vania-janet/multiturn-rag-retrieval-data huggingface dataset:
If not set, the context instance specified by dns instance-target INSTANCE is used.

---f, --force
: Delete custom resolver location without prompting for confirmation.





 Examples 

Delete location 9a234ede-c2b6-4c39-bc27-d39ec139ecdb in custom resolver f1aba936b94213e5b8dca0c0dbf1f9cc for instance dns-demo.

ibmcloud dns custom-resolver-location-delete f1aba936b94213e5b8dca0c0dbf1f9cc 9a234ede-c2b6-4c39-bc27-d39ec139ecdb -i "dns-demo"







 ibmcloud dns custom-resolver-forwarding-rule-create 

Create a custom resolver forwarding rule for a service instance.

ibmcloud dns custom-resolver-forwarding-rule-create RESOLVER_ID --type TYPE --match HOSTNAME --dns-svcs IPs [--description DESCRIPTION] [-i, --instance INSTANCE] [--output FORMAT]



 Command options 

RESOLVER_ID
: The ID of custom resolver.

-t, --type
: The type of the forwarding rule. Valid values: "zone".

-d, --description
: The descriptive text of the custom resolver forwarding rule.

--match
: The matching zone or hostname.

--dns-svcs
: The upstream DNS servers will be forwarded to, for example: ip1,ip2

-i, --instance
: Instance name or ID. If not set, the context instance specified by dns instance-target INSTANCE is used.

--output
: Specify output format. Currently, json is the only supported format.





 Examples 

Create a forwarding rule in custom resolver f1aba936b94213e5b8dca0c0dbf1f9cc for instance dns-demo.
Using HTTP proxy mode offers the following benefits:



* Traffic flows through CIS where all the security, performance, and reliability features such as firewall rules, caching, and so on, are applied.
* The "automatic" TTL (five minutes) reduces the number of authoritative queries made against CIS.







 DNS-only mode 

In DNS-only mode, records are resolved to the origin IP and you can customize the TTL for your records. For global load balancers, CIS serves the addresses of the healthy origin servers directly, but relies on DNS resolvers respecting the short TTL to re-query the CIS DNS for an updated list of healthy addresses.

In DNS-only mode, none of the CIS security, performance, and reliability features is applied.
etcd Service Record Node 2 _etcd-server-ssl._tcp.ocp.dallas.ibm.local 192.168.133.12 









 DNS commands 

 Create Reverse Lookup Zones
Add-DnsServerPrimaryZone -networkid "192.168.133.0/24" -replicationscope forest
Add-DnsServerPrimaryZone -networkid "10.208.242.0/24" -replicationscope forest

 Create DNS A Records, with PTR
Add-DnsServerResourceRecordA -Name "bastion.ocp.dallas" -ZoneName "ibm.local" -AllowUpdateAny -IPv4Address "192.168.133.8" -CreatePtr -TimeToLive 00:00:10
Add-DnsServerResourceRecordA -Name "bootstrap-0.ocp.dallas" -ZoneName "ibm.local" -AllowUpdateAny -IPv4Address "192.168.133.9" -CreatePtr -TimeToLive 00:00:10
Add-DnsServerResourceRecordA -Name "control-plane-0.ocp.dallas" -ZoneName "ibm.local" -AllowUpdateAny -IPv4Address "192.168.133.10" -CreatePtr -TimeToLive 00:00:10
Add-DnsServerResourceRecordA -Name "etcd-0.ocp.dallas" -ZoneName "ibm.local" -AllowUpdateAny -IPv4Address "192.168.133.10" -TimeToLive 00:00:10
Add-DnsServerResourceRecordA -Name "control-plane-1.ocp.dallas" -ZoneName "ibm.local" -AllowUpdateAny -IPv4Address "192.168.133.11" -CreatePtr -TimeToLive 00:00:10
<-- </section "id="section-create-range-app-examples" "> --><-- </section "id="section-create-range-app" "> --><-- <section "id="section-update-range-app" "> --> ibmcloud cis range-app-update Update an previously existing application's configuration (Enterprise plan only). ibmcloud cis range-app-update DNS_DOMAIN_ID APP_ID --origin-direct ORIGIN_DIRECT -i, --instance INSTANCE] --output FORMAT]
ibmcloud cis range-app-update DNS_DOMAIN_ID APP_ID --add-origin-direct ORIGIN_DIRECT] --remove-origin-direct ORIGIN_DIRECT] -i, --instance INSTANCE] --output FORMAT]
ibmcloud cis range-app-update DNS_DOMAIN_ID APP_ID --origin-lb-name ORIGIN_LB_NAME] --origin-lb-port ORIGIN_LB_PORT] -i, --instance INSTANCE] --output FORMAT]
ibmcloud cis range-app-update DNS_DOMAIN_ID APP_ID (--json @JSON_FILE | JSON_STRING) -i, --instance INSTANCE] --output FORMAT]
Deprecated] ibmcloud cis range-app-update DNS_DOMAIN_ID APP_ID -s JSON_STR -i, --instance INSTANCE] --output FORMAT]
Deprecated] ibmcloud cis range-app-update DNS_DOMAIN_ID APP_ID -j JSON_FILE -i, --instance INSTANCE] --output FORMAT] ! !!!!!!!!!!!!
<-- <section "id="section-update-range-app-options" "> --> Command options DNS_DOMAIN_ID: The ID of DNS domain. Required.APP_ID: The ID of range application.
The following table summarizes the fully qualified domain names (FQDNs) used by the three layers:



 Host description Example FQDN DNS How Protected 

 Range application hostname (user application hostname) www.application.example.com Managed by CIS, no explicit record CIS Layer 3/4 
 GLB hostname <uuid>-example.com Managed by CIS, no explicit record, public network Obfuscated, BIG-IP Virtual Server accepts only the Range Application Host Header 
 BIG-IP hostname f5-app.example.com A record maps to public external IP of BIG-IP, public network Security Group to [only allow traffic from CIS](https://cloud.ibm.com/docs/cis?topic=cis-cis-allowlisted-ip-addresses) 
 Red Hat OpenShift on IBM Cloud application hostname (not externalized) application-internal.example.com CNAME record maps to private-router ALB, private network Only accessible within network and protected by BIG-IP firewall. Security group restricts traffic to accept traffic only from BIG-IP. 







 Before you begin 

The following items are needed to deploy and configure the reference architecture with CIS and BIG-IP to create a WAF:



* [Provisioned and licensed BIG-IP](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-f5-tutorial)
* Registered domain for CIS
* Certificate for your registered domain (can be a wildcard certificate)
* Intermediate certificate for your server-side application







 Step 1: Provision CIS 



1. Provision an instance of [CIS](https://cloud.ibm.com/catalog/services/internet-services) that uses the Enterprise Usage plan.
2. Click Create to provision the service.







 Step 2: Configure CIS TLS Mode 



1. [Register your domain name with CIS](https://cloud.ibm.com/docs/cis?topic=cis-multi-domain-support).
2.
ibmcloud dns resource-record-create DNS_ZONE_ID (-r, --record-content @JSON_FILE | JSON_STRING) [-i, --instance INSTANCE] [--output FORMAT]

ibmcloud dns resource-record-create DNS_ZONE_ID --type A --name NAME --ipv4 IP_ADDRESS [--ttl TTL]
ibmcloud dns resource-record-create DNS_ZONE_ID --type AAAA --name NAME --ipv6 IP_ADDRESS [--ttl TTL]
ibmcloud dns resource-record-create DNS_ZONE_ID --type CNAME --name NAME --cname CNAME [--ttl TTL]
ibmcloud dns resource-record-create DNS_ZONE_ID --type PTR --name NAME --ptrdname PTRDNAME [--ttl TTL]
ibmcloud dns resource-record-create DNS_ZONE_ID --type TXT --name NAME --text TEXT [--ttl TTL]
ibmcloud dns resource-record-create DNS_ZONE_ID --type MX --name NAME --exchange EXCHANGE --preference PREFERENCE [--ttl TTL]
ibmcloud dns resource-record-create DNS_ZONE_ID --type SRV --name NAME --service SERVICE --protocol PROTOCOL --priority PRIORITY --weight WEIGHT --port PORT --target TARGET [--ttl TTL]



 Command options 

ZONE_ID
: The ID of the DNS zone.

--name
: Resource record name.

--type
: Resource record type.

--ipv4
: IPv4 address.

--ipv6
: IPv6 address.

--cname
: Canonical name.

--ptrdname
: Hostname of the relevant A or AAAA record.

--text
: Human readable text.

--exchange
: Hostname of Exchange server.

--preference
: Preference of the MX record
If the name resolution request for www.example.com originated from a client in VPC 2 that is not added as a permitted network to example.com, the request is forwarded to a public DNS server, and the response from public DNS server is returned to the VPC client. The scenario is referred to as a Split Horizon, where the same hostname, which is defined in both a private DNS zone and a public DNS zone, can be resolved to different IPs depending on where the DNS name resolution request originated.

DNS Services ensures a level of privacy for information that is specified in your zones and resource records.

DNS Services is private only. For provisioning and configuring DNS records for public DNS resolution, refer to [IBM Cloud Internet Services](https://cloud.ibm.com/docs/cis?topic=cis-about-ibm-cloud-internet-services-cis) (CIS).





 Limits 

DNS Services has limits in some areas, which are noted in the following table.



Table 1. DNS Services limitations

 Item Limitation 

 DNS zones 10 per service instance 
 DNS records 3500 per DNS zone 
 Permitted networks 10 per DNS zone 
 Global load balancers 25 per DNS zone 
 DNS queries per second 1000 per availability zone 







 DNS Services Supported Regions 



Table 2. Regions supported by DNS Services

 Region Data replication region [Health check region](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-global-load-balancersadd-a-pool) Permitted networks 

 Dallas (us-south) ![check icon](https://cloud.ibm.com/docs-content/v1/content/d56dbd8ab7d14086029681ee71679e14aea53723/icons/checkmark-icon.svg) ![check icon](https://cloud.ibm.com/docs-content/v1/content/d56dbd8ab7d14086029681ee71679e14aea53723/icons/checkmark-icon.svg) !
!
<-- <section "id="section-upload-cert-options" "> --> Command options DNS_DOMAIN_ID: The ID of DNS domain. Required.--json: The JSON file or JSON string used to describe a custom certificate. Required.
<-- <ul> -->

* The required fields in JSON data are certificate, private_key:

<-- <ul> -->

* certificate: SSL certificate or certificate and the intermediate(s) for the domain.
* private_key: Private key for the domain.

<-- </ul> -->

* The optional fields is bundle_method:

<-- <ul> -->

* bundle_method: Bundle method, default value is compatible, valid values are: compatible, modern and user-defined.

<-- </ul> -->

<-- </ul> -->

Sample JSON data: {
"certificate": "xxx",
"private_key": "xxx",
"bundle_method": "compatible"
}
-s, --json-str: Deprecated. The JSON data used to upload a custom certificate.-j, --json-file: Deprecated. A file contains input JSON data.-i, --instance: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.--output: Specify output format, only JSON is supported.<-- </section "id="section-upload-cert-options" "> --><-- <section "id="section-upload-cert-examples" "> --> Examples Upload a custom certificate for domain 31984fea73a15b45779fa0df4ef62f9b.
CIS's reverse proxy is also able to convert between compressed formats and uncompressed formats, meaning that it can pull content from a customer's origin server via gzip and serve it to clients uncompressed (or vice versa). This is done independently of caching.

The Accept-Encoding header is not respected and is removed.



Content Delivery Network (CDN)



* How does the CDN edge server retrieve content from the origin server?

 How does the CDN edge server retrieve content from the origin server? 



* For the Server type of origin, the CDN keeps the origin path in the URL. For example, if you add origin origin.example.com in path /example/, when a user opens the CDN URL cdn.example.com/example/, the CDN edge server retrieves the content from origin.example.com/example/.
* For the Object Storage type of origin, the CDN makes a URL transformation. For example, if object storage origin s3-example.object-storage.com with bucket name xyz-bucket-name is added in path /example-cos/, when a user opens the CDN URL cdn.example.com/example-cos/, the CDN edge server retrieves the content from s3-example.object-storage.com/xyz-bucket-name/.



* What's the difference between the origin on the Settings page and the origins on the Origins page?

 What's the difference between the origin on the Settings page and the origins on the Origins page? 

The Settings page shows the origin path created during CDN provisioning. You cannot edit or delete it. However, on the Origins page, you can configure different types of origins (COS or origin server). You can also edit or delete origins on this page.
* Why can't I change the protocol and port for an origin?

 Why can't I change the protocol and port for an origin? 

The displayed protocol and port options match what you selected when you ordered the CDN. For example, if you selected an HTTP port when you ordered a CDN, only the HTTP port option is shown as part of Add Origin.
cname www.example.com





 Creating type 'AAAA' resource record 

Use ibmcloud dns resource-record-create command with --type AAAA option to create a type AAAA resource record. --name and --ipv6 are mandatory options.

$ ibmcloud dns resource-record-create $DNS_ZONE_ID --type AAAA --name www --ipv6 2019::2020
Creating resource record in zone 'example.com:f7f40364-a5e6-48f7-9fc9-387434c579ae' for service instance 'DNS Services-km' ...
OK

ID AAAA:37e1e701-e549-4ca1-8c22-86574bf4aaed
Name www.example.com
Type AAAA
Created On 2020-04-10 09:37:15.063814601 +0000 UTC
Modified On 2020-04-10 09:37:15.063814601 +0000 UTC
TTL 900
Data
ip 2019::2020





 Getting a resource record 

Use ibmcloud dns resource-record command followed by the zone ID and resource record ID to get details of a resource record.

$ ibmcloud dns resource-record $DNS_ZONE_ID A:f20cfe91-b936-4bad-a8d1-f7afa4ac32a6
Getting resource record 'A:f20cfe91-b936-4bad-a8d1-f7afa4ac32a6' in zone 'example.com:f7f40364-a5e6-48f7-9fc9-387434c579ae' for service instance 'DNS Services-km' ...
OK

ID A:f20cfe91-b936-4bad-a8d1-f7afa4ac32a6
Name www.example.com
Type A
Created On 2020-04-10 09:12:07.858707275 +0000 UTC
In addition, a DNS record is created for your location and the IP addresses of your hosts are automatically registered and added to your DNS record to allow load balancing and health checking for your location. This process can take up to 30 minutes to complete. During this process, your location status continues to show an action required state, and you might see intermittent errors, such as Satellite is attempting to recover or Verify that the Satellite location has a DNS record for load balancing requests to the location control plane.
8. Verify that the IP addresses of all your hosts were registered and added to the DNS record of your location. Check that the cert status is created and that the records are populated with the subdomains.

ibmcloud sat location dns ls --location <location_ID_or_name>

Example output

Retrieving location subdomains...
OK
Hostname Records Health Monitor SSL Cert Status SSL Cert Secret Name Secret Namespace
ne1d37313068166254bcb-edfc0a8ba65085c5081eced6816c5b9c-c000.us-east.satellite.appdomain.cloud 169.62.196.20,169.62.196.23,169.62.196.30 None created ne1d37313068166254bcb-edfc0a8ba65085c5081eced6816c5b9c-c000 default
ne1d37313068166254bcb-edfc0a8ba65085c5081eced6816c5b9c-c001.us-east.satellite.appdomain.cloud 169.62.196.30 None created ne1d37313068166254bcb-edfc0a8ba65085c5081eced6816c5b9c-c001 default
* If you want to block traffic from the client, use the drop route action to forward unwanted or undesirable network traffic to a null or "black hole" route.
* When the route action is translate, the source IP is translated to the VPN server private IP before it is sent out from the VPN server. This means that your VPN client IP is invisible from the destination devices.



* What DNS server IP addresses should I use?

DNS server IP addresses are optional when you provision a VPN server. You should use 161.26.0.10 and 161.26.0.11 IP addresses if you want to access service endpoints and IaaS endpoints from your client. See [Service endpoints](https://cloud.ibm.com/docs/vpc?topic=vpc-service-endpoints-for-vpccloud-service-endpoints) and [IaaS endpoints](https://cloud.ibm.com/docs/vpc?topic=vpc-service-endpoints-for-vpcinfrastructure-as-a-service-iaas-endpoints) for details.

Use 161.26.0.7 and 161.26.0.8 if you need to resolve private DNS names from your client. See [About DNS Services](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-about-dns-services) for details.
* How do I update the certificate for the VPN server?

The VPN server is not aware of updates made to a certificate in Secrets Manager. You must re-import the certificate with a different CRN, and then update the VPN server with the new certificate CRN.
* Can I use a customized hostname for the VPN server?

Yes, you can. You must create a CNAME DNS record and point it to the VPN server hostname in your DNS provider. After that, edit the client profile by replacing direct remote 445df6c234345.us-south.vpn-server.appdomain.cloud with remote your-customized-hostname.com.
A TTL also can be specified from the list menu, with the default value of Automatic.



* Required Fields: Name, Content
* Optional Field: TTL (default value is Automatic)







 TXT Type record 

To add this record type, valid values must exist in the Name and Content fields. A TTL also can be specified from the list menu, with the default value of Automatic.



* Required Fields: Name, Content
* Optional Field: TTL (default value is Automatic)



The first time you order a dedicated certificate Domain Control Validation (DCV) process occurs, which generates a corresponding TXT record. If you delete the TXT record, the DCV process happens again when you order another dedicated certificate. If you delete a dedicated certificate, the TXT record corresponding to the DCV process is not deleted.





 NS Type record 

To add this record type, valid values must exist in the Name and Name Server fields. A TTL also can be specified from the list menu, with the default value of Automatic.



* Required Fields: Name, Name Server
* Optional Field: TTL (default value is Automatic)







 PTR type record 

The PTR record option shown in the DNS Records list menu is not for adding PTR records for Reverse DNS resolution. The purpose is adding a PTR Record to the Forward DNS resolution for the domain. PTR in Forward DNS is allowed under the [DNS specification](https://tools.ietf.org/html/rfc1035section-3.3.12).

PTR records primarily prevent emails from going to spam folders. Because CIS doesn't support email traffic by default, you must set the PTR record to the location of your email server. Contact your email provider for assistance.







 Updating DNS records 

In each record row, you can click the Edit record option from the menu, which opens a dialog box that you can use to update the record.

After you are finished making your changes, select Update record to save them, or Cancel to abort the changes.





 Deleting DNS records
If you have DHCP disabled on a server in the VPC, it is your responsibility to configure the DNS server IP addresses statically on that server, according to your operating system's documentation.





 Step 5: Verify that DNS name resolution works from the VPC 

Test whether the zone resolution works using a dig from the virtal server instance on your VPC. The following command should yield a resolution as the result.

dig www.example.com





 Next Steps 

Follow the steps in these detailed guides to use the API for:



* [Creating a DNS zone](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-managing-dns-zonescreate-dns-zone-api)
* [Managing permitted networks](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-managing-permitted-networksmanaging-permitted-networks-api)
* [Import a DNS zone file](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-managing-dns-zonesimport-resource-records-api)
* [Managing DNS records](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-managing-dns-recordsmanaging-dns-records-api)
CIS DNS zone CNAME (partial) setup 

The following table shows the recommended setup configurations for a child zone (subdomain).



Table 1. Parent and child domain setup

 Parent domain setup Recommended child subdomain setup 

 Parent domain on CIS via a Full setup Full setup only 
 Parent domain on CIS via a CNAME setup CNAME setup only 
 The parent domain is not on CIS Can choose Full or CNAME setup 





 Setting up a CNAME zone 

To set up a CNAME, take the following steps.



1. Create the partial type zone using the CIS API or CLI.



* Create partial type zone via CIS API: POST https://{{api}}/v1/{{crn}}/zones

data: {
"name": "ibmnetworkdemo.com",
"jump_start": false,
"type": "partial"
}
* Create partial type zone via CIS CLI:

ibmcloud cis domain-add ibmnetworkdemo.com --type partial --output JSON



If you encounter the error message: "Partial zone signup not allowed", contact Support.
2. Get the txt record verification_key and cname_suffix from the response:

{
"result": {
"id": "1df93abfb59849abd3e34fde156a4c21",
"name": "ibmnetworkdemo.com",
"status": "active",
"paused": false,
"verification_key": "476754457-428595283",
"cname_suffix": "cdn.cloudflare.net",
"original_name_servers": [
"ns1.softlayer.com",
"ns2.softlayer.com"
],
"original_registrar": "everyones internet, ltd. dba s (id: 925)",
"original_dnshost": null,
After you confirm that the records are propagated, click Validate to request Let's Encrypt to validate the challenges to your domains and create a public certificate.

If the order fails because the TXT records were not successfully propagated, you must start a new order to proceed.
23. When your certificate is issued, clean up and remove the TXT records from the domains in your DNS provider account.







 Ordering public certificates with your own DNS provider by using the API 

To create a public certificate by using a manual DNS provider, complete the following steps.



1. Create a certificate authority (CA) configuration by following the steps that are defined in [Adding a CA configuration](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-add-certificate-authority&interface=ui).
2. Create a new public certificate by specifying manual as your DNS configuration.

curl -X POST
-H "Authorization: Bearer {iam_token}" -H "Accept: application/json" -H "Content-Type: application/json" -d '{
"name": "example-public-certificate",
"description": "description of my public certificate",
"secret_type": "public_cert",
"secret_group_id": "bfc0a4a9-3d58-4fda-945b-76756af516aa",
"labels": [
"dev",
"us-south"
],
"common_name": "example.com",
"alt_names": [
"s1.example.com",
".s2.example.com"
],
"ca": "lets-encrypt-config",
"dns": "manual",
"rotation": {
"auto_rotate": true,
"rotate_keys": true
},
"bundle_certs": true,
"custom_metadata": {
Show more
<-- </section "id="section-upload-cert-examples" "> --><-- </section "id="section-upload-cert" "> --><-- <section "id="section-update-cert" "> --> ibmcloud cis certificate-update Update a custom certificate for a DNS domain. ibmcloud cis certificate-update DNS_DOMAIN_ID CERT_ID (--json @JSON_FILE | JSON_STRING) -i, --instance INSTANCE] --output FORMAT]
Deprecated] ibmcloud cis certificate-update DNS_DOMAIN_ID CERT_ID -s, --json-str JSON_STR | -j, --json-file JSON_FILE] -i, --instance INSTANCE] --output FORMAT] ! !!!!!! ! ! ! ! !
<-- <section "id="section-update-cert-options" "> --> Command options DNS_DOMAIN_ID: The ID of DNS domain. Required.CERT_ID: The ID of custom certificate. Required.--json: The JSON file or JSON string used to describe a custom certificate. Required.
<-- <ul> -->

* The required fields in JSON data are certificate, private_key:

<-- <ul> -->

* certificate: SSL certificate or certificate and the intermediate(s) for the domain.
* private_key: Private key for the domain.

<-- </ul> -->

* The optional fields is bundle_method:

<-- <ul> -->

* bundle_method: Bundle method, default value is compatible, valid values are: compatible, modern and user-defined.

<-- </ul> -->

<-- </ul> -->

Sample JSON data: {
"certificate": "xxx",
"private_key": "xxx",