vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Profiling is enabled by default in Red Hat OpenShift, but the profiling data is sent through the healthz port and the port must be protected by RBAC. 
 1.2.23 Ensure that the --audit-log-maxage option is set to 30 or as appropriate. Ensure that the audit logs are forwarded off the cluster for retention. Red Hat OpenShift has an operator for logging instead of retaining logs in the cluster. 
 1.2.24 Ensure that the --audit-log-maxbackup option is set to 10 or as appropriate. Ensure that the maximumRetainedFiles option is set to 10 or as appropriate. Different parameter names. 
 1.2.25 Ensure that the --audit-log-maxsize option is set to 100 or as appropriate. Ensure that the maximumFileSizeMegabytes option is set to 100 or as appropriate. Different parameter names. 
 1.3.1 Ensure that the --terminated-pod-gc-threshold option is set as appropriate. Ensure that garbage collection is configured as appropriate. Different parameter names. 
 1.3.2 Ensure that the --profiling option is set to false. Ensure that controller manager healthz endpoints are protected by RBAC. Profiling is enabled by default in Red Hat OpenShift, but the profiling data is sent through the healthz port and the port must be protected by RBAC. 
 1.4.1 Ensure that the --profiling option is set to false. Ensure that the healthz endpoints for the scheduler are protected by RBAC. Profiling is enabled by default in Red Hat OpenShift, but the profiling data is sent via healthz port and the port must be protected by RBAC. 
 1.4.2 Ensure that the --bind-address option is set to 127.0.0.1. Verify that the scheduler API service is protected by authentication and authorization. Red Hat OpenShift has different operator than vanilla kubernetes, and configuration for its security differs 
 4.1.3 Ensure that the proxy kubeconfig file permissions are set to 644 or more restrictive.
Healthcare use cases for IBM Cloud 

These use cases highlight how workloads on Red Hat® OpenShift® on IBM Cloud® benefit from the public cloud. They have secure compute on isolated bare metal, easy spin-up of clusters for faster development, migration from virtual machines, and data sharing in cloud databases.



 Healthcare provider migrates workloads from inefficient VMs to Ops-friendly containers for reporting and patient systems 

An IT Exec for a healthcare provider has business reporting and patient systems on-premises. Those systems go through slow enhancement cycles, which leads to stagnant patient service levels.

To improve patient service, the provider looked to Red Hat OpenShift on IBM Cloud and IBM Cloud® Continuous Delivery to reduce IT expenses and accelerate development, all on a secure platform. The provider’s high-use SaaS systems, which held both patient record systems and business report apps, needed updates frequently. Yet, the provider's developers were overwhelmed with administering the hardware, network, and even the Kubernetes stack on their own. The provider also wanted to counteract increasing labor costs and a decreasing budget.

They started by containerizing their SaaS systems and putting them in the cloud. From that first step, they went from over-built hardware in a private data center to customizable compute that reduces IT operations, maintenance, and energy. To host the SaaS apps, they easily designed Kubernetes clusters to fit their CPU, RAM, and storage needs. They used IBM Cloud Pak for Data to provide the familiar analytics tools from their on-prem environment. Another factor for decreased staff costs is that IBM manages Kubernetes, so the provider can focus on delivering better customer service.

Accelerated development is a key win for the IT Exec. With the move to public cloud, Developers can experiment easily with Node.js SDK, pushing changes to Development and Test systems, scaled out on separate clusters. Those pushes were automated with open toolchains and IBM Cloud® Continuous Delivery. Updates to the SaaS system no longer languished in slow, error-prone build processes. The Developers can deliver incremental updates to their users, daily or even more frequently.
Since [Red Hat OpenShift on IBM Cloud](https://www.ibm.com/cloud/openshift) is a managed service, you cannot SSH directly into the master and worker nodes.
* The storage node is configured as an NFS server and the block storage is mounted to /data, which is exported to share with Red Hat OpenShift cluster worker nodes. If you want to use the NFS storage inside the pods, then you need to create persistent volumes and persistent volume claims and attach them into the pods. For more information, see [Configuring persistent volumes and persistent volume claims](https://cloud.ibm.com/docs/hpc-openshift?topic=hpc-openshift-configure-pv-and-pvc).



The image that is used by the login node and the storage node is based on RHEL 8.4 by default. In the login node, client packages like oc, kubectl, and ibmcloud are installed for performing Red Hat OpenShift operations.

If your HPC workload needs more libraries, you need to install them on this machine so that they can be used when you assemble your application for deployment to the cluster.





 Step 1: Create SSH key 

Complete the following steps to create your SSH key:



1. Generate an SSH key on your system by running the following command:

ssh-keygen -t rsa
2. Copy and save all of the content from .ssh/id_rsa.pub.







 Step 2: Add SSH key to the VPC infrastructure 



1. Log in to the [IBM Cloud® console](https://cloud.ibm.com/) by using your unique credentials.
2. From the dashboard, click Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/9de14ae11cc0bda57c240e5b42f2964edeaab3c6/icons/icon_hamburger.svg) > VPC Infrastructure > SSH keys.
3. Click Create.
4.
Government use cases for IBM Cloud 

These use cases highlight how workloads on Red Hat® OpenShift® on IBM Cloud® benefit from the public cloud. These workloads are isolated in global regions for data sovereignty, use Watson machine learning instead of net-new code, and connect to on-premises databases.



 Regional government improves collaboration and velocity with community Developers who combine public-private data 

An Open-Government Data Program Executive needs to share public data with the community and private sector, but the data is locked in an on-premises monolithic system.

With Red Hat OpenShift on IBM Cloud, the Exec delivers the value of combined public-private data. Likewise, the service provides the public cloud platform to refactor and expose microservices from monolithic on-premises apps. Also, the public cloud allows government and the public partnerships to use external cloud services and collaboration-friendly open-source tools.



 Context 



* An “open government” model is the future, but this regional government agency can't make the leap with their on-premises systems.
* They want to support innovation and foster co-development between private sector, citizens, and public agencies.
* Disparate groups of Developers from the government and private organizations don’t have a unified open-source platform where they can share APIs and data easily.
* Government data is locked in on-premises systems with no easy public access.







 Solution 

An open-government transformation must be built on a foundation that provides performance, resilience, business continuity, and security. As innovation and co-development move ahead, agencies and citizens depend on software, services, and infrastructure companies to “protect and serve.”

To bust bureaucracy and transform government’s relationship with its constituency, they turned to open standards to build a platform for co-creation.



* OPEN DATA – data storage where citizens, government agencies, and businesses access, share, and enhance data freely
* OPEN APIs – a development platform where APIs are contributed by and reused with all community partners
* OPEN INNOVATION – a set of cloud services that allow developers to use plug-in innovation instead of manually coding it



To start, the government uses IBM Cloud Object Storage to store its public data in the cloud.
5.1.3 Red Hat OpenShift on IBM Cloud deploys some system components that could have their Kubernetes resource access further restricted. 
 5.1.5 Red Hat OpenShift on IBM Cloud does not set [automountServiceAccountToken: false](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/use-the-default-service-account-to-access-the-api-server) for each default service account. 
 5.1.6 Red Hat OpenShift on IBM Cloud deploys some system components that could set [automountServiceAccountToken: false](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/use-the-default-service-account-to-access-the-api-server). 
 5.2.1 Red Hat OpenShift on IBM Cloud can optionally [configure security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scc). 
 5.2.2 Red Hat OpenShift on IBM Cloud can optionally [configure security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scc). 
 5.2.3 Red Hat OpenShift on IBM Cloud can optionally [configure security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scc). 
 5.2.4 Red Hat OpenShift on IBM Cloud can optionally [configure security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scc). 
 5.2.5 Red Hat OpenShift on IBM Cloud can optionally [configure security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scc).
* Both Create a secret that can pull images from and push images to Container Registry. For example, you might set up a continuous delivery pipeline that builds an image to a private registry so that your team can pull the most recent image across multiple clusters.





 Set up the Red Hat OpenShift Container Platform internal registry to pull from Container Registry 

To configure Red Hat OpenShift Container Platform to pull from Container Registry, you must complete the following steps:



1. [Set up image pull secrets to IBM Cloud Container Registry](https://cloud.ibm.com/docs/openshift?topic=openshift-registryother_registry_accounts) for each project that you want to pull images in.
2. [Configure Red Hat OpenShift Container Platform to use the image pull secrets](https://cloud.ibm.com/docs/openshift?topic=openshift-registryuse_imagePullSecret) by adding the secrets to a service account in each project or by referring to the secret in your

poddeployment. You are only required to add the secret to the projects that you want to pull to.







 Set up the Red Hat OpenShift Container Platform build to push images to Container Registry 

If you want to push application images from Red Hat OpenShift Container Platform to Container Registry, you must edit the Red Hat OpenShift Container Platform build configuration to point at Container Registry, where myregistry.mycompany.io is <region_domain_name>.icr.io. For more information about Container Registry regions and domain names, see [Regions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_regions).

For instructions, see [Setting up builds in the internal registry to push images to IBM Cloud Container Registry](https://cloud.ibm.com/docs/openshift?topic=openshift-registrybuilds_registry).
If your location hosts have private network connectivity only, or if you use Amazon Web Services, Google Cloud Platform, or Microsoft Azure hosts, you must be connected to your hosts' private network, such as through VPN access, to connect to your cluster and access the Red Hat OpenShift web console. Alternatively, if your hosts have public network connectivity, you can test access to your cluster by changing your cluster's and location's DNS records to [use your hosts' public IP addresses](https://cloud.ibm.com/docs/openshift?topic=openshift-access_clustersat_public_access).
14. Optional: [Set up the internal container image registry](https://cloud.ibm.com/docs/openshift?topic=openshift-satellite-clusterssatcluster-internal-registry).







 Creating Red Hat OpenShift clusters on Satellite from the CLI 

Use the Satellite CLI to create your Red Hat OpenShift clusters on your Satellite infrastructure.

Before you begin, [install the Satellite CLI plug-in](https://cloud.ibm.com/docs/satellite?topic=satellite-cli-install).

To create the cluster in a Satellite location, you must use Red Hat OpenShift version 4.5 or later.



1. [Complete the prerequisite steps](https://cloud.ibm.com/docs/openshift?topic=openshift-satellite-clusterssatcluster-prereqs).
2. Verify that your location is in a Normal state. The location is in a Normal state when you successfully created the Satellite control plane and all hosts that you use for the control plane are in a healthy state.

ibmcloud sat location ls

Example output

Retrieving locations...
OK
Name ID Status Ready Created Hosts (used/total) Managed From
mylocation brhtfum2015a6mgqj16g normal yes 4 days ago 3 / 6 Dallas
3. Create a Red Hat OpenShift cluster in your Satellite location. When you create the cluster, the cluster master is automatically created in your Satellite control plane.
In short, they need to focus on coding instead of managing the infrastructure. Thus, they chose Red Hat OpenShift on IBM Cloud because IBM simplifies infrastructure management.



* Managing Kubernetes master, IaaS, and operational components, such as Ingress and storage
* Monitoring health and recovery for worker nodes
* Providing global compute, so Developers aren't responsible for infrastructure setup in data centers



Compute, storage, and event management that run in public cloud with access to back-end ERP systems

Technical solution:



* Red Hat OpenShift on IBM Cloud
* IBM® Event Streams for IBM Cloud®
* IBM Cloudant
* IBM Streaming Analytics
* IBM Watson Discovery







 Step 1: Containerize apps, by using microservices 



* Structure inventory analysis and mobile apps into microservices and deploy them to containers in Red Hat OpenShift on IBM Cloud.
* Provide standardized DevOps dashboards through Kubernetes.
* Scale compute resources for batch and other inventory workloads that run less frequently.







 Step 2: Analyze inventory and trends 



* IBM® Event Streams for IBM Cloud® acts as the just-in-time events platform to bring in the rapidly changing information from inventory systems to IBM Streaming Analytics.
* Social media analysis with Watson Discovery and inventory systems data is integrated with IBM Streaming Analytics to deliver merchandising and marketing advice.







 Step 3: Deliver promotions with mobile loyalty app 



* Promotions in the form of coupons and other entitlements are sent to users’ mobile app. The promotions were identified by using the inventory and social analysis, plus other back-end systems.
* Storage of promotion recipes on mobile app and conversions (redeemed checkout coupons) are fed back to ERP systems for further analysis.









 Results 



* With Red Hat OpenShift on IBM Cloud, microservices greatly reduce time to delivery for patches, bug fixes, and new features. Initial development is fast, and updates are frequent.
* Customer traffic and sales increased in stores by making the stores themselves a differentiating asset.
* At the same time, new insights from social and cognitive analysis improved reduced inventory OpEx (operating expenses).
* Social sharing in the mobile app also helps to identify and market to new customers.
5.2.3 Red Hat OpenShift on IBM Cloud can optionally configure [Red Hat OpenShift security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scc) and [Kubernetes pod security admission](https://kubernetes.io/docs/concepts/security/pod-security-admission/) which are similar to the deprecated [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 5.2.4 Red Hat OpenShift on IBM Cloud can optionally configure [Red Hat OpenShift security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scc) and [Kubernetes pod security admission](https://kubernetes.io/docs/concepts/security/pod-security-admission/) which are similar to the deprecated [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 5.2.5 Red Hat OpenShift on IBM Cloud can optionally configure [Red Hat OpenShiftta.keyword.redhat_openshift_notm}} security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scc) and [Kubernetes pod security admission](https://kubernetes.io/docs/concepts/security/pod-security-admission/) which are similar to the deprecated [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/).
5.2.9 Red Hat OpenShift on IBM Cloud can optionally configure [OpenShift security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scc) and [Kubernetes pod security admission](https://kubernetes.io/docs/concepts/security/pod-security-admission/) which are similar to the deprecated [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 5.3.2 Red Hat OpenShift on IBM Cloud has a set of [default Calico network policies defined](https://cloud.ibm.com/docs/openshift?topic=openshift-network_policiesdefault_policy) and [additional network policies can optionally be added](https://cloud.ibm.com/docs/openshift?topic=openshift-network_policiesadding_network_policies). 
 5.4.1 Red Hat OpenShift on IBM Cloud deploys some system components that could prefer using secrets as files over secrets as environment variables. 
 5.4.2 Red Hat OpenShift on IBM Cloud can optionally [enable a Kubernetes Key Management Service (KMS) provider](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionkms). 
 5.5.1 Red Hat OpenShift on IBM Cloud can optionally [enable image security enforcement](https://cloud.ibm.com/docs/openshift?topic=openshift-imagesportieris-image-sec). 
 5.6.2 Red Hat OpenShift on IBM Cloud does not annotate all pods with [seccomp profiles](https://kubernetes.io/docs/concepts/security/pod-security-policy/seccomp).
Step 4: Next steps 

After you've gathered the necessary input values to define your cluster configuration, you are ready to deploy your Red Hat OpenShift cluster. The Red Hat OpenShift cluster can be deployed on IBM Cloud by using the IBM Cloud Schematics UI, Schematics CLI, or the Schematics APIs. If you want to deploy your cluster by using the CLI or API, review the prerequisites for your interface of choice:



* [Setting up the IBM Cloud Schematics CLI](https://cloud.ibm.com/docs/hpc-openshift?topic=hpc-openshift-setting-up-cli)
* [Setting up the IBM Cloud Schematics API](https://cloud.ibm.com/docs/hpc-openshift?topic=hpc-openshift-setting-up-api)



After you've created and gathered your information and reviewed any additional prerequisites for your interface of choice, you are ready to begin [Creating a workspace](https://cloud.ibm.com/docs/hpc-openshift?topic=hpc-openshift-creating-workspace).
* (optional) IBM Cloud GitLab configured with your SSH key.Check the instructions under the Generate an SSH key pair and Add an SSH key to your GitLab account sections of the [documentation here](https://us-south.git.cloud.ibm.com/help/user/ssh.md)



You will find instructions to download and install these tools for your operating environment in the [Getting started with tutorials](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-tutorials) guide.

To avoid the installation of these tools, you can use the [Cloud Shell](https://cloud.ibm.com/shell) from the IBM Cloud console. Use oc version to ensure the version of the Red Hat OpenShift on IBM Cloud CLI matches your cluster version (4.12.x). If they do not match, install the matching version by following [these instructions](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-tutorialsgetting-started-cloud-shell).

In addition, make sure you [set up a registry namespace](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespaceregistry_namespace_setup).





 Step 1: Create an Red Hat OpenShift on IBM Cloud cluster 

With Red Hat OpenShift on IBM Cloud, you have a fast and secure way to containerize and deploy enterprise workloads in Red Hat OpenShift on IBM Cloud clusters. Red Hat OpenShift on IBM Cloud clusters build on Kubernetes container orchestration that offers consistency and flexibility for your development lifecycle operations.

In this section, you will provision a Red Hat OpenShift on IBM Cloud cluster in one (1) zone with two (2) worker nodes:



1. Create an Red Hat OpenShift on IBM Cloud cluster from the [IBM Cloud® catalog](https://cloud.ibm.com/kubernetes/catalog/create?platformType=openshift).
2.
Specify where you want to install IBM Cloud Pak for Data:



1. Select the Red Hat OpenShift on IBM Cloud cluster where you want to deploy IBM Cloud Pak for Data.
2. Enter or select the Red Hat OpenShift on IBM Cloud project where you want to deploy IBM Cloud Pak for Data.







 Step 3. Configure your workspace 

Specify how you will track and manage your installation:



1. Enter or select a name for the installation.
2. Consider changing the default resource group.
3. Specify any tags that you want to use for the installation. Specify multiple tags as a comma-separated list.







 Step 4. Complete the preinstallation task 

A Red Hat OpenShift on IBM Cloud cluster administrator must complete this step. Specifically, the administrator must have an [access](https://cloud.ibm.com/docs/openshift?topic=openshift-users) policy in IBM Cloud Identity and Access Management that has an Operator role or higher.



* If you are not an administrator, use the Share link to share the script with your cluster administrator.
* If you are a cluster administrator, click Run script to run the preinstallation set up on your cluster.



The preinstallation script makes the following changes to your Red Hat OpenShift on IBM Cloud cluster:



* Increases the size of the Docker registry to 200 GB. This change increases the cost of your Red Hat OpenShift on IBM Cloud cluster.
* Creates the security context constraints that are required for IBM Cloud Pak® for Data.
* Grants access to the security context constraints to the service accounts that are required for IBM Cloud Pak® for Data.



Confirm that the script completes successfully before you proceed.

If the cluster administrator is not allowed to modify the storage, or the infrastructure account is not the same as the current account, a storage administrator can manually execute the script that is provided in [Complete the preinstallation section](https://cloud.ibm.com/catalog/content/ibm-cp-datacore-6825cc5d-dbf8-4ba2-ad98-690e6f221701-global).





 Step 5.