vania-janet/multiturn-rag-retrieval-data huggingface dataset:
: Editor platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

-f
: Optional: Force the command to run without user prompts.

-q
: Optional: Do not show the message of the day or update reminders.



 Example cluster master private-service-endpoint allowlist enable command 

ibmcloud oc cluster master private-service-endpoint allowlist enable --cluster mycluster







 ibmcloud oc cluster master private-service-endpoint allowlist get 

Virtual Private Cloud

Classic infrastructure

List all subnets in the allowlist for a cluster's private cloud service endpoint.

This list includes subnets that you manually added by using the ibmcloud oc cluster master private-service-endpoint allowlist add command and subnets that are automatically added and managed by IBM, such as worker node subnets.

ibmcloud oc cluster master private-service-endpoint allowlist get --cluster CLUSTER [-q]

Minimum required permissions
: Viewer platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

-q
: Optional: Do not show the message of the day or update reminders.



 Example cluster master private-service-endpoint allowlist get command 

ibmcloud oc cluster master private-service-endpoint allowlist get --cluster mycluster







 ibmcloud oc cluster master private-service-endpoint allowlist rm 

Virtual Private Cloud

Classic infrastructure

Remove subnets that you previously added to the allowlist for a cluster's private cloud service endpoint.

After a subnet is removed, any requests that originate from this subnet to the cluster master through the private cloud service endpoint are denied.

ibmcloud oc cluster master private-service-endpoint allowlist rm --cluster CLUSTER --subnet SUBNET [--subnet SUBNET ...] [-q]

Minimum required permissions
Controlling user access with IBM Cloud IAM and Kubernetes RBAC 

Set IBM Cloud IAM platform access and service access policies in the IBM Cloud console or CLI so that users can work with clusters in IBM Cloud Kubernetes Service. IAM service access roles correspond with Kubernetes role-based access control (RBAC) within the cluster.

Before you begin, check out [Understanding access policies and roles](https://cloud.ibm.com/docs/containers?topic=containers-access-overviewaccess_policies) to review what policies are, whom you can assign policies to, and what resources can be granted policies.

IBM Cloud IAM roles can't be assigned to a service account. Instead, you can directly [assign RBAC roles to service accounts](https://cloud.ibm.com/docs/containers?topic=containers-usersrbac).



 Example cluster use cases and IAM roles 

Wondering which access roles to assign to your cluster users? Use the examples in following table to determine which roles and scope to assign. You can find more information about what roles authorize which types of actions on the user access reference page in the table's links.



Types of roles you might assign to meet different use cases.

 Use case Example roles and scope 

 App auditor [Viewer platform access role for a cluster, region, or resource group](https://cloud.ibm.com/docs/containers?topic=containers-iam-platform-access-roles), [Reader service access role for a cluster, region, or resource group](https://cloud.ibm.com/docs/containers?topic=containers-iam-service-access-roles). 
 App developers [Editor platform access role for a cluster](https://cloud.ibm.com/docs/containers?topic=containers-iam-platform-access-roles), [Writer service access role scoped to a namespace](https://cloud.ibm.com/docs/containers?topic=containers-iam-service-access-roles), [Cloud Foundry developer space role](https://cloud.ibm.com/docs/containers?topic=containers-cloud-foundry-roles).
For example, you might add conditions such as only clusters in a resource group, only clusters with a prod Kubernetes namespace, or only clusters with a trusted-profile Kubernetes service account.
* Specific resources: A particular cluster. Click Add another resource + to select a cluster and fill out conditions such as the Kubernetes namespace or Kubernetes service account that can establish trust.
* Click Continue.



The Kubernetes namespace and service account names that you enter don't have to exist already. Any future namespaces or service accounts with these names can establish trust. To list existing namespaces, log in to your cluster and run kubectl get ns. To list existing service accounts, log in to your cluster and run kubectl get sa -n <namespace>.
7. Grant the trusted profile any access policies to the IAM services and Account management that you want the pod in your cluster to be able to access.



* For example, you might grant access to All Identity and Access enabled services and All resources in those services, with the Editor platform, Writer service, and Viewer resource group access roles.
* Click Add + to add the policy to the profile, and continue adding as many policies as you want.



8. In the Summary pane, review the profile, trust, and access details. Then, click Create.



Your clusters can now establish trust with IBM Cloud IAM. Next, your developers can [configure their application pods to exchange the identity token for an IAM token to authenticate requests to IBM Cloud services](https://cloud.ibm.com/docs/containers?topic=containers-pod-iam-identityiam-identity-pod).





 Configure your application pods to authenticate with IBM Cloud services 

As a developer, you can configure your application pods to authenticate with IBM Cloud services in clusters that are linked to an IAM trusted profile set up.

Before you begin:



* [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.]
Kubernetes security bulletins that affect IBM Cloud Kubernetes Service users or the IBM Cloud platform are published in the [IBM Cloud security bulletin](https://cloud.ibm.com/status?component=containers-kubernetes&selected=security).

Some CVEs require the latest patch update for a Kubernetes version that you can install as part of the regular [cluster update process](https://cloud.ibm.com/docs/containers?topic=containers-updateupdate) in IBM Cloud Kubernetes Service. Make sure to apply security patches in time to protect your cluster from malicious attacks. For more information about what is included in a security patch, refer to the [version change log](https://cloud.ibm.com/docs/containers?topic=containers-changelog).
For example, to access your cluster's private cloud service endpoint, you must connect to your IBM Cloud classic network or your VPC network through a VPN or IBM Cloud Direct Link. You can add the subnet for the VPN or IBM Cloud Direct Link tunnel so that authorized users in your organization can only access the private cloud service endpoint from that subnet.

Worker node subnets are automatically added to and removed from your allowlist so that worker nodes can always access the master through the private cloud service endpoint.

ibmcloud oc cluster master private-service-endpoint allowlist add --cluster CLUSTER --subnet SUBNET [--subnet SUBNET ...] [-q]

Minimum required permissions
: Editor platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

--subnet SUBNET
: Required: The subnet in CIDR format. Specify more than one subnet by using multiple repeated options.

-q
: Optional: Do not show the message of the day or update reminders.



 Example cluster master private-service-endpoint allowlist add command 

ibmcloud oc cluster master private-service-endpoint allowlist add --cluster mycluster --subnet 1.1.1.1/16







 ibmcloud oc cluster master private-service-endpoint allowlist disable 

Virtual Private Cloud

Classic infrastructure

Disable the subnet allowlist feature for a cluster's private cloud service endpoint.

After you disable this feature, authorized requests to your cluster master through the cluster's private cloud service endpoint can originate from any subnet.

ibmcloud oc cluster master private-service-endpoint allowlist disable --cluster CLUSTER [-f] [-q]

Minimum required permissions
: Editor platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

-f
: Optional: Force the command to run without user prompts.

-q
ibmcloud ks cluster master private-service-endpoint allowlist rm --cluster mycluster
--subnet 1.1.1.1/16









 ibmcloud ks cluster master private-service-endpoint disable 

Classic infrastructure

Disable the [private cloud service endpoint](https://cloud.ibm.com/docs/containers?topic=containers-plan_basicsworkeruser-master) to remove private accessibility to your cluster master.

Important: Before you disable the private endpoint, you first must complete the following steps to enable the public cloud service endpoint:



1. Enable the public cloud service endpoint by running ibmcloud ks cluster master public-service-endpoint enable --cluster <cluster_name>.
2. Follow the prompt in the CLI to refresh the Kubernetes master API server.
3. [Reload all the worker nodes in your cluster to pick up the public endpoint configuration.](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_worker_reload)



ibmcloud ks cluster master private-service-endpoint disable --cluster CLUSTER [-f] [-q] [-y]

Minimum required permissions
: Administrator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-f
: Optional: Force the command to run with no user prompts.

-q
: Optional: Do not show the message of the day or update reminders.

-y
: Optional: Refresh the cluster master and reload worker nodes with no user prompts.



 Example cluster master private-service-endpoint disable command 

ibmcloud ks cluster master private-service-endpoint disable --cluster my_cluster







 ibmcloud ks cluster master private-service-endpoint enable 

Classic infrastructure

Enable the [private cloud service endpoint](https://cloud.ibm.com/docs/containers?topic=containers-plan_basicsworkeruser-master) to make your cluster master privately accessible.

To run this command:



1.
By using the following steps and the information in the table, assign the required permissions:



1. Log into your IBM Cloud account and click Manage -> Access (IAM).
2. In the Manage access and users dashboard, click View all in the My user details section.
3. In the Access tab, click Assign access +. From the Table 1, select a service and click Next.
4. In the Roles and actions section, select the specified permissions that are required.
5. Click Add and Assign to assign the permissions required.





Table 2. Permissions required for Data Security Broker

 Service Name Permission level 

 Key Protect Writer 
 IBM Cloud® Object Storage Manager 
 Kubernetes Service Manager, Editor 
 IBM Red Hat OpenShift Kubernetes Service Editor 
 Schematics Manager, Administrator 



You can find more information about Data Security Broker in the [About Data Security Broker](https://cloud.ibm.com/docs/security-broker?topic=security-broker-sb_about) section.





 Next Steps 

After the environment is set up and you have the required roles and permissions, you can start installing the Data Security Broker by following the instructions in the [Installing Data Security Broker](https://cloud.ibm.com/docs/security-broker?topic=security-broker-sb_install_catalog) section.
Choose a combination of [platform and service access roles](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-accessmanage-access-roles) to assign access for the user.
12. Click Add.
13. Continue to add platform and service access roles as needed. When you are finished, click Assign.



Zoom

![The image shows an example of how to grant user access to a key.](https://cloud.ibm.com/docs-content/v1/content/0bc8db34a3d90b2a5103c9c71b08a96de9525bbc/key-protect/images/grant-access-key.png)

Figure 1. Shows how to grant user access to a specific key.







 Granting access to key rings in an instance 

A key ring is a collection of keys located within your service instance, in which you can restrict access to via IAM access policy. For information on key rings, see [Grouping keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grouping-keys).

You can grant access to key rings within a Key Protect instance by using the IBM Cloud console, IAM API, or IAM CLI.

Review [roles and permissions](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-access) to learn how IBM Cloud IAM roles map to Key Protect actions.



 Granting access to key rings in an instance using the console 

To assign access to a key ring via the console:



1. From the menu bar, click Manage > Access (IAM), and select Users to browse the existing users in your account.
2. Select a table row, and click the ⋯ icon to open a list of options for that user.
3. From the options menu, click Assign access.
4. Click Assign access to the users.
5. Click the IAM services tile.
6. From the list of services, select Key Protect.
7.
In the ibm-credentials.env: field, enter the base64 encoded API key or the ID of trusted profile.

apiVersion: v1
data:
ibm-credentials.env: Trusted profile ID
kind: Secret
metadata:
name: ibm-cloud-credentials
namespace: kube-system
type: Opaque
6. [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)
7. Create the secret in your cluster.

kubectl apply -f ibm-cloud-credentials.yaml
8. Restart the driver pods by disabling and re-enabling the add-on.



1. Disable the add-on.

ibmcloud oc cluster addon disable vpc-block-csi-driver
2. Re-enable the add-on.

ibmcloud oc cluster addon enable vpc-block-csi-driver --cluster CLUSTER --version VERSION







 Automatically creating a secret by using a Shell script 



1. Save the following script to a file called generate-secret.sh.

!/bin/bash

IBMCLOUD_AUTHTYPE=
SECRET=

error() {
if [! $? = 0 ]]; then
echo $1; exit 1
fi
}

validate_options validates the options provided to the script
validate_options() {
if [ "$" -eq 1 ]]; then
if [ "$1" == "-h" ]] || [ "$1" == "--help" ]]; then
usage; exit 1
fi
fi

number of options provided to the script must be 2
if [ "$" -ne 2 ]]; then
echo "Invalid number of options provided"
usage; exit 1
fi

1st option must be 'iam' or 'pod-identity'
if [!
1 November 2019 

New! Keep your own key (KYOK) support (beta)
: You can now [enable several key management service (KMS) providers](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkms), so that you can use your own root key to encrypt the secrets in your cluster.







 October 2019 



 28 October 2019 

Version change logs
: Worker node patch updates are available for Kubernetes [1.15.5_1521](https://cloud.ibm.com/docs/containers?topic=containers-115_changelog1155_1521), [1.14.8_1537](https://cloud.ibm.com/docs/containers?topic=containers-114_changelog1148_1537), [1.13.12_1540](https://cloud.ibm.com/docs/containers?topic=containers-113_changelog11312_1540), [1.12.10_1570](https://cloud.ibm.com/docs/containers?topic=containers-112_changelog11210_1570), and Red Hat OpenShift [3.11.153_1529_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_changelog_311311153_1529).

New! Resource groups for VPC clusters
: You can now [create Kubernetes clusters](https://cloud.ibm.com/docs/containers?topic=containers-vpc_ks_tutorial) in different resource groups than the resource group of the Virtual Private Cloud (VPC).





 24 October 2019 

CLI change log
: Updated the IBM Cloud Kubernetes Service CLI plug-in change log page for the [release of version 0.4.42](https://cloud.ibm.com/docs/containers?topic=containers-cs_cli_changelog).

Scaling down file storage
Edit the ALB's ConfigMap (kube-system/ibm-k8s-controller-config) and change allow-snippet-annotations: "false" to allow-snippet-annotations: "true".

kubectl edit cm ibm-k8s-controller-config -n kube-system
6. Bind the App ID service instance to the cluster. If you have several services with the same name the command will fail. You should pass the service GUID instead of its name. To find the GUID of a service, use ibmcloud resource service-instance <service-name>. Replace default namespace if using a different namespace.

ibmcloud ks cluster service bind --cluster $MYCLUSTER --namespace default --service secure-file-storage-appid
7. Deploy the app.

kubectl apply -f secure-file-storage.yaml









 Step 3: Test the application 

The application can be accessed at https://secure-file-storage.<your-cluster-ingress-subdomain>/.



1. Go to the application's home page. You will be redirected to the App ID default login page.
2. Sign up for a new account with a valid email address.
3. Wait for the email in your inbox to verify the account.
4. Login.
5. Choose a file to upload. Click Upload.
6. Use the Share action on a file to generate a pre-signed URL that can be shared with others to access the file. The link is set to expire after 5 minutes.



Authenticated users have their own spaces to store files. While they can not see each other files, they can generate pre-signed URLs to grant temporary access to a specific file.

You can find more details about the application in the [source code repository](https://github.com/IBM-Cloud/secure-file-storage).





 Step 4: Review Security Events
Therefore, the private cloud service endpoint allowlist is most effective for controlling access to clusters that have only the private cloud service endpoint enabled.

Before you begin:



* [Access your cluster through the private cloud service endpoint](https://cloud.ibm.com/docs/containers?topic=containers-access_clusteraccess_private_se).
* [Grant users access to your cluster through IBM Cloud IAM](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-perms).



To create a private cloud service endpoint allowlist:



1. Get the subnets that you want to add to the allowlist. For example, you might get the subnet for the connection through your VPN or Direct Link tunnel to your IBM Cloud private network.
2. Enable the subnet allowlist feature for a cluster's private cloud service endpoint. Now, access to the cluster via the private cloud service endpoint is blocked for any requests that originate from a subnet that is not in the allowlist. Your worker nodes continue to run and have access to the master.

ibmcloud ks cluster master private-service-endpoint allowlist enable --cluster <cluster_name_or_ID>
3. Add subnets from which authorized users can access your private cloud service endpoint to the allowlist.

ibmcloud ks cluster master private-service-endpoint allowlist add --cluster <cluster_name_or_ID> --subnet <subnet_CIDR> [--subnet <subnet_CIDR> ...]
4. Verify that the subnets in your allowlist are correct. The allowlist includes subnets that you manually added and subnets that are automatically added and managed by IBM, such as worker node subnets.

ibmcloud ks cluster master private-service-endpoint allowlist get --cluster <cluster_name_or_ID>



Your authorized users can now continue with [Accessing clusters through the private cloud service endpoint](https://cloud.ibm.com/docs/containers?topic=containers-access_clusteraccess_private_se).
Review network design to avoid IP conflicts between two ends of Direct Link.
* [Install the IBM Cloud CLI and plug-ins](https://cloud.ibm.com/docs/containers?topic=containers-install-ibmcloud-cli) and [install the Kubernetes CLI (kubectl)](https://cloud.ibm.com/docs/containers?topic=containers-cli-install).
* Ensure that your IBM Cloud account is Virtual Router Function (VRF) enabled to use service endpoints.
* Ensure you have the following access policies. For more information, see [Checking user permissions](https://cloud.ibm.com/docs/satellite?topic=satellite-iam-assign-accesschecking-perms).



* Administrator IBM Cloud IAM platform access role for IBM Cloud Kubernetes Service
* Administrator IBM Cloud IAM platform access role for IBM Cloud Container Registry
* Writer or Manager IBM Cloud IAM service access role for IBM Cloud Kubernetes Service
* Administrator IBM Cloud IAM platform access role for IBM Cloud Container Registry
* Administrator IBM Cloud IAM platform access role for IBM Cloud Satellite
* Manager IBM Cloud IAM service access role for IBM Cloud Satellite
* Administrator IBM Cloud IAM platform access role for Object Storage
* Writer or Manager IBM Cloud IAM platform access role for IBM Cloud Object Storage
* Administrator IBM Cloud IAM platform access role for IBM Cloud Certificate Manager
* Writer or Manager IBM Cloud IAM platform access role for IBM Cloud Certificate Manager
* Viewer IBM Cloud IAM platform access role for the resource group that you plan to use with Satellite
* Manager IBM Cloud IAM service access role for IBM Cloud Schematics



* Specifically provision a Kubernetes cluster and deploy NGINX reverse proxy in it to forward to the Direct Link endpoints.







 Step 1: Creating a Red Hat CoreOS enabled Satellite Location 

You can skip this step if you already have a Red Hat CoreOS enabled Satellite Location.

Log in to your IBM Cloud account that has Direct Link and create a Red Hat CoreOS enabled Satellite Location.
: Viewer platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

--provider (classic | vpc-gen2)
: Optional: Filter output based on infrastructure provider type.

-l, --location LOCATION
: Filter output by a specific location. To see supported locations, run ibmcloud oc locations. To specify multiple locations, use one option for each location, such as -l dal -l seo.

--output json
: Optional: Prints the command output in JSON format. Note: If you don't include the --provider option, only classic clusters are returned.

-q
: Optional: Do not show the message of the day or update reminders.



 Example cluster ls command 

ibmcloud oc cluster ls -l ams03 -l wdc -l ap







 ibmcloud oc cluster master pod-security get 

Virtual Private Cloud

Classic infrastructure

View the pod security admission configuration for a cluster's Kubernetes API server.

ibmcloud oc cluster master pod-security get --cluster CLUSTER [--output OUTPUT] [-q]

Minimum required permissions
: Viewer platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

--output json
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.



 Example cluster master pod-security get command 

ibmcloud oc cluster master pod-security get --cluster mycluster







 ibmcloud oc cluster master pod-security policy disable 

Virtual Private Cloud

Classic infrastructure

Disable the pod security policy for a cluster's Kubernetes API server.

ibmcloud oc cluster master pod-security policy disable --cluster CLUSTER [-q]

Minimum required permissions
: Administrator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER