vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* Overriding node configuration during or after deployment by using the console or APIs.
* Adding or removing ordering nodes to an ordering service. The free offering only supports a single node Raft ordering service.



See [Find out how to preview the platform free for 30 days](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-saas-pricingibp-saas-pricing-free) for more information on how to get started.





 What regions or locations are available for the IBM Blockchain Platform for IBM Cloud? 

The available regions for IBM Blockchain Platform are listed in [IBM Blockchain Platform locations](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-regions-locations). Note that you must create a Kubernetes cluster on IBM Cloud in the same region as the blockchain service to recognize the cluster. Additional regions will be available soon.





 What persistent file storage does IBM Blockchain Platform for IBM Cloud use by default? 

By default IBM Blockchain Platform for IBM Cloud uses Classic file storage. You can find more information on the [IBM Cloud File storage page](https://cloud.ibm.com/docs/containers?topic=containers-file_storagefile_storage). For a complete list of storage options, see [Persistent storage considerations](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-v2-deploy-iksibp-console-storage)





 Do I need multizone region storage for IBM Blockchain Platform nodes? 

No. When the IBM Blockchain Platform is configured with a multizone cluster in IBM Cloud Kubernetes service, you can choose which zone a particular component (peer or ordering node) is deployed to, or you can let the console decide. Then, when the node is subsequently deployed, Kubernetes "pins" the associated pod to the chosen zone. Pinning means that Kubernetes will not provision the pod in another zone in the event of a whole zone failure. And because the pods are pinned to specific zones, there is no need to access the same storage from another zone.
Choosing an app exposure service 

With IBM Cloud® Kubernetes Service, you can manage in-cluster and external networking by making apps publicly or privately accessible.

To quickly get started with app networking, follow this decision tree and click an option to see its setup docs:

Zoom

![Choosing an app exposure service](https://cloud.ibm.com/docs-content/v1/content/4d497aff9e27b92fbbc2ee4e343a9ec4549cb1d7/containers/images/choosing-app-exposure.svg)

Figure 1. This image walks you through choosing the best networking option for your application caption-side=bottom"



 Understanding load balancing for apps through Kubernetes service discovery 

Kubernetes service discovery provides apps with a network connection by using network services and a local Kubernetes proxy.

All pods that are deployed to a worker node are assigned a private IP address in the 172.30.0.0/16 range and are routed between worker nodes only. To avoid conflicts, don't use this IP range on any nodes that communicate with your worker nodes. Worker nodes and pods can securely communicate on the private network by using private IP addresses. However, when a pod crashes or a worker node needs to be re-created, a new private IP address is assigned.

Instead of trying to track changing private IP addresses for apps that must be highly available, you can use built-in Kubernetes service discovery features to expose apps as services. A Kubernetes service groups a set of pods and provides a network connection to these pods. The service selects the targeted pods that it routes traffic to via labels.

A service provides connectivity between your app pods and other services in the cluster without exposing the actual private IP address of each pod. Services are assigned an in-cluster IP address, the clusterIP, that is accessible inside the cluster only. This IP address is tied to the service for its entire lifespan and does not change while the service exists. Services are assigned an IP from one of the 65,000 IPs in the 172.21.0.0/16 range.
3.2.1 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server). 
 3.2.2 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server). 
 4.2.6 IBM Cloud Kubernetes Service does not protect kernel defaults to allow customers to [tune kernel parameters](https://cloud.ibm.com/docs/containers?topic=containers-kernel). 
 4.2.8 IBM Cloud Kubernetes Service ensures that the hostname matches the name issued by the infrastructure. 
 4.2.11 IBM Cloud Kubernetes Service rotates certificates on every worker node reload or update. 
 4.2.12 IBM Cloud Kubernetes Service rotates certificates on every worker node reload or update. 
 5.1.2 IBM Cloud Kubernetes Service deploys some system components (for example, Operator Lifecycle Manager) that could have their Kubernetes secret access further restricted. 
 5.1.3 IBM Cloud Kubernetes Service deploys some system components (for example Operator Lifecycle Manager) that could have their Kubernetes resource access further restricted. 
 5.1.5 IBM Cloud Kubernetes Service does not set automountServiceAccountToken: false for each default service account. 
 5.1.6 IBM Cloud Kubernetes Service deploys some system components that could set automountServiceAccountToken: false. 
 5.2.1 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.2.2 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp).
[Architecture](https://cloud.ibm.com/docs-content/v1/content/cbb80bf851fb762a838129cba09d5674f8bfffda/Registry/includes/solution-tutorials/includes/solution-tutorials/images/solution32-multi-region-k8s-cis/Architecture.svg)

Figure 1. Architecture diagram of the tutorial



1. The developer builds a Docker image for the application.
2. The image is pushed to a Container Registry.
3. The application is deployed to Kubernetes clusters in Dallas and London.
4. End-users access the application.
5. IBM Cloud Internet Services is configured to intercept requests to the application and to distribute the load across the clusters. In addition, DDoS Protection and Web Application Firewall are enabled to protect the application from common threats. Optionally assets like images, CSS files are cached.







 Before you begin 

This tutorial requires:



* IBM Cloud CLI,



* IBM Cloud Kubernetes Service plugin (kubernetes-service),



* kubectl to interact with Kubernetes clusters,



You will find instructions to download and install these tools for your operating environment in the [Getting started with solution tutorials](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-tutorials) guide.

In addition, make sure you:



* own a custom domain so you can configure the DNS for this domain to point to IBM Cloud Internet Services name servers.
* and [understand the basics of Kubernetes](https://kubernetes.io/docs/tutorials/kubernetes-basics/).







 Step 1: Deploy an application to one location 

This tutorial deploys a Kubernetes application to clusters in multiple locations. You will start with one location, Dallas, and then repeat these steps for London.



 Create a Kubernetes cluster
1.2.24 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server). 
 1.2.25 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server). 
 1.2.33 IBM Cloud Kubernetes Service can optionally [enable a Kubernetes Key Management Service (KMS) provider](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkms). 
 1.2.34 IBM Cloud Kubernetes Service can optionally [enable a Kubernetes Key Management Service (KMS) provider](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkms). 
 1.3.6 IBM Cloud Kubernetes Service rotates certificates on every worker node reload or update. 
 3.2.1 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server). 
 3.2.2 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server). 
 4.2.6 IBM Cloud Kubernetes Service does not protect kernel defaults to allow customers to [tune kernel parameters](https://cloud.ibm.com/docs/containers?topic=containers-kernel). 
 4.2.8 IBM Cloud Kubernetes Service ensures that the hostname matches the name issued by the infrastructure. 
 4.2.11 IBM Cloud Kubernetes Service rotates certificates on every worker node reload or update. 
 4.2.12 IBM Cloud Kubernetes Service rotates certificates on every worker node reload or update.
3.2.2 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server). 
 4.2.6 IBM Cloud Kubernetes Service does not protect kernel defaults to allow customers to [tune kernel parameters](https://cloud.ibm.com/docs/containers?topic=containers-kernel). 
 4.2.8 IBM Cloud Kubernetes Service ensures that the hostname matches the name issued by the infrastructure. 
 4.2.11 IBM Cloud Kubernetes Service rotates certificates on every worker node reload or update. 
 4.2.12 IBM Cloud Kubernetes Service rotates certificates on every worker node reload or update. 
 5.1.2 IBM Cloud Kubernetes Service deploys some system components (for example, Operator Lifecycle Manager) that could have their Kubernetes secret access further restricted. 
 5.1.3 IBM Cloud Kubernetes Service deploys some system components (for example Operator Lifecycle Manager) that could have their Kubernetes resource access further restricted. 
 5.1.5 IBM Cloud Kubernetes Service does not set automountServiceAccountToken: false for each default service account. 
 5.1.6 IBM Cloud Kubernetes Service deploys some system components that could set automountServiceAccountToken: false. 
 5.2.1 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.2.2 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.2.3 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp).
, and hyphen (-), and must be 35 characters or fewer. Use a name that is unique across regions. The cluster name and the region in which the cluster is deployed form the fully qualified domain name for the Ingress subdomain. To ensure that the Ingress subdomain is unique within a region, the cluster name might be truncated and appended with a random value within the Ingress domain name.

--workers <number>
: Specify the number of worker nodes to include in the cluster. If you don't specify this option, a cluster with the minimum value of 1 is created. For more information, see [What is the smallest size cluster that I can make?](https://cloud.ibm.com/docs/containers?topic=containers-faqssmallest_cluster).

--version <major.minor.patch>
: The Kubernetes version for the cluster master node. This value is optional. When the version is not specified, the cluster is created with the default supported Kubernetes version. To see available versions, run ibmcloud ks versions.

--public-service-endpoint
: Enable the public cloud service endpoint so that your Kubernetes master can be accessed over the public network, for example to run kubectl commands from your CLI, and so that your Kubernetes master and the worker nodes can communicate over the public VLAN. You can later disable the public cloud service endpoint if you want a private-only cluster.After you create the cluster, you can get the endpoint by running ibmcloud ks cluster get --cluster <cluster_name_or_ID>.

--private-service-endpoint
: In [VRF-enabled](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpointvrf) and [service endpoint-enabled accounts](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpointservice-endpoint): Enable the private cloud service endpoint so that your Kubernetes master and the worker nodes can communicate over the private VLAN.
[Versions commands](https://cloud.ibm.com/docs/cli?topic=cli-kubernetes-service-clics_versions_command) List the container platform versions that are available for IBM Cloud Kubernetes Service clusters. 
 Deprecated[API commands](https://cloud.ibm.com/docs/cli?topic=cli-kubernetes-service-clics_cli_api) View or target the API endpoint and API version for the service. 
 Deprecated[init commands](https://cloud.ibm.com/docs/cli?topic=cli-kubernetes-service-clics_init) Initialize the IBM Cloud Kubernetes Service plug-in or specify the region where you want to create or access Kubernetes clusters. 
 [Script commands](https://cloud.ibm.com/docs/cli?topic=cli-kubernetes-service-cliscript) Rewrite scripts that call IBM Cloud Kubernetes Service plug-in commands. 
 Beta[Storage commands](https://cloud.ibm.com/docs/cli?topic=cli-kubernetes-service-clics_storage) View and modify storage resources. 







 cluster commands 

Create, view, and modify clusters and cluster settings, such as add-on, subnet, and master settings.



 ibmcloud ks cluster addon disable 

Disable a managed add-on in an existing cluster. This command must be combined with one of the following subcommands for the managed add-on that you want to disable.



 ibmcloud ks cluster addon disable alb-oauth-proxy 

Virtual Private Cloud

Classic infrastructure

Disable the add-on for the [ALB OAuth Proxy](https://cloud.ibm.com/docs/containers?topic=containers-debug-tool) in a cluster.

ibmcloud ks cluster addon disable alb-oauth-proxy --cluster CLUSTER

Minimum required permissions
: Administrator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:
For more information, see the documentation for the ibmcloud ks flavors (machine-types)[command](https://cloud.ibm.com/docs/cli?topic=cli-kubernetes-service-clics_machine_types). This value is required for standard clusters and is not available for free clusters.

--size-per-zone WORKERS_PER_ZONE
: The number of workers to create in each zone. This value is required, and must be 1 or greater. For more information, see [What is the smallest size cluster that I can make?](https://cloud.ibm.com/docs/containers?topic=containers-faqssmallest_cluster).

--hardware ISOLATION
: Required: The level of hardware isolation for your worker node. Use dedicated if you want to have available physical resources that are dedicated to you only, or shared to allow physical resources to be shared with other IBM customers. The default is shared. For bare metal flavors, specify dedicated.

--disable-disk-encrypt
: Specifies that the disk is not encrypted. The default value is false.

-l, --label KEY1=VALUE1
: Optional: Apply key-value labels to each worker node in the worker pool. To specify multiple labels, use multiple options, such as -l key1=value1 -l key2=value2.

--operating-system SYSTEM
: Optional. The operating system of the worker nodes you want to provision in your cluster. For a list of available operating systems by cluster version, see [IBM Cloud Kubernetes Service version information](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions).

-q
: Optional: Do not show the message of the day or update reminders.

--output json
: Optional: Prints the command output in JSON format.



 Example worker-pool create classic command 

ibmcloud ks worker-pool create classic --name my_pool --cluster my_cluster --flavor b3c.4x16 --size-per-zone 6
: Every region is set up with a highly available load balancer that is accessible from the region-specific API endpoint. The load balancer routes incoming and outgoing requests to clusters in the regional zones. The likelihood of a full regional failure is low. However, to account for this failure, you can set up multiple clusters in different regions and connect them by using an external load balancer. If an entire region fails, the cluster in the other region can take over the workload. For more information, see [Setting up highly available clusters](https://cloud.ibm.com/docs/containers?topic=containers-ha_clustersha_clusters).

A multi-region cluster requires several Cloud resources, and depending on your app, can be complex and expensive. Check whether you need a multi-region setup or if you can accommodate a potential service disruption. If you want to set up a multi-region cluster, ensure that your app and the data can be hosted in another region, and that your app can handle global data replication.

Potential failure point 6: Storage availability
: In a stateful app, data plays an important role to keep your app up and running. Make sure that your data is highly available so that you can recover from a potential failure. In IBM Cloud Kubernetes Service, you can choose from several options to persist your data. For example, you can provision NFS storage by using Kubernetes native persistent volumes, or store your data by using an IBM Cloud database service. For more information, see [Planning highly available data](https://cloud.ibm.com/docs/containers?topic=containers-storage-plan).
Target the resource group where you want to set the API key. If you don't target a resource group, the API key is set for the default resource group. To list available resource groups, run ibmcloud resource groups.

ibmcloud target -g <resource_group_name>
5. Create an API key that impersonates your infrastructure permissions. IBM Cloud Kubernetes Service uses this API key to authenticate requests to manage infrastructure in the region and resource group. The previous API key for the region and resource group, if any, is deleted.

ibmcloud ks api-key reset --region <region>
6. Verify that the API key is set up.

ibmcloud ks api-key info --cluster <cluster_name_or_ID>
7. Repeat these steps for each region and resource group that you want to create clusters in.



Now that the API key is set up for the region and resource group, you can [assign users IBM Cloud IAM platform access roles](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-perms) to restrict what cluster infrastructure actions they can perform.





 Understanding other options than the API key 

For different ways to access the IBM Cloud infrastructure portfolio, check out the following sections.



* If you aren't sure whether your account already has access to the IBM Cloud infrastructure portfolio, see [Understanding access to the infrastructure portfolio](https://cloud.ibm.com/docs/containers?topic=containers-access-credsunderstand_infra).
* If the account owner does not set the API key, [ensure that the user who sets the API key has the correct permissions](https://cloud.ibm.com/docs/containers?topic=containers-access-credsowner_permissions).
* For more information about using your Pay-As-You-Go or Subscription account to set the API key, see [Accessing the infrastructure portfolio with your IBM Cloud Pay-As-You-Go or Subscription account](https://cloud.ibm.com/docs/containers?topic=containers-access-credsdefault_account).
[Architecture](https://cloud.ibm.com/docs-content/v1/content/cb1eb27836421578019401fa7556779109430b29/cis/includes/solution-tutorials/includes/solution-tutorials/images/solution32-multi-region-k8s-cis/Architecture.svg)

Figure 1. Architecture diagram of the tutorial



1. The developer builds a Docker image for the application.
2. The image is pushed to a Container Registry.
3. The application is deployed to Kubernetes clusters in Dallas and London.
4. End-users access the application.
5. IBM Cloud Internet Services is configured to intercept requests to the application and to distribute the load across the clusters. In addition, DDoS Protection and Web Application Firewall are enabled to protect the application from common threats. Optionally assets like images, CSS files are cached.







 Before you begin 

This tutorial requires:



* IBM Cloud CLI,



* IBM Cloud Kubernetes Service plugin (kubernetes-service),



* kubectl to interact with Kubernetes clusters,



You will find instructions to download and install these tools for your operating environment in the [Getting started with solution tutorials](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-tutorials) guide.

In addition, make sure you:



* own a custom domain so you can configure the DNS for this domain to point to IBM Cloud Internet Services name servers.
* and [understand the basics of Kubernetes](https://kubernetes.io/docs/tutorials/kubernetes-basics/).







 Step 1: Deploy an application to one location 

This tutorial deploys a Kubernetes application to clusters in multiple locations. You will start with one location, Dallas, and then repeat these steps for London.



 Create a Kubernetes cluster
1.2.1 IBM Cloud Kubernetes Service utilizes RBAC for cluster protection, but allows anonymous discovery, which is considered reasonable per [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/). 
 1.2.10 IBM Cloud Kubernetes Service does not enable the [EventRateLimit](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/eventratelimit) admission controller since it is a Kubernetes alpha feature. 
 1.2.12 IBM Cloud Kubernetes Service does not enable the [AlwaysPullImages](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/alwayspullimages) admission controller since it overrides a container's imagePullPolicy and may impact performance. 
 1.2.22 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server). 
 1.2.23 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server). 
 1.2.24 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server). 
 1.2.25 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server).