vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Network segmentation also limits the access that is provided to an insider or third-party software and can limit the range of malicious activities.

IBM Cloud Kubernetes Service provides IBM Cloud VPC subnets that ensure quality network performance and network isolation for worker nodes. A VPC subnet consists of a specified private IP address range (CIDR block) and configures a group of worker nodes and pods as if they were attached to the same physical wire. VPC subnets are dedicated to your IBM Cloud account and not shared across IBM customers.

VPC subnets provide a channel for connectivity among the worker nodes within the cluster. Any system that is connected to any of the private subnets in the same VPC can communicate with workers. For example, all subnets in one VPC can communicate through private layer 3 routing with a built-in VPC router. If your clusters don't need to communicate, you can achieve the best network segmentation by creating the clusters in separate VPCs. If you have multiple clusters that must communicate with each other, you can create the clusters in the same VPC. Although subnets within one VPC can be shared by multiple clusters in that VPC, you can achieve better network segmentation by using different subnets for clusters within one VPC.

To achieve further private network segmentation between VPC subnets for your account, you can set up custom network policies with VPC access control lists (ACLs). When you create a VPC, a default ACL is created in the format allow-all-network-acl-<VPC_ID> for the VPC. Any subnet that you create in the VPC is attached to this ACL by default. The ACL includes an inbound rule and an outbound rule that allow all traffic between your worker nodes on a subnet and any system on the subnets in the same VPC. If you want to specify which private network traffic is permitted to the worker nodes on your VPC subnets, you can create a custom ACL for each subnet in the VPC.
One IP address from one subnet in each zone where your cluster has worker nodes is automatically used for the VPE gateway, and the worker nodes in this zone use this IP address to communicate with the Kubernetes master. To view the VPE gateway details for your cluster, open the [Virtual private endpoint gateways for VPC dashboard](https://cloud.ibm.com/vpc-ext/network/endpointGateways) and look for the VPE gateway in the format iks-<cluster_ID>.

Note that your worker nodes automatically use the VPE that is created by default in your VPC. However, if you enabled the [public cloud service endpoint for your cluster](https://cloud.ibm.com/docs/containers?topic=containers-plan_vpc_basicsvpc-workeruser-master), worker-to-master traffic is established half over the public endpoint and half over the VPE for protection from potential outages of the public or private network.

Do not delete any IP addresses on your subnets that are used for VPEs.





 Network segmentation 

Network segmentation describes the approach to divide a network into multiple sub-networks. Apps that run in one sub-network can't see or access apps in another sub-network. For more information about network segmentation options for VPC subnets, see [this cluster security topic](https://cloud.ibm.com/docs/containers?topic=containers-securitynetwork_segmentation_vpc).

Subnets provide a channel for connectivity among the worker nodes within the cluster. Additionally, any system that is connected to any of the private subnets in the same VPC can communicate with workers. For example, all subnets in one VPC can communicate through private layer 3 routing with a built-in VPC router.

If you have multiple clusters that must communicate with each other, you can create the clusters in the same VPC. However, if your clusters don't need to communicate, you can achieve better network segmentation by creating the clusters in separate VPCs.
Service interface VPC clusters are supported by the [next version (v2) of the IBM Cloud Kubernetes Service API](https://cloud.ibm.com/docs/containers?topic=containers-cs_api_install), and you can manage your VPC clusters through the same CLI and console as classic clusters. 
 Service compliance See the VPC section in [What standards does the service comply to?](https://cloud.ibm.com/docs/containers?topic=containers-faqsstandards). 
 Service limitations See [Service limitations](https://cloud.ibm.com/docs/containers?topic=containers-limitationstech_limits). For VPC-specific limitations in IBM Cloud Kubernetes Service, see [VPC cluster limitations](https://cloud.ibm.com/docs/containers?topic=containers-limitationsks_vpc_gen2_limits). For general VPC infrastructure provider limitations, see [Limitations](https://cloud.ibm.com/docs/vpc?topic=vpc-limitations). 







 Classic 

Classic infrastructure



Table 3. Classic infrastructure overview.

 Component Description 

 Compute and worker node resources [Virtual](https://cloud.ibm.com/docs/containers?topic=containers-planning_worker_nodesvm), [bare metal](https://cloud.ibm.com/docs/containers?topic=containers-planning_worker_nodesbm), and [software-defined storage](https://cloud.ibm.com/docs/containers?topic=containers-planning_worker_nodessds) machines are available for your worker nodes. Your worker node instances reside in your IBM Cloud infrastructure account, but you can manage them through IBM Cloud Kubernetes Service. You own the worker node instances. 
 Security Built-in security features that help you protect your cluster infrastructure, isolate resources, and ensure security compliance. For more information, see the [classic Network Infrastructure documentation](https://cloud.ibm.com/docs/cloud-infrastructure?topic=cloud-infrastructure-compare-infrastructure).
* By default, your cluster is provisioned with a VPC security group and a cluster-level security group. If you want to attach additional security groups or change which default security groups are applied when you create the cluster, you must [create your VPC cluster in the CLI](https://cloud.ibm.com/docs/containers?topic=containers-cluster-create-vpc-gen2&interface=uicluster_vpcg2_cli).







 Creating a VPC cluster in the console 



1. Make sure that you complete the prerequisites to [prepare your account](https://cloud.ibm.com/docs/containers?topic=containers-clusters&interface=ui) and decide on your cluster setup.
2. [Navigate to the console](https://cloud.ibm.com/kubernetes/catalog/create?platformType=containers).
3. In the Infrastructure section, select VPC.
4. In the Virtual private cloud section, choose from the following options.



* Select an existing VPC.
* Click Create VPC.



5. Optional: If you selected Create VPC, complete the following steps.



1. Select a Geography and Region. To review the available regions, see [VPC multizone regions](https://cloud.ibm.com/docs/containers?topic=containers-regions-and-zoneszones-vpc)
2. Enter a name for your VPC.
3. Select the Resource group where you want to create your VPC.
4. Enter any tags that you want to associate with your VPC.
5. Decide whether to Allow SSH and Allow ping in the default security group.
6. Decide whether to allow access to Classic resources.
7. Review the subnet details. By default, subnets are spread evenly across zones. If you want to modify your subnets, uncheck the Create subnet in every zone box.
8. If you modify your subnet details, specify the number of IP addresses to create.
* By default, your cluster is provisioned with a VPC security group and a cluster-level security group. If you want to attach additional security groups or change which default security groups are applied when you create the cluster, you must [create your VPC cluster in the CLI](https://cloud.ibm.com/docs/containers?topic=containers-cluster-create-vpc-gen2cluster_vpcg2_cli).







 Creating a VPC cluster in the console 



1. Make sure that you complete the prerequisites to [prepare your account](https://cloud.ibm.com/docs/containers?topic=containers-clusters&interface=ui) and decide on your cluster setup.
2. [Navigate to the console](https://cloud.ibm.com/kubernetes/catalog/create?platformType=containers).
3. In the Infrastructure section, select VPC.
4. In the Virtual private cloud section, choose from the following options.



* Select an existing VPC.
* Click Create VPC.



5. Optional: If you selected Create VPC, complete the following steps.



1. Select a Geography and Region. To review the available regions, see [VPC multizone regions](https://cloud.ibm.com/docs/containers?topic=containers-regions-and-zoneszones-vpc)
2. Enter a name for your VPC.
3. Select the Resource group where you want to create your VPC.
4. Enter any tags that you want to associate with your VPC.
5. Decide whether to Allow SSH and Allow ping in the default security group.
6. Decide whether to allow access to Classic resources.
7. Review the subnet details. By default, subnets are spread evenly across zones. If you want to modify your subnets, uncheck the Create subnet in every zone box.
8. If you modify your subnet details, specify the number of IP addresses to create.
VPC clusters: Why can't my app connect via load balancer? 

Infrastructure provider: VPC

 What’s happening 

You exposed your app by creating a Kubernetes LoadBalancer service in your VPC cluster. When you try to connect to your app by using the hostname that is assigned to the Kubernetes LoadBalancer, the connection fails or times out.

When you run oc describe svc <kubernetes_lb_service_name>, you might see a warning message similar to one of the following in the Events section:

The VPC load balancer that routes requests to this Kubernetes LoadBalancer service is offline.

The VPC load balancer that routes requests to this Kubernetes LoadBalancer service was deleted from your VPC.

 Why it’s happening 

When you create a Kubernetes LoadBalancer service in your cluster, a VPC load balancer is automatically created in your VPC. The VPC load balancer routes requests only to the app that the Kubernetes LoadBalancer service exposes.

Requests can't be routed to your app in the following situations:



* A VPC security group is blocking incoming traffic to your worker nodes, including incoming requests to your app.
* The VPC load balancer is offline, such as due to load balancer provisioning errors or VSI connection errors.
* The VPC load balancer is deleted through the VPC console or the CLI.
* The VPC load balancer's DNS entry is still registering.
* You reached the maximum number of VPC load balancers permitted per account. Check the [VPC quotas documentation](https://cloud.ibm.com/docs/vpc?topic=vpc-quotas) for VPC resource quotas across all your VPC clusters in your VPC.



 How to fix it 

Verify that no VPC security groups are blocking traffic to your cluster and that the VPC load balancer is available.



2. Verify that the VPC load balancer for the Kubernetes LoadBalancer service exists.
VPC clusters: Why can't my app connect via load balancer? 

Infrastructure provider: VPC

 What’s happening 

You exposed your app by creating a Kubernetes LoadBalancer service in your VPC cluster. When you try to connect to your app by using the hostname that is assigned to the Kubernetes LoadBalancer, the connection fails or times out.

When you run kubectl describe svc <kubernetes_lb_service_name>, you might see a warning message similar to one of the following in the Events section:

The VPC load balancer that routes requests to this Kubernetes LoadBalancer service is offline.

The VPC load balancer that routes requests to this Kubernetes LoadBalancer service was deleted from your VPC.

 Why it’s happening 

When you create a Kubernetes LoadBalancer service in your cluster, a VPC load balancer is automatically created in your VPC. The VPC load balancer routes requests only to the app that the Kubernetes LoadBalancer service exposes.

Requests can't be routed to your app in the following situations:



* A VPC security group is blocking incoming traffic to your worker nodes, including incoming requests to your app.
* The VPC load balancer is offline, such as due to load balancer provisioning errors or VSI connection errors.
* The VPC load balancer is deleted through the VPC console or the CLI.
* The VPC load balancer's DNS entry is still registering.
* You reached the maximum number of VPC load balancers permitted per account. Check the [VPC quotas documentation](https://cloud.ibm.com/docs/vpc?topic=vpc-quotas) for VPC resource quotas across all your VPC clusters in your VPC.



 How to fix it 

Verify that no VPC security groups are blocking traffic to your cluster and that the VPC load balancer is available.



2. Verify that the VPC load balancer for the Kubernetes LoadBalancer service exists.
GET/v2/getFlavors List available flavors types for a VPC zone (data center). N/A N/A 
 GET/v2/getKMSInstances Get key management service (KMS) instances tied to an account containers-kubernetes.cluster.read N/A 
 GET/v2/getKubeconfig Get the cluster's kubeconfig file. Optionally include the network configuration file. containers-kubernetes.cluster.read containers-kubernetes.account.get 
 GET/v2/getOperatingSystems Get a list of available worker node operating systems. N/A cluster-worker-pool-supported-operating-systems.get 
 GET/v2/getRBACStatus Get the status of an RBAC. containers-kubernetes.cluster.view cluster-rbac.status 
 GET/v2/vpc/getCluster Get detailed information for a VPC cluster. containers-kubernetes.cluster.read N/A 
 GET/v2/vpc/getClusters List the VPC clusters that you have access to. containers-kubernetes.cluster.read N/A 
 GET/v2/vpc/getSubnets View subnets for a given VPC. containers-kubernetes.cluster.read N/A 
 GET/v2/vpc/getVPC View details of a VPC. containers-kubernetes.cluster.read N/A 
 GET/v2/vpc/getVPCs View available VPCs for the infrastructure provider. containers-kubernetes.cluster.read N/A 
 PATCH/v1/clusters/{idOrName}/addons Enable, disable, or update add-ons for a cluster. containers-kubernetes.cluster.create containers-kubernetes.cluster.update 
 PATCH/v1/clusters/{idOrName}/subnets/{subnetId} Detach a public or private portable subnet from a cluster. containers-kubernetes.cluster.operate 
 POST/v1/clusters Create a cluster.
* By default, your cluster is provisioned with a VPC security group and a cluster-level security group. If you want to attach additional security groups or change which default security groups are applied when you create the cluster, you must [create your VPC cluster in the CLI](https://cloud.ibm.com/docs/containers?topic=containers-cluster-create-vpc-gen2&interface=clicluster_vpcg2_cli).







 Creating a VPC cluster in the console 



1. Make sure that you complete the prerequisites to [prepare your account](https://cloud.ibm.com/docs/containers?topic=containers-clusters&interface=ui) and decide on your cluster setup.
2. [Navigate to the console](https://cloud.ibm.com/kubernetes/catalog/create?platformType=containers).
3. In the Infrastructure section, select VPC.
4. In the Virtual private cloud section, choose from the following options.



* Select an existing VPC.
* Click Create VPC.



5. Optional: If you selected Create VPC, complete the following steps.



1. Select a Geography and Region. To review the available regions, see [VPC multizone regions](https://cloud.ibm.com/docs/containers?topic=containers-regions-and-zoneszones-vpc)
2. Enter a name for your VPC.
3. Select the Resource group where you want to create your VPC.
4. Enter any tags that you want to associate with your VPC.
5. Decide whether to Allow SSH and Allow ping in the default security group.
6. Decide whether to allow access to Classic resources.
7. Review the subnet details. By default, subnets are spread evenly across zones. If you want to modify your subnets, uncheck the Create subnet in every zone box.
8. If you modify your subnet details, specify the number of IP addresses to create.
: A load balancer is a Kubernetes service that can be used to balance network traffic workloads in your cluster by forwarding public or private requests to an app.





 default namespace 

App pods and services
: In the default namespace or in namespaces that you create, you can deploy apps in pods and services to communicate with those pods.







 VPC cluster 

The following diagram and table describe the default components that are set up in an IBM Cloud Kubernetes Service VPC cluster architecture.

The following architectural overviews are specific to the VPC infrastructure provider. For an architectural overview for the classic infrastructure provider, see [Classic cluster architecture](https://cloud.ibm.com/docs/containers?topic=containers-service-archarchitecture_classic).

Zoom

![Kubernetes cluster in a VPC](https://cloud.ibm.com/docs-content/v1/content/4d497aff9e27b92fbbc2ee4e343a9ec4549cb1d7/containers/images/cs_org_ov_vpc.png)

Figure 1. Kubernetes cluster in a VPC



Table 1. Kubernetes cluster in a VPC

 Component Description 

 Master [Master components](https://cloud.ibm.com/docs/containers?topic=containers-service-archmaster-components), including the API server and etcd, have three replicas and are spread across zones for even higher availability. Masters include the same components as described in the community Kubernetes architecture. The master and all the master components are dedicated only to you, and are not shared with other IBM customers. 
 Worker node With IBM Cloud Kubernetes Service, the virtual machines that your cluster manages are instances that are called worker nodes. These worker nodes virtual machines and all the worker node components are dedicated to you only and are not shared with other IBM customers. However, the underlying hardware is shared with other IBM customers. For more information, see [Virtual machines](https://cloud.ibm.com/docs/containers?topic=containers-planning_worker_nodesvm).
Symphony Multicluster (SMC) FAQs 



  Is it possible to submit jobs during a failover in-progress? 

Yes, if SMC is not available for any reason, submitted jobs are scheduled in respective Lone symphony cluster.





  How do I check the SMC host logs? 



1.  Change the directory to /data/<cluster_id>/sym731/multicluster/smc/logs.
2.  Run command tail -f smc-<host-file-name>.log.







  Does SMC allow there to be more than three zones in a region selected for deployment (smc_zone parameter to have more than 3 zones)? 

No, the smc-zone parameter supports a maximum of 3 zones, entered as a list, for example, ["us-south-1","eu-gb-3","jp-tok-2"].





  Does SMC allow there to be more than three existing vpcs or more than three existing regions for VPCs? 

No, SMC supports maximum of 3 existing VPCs in lone_vpc_name and 3 existing regions for VPCs in lone_vpc_region. The VPC names and VPC regions are provided in a list and must be in the same order. For example, there are three VPCs in three regions, "vpc-east" in "us-east". "vpc-south" in "us-south", and "vpc-tor" in "ca-tor". For this example, lone_vpc_name = ["vpc-east" , "vpc-south" "vpc-tor"] and lone_vpc_region = [ "us-east","us-south","ca-tor"].





  When one of the joined lone symphony clusters with SMC fails to participate in workload placement after execution of symping command, what should I do? 

Run a few more iterations of workload placement by running jobs, the lone symphony cluster will join back automatically.
One of the available shared storage options is needed for clusters that are enabled for HA.

You are responsible to adjust the admission control policy when the cluster is later expanded or contracted.





 Enhanced vMotion Compatibility 

To simplify vMotion compatibility across cluster nodes with potentially differing CPU capabilities, Enhanced vMotion Compatibility (EVC) mode can be enabled at the highest available level that is supported by the vSphere version. This setting ensures vMotion compatibility across cluster nodes when newer processors arrive within IBM Cloud VPC inventory. The setting allows for cluster expansion in the future if the original processor is no longer in inventory.







 Related links 



* [IBM Cloud VPC getting started](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started)
* [IBM Cloud VPC Bare Metal Servers](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-for-bare-metal-servers)
* [IBM Cloud VPC RYO VMware reference architecture](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vpc-ryo-arch-overview)
* [IBM Cloud Direct Link overview](https://cloud.ibm.com/docs/dl?topic=dl-get-started-with-ibm-cloud-dl)
* [IBM Cloud Transit Gateway overview](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-getting-started)
* [IBM Cloud VPC VPN overview](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-overview)
* [VPC IaaS endpoints](https://cloud.ibm.com/docs/vpc?topic=vpc-service-endpoints-for-vpcinfrastructure-as-a-service-iaas-endpoints)
* [VMware on Bare Metal VPC tutorial](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-bm-vmware)
From the [Security groups for VPC dashboard](https://cloud.ibm.com/vpc-ext/network/securityGroups), find the security groups that are attached to the VPC that your cluster is in. The VPC cluster security group is named in the format of kube-<cluster-ID>. The Kubernetes Service security group is named in the format of kube-<vpc-ID>. Click on the security group.

To sort the security groups by the VPC they are attached to, click the Virtual Private Cloud column heading in the table.
2. To view the inbound and outbound rules attached to the security group, click the Rules tab.







 Minimum inbound and outbound requirements 

The following inbound and outbound rules are covered by the default VPC security groups. Note that you can modify the randomly named VPC security group and the cluster-level kube-<cluster-id> security group, but you must make sure that these rules are still met.

Modifying the kube-<vpc-id> security group is not recommended as doing so might cause disruptions in network connectivity between the cluster and the Kubernetes master. Instead, you can [remove the default security group from the VPC ALB or VPE gateway](https://cloud.ibm.com/docs/vpc-infrastructure-cli-plugin?topic=vpc-infrastructure-cli-plugin-vpc-reference&interface=clisecurity-group-target-remove) and [replace it with a security group](https://cloud.ibm.com/docs/vpc-infrastructure-cli-plugin?topic=vpc-infrastructure-cli-plugin-vpc-reference&interface=clisecurity-group-target-add) that you create and manage.



 Required inbound and outbound rules for cluster workers 

By default, traffic rules for cluster workers are covered by the randomly named VPC security group and the kube-<cluster-id> cluster security group. If you modify or replace either of these security groups, make sure the following traffic rules are still allowed.



 Inbound rules 



Required inbound rules for cluster worker security groups