11. Click Create to create the Global Load Balancer.



Wait until the Health check status changes to Healthy. Open the URL of the load balancer: lb.mydomain.com.







 Related Content 

For a detailed example, watch the video [Patching, updating web servers with minimal downtime in a high available environment](https://www.youtube.com/watch?v=PdOjauL-SQI&feature=youtu.be).
* Click Create and choose Secrets Manager as the source service.
* Choose All instances or just the Secrets Manager created earlier.
* Internet Services as the target service.
* Choose All instances or just the CIS created earlier.
* Assign the Manager service access role.
* Click on Authorize.



If your CIS instance supports multiple domains, you can also assign Reader role to the CIS instance and Manager to the specific domain that is you are using for your solution. See [granting service access to specific domains](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-prepare-order-certificatesauthorize-specific-domains) topic.



IBM CIS supports proxying for global load balancers. When a load balancer is proxied, it means that its traffic runs directly through CIS. Load balancers support both DNS-only and HTTP proxy modes, consider which of the two alternatives below best match your use case before proceeding as the traffic routing behavior differs as follows:



* Alternative 1: Traffic that is proxied flows through CIS.
* Alternative 2: Traffic that is non-proxied (DNS-only mode) flows directly from the client to the origin. In DNS-only mode, none of the CIS security, performance, and reliability features are applied.



Zoom

![Traffic flow](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/includes/solution-tutorials/includes/solution-tutorials/images/solution41-vpc-multi-region/vpc-multi-region-alternatives.svg)

Traffic flow

For more information read through the [Proxying DNS records and global load balancers](https://cloud.ibm.com/docs/cis?topic=cis-dns-conceptsdns-concepts-proxying-dns-records) topic.





 Alternative 1: Proxy, traffic flows through CIS
This CDN is powered by Akamai. Click Create.

The Hostname has two purposes. It is a unique name that identifies the CDN instance. It can also be the [DNS subdomain](https://en.wikipedia.org/wiki/Subdomain). When filling out this form you will choose one of the following options:



1. To use a DNS subdomain in a domain that you control:



* Fill in the hostname as the DNS subdomain. For example if you control example.com then static.example.com would be a valid choice.
* Choose HTTP port if required by your application.
* Choose HTTPS port if required by your application and chose the SSL certificate DV SAN certificate.
* CDN Content will be available at your subdomain, static.example.com, for example.
* CDN Content is also available on the generated CNAME.



2. Use the IBM generated DNS subdomain:



* Fill in a unique hostname to identify the DNS instance, this will not be used in the URL for the CDN content.
* Choose HTTP port if required by your application.
* Choose HTTPS port - this is required.
* Choose SSL certificate Wildcard - this is required.
* CDN Content will be available in the generated CNAME.





2. On the next dialog, set the Hostname to a DNS subdomain like static.example.com (option a) or simply a unique name (option b).
3. Leave the Custom CNAME prefix blank, it will default to a unique name.
4. Next, under Configure your origin, leave Host header and Path empty.
5. Select Object Storage to configure the CDN for COS.
6. Set the Endpoint to your bucket public endpoint ($PUBLIC_ENDPOINT). Above this was: s3.us-south.cloud-object-storage.appdomain.cloud.
7. Set Bucket name to the bucket name from above.
8. Enable HTTP (80).
9.
You can [change the default domain](https://cloud.ibm.com/docs/containers?topic=containers-ingress-domainsingress-domain-manage-default) to any domain that exists in your cluster.

You can also [create or add your own domain](https://cloud.ibm.com/docs/containers?topic=containers-ingress-domains) registered with IBM Cloud's internal domain provider, or a domain registered with an external provider. Currently, IBM Cloud supports external domains registered with IBM Cloud Internet Services, Akamai, or Cloudflare.

Private ALBs do not reference the IBM-provided Ingress subdomain and instead require a [custom domain](https://cloud.ibm.com/docs/containers?topic=containers-managed-ingress-setupingress-custom-domain).

The subdomain is registered in the following format.

<cluster_name>.<globally_unique_account_HASH>-0000.<region>.containers.appdomain.cloud

The following table describes each portion of the subdomain.



Understanding the Ingress subdomain format

 Subdomain component Description 

 * The wildcard for the subdomain is registered by default for your cluster.
* UI
* CLI
* API







 Creating a secondary zone 



 Creating a secondary zone using the UI 

To create a secondary zone using the UI, take the following steps:



1. Navigate to the Custom resolver section of your DNS Services instance, and select the custom resolver where you want to create a secondary zone.
2. In the Custom resolver details page, select the Secondary zone tab.
3. Click Create secondary zone.
4. Enter a name for the secondary zone.
5. Optionally, enter a description for the secondary zone.
6. Enter up to two IP addresses of your AXFR-capable DNS servers, separated by a comma.
7. Click Create.



The new secondary zone now appears in the list of secondary zones in the Custom resolver details page, and is enabled by default.





 Creating a secondary zone using the CLI 

To create a secondary zone using the CLI, run the following command:

ibmcloud dns secondary-zone-create RESOLVER_ID --name NAME --transfer-from ADDRESS1,ADDRESS2 [--description DESCRIPTION] [--enabled true|false] [-i, --instance INSTANCE] [--output FORMAT]

Where:



* RESOLVER_ID is the ID of the custom resolver. Required.
* --name value is the name of the secondary zone.
* --transfer-from value is the addresses of the DNS servers from where the secondary zone data is transferred.
* --description value is the description of the secondary zone.
* --enabled value specifies whether the secondary zone is enabled.
* -i, --instance value is the instance name or ID. If not set, the context instance specified by ibmcloud dns instance-target INSTANCE is used.
* --output value specifies the output format. Currently, JSON is the only supported format.







 Creating a secondary zone using the API 

To create a secondary zone using the API, follow these steps:



1.
However, if the custom domain is within your control and you want quickly create a certificate that is not self-certified, then you can optionally use the [Let's Encrypt](https://letsencrypt.org/) service and [Certbot](https://certbot.eff.org/) to obtain a certificate.



1. Install [Certbot](https://certbot.eff.org/). Certbot is a client for the [Automatic Certificate Management Environment (ACME)](https://letsencrypt.org/2019/03/11/acme-protocol-ietf-standard.html/) protocol for automating interactions between a CA and a server. The Let's Encrypt service uses this client to verify domain ownership and issue certificates. From the [Certbot Instructions page](https://certbot.eff.org/instructions), select Other as the software and select the operating system for your workstation to obtain the applicable information to install the Certbot command line.
2. Run the following command to create your certificate. This example command creates a certificate for the example.com and www.example.com custom domains. Be sure to update the command for your own custom domain.

certbot certonly --manual --preferred-challenges dns --email webmaster@example.com --server https://acme-v02.api.letsencrypt.org/directory --agree-tos --domain example.com --domain www.example.com
3. To verify that you own the domain, set a TXT record with your domain registrar for the domains that you requested in the previous step with values that were provided with the Certbot tool output; for example, _acme_challenge.example.com and _acme_challenge.ww.example.com. After you set the TXT record, continue with the Certbot command.
4. Certbot retrieves the certificate that is signed by Let's Encrypt. The location where the certificate is stored is provided by the Certbot output.