vania-janet/multiturn-rag-retrieval-data huggingface dataset:
In the SSH session to the bastion node with root privileges, use the following commands to create the install-config.yaml file:

cd /opt/ocpinstall
vi install-config.yaml

Type i to enter insert mode, paste the file contents. Press Esc, then type :wq to save the file and exit the vi editor.

The Red Hat OpenShift Installer deletes this file so to keep a copy use the following command:

cp install-config.yaml install-config.bak





 Running the Red Hat OpenShift Ignition command 

Now that the install-config.yaml is created and populated run the Red Hat OpenShift Installer to create the ignition files.

cd /opt/ocpinstall/
openshift-install create ignition-configs --dir=/opt/ocpinstall/

The Ignition files are valid for 24 hours and your Red Hat OpenShift deployment must be completed within this time. Otherwise, you must regenerate the Ignition files. For more information, see [Troubleshooting Red Hat OpenShift problems](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-openshift-runbook-runbook-trbl-intro).

The following files are produced by the Red Hat OpenShift Installer:

.
├── auth
│ ├── kubeadmin-password
│ └── kubeconfig
├── bootstrap.ign
├── master.ign
├── metadata.json
└── worker.ign





 Copying the bootstrap Ignition file to the web server 

The bootstrap.ign file needs to be copied to the document root of NGINX. The bootstrap ignition file must be hosted on the web server so the bootstrap node can reach it on the first start. The Ignition file is too large to fit in a vApp property.

Copy the bootstrap.ign file to the document root of NGINX.

cp bootstrap.ign /usr/share/nginx/html





 Terraform files
For more locations, see [Single and multizone locations in Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-regions-and-zones).



* Amsterdam, the Netherlands
* Hong Kong SAR of the PRC, China
* Mexico City, Mexico
* Milan, Italy







 16 September 2019 

CLI change log
: Updated the IBM Cloud Kubernetes Service CLI plug-in change log page for the release of version 0.4.23.

IBM Cloud Activity Tracker events
: Added information about [which Activity Tracker location your events are sent to](https://cloud.ibm.com/docs/openshift?topic=openshift-at_eventsat-ui) based on the IBM Cloud Kubernetes Service location where the cluster is located.

New! Melbourne, Australia mel01 single zone location for Red Hat OpenShift clusters
: For more locations, see [Single and multizone locations in Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-regions-and-zones).

Version change log
: Master fix pack updates are available for Red Hat OpenShift [3.11.141_1524_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_changelog_311311141_1524).





 13 September 2019 

Refreshed Red Hat OpenShift on IBM Cloud docs
: Includes the following new content.



* [Security information for Red Hat OpenShift clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-security).
* [Accessing clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-access_cluster).
* [App networking options](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_network_planning) with comparisons of routes, NodePort, load balancers, and Ingress.
satellite.link-endpoints.delete A Satellite endpoint is removed. 
 satellite.link-endpoints.export The configuration for a Satellite endpoint is exported to a file. 
 satellite.link-endpoints.get Details for a Satellite endpoint are retrieved. 
 satellite.link-endpoints.import The configuration for a Satellite endpoint is imported from a file. 
 satellite.link-endpoints.list A list of Satellite endpoints is retrieved. 
 satellite.link-endpoints.update A Satellite endpoint is updated or data for the endpoint is exported. 
 satellite.link-source-endpoints.list A list of Satellite endpoints that a client (source) is configured for and the enabled status of the client (source) for each endpoint is retrieved. 
 satellite.link-source-endpoints.update A client (source) is enabled or disabled for one or more Satellite endpoints. 
 satellite.link-sources.create A client (source) is configured for a Satellite endpoint. 
 satellite.link-sources.delete A client (source) is removed from a Satellite endpoint. 
 satellite.link-sources.list A list of clients (sources) that are configured for a Satellite endpoint is retrieved. 
 satellite.link-sources.update A client (source) configuration is updated for a Satellite endpoint. 







 Events for the Satellite Config component 



Satellite Config actions that generate events.

 Action Description 

 satellite.config-cluster.register A Satellite or Red Hat OpenShift on IBM Cloud cluster is registered with Satellite Config. 
 satellite.config-cluster.update A Satellite or Red Hat OpenShift on IBM Cloud cluster is updated with Satellite Config. 
 satellite.config-cluster.detach A Satellite or Red Hat OpenShift on IBM Cloud cluster is detached from Satellite Config and can no longer receive configuration. 
 satellite.config-clusters.detach One or more Satellite or Red Hat OpenShift on IBM Cloud clusters are detached from Satellite Config and can no longer receive configuration. 
 satellite.config-clusters.group One or more Satellite or Red Hat OpenShift on IBM Cloud clusters are added to a cluster group.
* Microservices greatly reduce time to delivery for patches, bug fixes, and new features. Initial development is fast, and updates are frequent.
* Shipping customers have real-time access to shipments’ locations, delivery schedules, and even approved port records.
* Transit partners at various shipping terminals are aware of manifests and shipment details so that onsite logistics are improved, instead of delayed.









 Airline delivers innovative Human Resources (HR) benefits site in under 3 weeks 

An HR Exec (CHRO) needs a new HR benefits site with an innovative chatbot, but current Development tools and platform mean long lead times for apps to go live. This situation includes long waits for hardware procurement.

Red Hat OpenShift on IBM Cloud provides easy spin-up of compute. Then, Developers can experiment easily, pushing changes to Development and Test systems quickly with open toolchains. Their traditional software development tools get a boost when they add on IBM Watson Assistant. The new benefits site was created in less than 3 weeks.



 Context 

Rapidly building and deploying innovative HR benefits site in less than 3 weeks.



* Employee growth and changing HR policies meant that a whole new site would be required for annual enrollment.
* Interactive features, such as a chatbot, were expected to help communicate new HR policies to existing employees.
* Due to growth in number employees, the site traffic is increasing, but their infrastructure budget remains flat.
* The HR team faced pressure to move faster: roll out new site features quickly and post last-minute benefit changes frequently.
* The enrollment period lasts for two weeks, and so downtime for the new app isn't tolerated.







 Solution 

The airline wants to design an open culture that puts people first. The HR Executive is well aware that a focus on rewarding and retaining talent impacts the airline’s profitability. Thus, the annual rollout of benefits is a key aspect of fostering an employee-centered culture.

They need a solution that helps the Developers and their users.



* FRONT-END TO EXISTING BENEFITS: insurance, educational offerings, wellness, and more
* REGION-SPECIFIC FEATURES: each country has unique HR policies so that the overall site might look similar but show region-specific benefits
* DEVELOPER-FRIENDLY TOOLS that accelerate rollout of features and bug fixes
The ratings microservice contains book ranking information that accompanies a book review.



There are 3 versions of the reviews microservice:



* Version v1 doesn’t call the ratings service.
* Version v2 calls the ratings service, and displays each rating as 1 to 5 black stars.
* Version v3 calls the ratings service, and displays each rating as 1 to 5 red stars.



The end-to-end architecture of the application is shown below.

Zoom

![Architecture using Istio](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/solution57-openshift-service-mesh/withistio.svg)

Architecture using Istio

Red Hat OpenShift Service Mesh relies on the Envoy sidecars within the application’s pod to provide Service Mesh capabilities to the application. You can enable automatic sidecar injection or manage it manually. Automatic injection using the annotation is the recommended way.



1. From your Cloud Shell, create a project called "bookinfo" with oc new-project command

oc new-project bookinfo

In Red Hat OpenShift, a project is a Kubernetes namespace with additional annotations.
2. Deploy the Bookinfo application in the bookinfo project by applying the bookinfo.yaml file on to the Red Hat OpenShift cluster. This deploys both the v1 and v2 versions of the app,

oc apply -f https://raw.githubusercontent.com/Maistra/istio/maistra-2.2/samples/bookinfo/platform/kube/bookinfo.yaml

The bookinfo.yaml file is annotated sidecar.istio.io/inject: "true" to enable automatic injection of the Istio sidecar for Red Hat OpenShift Service Mesh. So, these pods will also include an Envoy sidecar as they are started in the cluster.
FAQs 



  What locations are available for deploying VPC resources? 

Available regions and zones for deploying VPC resources, and a mapping of those to city locations and data centers can be found in [Locations for resource deployment](https://cloud.ibm.com/docs/overview?topic=overview-locations).





  What permissions do I need in order to create a cluster using the offering? 

Instructions for setting the appropriate permissions for IBM Cloud services that are used by the offering to create a cluster can be found in [User access permissions](https://cloud.ibm.com/docs/openshift?topic=openshift-access_referencecluster_create_permissions).





  How many worker nodes can I deploy in my Red Hat OpenShift cluster through this offering? 

Before you deploy a cluster, it is important to ensure that the cluster-related resource quota settings in your IBM Cloud account are appropriate for the size of the cluster that you would like to create. For more information, see [Service and quota limitations](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_limitationstech_limits).

The maximum number of worker nodes that are supported for the worker_nodes_per_zone deployment value is 1,000 (see [Deployment values](https://cloud.ibm.com/docs/hpc-openshift?topic=hpc-openshift-deployment-values)). However, the default quota, as noted in [Service and quota limitations](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_limitationstech_limits), is 500 worker nodes across all of the clusters in a region. If you need to deploy more nodes, [contact IBM Support](https://cloud.ibm.com/docs/get-support?topic=get-support-using-avatar).





  Where are the Terraform files used by the Red Hat OpenShift offering located? 

The Terraform-based templates can be found in this [GitHub repository](https://github.com/IBM-Cloud/hpc-cluster-openshift).
Worker node connection to the API server 10.240.128.09 3 years You [Update hosts that are assigned as worker nodes](https://cloud.ibm.com/docs/satellite?topic=satellite-host-update-workers). 
 Satellite control plane master API endpoint http://c103-1.containers.cloud.ibm.com/ 19800 hours (2.26 years) IBM Regenerated during automated rollouts for major and minor version updates for the Satellite location control plane master hosts. 
 Satellite control plane master hosts <br><br> * <br><br><br> 19800 hours (2.26 years) IBM [Update control plane hosts](https://cloud.ibm.com/docs/satellite?topic=satellite-host-update-location). 







 Platform compliance and certification 

Learn more about compliance standards for the IBM Cloud Satellite service.



 What compliance standards does the service meet? 

See the [Satellite FAQ for compliance standards](https://cloud.ibm.com/docs/satellite?topic=satellite-faqsstandards).





 Which areas of security compliance am I responsible for? 

For an overview of who is responsible for particular cloud resources when using IBM Cloud Satellite, see the table in [Overview of shared responsibilities](https://cloud.ibm.com/docs/satellite?topic=satellite-responsibilitiesoverview-by-resource). For a detailed description of areas in which responsibilities are shared between you and IBM for security and compliance, see [Tasks for shared responsibilities: Security and regulation compliance](https://cloud.ibm.com/docs/satellite?topic=satellite-responsibilitiessecurity-compliance).





 What are the security compliance responsibilities of Satellite-enabled IBM Cloud services? 

To see the security options and compliance standards of a Satellite-enabled IBM Cloud service, review the documentation for each Satellite-enabled IBM Cloud service. For example, for Red Hat OpenShift clusters, see [What compliance standards does the service meet?](https://cloud.ibm.com/docs/openshift?topic=openshift-faqsstandards) in the Red Hat OpenShift on IBM Cloud documentation.
: When you create a cluster, the cluster has an IBM Cloud IAM service ID that is given an IAM Reader service access role policy to IBM Cloud Container Registry. The service ID credentials are impersonated in a non-expiring API key that is stored in image pull secrets in your cluster. The image pull secrets are added to the default Kubernetes namespace and the list of secrets in the default service account for this Red Hat OpenShift project. By using image pull secrets, your deployments can pull images (read-only access) from the [global and regional IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_regions) to deploy containers in the default Red Hat OpenShift project.



* The global registry securely stores public images that are provided by IBM. You can refer to these public images across your deployments instead of having different references for images that are stored in each regional registry.
* The regional registry securely stores your own private Docker images.



What if I don't have image pull secrets in the default Red Hat OpenShift project?
: You can check the image pull secrets by [logging in to your cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-access_cluster) and running oc get secrets -n default | grep "icr-io". If no icr secrets are listed, the person who created the cluster might not have had the required permissions to IBM Cloud Container Registry in IAM. See [Updating existing clusters to use the API key image pull secret](https://cloud.ibm.com/docs/openshift?topic=openshift-registryimagePullSecret_migrate_api_key).

Can I restrict pull access to a certain regional registry?
: Yes, you can [edit the existing IAM policy of the service ID](https://cloud.ibm.com/docs/account?topic=account-serviceidsupdate_serviceid) that restricts the Reader service access role to that regional registry or a registry resource such as a namespace.
Built on open source HashiCorp Vault, IBM Cloud Secrets Manager helps you get the data isolation of a dedicated environment with the benefits of a public cloud. For more information, see [Getting started with IBM Cloud Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-getting-started). 







 Latency requirements 

Review the network latency requirements for the hosts that you add to your IBM Cloud Satellite location.



 IBM-managed master to customer-provided worker nodes for the Satellite location control plane 

The hosts that you want to attach to the Satellite location control plane must have a low latency connection of less than or equal to 200 milliseconds (<= 200ms) round-trip time (RTT) to the IBM Cloud region that your Satellite location is managed from. As latency increases, you might see impacts to performance, including Satellite Link throughput, Satellite-enabled IBM Cloud service provisioning time, host failure recovery time, and in extreme cases, the availability of resources that run in the Satellite location control plane, such as Red Hat OpenShift cluster masters. For more information, see [Testing the latency between IBM Cloud and the Satellite location control plane hosts](https://cloud.ibm.com/docs/satellite?topic=satellite-host-latency-testhost-latency-mzr).





 Customer-provided worker nodes in the Satellite location control plane to worker nodes that run Satellite-enabled IBM Cloud services like Red Hat OpenShift clusters in the same location 

Your host infrastructure setup must have a low latency connection of less than or equal to 100 milliseconds (<= 100ms) round-trip time (RTT) between the hosts that are used for the Satellite location control plane worker nodes and the hosts that are used for other resources in the location, like clusters or [Satellite-enabled IBM Cloud service](https://cloud.ibm.com/docs/satellite?topic=satellite-managed-services). For example, in cloud providers such as AWS, this setup typically means that all the hosts in the Satellite location are from the same cloud region, like us-east-1.
Create a cluster logging instance.
6. Set up virtual server instance logging with Fluentd.







 Before you begin 



* You have a [VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started) provisioned.
* Subnets are provisioned across three zones within a region.







 Step 1: Provision Red Hat® OpenShift® on IBM Cloud® 

To capture logs from workloads that are running outside of Red Hat OpenShift on IBM Cloud (such as a virtual server instance), you need to provision an instance of Red Hat OpenShift on IBM Cloud if you don't already have one.



1. [Provision Red Hat® OpenShift® on IBM Cloud®](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_tutorial) within the workload VPC where you plan to install the monitoring service. Use the following configuration:





* Red Hat OpenShift on IBM Cloud version: 4.6.x
* Worker zones: User defined subnet in each zone of the region
* Worker nodes per zone: 1
* Flavor: mx2.4x32 - 4 vCPU, 32 GB Memory
* Master service endpoint: Private endpoint only







 Step 2: Provision a Red Hat OpenShift on IBM Cloud worker pool 



1. Use a separate worker pool for the logging stack to keep the logging stack resources distinct from other workload resources. [Provision a new worker pool](https://cloud.ibm.com/docs/openshift?topic=openshift-add_workersvpc_pools) with the following configuration:



* Worker zones: User defined subnet in each zone of the region
* Worker nodes per zone: 1
* Flavor: mx2.4x32 - 4 vCPU, 32 GB Memory



2. After provisioning completes, [access the Red Hat OpenShift on IBM Cloud cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-access_clustervpc_private_se).
3. Taint the worker pool.
: The subnet must be specified in CIDR format with a size of at least /24, which allows a maximum of 255 services in the cluster, or larger. The subnet that you choose must be within one of the following ranges:



* 172.17.0.0 - 172.17.255.255
* 172.21.0.0 - 172.31.255.255
* 192.168.0.0 - 192.168.254.255
* 198.18.0.0 - 198.19.255.255



: Note that the pod and service subnets can't overlap. The pod subnet is in the 172.30.0.0/16 range by default.

--disable-disk-encrypt
: Worker nodes feature AES 256-bit [disk encryption by default](https://cloud.ibm.com/docs/openshift?topic=openshift-securityencrypted_disk). If you want to disable encryption, include this option.

--entitlement cloud_pak
: Include this option only if you use this cluster with an [IBM Cloud Pak](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_cloud_paks) that has a Red Hat OpenShift entitlement. When you specify the number of workers (--workers) and flavor (--flavor), make sure to specify only the number and size of worker nodes that you are entitled to use in [IBM Passport Advantage](https://www.ibm.com/software/passportadvantage/index.html). After your cluster is created, you are not charged the Red Hat OpenShift license fee for the entitled worker nodes in the default worker pool. Do not exceed your entitlement. Keep in mind that your OpenShift Container Platform entitlements can be used with other cloud providers or in other environments. To avoid billing issues later, make sure that you use only what you are entitled to use.
* 198.18.0.0 - 198.19.255.255







 Services 

Default range
: All services that are deployed to the cluster are assigned a private IP address in the 172.21.0.0/16 range by default.

Size requirements
: When you specify a custom subnet, the subnet must be specified in CIDR format with a size of at least /24, which allows a maximum of 255 services in the cluster, or larger.

Range requirements
: The pod and service subnets can't overlap each other. The subnet that you choose must be within one of the following ranges.



* 172.17.0.0 - 172.17.255.255
* 172.21.0.0 - 172.31.255.255
* 192.168.0.0 - 192.168.254.255
* 198.18.0.0 - 198.19.255.255









 Public gateways 

A public gateway enables a subnet and all worker nodes that are attached to the subnet to establish outbound connections to the internet. If both the public and private cloud service endpoints are enabled for your cluster, you must enable a [public gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-about-networking-for-vpcpublic-gateway-for-external-connectivity) on the VPC subnets that worker nodes are deployed to to access default Red Hat OpenShift components without being connected to your VPC's private network.

When you create a VPC cluster and enable both the public and private cloud service endpoints during cluster creation, the public cloud service endpoint is used by default for access to components such as the Red Hat OpenShift web console for your cluster. In order for console pods to establish a secure, public connection over the internet through the public service endpoint, you must enable a public gateway on each VPC subnet that your worker nodes are deployed to.

When you create a VPC cluster and enable only the private cloud service endpoint during cluster creation, the private cloud service endpoint is used by default to access Red Hat OpenShift components such as the Red Hat OpenShift web console or OperatorHub.