vania-janet/multiturn-rag-retrieval-data huggingface dataset:
To obtain the CNAME record with the CLI, use the [ibmcloud ce domainmapping get](https://cloud.ibm.com/docs/codeengine?topic=codeengine-clicli-domainmapping-get) command. For example,

ibmcloud ce domainmapping get --domain-name www.example.com

Example output

Getting domain mapping 'www.example.com'...
OK

Domain Name: www.example.com
CNAME: custom.abcdabcdabc.us-south.codeengine.appdomain.cloud
Target Name: myapp
Target Type: app
TLS Secret: mytlssecret
Status: ready

After you have the CNAME target, you are ready to add the CNAME record entry to the DNS settings of your custom domain. Note that publishing of the CNAME record with the domain registrar can take some time to populate the DNS changes in the internet.





 How can I use Cloud Internet Services (CIS) with custom domain mapping? 

You cannot use the CIS TLS encryption mode of End-to-End flexible with Code Engine custom domain mappings because this mode uses self-signed certificates that are not allowed. Instead, you can use the default TLS encryption mode of [End-to-End CA signed](https://cloud.ibm.com/docs/cis?topic=cis-cis-tls-optionstls-encryption-modes-end-to-end-ca-signed). If you use the CIS TLS mode of End-to-End-flexible, you can switch to use the CIS TLS End-to-End CA signed mode, and obtain a CA signed certificate that is created outside of Cloud Internet Services (CIS).



1. Create the TLS/SSL certificate outside of CIS. See [How can I obtain a certificate for my custom domain?](https://cloud.ibm.com/docs/codeengine?topic=codeengine-domain-mappingsprepare-custom-domain-cert)
2.
* US-SOUTH - api.us-south.cf.cloud.ibm.com
* US-EAST - api.us-east.cf.cloud.ibm.com
* EU-DE - api.eu-de.cf.cloud.ibm.com
* EU-GB - api.eu-gb.cf.cloud.ibm.com
* AU-SYD - api.au-syd.cf.cloud.ibm.com



2. Create a custom domain for your organization by typing the following command:

ibmcloud app domain-create <MY_ORGNAME> <MY_DOMAIN>
3. Add the route with the custom domain to an app.

For Cloud Foundry apps, run the following command:

ibmcloud app route-map <MY_APPNAME> <MY_DOMAIN> -n <MY_HOSTNAME>







 Mapping the custom domain to the system domain 

After you configure the custom domain in IBM Cloud, map the custom domain to the IBM Cloud system domain on your registered DNS server:



1. Set up a 'CNAME' record for the custom domain name on your DNS server. Steps for setting up the CNAME record vary depending on your DNS provider. For example, if you use GoDaddy, you follow the [Domains Help](https://www.godaddy.com/help/add-a-cname-record-19236) guidance from GoDaddy.
2. Map the custom domain name to the secure endpoint for the IBM Cloud region where your app is running. Use the following region endpoints to provide the URL route that is allocated to your organization in IBM Cloud. For example, point your CNAME to custom-domain.us-east.cf.cloud.ibm.com.

Cloud Foundry endpoints:



* US-SOUTH - custom-domain.us-south.cf.cloud.ibm.com
* US-EAST - custom-domain.us-east.cf.cloud.ibm.com
* EU-DE - custom-domain.eu-de.cf.cloud.ibm.com
* EU-GB - custom-domain.eu-gb.cf.cloud.ibm.com
However, you can use that single certificate only one time in a region. If you plan to use your custom domains in more than one project in a single region, keep them separate.







 Testing your custom domain 

After the CNAME record updates are published, you can test the application with the custom domain mapping.

With a browser, call the application by targeting the custom domain by using curl.

curl -v -X GET https://www.example.com

Example output

Hello World from:
___ __ ____ ____
/ __)/ ( ( __)
( (__( O )) D ( ) _)
___)__/(____/(____)
____ __ _ ___ __ __ _ ____
( __)( ( / __)( )( ( ( __)
) _) / /( (_ )( / / ) _)
(____)_)__) ___/(__)_)__)(____)
Some Env Vars:
--------------
CE_APP=myapp
CE_DOMAIN=us-east.codeengine.appdomain.cloud
CE_SUBDOMAIN=abcdabcdab
HOME=/root
HOSTNAME=myapp-00001-deployment-6db6d89dc7-k6qc7
K_REVISION=myapp-00001
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
PORT=8080
PWD=/
SHLVL=1

The output of the call to the custom domain is mapped to the myapp application, which uses the icr.io/codeengine/helloworld sample image.





 Viewing domain mappings 



 Viewing domain mappings from the console 

You can view a listing of all automatically generated and custom domain mappings for your applications from the console.
* [Configure the Ingress for the DNS subdomain](https://cloud.ibm.com/docs/Registry?topic=Registry-multi-region-k8s-cismulti-region-k8s-cis-ingress)







 Step 3: Configure multi-location load-balancing 

Your application is now running in two clusters but it is missing one component for the users to access either clusters transparently from a single entry point.

In this section, you will configure IBM Cloud Internet Services (CIS) to distribute the load between the two clusters. CIS is a one stop-shop service providing Global Load Balancer (GLB), Caching, Web Application Firewall (WAF) and Page rule to secure your applications while ensuring the reliability and performance for your Cloud applications.

To configure a global load balancer, you will need:



* to point a custom domain to CIS name servers,
* to retrieve the Ingress Subdomain of the Kubernetes clusters,
* to configure health checks to validate the availability of your application,
* and to define origin pools pointing to the clusters.





 Register a custom domain with IBM Cloud Internet Services 

The first step is to create an instance of CIS and to point your custom domain to CIS name servers.



1. If you do not own a domain, you can buy one from a registrar.
2. Navigate to [IBM Cloud Internet Services](https://cloud.ibm.com/catalog/services/internet-services) in the IBM Cloud catalog.
3. Set the service name, and click Create to create an instance of the service.
4. When the service instance is provisioned, click on Add domain.
5. Enter your domain name and click Next.
6. Setup your DNS records is an optional step and can be skipped for this tutorial. click on Next
7. When the name servers are assigned, configure your registrar or domain name provider to use the name servers listed.
8. After you've configured your registrar or the DNS provider, it may require up to 24 hours for the changes to take effect.
If you already have a domain provisioned with an internal or external provider and have set up any necessary credentials, you can use this command to add that domain to your cluster. Or, you can provision a new domain in both your cluster and in your provider account. To specify an existing domain, include the full domain name with the external provider zone, such as exampledomain.externalzone.com. To create a new domain, you must still include the external provider zone, but you can customize the subdomain portion, such as new-exampledomain.externalzone.com.

ibmcloud ks ingress domain create --cluster CLUSTER [--is-default] [--domain DOMAIN] [--hostname HOSTNAME] [--ip IP] [--output OUTPUT] [--domain-provider PROVIDER] [-q] [--secret-namespace NAMESPACE]

-c, --cluster CLUSTER
: Required. The name or ID of the cluster where you want to create the domain.

--is-default
: Optional. Include this option to set the relevant domain as the default domain for the cluster.

--domain DOMAIN
: The domain to create or add to your cluster. This can be a domain that exists in your provider account, or a new domain.

--hostname HOSTNAME
: For VPC clusters. The hostname to register for the domain.

--ip IP
: The IP addresses to register for the domain.

--output OUTPUT
: Optional: Prints the command output in JSON format.

--domain-provider PROVIDER
: Optional. The external DNS provider type. Specify akamai-ext for Akamai or cloudflare-ext for Cloudflare.

--secret-namespace NAMESPACE
: Optional. The namespace that the domain TLS secret is created in. If no namespace is specified, the secret is created in the default namespace.







 Managing domains 

Learn how to manage the domains that exist in your cluster.



 Viewing domains in a cluster 

You can view the status of all domains in your cluster, or you can view details of a single domain.
If you already have a domain provisioned with an internal or external provider and have set up any necessary credentials, you can use this command to add that domain to your cluster. Or, you can provision a new domain in both your cluster and in your provider account. To specify an existing domain, include the full domain name with the external provider zone, such as exampledomain.externalzone.com. To create a new domain, you must still include the external provider zone, but you can customize the subdomain portion, such as new-exampledomain.externalzone.com.

ibmcloud oc ingress domain create --cluster CLUSTER [--is-default] [--domain DOMAIN] [--hostname HOSTNAME] [--ip IP] [--output OUTPUT] [--domain-provider PROVIDER] [-q] [--secret-namespace NAMESPACE]

-c, --cluster CLUSTER
: Required. The name or ID of the cluster where you want to create the domain.

--is-default
: Optional. Include this option to set the relevant domain as the default domain for the cluster.

--domain DOMAIN
: The domain to create or add to your cluster. This can be a domain that exists in your provider account, or a new domain.

--hostname HOSTNAME
: For VPC clusters. The hostname to register for the domain.

--ip IP
: The IP addresses to register for the domain.

--output OUTPUT
: Optional: Prints the command output in JSON format.

--domain-provider PROVIDER
: Optional. The external DNS provider type. Specify akamai-ext for Akamai or cloudflare-ext for Cloudflare.

--secret-namespace NAMESPACE
: Optional. The namespace that the domain TLS secret is created in. If no namespace is specified, the secret is created in the default namespace.







 Managing domains 

Learn how to manage the domains that exist in your cluster.



 Viewing domains in a cluster 

You can view the status of all domains in your cluster, or you can view details of a single domain.
To register your custom domain, work with your Domain Name Service (DNS) provider or [IBM Cloud DNS](https://cloud.ibm.com/docs/dns?topic=dns-getting-started). If the apps that you want Ingress to expose are in different namespaces in one cluster, register the custom domain as a wildcard domain, such as .custom_domain.net. Note that domains are limited to 130 characters or fewer in Kubernetes version 1.20 or later.
2. Define an alias for your custom domain by specifying the IBM-provided subdomain as a Canonical Name record (CNAME). To find the IBM-provided Ingress domain, run ibmcloud ks cluster get --cluster <cluster_name> and look for the Ingress subdomain field.

Specifying the IBM-provided subdomain as a CNAME is required for automatic health checks to remove any failing IPs from the DNS response, and to ensure that your custom domain updates when you add or remove ALBs.







 Creating custom domains for private ALBs 

Follow the steps to create a custom domain for private ALBs. Note that custom domains are required to use Ingress with private ALBs.

If you have a classic cluster with only a private VLAN, you must first configure your own [DNS service that is available on your private network](https://kubernetes.io/docs/tasks/administer-cluster/dns-custom-nameservers/).



1. Create a custom domain through your DNS service provider. Note that Ingress URLs must be 130 characters or fewer.
2. Map your custom domain to the private ALBs by adding their IP addresses as A records (classic clusters) or their VPC hostname as a CNAME (VPC clusters). To find the ALB IP addresses (classic) or hostname (VPC), run ibmcloud ks ingress alb ls -c <cluster_name_or_ID>.
At a PowerShell prompt on the bastion host, enter the following commands that enable the server to join the domain:



* The Get-DnsClientServerAddress captures the Interface Index for the IPv4 Ethernet interface, so that the DNS can be changed from the IBM Cloud DNS server to the ADDNS server. The Add-Computer command will fail if this step is missed as the server will not be able to locate the domain controller. The Add-Computer -Server only accepts FQDN.
* The Add-Computer command adds the server to the domain <domain> using the ADDNS server <ad_server_fqdn> and then restarts the server to make the change effective.



$dns = "<ADDNS_IP_Address>"
$adserver = "<ad_server_fqdn>"
$domain = "<domain>"
$user = $domain + "Administrator"
$password = "<password>"
$out=Get-DnsClientServerAddress -InterfaceAlias Ethernet -AddressFamily IPv4 | Select-Object -Property InterfaceIndex
Set-DnsClientServerAddress -InterfaceIndex $out.InterfaceIndex -ServerAddresses ($dns)
$password = ConvertTo-SecureString $password -AsPlainText -Force
$credential = New-Object System.Management.Automation.PSCredential ($user, $password)
Add-Computer -DomainName $domain -Server $adserver -Restart -Credential $credential





 Add the PowerShell AD module 

In Windows Server 2019, you can optionally install the Active Directory module for Windows PowerShell, using the following PowerShell commands. By adding the module, you can access AD information from the bastion host rather then RDP to the AD server:

Import-Module ServerManager
Add-WindowsFeature -Name "RSAT-AD-PowerShell" –IncludeAllSubFeature
Install-Module -Name WindowsCompatibility





 Add the PowerShell SQL module
Click Create to create the custom domain mapping.



Now you have a domain mapping that is created in Code Engine. However, requests that are sent to your application are not (yet) routed to your custom domain. Next, [complete the custom domain configuration with your domain registrar](https://cloud.ibm.com/docs/codeengine?topic=codeengine-domain-mappingscompleting-custom-domain-registrar).

Suppose that you want to create a custom domain mapping for www.example.com and shop.example.com. In this case, you must create a custom domain mapping for each unique domain or subdomain. However, you can reuse the same TLS secret for multiple custom domain mappings if the TLS secret includes certification for the domain that is specified in the custom domain mapping. The TLS secret can contain certificates that map to specific multiple domains, such as www.example.com and shop.example.com, or a wildcard domain such as .example.com. Note that you cannot use the wildcard domain more than one time within a region.





 Configuring custom domain mappings with the CLI 

To create a custom domain mapping with the CLI, use the domainmapping create command. This command requires a fully qualified domain name (FQDN), such as www.example.com, a target application, and a TLS secret. For a complete listing of options, see the [ibmcloud ce domainmapping create](https://cloud.ibm.com/docs/codeengine?topic=codeengine-clicli-domainmapping-create) command.

Before you begin



* Obtain the registered domain name.
* Obtain the signed TLS certificate and the private key.
* Set up your [Code Engine CLI](https://cloud.ibm.com/docs/codeengine?topic=codeengine-install-cli) environment.
* [Create a project](https://cloud.ibm.com/docs/codeengine?topic=codeengine-manage-project).
* UI
* CLI
* API







 Configuring a custom resolver 

You can add a custom resolver in IBM Cloud® DNS Services by using the UI, CLI, or API.



 Creating a custom resolver using the UI 

To add a custom resolver in DNS Services, follow these steps:

Each VPC can have only one custom resolver.



1. Navigate to Custom resolvers in the DNS Services navigation menu.
2. Click Create custom resolver.
3. Enter a name and description for your custom resolver.
4. Select a region from the list menu.
5. Select a VPC from the list menu.
6. Select a subnet from the list menu.

To achieve high availability, you must provide a minimum of two subnets. You can configure a maximum of three locations within the same subnet, or in different subnets.
7. Click Add+ if you want to add another subnet.
8. Click Create.

The custom resolver details view appears, where you can manage custom resolver settings.





 Creating a custom resolver without high availability 

If you want to create a custom resolver without high availability, you must manually delete the second subnet field by clicking the trashcan icon next to the second subnet.

Zoom

![Delete second subnet](https://cloud.ibm.com/docs-content/v1/content/d56dbd8ab7d14086029681ee71679e14aea53723/dns-svcs/images/cr-no-ha.png)

Figure 1. Delete the second subnet to remove high availability function







 Creating a custom resolver using the CLI 

To create a custom resolver using the CLI, run the following command:

ibmcloud dns custom-resolver-create --name NAME --location LOCATION1 --location LOCATION2 [-description DESCRIPTION] [-i, --instance INSTANCE] [--output FORMAT]

Where:
ibmcloud cis access-certificates-settings DNS_DOMAIN_ID [-i, --instance INSTANCE] [--output FORMAT]



 Command options 

DNS_DOMAIN_ID
: The ID of DNS domain. Required.

-i, --instance
: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.

--output
: Specify output format, only JSON is supported.





 Examples 

Get access certificates settings for Domain 31984fea73a15b45779fa0df4ef62f9b.

ibmcloud cis access-certificates-settings 31984fea73a15b45779fa0df4ef62f9b -i cis-demo







 ibmcloud cis access-certificates-settings-update 

Update access certificates settings for a given DNS domain (Enterprise plan only).

ibmcloud cis access-certificates-settings-update DNS_DOMAIN_ID (-f, --feature FEATURE) (-v, --value VALUE) [-i, --instance INSTANCE] [--output FORMAT]



 Command options 

DNS_DOMAIN_ID
: The ID of DNS domain. Required.

-f, --feature
: Feature of certificates settings. Valid values:

client_certificate_forwarding
: The client certificate payload and its SHA256 signature are forwarded to origin servers via CF-Client-Cert-DER_BASE64 and CF-Client-Cert-SHA256 headers, respectively.

-v, --value
: The value set to the feature for certificates.

client_certificate_forwarding
: Specify the hostname to forward client certificate or not. For example: -v host1=on,host2=on,host3=off

-i, --instance
: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.

--output
: Specify output format, only JSON is supported.





 Examples
* host: Label to be added under the zone



$client = SoftLayer_SoapClient::getClient('SoftLayer_Dns_Domain_ResourceRecord', null, $apiUser, $apiKey);
$domainId = 123456;
 
$template = new stdClass();
$template->data = 'webserver01.example.com';
$template->host = 'www';
$template->type = 'cname';
$template->domainId = $domainId;
 
$result = $client->createObject($template);
print_r($result);





 Edit records 

Edit resource records by passing a template object into SoftLayer_Dns_Domain_ResourceRecord::editObject. The template object must contain:



* id: Identifier for the SoftLayer_Dns_Domain_ResourceRecord to be edited.
* domainId: Identifier of the SoftLayer_Dns_Domain to which this resource record is a child record
* properties: To be changed



Domain serial numbers are updated by the API automatically.

$domainId = 45567;
$resourceRecordId = 1234;
$client = SoftLayer_SoapClient::getClient('SoftLayer_Dns_Domain_ResourceRecord', $resourceRecordId, $apiUser, $apiKey);
 
$template = new stdClass();
$template->id = $resourceRecordId;
$template->domainId = $domainId;
$template->data = '127.0.0.1';
$template->host = 'server01';
 
$result = $client->editObject($template);
print_r($result);

It is also necessary to populate the init params with the resource record ID property. A Boolean is returned by SoftLayer_Dns_Domain_ResourceRecord::editObject





 Delete records
Assign the Manager role.





 Create a domain 

Create a new domain, or specify an existing domain that you want to add to your cluster. To specify an existing domain, include the full domain name with the external provider zone, such as exampledomain.externalzone.com. To create a new domain, you must still include the external provider zone, but you can customize the subdomain portion, such as custom.exampledomain.externalzone.com. Note that the domain name must be unique in the zone it is registered in.

If you delete a domain that is registered with the IBM internal provider, you cannot reuse the domain name.

ibmcloud ks ingress domain create --cluster CLUSTER [--crn CRN] [--is-default] [--domain DOMAIN] [--hostname HOSTNAME] [--ip IP] [--output OUTPUT] [--domain-provider PROVIDER] [-q] [--secret-namespace NAMESPACE] [--zone ZONE]

-c, --cluster CLUSTER
: Required. The name or ID of the cluster where you want to create the domain.

--crn CRN
: Required for IBM Cloud Internet Services domains. The CRN for the IBM Cloud Internet Services instance.

--is-default
: Optional. Include this option to set the relevant domain as the default domain for the cluster.

--domain DOMAIN
: The domain to create or add to your cluster. This can be a domain that exists in your provider account, or a new domain.

--hostname HOSTNAME
: For VPC clusters. The hostname to register for the domain.

--ip IP
: The IP addresses to register for the domain.

--output OUTPUT
: Optional: Prints the command output in JSON format.

--domain-provider PROVIDER
: Required. The external DNS provider type. Specify --cis-ext.

--secret-namespace NAMESPACE
: Optional. The namespace that the domain TLS secret is created in. If no namespace is specified, the secret is created in the default namespace.
Custom domain: To specify a custom domain, work with your DNS provider or [IBM Cloud® Internet Services](https://cloud.ibm.com/catalog/services/internet-services).



1. Get the public IP address for the public Ingress controller service in each zone in the EXTERNAL-IP column. Note that the Ingress controller service in the first zone where you have workers nodes is always named router-default, and Ingress controller services in zones that you subsequently add to your cluster have names such as router-dal12.

oc get svc -n openshift-ingress
2. Create a custom domain with your DNS provider. If you want to use the same subdomain for multiple services in your cluster, you can register a wildcard subdomain, such as .example.com.
3. Map your custom domain to the Ingress controller's public IP address by adding the IP address as an A record.



3. Set up a route that is based on the [type of TLS termination that your app requires](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_routesroute-types). If you don't have a custom domain, don't include the --hostname option. A route hostname is generated for you in the format <service_name>-<project>.<cluster_name>-<random_hash>-0000.<region>.containers.appdomain.cloud. If you registered a wildcard subdomain, specify a unique subdomain in each route that you create. For example, you might specify --hostname svc1.example.com in this route, and --hostname svc2.example.com in another route.



* Simple:

oc expose service <app_service_name> [--hostname <subdomain>]
* Passthrough:

oc create route passthrough --service <app_service_name> [--hostname <subdomain>]

Need to handle HTTP/2 connections?