vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Privately exposing apps with Ingress 

Privately expose multiple apps in your Red Hat® OpenShift® on IBM Cloud® cluster by creating Ingress resources that are managed by the Ingress controller.



 Prerequisites 

Before you get started with Ingress, review the following prerequisites.



* Setting up Ingress requires the following [IBM Cloud IAM roles](https://cloud.ibm.com/docs/openshift?topic=openshift-users):



* Administrator platform access role for the cluster in IBM Cloud Kubernetes Service.
* Manager service access role in all IBM Cloud Kubernetes Service namespaces (Red Hat OpenShift projects).



* If a zone fails, you might see intermittent failures in requests to apps that are exposed by the Ingress controller in that zone.
* To ensure high availability, at least two worker nodes per zone are recommended.





* VPC clusters: [Allow traffic requests that are routed by Ingress to node ports on your worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-security-group).
* VPC multizone clusters: If you created a cluster in the CLI and later manually added zones to your worker pools with the ibmcloud oc zone add vpc-gen2 command, you must [update the VPC load balancer that exposes the Ingress controller](https://cloud.ibm.com/docs/openshift?topic=openshift-router-mzr-error) to include subnets for all zones in your cluster.
* Classic clusters: Enable a [Virtual Router Function (VRF)](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpointvrf) for your IBM Cloud infrastructure account. To check whether a VRF is already enabled, use the ibmcloud account show command. If you can't or don't want to enable VRF, enable [VLAN spanning](https://cloud.ibm.com/docs/vlans?topic=vlans-vlan-spanningvlan-spanning).
If you [set up a secure external route for the internal image registry](https://cloud.ibm.com/docs/openshift?topic=openshift-registryroute_internal_registry), or to [access an IBM Cloud Object Storage bucket that backs up your internal image registry in a VPC cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-registrycos_image_registry), you must allow access for the internal registry and IBM Cloud Object Storage endpoints in your corporate allowlist.



1. If you create an external route for the internal Red Hat OpenShift image registry, allow access to the .containers.appdomain.cloud domain so that you can access the image-registry-openshift-image-registry.<cluster_name>-<ID_string>.<region>.containers.appdomain.cloud route from your corporate network.
2. VPC clusters: If you must access an IBM Cloud Object Storage bucket that backs up the internal Red Hat OpenShift image registry, or if you must otherwise access IBM Cloud Object Storage from your corporate network, allow access to the .cloud-object-storage.appdomain.cloud domain.









 Allowing traffic from your cluster in other services' allowlists or in on-premises allowlists 

Allow your worker nodes to communicate with services that are protected by allowlists.

For example, you might have services that run inside or outside IBM Cloud, or services that run on-premises, that are protected by an allowlist. You want to permit incoming network traffic to those services from your cluster. In your service's allowlist, you must add the external IP addresses of the public gateways on your cluster's VPC subnets.

If you want to permit egress from your allowlist-protected services to your cluster, you must add your worker nodes' private IP addresses or your cluster's VPC subnet CIDRs in your service's allowlist. Note that because worker nodes in VPC clusters have only private IP addresses, connections into the VPC cluster worker nodes can only originate from systems that are connected to your IBM Cloud private network.

Before you begin



1.
The synchronization of service roles to RBAC might take a couple minutes, depending on the number of users and namespaces in your cluster.

Managing your own RBAC
: See [Assigning RBAC permissions](https://cloud.ibm.com/docs/containers?topic=containers-access-overviewrole-binding).





 Overview of classic infrastructure 

Classic infrastructure roles enable access to your classic IBM Cloud infrastructure resources.

Set up a user with Super User infrastructure role, and store this user's infrastructure credentials in an API key. Then, set the API key in each region and resource group that you want to create clusters in. After you set up the API key, other users that you grant access to IBM Cloud Kubernetes Service don't need infrastructure roles as the API key is shared for all users within the region. Instead, IBM Cloud IAM platform access roles determine the infrastructure actions that users are allowed to perform.

If you don't want to set up the API key with full Super User infrastructure permissions or you need to grant specific device access to users, you can [customize infrastructure permissions](https://cloud.ibm.com/docs/containers?topic=containers-access-credsinfra_access).

Example actions that are permitted by infrastructure roles are viewing the details of cluster worker node machines or editing networking and storage resources.

VPC clusters don't need classic infrastructure permissions. Instead, you assign Administrator platform access to the VPC Infrastructure service in IBM Cloud. Then, these credentials are stored in the API key for each region and resource group that you create clusters in.





 Overview of Cloud Foundry 

Not all IBM Cloud services can be managed with IAM. If you use one of these services, you can continue to use Cloud Foundry user roles to control access to those services.

Cloud Foundry roles grant access to organizations and spaces within the account. To see the list of Cloud Foundry-based services in IBM Cloud, run ibmcloud service list.

Example actions that are permitted by Cloud Foundry roles are creating a new Cloud Foundry service instance or binding a Cloud Foundry service instance to a cluster.
The synchronization of service roles to RBAC might take a couple minutes, depending on the number of users and namespaces in your cluster.

Managing your own RBAC
: See [Assigning RBAC permissions](https://cloud.ibm.com/docs/openshift?topic=openshift-access-overviewrole-binding).





 Overview of classic infrastructure 

Classic infrastructure roles enable access to your classic IBM Cloud infrastructure resources.

Set up a user with Super User infrastructure role, and store this user's infrastructure credentials in an API key. Then, set the API key in each region and resource group that you want to create clusters in. After you set up the API key, other users that you grant access to Red Hat OpenShift on IBM Cloud don't need infrastructure roles as the API key is shared for all users within the region. Instead, IBM Cloud IAM platform access roles determine the infrastructure actions that users are allowed to perform.

If you don't want to set up the API key with full Super User infrastructure permissions or you need to grant specific device access to users, you can [customize infrastructure permissions](https://cloud.ibm.com/docs/openshift?topic=openshift-access-credsinfra_access).

Example actions that are permitted by infrastructure roles are viewing the details of cluster worker node machines or editing networking and storage resources.

VPC clusters don't need classic infrastructure permissions. Instead, you assign Administrator platform access to the VPC Infrastructure service in IBM Cloud. Then, these credentials are stored in the API key for each region and resource group that you create clusters in.





 Overview of Cloud Foundry 

Not all IBM Cloud services can be managed with IAM. If you use one of these services, you can continue to use Cloud Foundry user roles to control access to those services.

Cloud Foundry roles grant access to organizations and spaces within the account. To see the list of Cloud Foundry-based services in IBM Cloud, run ibmcloud service list.

Example actions that are permitted by Cloud Foundry roles are creating a new Cloud Foundry service instance or binding a Cloud Foundry service instance to a cluster.
Publicly exposing apps with Ingress 

Publicly expose multiple apps in your Red Hat® OpenShift® on IBM Cloud® cluster by creating Ingress resources that are managed by the Ingress controller.



 Prerequisites 

Before you get started with Ingress, review the following prerequisites.



* Setting up Ingress requires the following [IBM Cloud IAM roles](https://cloud.ibm.com/docs/openshift?topic=openshift-users):



* Administrator platform access role for the cluster in IBM Cloud Kubernetes Service.
* Manager service access role in all IBM Cloud Kubernetes Service namespaces (Red Hat OpenShift projects).



* If a zone fails, you might see intermittent failures in requests to apps that are exposed by the Ingress controller in that zone.
* To ensure high availability, at least two worker nodes per zone are recommended.





* VPC clusters: [Allow traffic requests that are routed by Ingress to node ports on your worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-security-group).
* VPC multizone clusters: If you created a cluster in the CLI and later manually added zones to your worker pools with the ibmcloud oc zone add vpc-gen2 command, you must [update the VPC load balancer that exposes the Ingress controller](https://cloud.ibm.com/docs/openshift?topic=openshift-router-mzr-error) to include subnets for all zones in your cluster.
* Classic clusters: Enable a [Virtual Router Function (VRF)](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpointvrf) for your IBM Cloud infrastructure account. To enable VRF, see [Enabling VRF](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpointvrf). To check whether a VRF is already enabled, use the ibmcloud account show command.
For more information about monitoring alarms, events, editing existing alarm settings, and using the default vSAN alarms to monitor your cluster, hosts, analyze any new events, and assess the overall cluster health, see [Using the vSAN default alarms](https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.vsan-monitoring.doc/GUID-E7885CDE-654D-4732-A5FE-31D0AB2B2F57.html). 
 Enable SIOC By default, Storage IO Control (SIOC) is disabled. If you are experiencing poor performance for VMs in a datastore, you can enable SIOC to help with prioritization to storage resources. SIOC is only activated when there is storage contention to ensure that every VM gets its share of storage resources. Using a VM storage policy and assigning that policy to a VM or VMDK enables this. For more information, see [Managing storage I/O resources](https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.resmgmt.doc/GUID-7686FEC3-1FAC-4DA7-B698-B808C44E5E96.html). 
 Configure a datastore cluster A datastore cluster is a collection of datastores with shared resources and a shared management interface. Datastore clusters are to datastores what clusters are to hosts. When you create a datastore cluster, you can use vSphere Storage DRS to manage storage resources. When you add a datastore to a datastore cluster, the datastore's resources become part of the datastore cluster's resources. Use datastore clusters to aggregate storage resources, providing support resource allocation policies at the datastore cluster level.
For more information, see the Kubernetes documentation on [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).

For an example of affinity in an app deployment, see [Making your app deployment YAML file](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_appsapp_yaml).

Distribute pods across multiple zones or regions
: To protect your app from a zone failure, you can create multiple clusters in separate zones or add zones to a worker pool in a multizone cluster. Multizone clusters are available only in certain [classic](https://cloud.ibm.com/docs/openshift?topic=openshift-regions-and-zoneszones-mz) or [VPC](https://cloud.ibm.com/docs/openshift?topic=openshift-regions-and-zoneszones-vpc) multizones, such as Dallas. If you create multiple clusters in separate zones, you must [set up a global load balancer](https://cloud.ibm.com/docs/openshift?topic=openshift-ha_clustersmultiple-clusters-glb). When you use a replica set and specify pod anti-affinity, Kubernetes spreads your app pods across the nodes. If your nodes are in multiple zones, the pods are spread across the zones, increasing the availability of your app. If you want to limit your apps to run only in one zone, you can configure pod affinity, or create and label a worker pool in one zone. For more information, see [High availability for multizone clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-ha_clustersha_clusters).

In a multizone cluster deployment, are my app pods distributed evenly across the nodes?
: The pods are evenly distributed across zones, but not always across nodes. For example, if you have a cluster with one node in each of three zones and deploy a replica set of six pods, then each node gets two pods.
When you are planning the sizing for your VMware vSphere clusters in IBM Cloud VPC, consider the VMware best practices that are documented in [VMware validated designs](https://docs.vmware.com/en/VMware-Validated-Design/5.1/sddc-architecture-and-design/) to meet your capacity and high availability targets.

Theoretically, as each IBM Cloud VPC Bare Metal Server is deployed individually, you can build a solution as small as one ESXi host per IBM Cloud VPC zone. However, you need to take the high availability aspects into account. To protect your VMware workloads from host failures, for example in case one host stops functioning, you need to have a cluster with at least two hosts. To keep the workloads running, you need to size enough reserve capacity in each cluster even if a host would fail. In most use cases, a three node cluster is far more appropriate because you have the option of running maintenance tasks on ESXi hosts (such as host updates) without having to disable HA.

As the central point of SDDC management (vCenter Server and NSX-T Managers) runs on the same IBM Cloud VPC Bare Metal Servers, protecting them is key. You can use vSphere HA and anti-affinity rules (to prevent specific VMs from running on a same host) for these in the vSphere HA cluster. As your initial cluster is typically a management cluster, VMware best practice is to build a management cluster of four hosts or more allowing the cluster to tolerate host failures better and you to perform maintenance tasks much easier, especially with NSX-T and vSAN deployments. Typically, it's not suitable to have three or fewer hosts for a management or a converged management and workload cluster in production.

In general, when you are deploying vSphere HA clusters, it is also important to consider the overall size of the cluster. Smaller sized clusters require a larger relative percentage of all the available cluster resources to be reserved to handle failures. For example, a cluster of three nodes requires at least 33% of the cluster resources to be held on reserve for failover where a cluster of eight nodes requires 12.5% of cluster resources that are reserved for failover.
ibmcloud ks worker-pool get --cluster CLUSTER --worker-pool WORKER-POOL
3. In the output, note the zone and either the private and public VLAN ID for Classic clusters or the subnet ID for VPC clusters. Also note any custom labels that you are using. The default worker pool label is ibm-cloud.kubernetes.io. Any labels other than ibm-cloud.kubernetes.io are custom labels that you should add to your new worker pool.







 Migration steps 

Migrate your worker nodes to use Ubuntu 20. These steps apply to all supported cluster versions.



1. In your cluster, create a new worker pool for the Ubuntu 20 worker nodes. Include the --operating-system=UBUNTU_20_64 option. Make sure that the number of nodes specified with the --size-per-zone option matches the number of Ubuntu 18 worker nodes that you are replacing. Also, be sure to include the custom labels that you retrieved earlier.

For classic clusters. See the [CLI reference](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_worker_pool_create) for command details.

ibmcloud ks worker-pool create classic --name NAME --cluster CLUSTER --flavor FLAVOR --operating-system UBUNTU_20_64 --size-per-zone WORKERS-PER-ZONE --label LABEL --label LABEL

For VPC clusters. See the [CLI reference](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clicli_worker_pool_create_vpc_gen2) for command details.

ibmcloud ks worker-pool create vpc-gen2 --name NAME --cluster CLUSTER --flavor FLAVOR --operating-system UBUNTU_20_64 --size-per-zone WORKERS-PER-ZONE --label LABEL --label LABEL
2. Verify that the worker pool is created.

ibmcloud ks worker-pool ls --cluster CLUSTER
3.
You need to add nofail next to defaults if it isn’t there already.

VPC+ Cloud Migration only supports a maximum of three secondary volumes for migration.

If a server cannot be migrated because it's not configured as cloud-init, you can still migrate the secondary volume of that server. First, create a compatible server in VPC, then migrate the secondary volume by using the previous procedure.





 Considerations for load balancers 

Only IBM Cloud Load Balancer is supported.

If your IBM Cloud classic environment uses configurations in IBM Cloud Load Balancer that are not available in VPC, VPC+ Cloud Migration sets the closest match to what is available for VPC or uses a default configuration.





 Considerations for gateway appliance 

Only VRA (Vyatta 5600) is supported. Within VRA, the following features are supported:



* Gateway (NAT masquerade)
* VPN/IKE
* Stateless ACLs





 ACLs 

The VPC+ tool does not translate network or host-based ACL rules. You will need to add these rules when editing your discovered resources or after you provision your VPC environment.

For port-based ACLs that are configured with RFC1918 a network address, the port ACLs are migrated but the address will change to Any. For example, the following VRA configuration:

Allow UDP, Source Address 10.1.1.0/26, Destination Address 172.16.20.0/26 Port 80

Migrates to VPC as:

Allow UDP Source Address Any, Destination Address Any, Port 80

If you have host-based rules /32, consider moving to security groups to preserve ACLs resource usage.





 VRA rule limitations 

IBM Cloud limits VRA rules to 25. If you have more than 25 rules, IBM Cloud selects the first 25. You can manage these rules when editing your discovered resources.







 Gateway configurations not available in VPC 

If your IBM Cloud classic environment uses configurations in a gateway that are not available in VPC, VPC+ Cloud Migration sets the closest match to what is available for VPC or uses a default configuration.





 Considerations for IBM Cloud Kubernetes Service and Red Hat OpenShift migration
: Platform access Viewer, Operator, Editor, and Administrator roles
: Custom service access role to create clusters, Satellite Cluster Creator

What you can scope an access policy for the resource to
: Account
: Resource group
: Particular instances of the resource

Description
: [Locations](https://cloud.ibm.com/docs/satellite?topic=satellite-locations) are places that you use to extend IBM Cloud by attaching your own host compute machines to the location. Access to the location resource lets users work with locations and hosts. However, location access does not grant access to other resources that run within the location, such as endpoints, configurations, or Red Hat OpenShift clusters.





 Configuration, subscription, cluster, cluster group, and resource 

Review details about the Satellite Config IAM resource type, which includes actions for configurations, subscriptions, clusters, cluster groups, resources, and other components that use Satellite Config such as storage.

Name of the resource type
: UI: Configuration, Subscription, Cluster, Clustergroup, or Resource
: API or CLI: configuration, subscription, cluster, clustergroup, or resource

Type of role that you can assign for the resource in IAM
: Platform access Viewer, Operator, Editor, and Administrator roles
: Service access Reader, Writer, and Manager roles, and a custom Deployer role

What you can scope an access policy for the resource to
: Account
: Cluster or Clustergroup only: Particular instance of the resource

Description
: [Satellite Config](https://cloud.ibm.com/docs/satellite?topic=satellite-setup-clusters-satconfig) is a collection of configurations, versions, and subscriptions that you use to automatically deploy Kubernetes resources to groups of clusters that are registered with the Satellite Config component. However, access to Satellite Config does not give a user access to the clusters that run the Kubernetes resources of the configuration. You can scope access to the following Satellite Config resources.



* Configurations, where you upload the version of the configuration file for the Kubernetes resources that you want to deploy. You cannot scope a policy to a particular configuration.
Automating SAP AnyDB (non-SAP HANA) 2-tier and 3-tier distributed architecture on IBM Cloud® VPC with Terraform 

Terraform on IBM Cloud® enables predictable and consistent provisioning of IBM Cloud VPC infrastructure resources so that you can rapidly build complex, cloud environments. IBM Cloud VPC infrastructure consists of SAP certified hardware using Intel Xeon CPUs and additional Intel technologies.

For more information about Terraform on IBM Cloud, see [Terraform on IBM Cloud getting started tutorial](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-getting-started).

To create resources with Terraform, you use Terraform configuration files that describe the IBM Cloud resources that you need and how you want to configure them. Based on your configuration, Terraform creates an execution plan and describes the actions that need to be run to create the resources. You can review the execution plan, change it, or run the plan. When you change your configuration, Terraform on IBM Cloud can determine what changed and create incremental execution plans that you can apply to your existing IBM Cloud resources.



 Script files 

The configuration and script files are provided on the GitHub repository [https://github.com/IBM-Cloud/sap-infra-anydb-distributed](https://github.com/IBM-Cloud/sap-infra-anydb-distributed).

For 2-tier and 3-tier VPC for SAP, you modify the:



* terraform.tfvars file to add your IBM Cloud API-key
* input.auto.tfvars file to customize the resources for your solution. You specify zones, resource names, and SSH keys.



All of the other configuration files are provided and do not need to be modified.

The IBM Cloud Provider plug-in for Terraform on IBM Cloud uses these configuration files to provision a VPC in your IBM Cloud account.





 What is created 

A VPC is a private space in IBM Cloud where you can run an isolated environment with custom network policies. The variables that you define are used by the scripts to provision the following VPC infrastructure resources for you: