vania-janet/multiturn-rag-retrieval-data huggingface dataset:
3.2.2 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server). 
 4.2.6 IBM Cloud Kubernetes Service does not protect kernel defaults to allow customers to [tune kernel parameters](https://cloud.ibm.com/docs/containers?topic=containers-kernel). 
 4.2.8 IBM Cloud Kubernetes Service ensures that the hostname matches the name issued by the infrastructure. 
 4.2.11 IBM Cloud Kubernetes Service rotates certificates on every worker node reload or update. 
 4.2.12 IBM Cloud Kubernetes Service rotates certificates on every worker node reload or update. 
 5.1.2 IBM Cloud Kubernetes Service deploys some system components that could have their Kubernetes secret access further restricted. 
 5.1.3 IBM Cloud Kubernetes Service deploys some system components that could have their Kubernetes resource access further restricted. 
 5.1.5 IBM Cloud Kubernetes Service does not set [automountServiceAccountToken: false](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/use-the-default-service-account-to-access-the-api-server) for each default service account. 
 5.1.6 IBM Cloud Kubernetes Service deploys some system components that could set [automountServiceAccountToken: false](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/use-the-default-service-account-to-access-the-api-server).
3.2.2 IBM Cloud Kubernetes Service can optionally [Enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server). 
 4.2.6 IBM Cloud Kubernetes Service does not protect kernel defaults to allow customers to [Tune kernel parameters](https://cloud.ibm.com/docs/containers?topic=containers-kernel). 
 4.2.8 IBM Cloud Kubernetes Service ensures that the hostname matches the name issued by the infrastructure. 
 4.2.11 IBM Cloud Kubernetes Service rotates certificates on every worker node reload or update. 
 4.2.12 IBM Cloud Kubernetes Service rotates certificates on every worker node reload or update. 
 5.1.2 IBM Cloud Kubernetes Service deploys some system components that could have their Kubernetes secret access further restricted. 
 5.1.3 IBM Cloud Kubernetes Service deploys some system components that could have their Kubernetes resource access further restricted. 
 5.1.5 IBM Cloud Kubernetes Service does not set [automountServiceAccountToken: false](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/use-the-default-service-account-to-access-the-api-server) for each default service account. 
 5.1.6 IBM Cloud Kubernetes Service deploys some system components that could set [automountServiceAccountToken: false](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/use-the-default-service-account-to-access-the-api-server).
By default, every cluster in IBM Cloud Kubernetes Service is set up with multiple Kubernetes master instances to ensure availability and accessibility of your cluster resources, even if one or more instances of your Kubernetes master are unavailable.

You can make your cluster even more highly available and protect your app from a downtime by spreading your workloads across multiple worker nodes in multiple zones of a region. This setup is called a [multizone cluster](https://cloud.ibm.com/docs/containers?topic=containers-ha_clustersmz-clusters) and ensures that your app is accessible, even if a worker node or an entire zone is not available.

To protect against an entire region failure, create [multiple clusters and spread them across IBM Cloud regions](https://cloud.ibm.com/docs/containers?topic=containers-ha_clustersmultiple-clusters-glb). By setting up a network load balancer (NLB) for your clusters, you can achieve cross-region load balancing and cross-region networking for your clusters.

If you have data that must be available, even if an outage occurs, make sure to store your data on [persistent storage](https://cloud.ibm.com/docs/containers?topic=containers-storage-plan).

For more information about how to achieve high availability for your cluster, see [High availability for IBM Cloud Kubernetes Service](https://cloud.ibm.com/docs/containers?topic=containers-haha).
* What options do I have to secure my cluster?

You can use built-in security features in IBM Cloud Kubernetes Service to protect the components in your cluster, your data, and app deployments to ensure security compliance and data integrity. Use these features to secure your Kubernetes API server, etcd data store, worker node, network, storage, images, and deployments against malicious attacks. You can also leverage built-in logging and monitoring tools to detect malicious attacks and suspicious usage patterns.
(https://cloud.ibm.com/docs/containers?topic=containers-faqskubernetes_service)
* [Why should I use IBM Cloud Kubernetes Service?](https://cloud.ibm.com/docs/containers?topic=containers-faqsfaq_benefits)
* [Can I get a free cluster?](https://cloud.ibm.com/docs/containers?topic=containers-faqsfaq_free)
* [What container platforms are available for my cluster?](https://cloud.ibm.com/docs/containers?topic=containers-faqscontainer_platforms)
* [Does the service come with a managed Kubernetes master and worker nodes?](https://cloud.ibm.com/docs/containers?topic=containers-faqsmanaged_master_worker)
* [Are the master and worker nodes highly available?](https://cloud.ibm.com/docs/containers?topic=containers-faqsfaq_ha)
* [What options do I have to secure my cluster?](https://cloud.ibm.com/docs/containers?topic=containers-faqssecure_cluster)
* [What access policies do I give my cluster users?](https://cloud.ibm.com/docs/containers?topic=containers-faqsfaq_access)
* [Where can I find a list of security bulletins that affect my cluster?](https://cloud.ibm.com/docs/containers?topic=containers-faqsfaq_security_bulletins)
* [Does the service offer support for bare metal and GPU?](https://cloud.ibm.com/docs/containers?topic=containers-faqsbare_metal_gpu)
* [What is the smallest size cluster that I can make?](https://cloud.ibm.com/docs/containers?topic=containers-faqssmallest_cluster)
* [Which Kubernetes versions does the service support?]
Minimum required permissions
: Operator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster. To list your clusters, use the ibmcloud ks cluster ls[command](https://cloud.ibm.com/docs/cli?topic=cli-kubernetes-service-clics_clusters).

--size SIZE
: The number of IP addresses that you want to create in the portable subnet. Accepted values are 8, 16, 32, or 64. When you add portable IP addresses for your subnet, three IP addresses are used to establish cluster-internal networking. You can't use these three IP addresses for your Ingress application load balancers (ALBs) or to create network load balancer (NLB) services. For example, if you request eight portable public IP addresses, you can use five of them to expose your apps to the public.

--vlan VLAN_ID
: The ID of the public or private VLAN on which you want to create the subnet. You must select a public or private VLAN that an existing worker node is connected to. To review the public or private VLANs that your worker nodes are connected to, run ibmcloud ks cluster get --cluster <cluster> --show-resources and look for the Subnet VLANs section in the output. The subnet is provisioned in the same zone that the VLAN is in.

-q
: Optional: Do not show the message of the day or update reminders.



 Example cluster subnet create command 

ibmcloud ks cluster subnet create --cluster my_cluster --size 8 --vlan 1764905







 ibmcloud ks cluster subnet detach 

Classic infrastructure

Detach a public or private portable classic subnet in an IBM Cloud infrastructure account from a cluster. The subnet remains available in your IBM Cloud infrastructure account. Note: Any services that were deployed to an IP address from the subnet remain active after the subnet is removed.
For more information about the locations that are returned, see [IBM Cloud Kubernetes Service locations](https://cloud.ibm.com/docs/containers?topic=containers-regions-and-zoneslocations).

ibmcloud ks locations [--output json]

Minimum required permissions
: None

Command options:

--output json
: Optional: Prints the command output in JSON format.





 versions command 

Virtual Private Cloud

Classic infrastructure

List all the container platform versions that are available for IBM Cloud Kubernetes Service clusters. Update your [cluster master](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_cluster_update) and [worker nodes](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_worker_update) to the default version for the latest, stable capabilities.

The kube-versions alias for this command is deprecated.

ibmcloud ks versions [--show-version (KUBERNETES|OPENSHIFT)] [--output json] [-q]

Minimum required permissions
: None

Command options:

--show-version (KUBERNETES|OPENSHIFT)
: Show only the versions for the specified container platform. Supported values are kubernetes or openshift.

--output json
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.

Example:

ibmcloud ks versions





 api command 

Virtual Private Cloud

Classic infrastructure

Target the API endpoint for IBM Cloud Kubernetes Service. If you don't specify an endpoint, you can view information about the current endpoint that is targeted.

Region-specific endpoints are deprecated. Use the [global endpoint](https://cloud.ibm.com/docs/containers?topic=containers-regions-and-zonesendpoint) instead.
Unsupported: Kubernetes version 1.14
: With the release of version 1.18, clusters that run version 1.14 are unsupported. To continue receiving important security updates and support, you must [update the cluster to a supported version](https://cloud.ibm.com/docs/containers?topic=containers-cs_versionsprep-up) immediately.





 26 May 2020 

CLI change log
: Updated the IBM Cloud Kubernetes Service CLI plug-in change log page for the [release of version 1.0.84](https://cloud.ibm.com/docs/containers?topic=containers-cs_cli_changelog10).

Image pull secrets
: Now, the default-icr-io and default-<region>-icr-io image pull secrets in the default project are replaced by a single all-icr-io image pull secret that has credentials to all the public and private regional registry domains. Clusters that run Kubernetes 1.15 - 1.17 still have the previous default-<region>-icr-io image pull secrets for backwards compatibility.

Ingress status
: Added information about [health reporting for your Ingress components](https://cloud.ibm.com/docs/containers?topic=containers-ingress-status).

NodeLocal DNS cache
: Added how to customize the [NodeLocal DNS cache](https://cloud.ibm.com/docs/containers?topic=containers-cluster_dnsdns_nodelocal_customize).

Version change logs
: Master and worker node change log documentation is available.
Custom routing rules Yes 
 Multiple apps per service Yes 



* An SSL certificate for HTTPS load balancing is provided by ibmcloud ks nlb-dns commands. In classic clusters, these commands are supported for public NLBs only.



 ClusterIP 

You can expose apps only as [ClusterIP services](https://kubernetes.io/docs/concepts/services-networking/service/defining-a-service) on the private network. A ClusterIP service provides an in-cluster IP address that is accessible by other pods and services inside the cluster only. No external IP address is created for the app. To access a pod behind a cluster service, other apps in the cluster can either use the in-cluster IP address of the service or send a request by using the name of the service. When a request reaches the service, the service forwards requests to the pods equally, independent of pods' in-cluster IP addresses and the worker node that they are deployed to. Note that if you don't specify a type in a service's YAML configuration file, the ClusterIP type is created by default.





 NodePort 

When you expose apps with a [NodePort](https://cloud.ibm.com/docs/containers?topic=containers-nodeport) service, a NodePort in the range of 30000 - 32767 and an internal cluster IP address is assigned to the service. To access the service from outside the cluster, you use the public or private IP address of any worker node and the NodePort in the format <IP_address>:<nodeport>. However, the public and private IP addresses of the worker node are not permanent. When a worker node is removed or re-created, a new public and a new private IP address are assigned to the worker node.

NodePorts are ideal for testing public or private access or providing access for only a short amount of time. Note: Because worker nodes in VPC clusters don't have a public IP address, you can access an app through a NodePort only if you are connected to your private VPC network, such as through a VPN connection.

Zoom

!
* Only one blockchain console can be connected to a free cluster at a time.
* You cannot migrate any nodes or data from a free cluster to a paid cluster.



The following capabilities are only available on a paid cluster:



* Customizing resource allocation for a node during or after deployment.
* Using a Hardware Security Module (HSM) to secure the private key for a node.
* Configuring a Certificate Authority (CA) for high availability by using a PostgreSQL database and replica sets.
* Selecting a specific Kubernetes zone when deploying a node.
* Overriding node configuration during or after deployment by using the console or APIs.
* Adding or removing ordering nodes to an ordering service. The free offering only supports a single node Raft ordering service.



See [Find out how to preview the platform free for 30 days](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-saas-pricingibp-saas-pricing-free) for more information on how to get started.
* What regions or locations are available for the IBM Blockchain Platform for IBM Cloud?

The available regions for IBM Blockchain Platform are listed in [IBM Blockchain Platform locations](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-regions-locations). Note that you must create a Kubernetes cluster on IBM Cloud in the same region as the blockchain service to recognize the cluster. Additional regions will be available soon.
* What persistent file storage does IBM Blockchain Platform for IBM Cloud use by default?

By default IBM Blockchain Platform for IBM Cloud uses Classic file storage. You can find more information on the [IBM Cloud File storage page](https://cloud.ibm.com/docs/containers?topic=containers-file_storagefile_storage). For a complete list of storage options, see [Persistent storage considerations](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-v2-deploy-iksibp-console-storage)
After you deploy a cluster on IBM Cloud, you need to deploy an instance of the IBM Blockchain Platform. The IBM Blockchain Platform operational tooling can be deployed in each of the regions in the table below:





Table 1. IBM Blockchain Platform for IBM Cloud locations

 Geography Country IBM Blockchain Platform operational tools region 

 Asia Pacific Australia Sydney 
 Asia Pacific Japan Tokyo 
 Europe Germany Frankfurt 
 Europe United Kingdom London 
 North America United States Dallas 
 North America United States Washington, D.C. 



You can link an instance of the IBM Blockchain Platform operational tooling to a cluster that is deployed at any location. However, all nodes provisioned by the console will be deployed in the location of the cluster. For example, if the Kubernetes cluster is located in Toronto and the linked console is in Washington, D.C., when you use the console to deploy a peer, the peer will reside in Toronto. For more information about the relationship between the operational tools and your cluster, see the [IBM Blockchain Platform for IBM Cloud architecture reference](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-overviewibp-console-overview-architecture).
View a list of available zones that you can create a cluster in.

The locations alias for this command is deprecated.

ibmcloud ks zone ls --provider (classic | vpc-gen2) [--location LOCATION] [--region-only] [--output json] [-q]

Minimum permissions: None

Command options:

--provider (classic | vpc-gen2)
: The infrastructure provider type to list zones for. This option is required.

-l, --location LOCATION
: Filter output by a specific location. To see supported locations, run ibmcloud ks locations. To specify multiple locations, use one option for each location, such as -l dal -l seo.

--region-only
: Optional: List multizones only within the region that you are logged in to.

--output json
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.

Example:

ibmcloud ks zone ls -l ap





 ibmcloud ks zone network-set 

Classic infrastructure

Multizone classic clusters only: Set the network metadata for a worker pool to use a different public or private VLAN for the zone than it previously used. Worker nodes that were already created in the pool continue to use the previous public or private VLAN, but new worker nodes in the pool use the new network data.

ibmcloud ks zone network-set --zone ZONE --cluster CLUSTER --private-vlan PRIVATE_VLAN [--worker-pool WORKER_POOL] [--public-vlan PUBLIC_VLAN] [--private-only] [-f] [-q]

Minimum required permissions
: Operator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

--zone ZONE
: Required: The zone that you want to add. The zone must be a [multizone-capable zone](https://cloud.ibm.com/docs/containers?topic=containers-regions-and-zoneszones-mz) within the cluster's region.
In your allowlist, you must also add the CIDRs of the IBM Cloud Kubernetes Service control plane for the zones in the region where your cluster is located so that IBM Cloud Kubernetes Service can create or access components such as Ingress ALBs

Before you begin, the following steps require you to change the IAM allowlist for the user whose credentials are used for the cluster's region and resource group infrastructure permissions. If you are the credentials owner, you can change your own IAM allowlist settings. If you are not the credentials owner, but you are assigned the Editor or Administrator IBM Cloud IAM platform access role for the [User Management service](https://cloud.ibm.com/docs/account?topic=account-account-services), you can update the restricted IP addresses for the credentials owner.



1. Identify what user credentials are used for the cluster's region and resource group infrastructure permissions.



1. Check the API key for a region and resource group of the cluster.

ibmcloud ks api-key info --cluster <cluster_name_or_ID>

Example output

Getting information about the API key owner for cluster <cluster_name>...
OK
Name Email
<user_name> <name@email.com>
2. Check if the infrastructure account for the region and resource group is manually set to use a different IBM Cloud infrastructure account.

ibmcloud ks credential get --region <us-south>

Example output if credentials are set to use a different account. In this case, the user's infrastructure credentials are used for the region and resource group that you targeted, even if a different user's credentials are stored in the API key that you retrieved in the previous step.

OK
Infrastructure credentials for user name <1234567_name@email.com> set for resource group <resource_group_name>.

Example output if credentials are not set to use a different account. In this case, the API key owner that you retrieved in the previous step has the infrastructure credentials that are used for the region and resource group.

FAILED
No credentials set for resource group <resource_group_name>.: The user credentials could not be found.
[Architecture](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/solution32-multi-region-k8s-cis/Architecture.svg)

Figure 1. Architecture diagram of the tutorial



1. The developer builds a Docker image for the application.
2. The image is pushed to a Container Registry.
3. The application is deployed to Kubernetes clusters in Dallas and London.
4. End-users access the application.
5. IBM Cloud Internet Services is configured to intercept requests to the application and to distribute the load across the clusters. In addition, DDoS Protection and Web Application Firewall are enabled to protect the application from common threats. Optionally assets like images, CSS files are cached.







 Before you begin 

This tutorial requires:



* IBM Cloud CLI,



* IBM Cloud Kubernetes Service plugin (kubernetes-service),



* kubectl to interact with Kubernetes clusters,



You will find instructions to download and install these tools for your operating environment in the [Getting started with solution tutorials](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-tutorials) guide.

In addition, make sure you:



* own a custom domain so you can configure the DNS for this domain to point to IBM Cloud Internet Services name servers.
* and [understand the basics of Kubernetes](https://kubernetes.io/docs/tutorials/kubernetes-basics/).







 Step 1: Deploy an application to one location 

This tutorial deploys a Kubernetes application to clusters in multiple locations. You will start with one location, Dallas, and then repeat these steps for London.



 Create a Kubernetes cluster 

A minimal cluster with one (1) zone, one (1) worker node and the smallest available size (Flavor) is sufficient for this tutorial.
* Regional: With this option, your data is replicated across multiple zones within one region. If you have workloads that are located in the same region, you see lower latency and better performance than in a cross-regional setup. The regional endpoint is automatically set by the ibm Helm plug-in that you installed earlier based on the location that your cluster is in. For example, if your cluster is in US South, then your storage classes were configured to use US South as the regional endpoint for your buckets. For more information, see [Regions and endpoints](https://cloud.ibm.com/docs/cloud-object-storage/basics?topic=cloud-object-storage-endpointsendpoints).



4. Review the detailed IBM Cloud Object Storage bucket configuration for a storage class.

kubectl describe storageclass <storageclass_name>

Example output

Name: ibmc-s3fs-standard-cross-region
IsDefaultClass: No
Annotations: <none>
Provisioner: ibm.io/ibmc-s3fs
Parameters: ibm.io/chunk-size-mb=16,ibm.io/curl-debug=false,ibm.io/debug-level=warn,ibm.io/iam-endpoint=https://iam.bluemix.net,ibm.io/kernel-cache=true,ibm.io/multireq-max=20,ibm.io/object-store-endpoint=https://s3-api.dal-us-geo.objectstorage.service.networklayer.com,ibm.io/object-store-storage-class=us-standard,ibm.io/parallel-count=2,ibm.io/s3fs-fuse-retry-count=5,ibm.io/stat-cache-size=100000,ibm.io/tls-cipher-suite=AESGCM
AllowVolumeExpansion: <unset>
MountOptions: <none>
ReclaimPolicy: Delete
VolumeBindingMode: Immediate
Events: <none>

ibm.io/chunk-size-mb