vania-janet/multiturn-rag-retrieval-data huggingface dataset:
[Remote Access API 2.0 Reference Guide, 17.2.0](https://public.dhe.ibm.com/cloud/bluemix/network/vra/18_remote_access_api_2_configuration_5600.pdf) This guide describes how to use the Remote Access API 2.0 to remotely run commands on AT&T products that run on the AT&T Vyatta Network Operating System over HTTPs. 
 [Remote Access IPsec VPN Configuration Guide, 17.2.0](https://public.dhe.ibm.com/cloud/bluemix/network/vra/18_remote_access_ipsec_vpn_configuration_5600.pdf) This guide describes how to configure Remote Access Virtual Private Network (VPN) on the AT&T Vyatta Network Operating System. 
 [Remote Management Configuration Guide, 17.2.0](https://public.dhe.ibm.com/cloud/bluemix/network/vra/18_remote_management_configuration_5600.pdf) This guide describes how to configure SSH, Telnet, Web GUI access (HTTPS), NETCONF and SNMP for remote management of the AT&T Vyatta vRouter. 
 [RIP Configuration Guide, 17.2.0](https://public.dhe.ibm.com/cloud/bluemix/network/vra/18_rip_configuration_5600.pdf) This guide describes how to configure Routing Information Protocol (RIP) on the AT&T Vyatta vRouter. 
 [RIPng Configuration Guide, 17.2.0](https://public.dhe.ibm.com/cloud/bluemix/network/vra/18_ripng_Configuration_5600.pdf) This guide describes how to configure Routing Information Protocol next generation (RIPng) on the AT&T Vyatta vRouter.
: The Log Analysis ingestion key that you want to use for your configuration. For information about how to retrieve the ingestion key, see [Get the ingestion key through the IBM Cloud UI](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-ingestion_key). This value is required if you want to replace the ingestion key, and optional if you want to replace the IBM Log Analysis service instance. If you don't provide the ingestion key when replacing the IBM Log Analysis service instance, the ingestion key that was last added is retrieved automatically.





 ibmcloud ob logging config show 

Virtual Private Cloud

Classic infrastructure

Show the details of a Log Analysis configuration.

To show the details of logging configurations that you manually set up without using the IBM Cloud Kubernetes Service observability plug-in, you must first make this configuration available to the plug-in by using the [ibmcloud ob logging agent discover](https://cloud.ibm.com/docs/containers?topic=containers-observability_clilogging_agent_discover) command.

ibmcloud ob logging config show --cluster CLUSTER --instance LOGGING_INSTANCE

Minimum required permissions:



* Viewer platform access role and Reader service access role for the ibm-observe Kubernetes namespaces in IBM Cloud Kubernetes Service.
* Viewer platform access role for IBM Log Analysis



Command options:

--cluster CLUSTER
: The name or ID of the cluster for which you want to list existing Log Analysis configurations. To retrieve your cluster name or ID, run ibmcloud ks clusters. This value is required.

--instance LOGGING_INSTANCE
: The ID or name of the IBM Log Analysis service instance for which you want to show the logging configuration. To retrieve the name, run ibmcloud resource service-instances. This value is required.







 Monitoring commands 



 ibmcloud ob monitoring agent discover 

Virtual Private Cloud

Classic infrastructure
If you don't want to set up IBM Cloud Object Storage, you can skip this step and [install the add-on](https://cloud.ibm.com/docs/openshift?topic=openshift-deploy-odf-vpcinstall-odf-cli-vpc).

If you want to set up IBM Cloud Object Storage as the default backing store in your storage cluster, create an instance of IBM Cloud Object Storage. Then, create a set of HMAC credentials and a Kubernetes secret that uses your Object Storage HMAC credentials. If you don't specify IBM Cloud Object Storage credentials during installation, then the default backing store in your storage cluster is created by using the PVs in your cluster. You can set up additional backing stores after deploying ODF, but you can't change the default backing store.

[Access your Red Hat OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-access_cluster).



1. Create an openshift-storage namespace in your cluster. The driver pods are deployed to this namespace. Copy the following YAML and save it as os-namespace.yaml on your local machine.

apiVersion: v1
kind: Namespace
metadata:
labels:
openshift.io/cluster-monitoring: "true"
name: openshift-storage
2. Create the openshift-storage namespace by using the YAML file that you saved.

oc create -f os-namespace.yaml
3. Verify that the namespace is created.

oc get namespaces | grep storage
4. Create an IBM Cloud Object Storage service instance.

ibmcloud resource service-instance-create noobaa-store cloud-object-storage standard global
5. Create HMAC credentials. Make a note of your credentials.

ibmcloud resource service-key-create cos-cred-rw Writer --instance-name noobaa-store --parameters '{"HMAC": true}'
6.
If you don't want to set up IBM Cloud Object Storage, you can skip this step and [install the add-on](https://cloud.ibm.com/docs/openshift?topic=openshift-deploy-odf-vpc&interface=uiinstall-odf-cli-vpc).

If you want to set up IBM Cloud Object Storage as the default backing store in your storage cluster, create an instance of IBM Cloud Object Storage. Then, create a set of HMAC credentials and a Kubernetes secret that uses your Object Storage HMAC credentials. If you don't specify IBM Cloud Object Storage credentials during installation, then the default backing store in your storage cluster is created by using the PVs in your cluster. You can set up additional backing stores after deploying ODF, but you can't change the default backing store.

[Access your Red Hat OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-access_cluster).



1. Create an openshift-storage namespace in your cluster. The driver pods are deployed to this namespace. Copy the following YAML and save it as os-namespace.yaml on your local machine.

apiVersion: v1
kind: Namespace
metadata:
labels:
openshift.io/cluster-monitoring: "true"
name: openshift-storage
2. Create the openshift-storage namespace by using the YAML file that you saved.

oc create -f os-namespace.yaml
3. Verify that the namespace is created.

oc get namespaces | grep storage
4. Create an IBM Cloud Object Storage service instance.

ibmcloud resource service-instance-create noobaa-store cloud-object-storage standard global
5. Create HMAC credentials. Make a note of your credentials.

ibmcloud resource service-key-create cos-cred-rw Writer --instance-name noobaa-store --parameters '{"HMAC": true}'
6.
[Brocade Vyatta Network OS QoS Configuration Guide, 5.2R1](https://public.dhe.ibm.com/cloud/bluemix/network/vra/vyatta-network-os-5.2r1-qos.pdf) This guide describes the QoS architecture and how to configure QoS on on Brocade products that run on the Brocade Vyatta Network OS (referred to as a virtual router, vRouter, or router in the guide). 
 [Brocade Vyatta Network OS Product Guide, 5.2R1](https://public.dhe.ibm.com/cloud/bluemix/network/vra/vyatta-network-os-5.2r1-productguide.pdf) This guide describes the Brocade Vyatta Network OS (referred to as a virtual router, vRouter, or router in the guide). 
 [Brocade Vyatta Network OS PIM Configuration Guide, 5.2R1](https://public.dhe.ibm.com/cloud/bluemix/network/vra/vyatta-network-os-5.2r1-pim.pdf) This guide describes how to configure PIM on Brocade products that run on the Brocade Vyatta Network OS (referred to as a virtual router, vRouter, or router in the guide). 
 [Brocade Vyatta Network OS OSPFv3 Configuration Guide, 5.2R1](https://public.dhe.ibm.com/cloud/bluemix/network/vra/vyatta-network-os-5.2r1-ospfv3.pdf) This guide describes how to configure OSPFv3 on Brocade products that run on the Brocade Vyatta Network OS (referred to as a virtual router, vRouter, or router in the guide).
If you have a multi-tenant cluster in which cluster resources are dedicated to tenants, you can [limit VPN traffic for each strongSwan deployment to the worker nodes dedicated to each tenant](https://cloud.ibm.com/docs/containers?topic=containers-vpnlimit_worker).



 Limiting strongSwan VPN traffic by namespace 

When you have a single-tenant or multi-tenant cluster, you can limit VPN traffic to pods in only certain namespaces.

For example, say that you want pods in only a specific namespace, my-secure-namespace, to send and receive data over the VPN. You don't want pods in other namespaces, such as kube-system, ibm-system, or default, to access your on-premises network. To limit the VPN traffic to only my-secure-namespace, you can create Calico global network policies.

Before you use this solution, review the following considerations and limitations.



* You don't need to deploy the strongSwan Helm chart into the specified namespace. The strongSwan VPN pod and the routes daemon set can be deployed into kube-system or any other namespace. If the strongSwan VPN is not deployed into the specified namespace, then the vpn-strongswan-ping-remote-ip-1 Helm test fails. This failure is expected and acceptable. The test pings the remote.privateIPtoPing private IP address of the on-premises VPN gateway from a pod which is not in the namespace that has direct access to the remote subnet. However, the VPN pod is still able to forward traffic to pods in the namespaces that do have routes to the remote subnet, and traffic can still flow correctly. The VPN state is still ESTABLISHED and pods in the specified namespace can connect over the VPN.
* The Calico global network policies in the following steps don't prevent Kubernetes pods that use host networking from sending and receiving data over the VPN. When a pod is configured with host networking, the app running in the pod can listen on the network interfaces of the worker node that it is on. These host networking pods can exist in any namespace.
For example, you might add conditions such as only clusters in a resource group, only clusters with a prod Kubernetes namespace, or only clusters with a trusted-profile Kubernetes service account.
* Specific resources: A particular cluster. Click Add another resource + to select a cluster and fill out conditions such as the Kubernetes namespace or Kubernetes service account that can establish trust.
* Click Continue.



The Kubernetes namespace and service account names that you enter don't have to exist already. Any future namespaces or service accounts with these names can establish trust. To list existing namespaces, log in to your cluster and run oc get ns. To list existing service accounts, log in to your cluster and run oc get sa -n <namespace>.
7. Grant the trusted profile any access policies to the IAM services and Account management that you want the pod in your cluster to be able to access.



* For example, you might grant access to All Identity and Access enabled services and All resources in those services, with the Editor platform, Writer service, and Viewer resource group access roles.
* Click Add + to add the policy to the profile, and continue adding as many policies as you want.



8. In the Summary pane, review the profile, trust, and access details. Then, click Create.



Your clusters can now establish trust with IBM Cloud IAM. Next, your developers can [configure their application pods to exchange the identity token for an IAM token to authenticate requests to IBM Cloud services](https://cloud.ibm.com/docs/openshift?topic=openshift-pod-iam-identityiam-identity-pod).





 Configure your application pods to authenticate with IBM Cloud services 

As a developer, you can configure your application pods to authenticate with IBM Cloud services in clusters that are linked to an IAM trusted profile set up.

Before you begin:



* [Access your Red Hat OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-access_cluster).
[Brocade Vyatta Network OS RIP Configuration Guide, 5.2R1](https://public.dhe.ibm.com/cloud/bluemix/network/vra/vyatta-network-os-5.2r1-rip.pdf) This guide describes how to configure Routing Information Protocol (RIP) on the Brocade 5600 vRouter (referred to as a virtual router, vRouter, or router in the guide). 
 [Brocade Vyatta Network OS Remote Access API Reference Guide, 5.2R1](https://public.dhe.ibm.com/cloud/bluemix/network/vra/vyatta-network-os-5.2r1-remote-access-api.pdf) This guide describes how to use the Remote Access API 2.0 to remotely run commands on Brocade products that run on the Brocade Vyatta Network OS (referred to as a virtual router, vRouter, or router in the guide) over HTTPs. 
 [Brocade Vyatta Network OS QoS Configuration Guide, 5.2R1](https://public.dhe.ibm.com/cloud/bluemix/network/vra/vyatta-network-os-5.2r1-qos.pdf) This guide describes the QoS architecture and how to configure QoS on on Brocade products that run on the Brocade Vyatta Network OS (referred to as a virtual router, vRouter, or router in the guide). 
 [Brocade Vyatta Network OS Product Guide, 5.2R1](https://public.dhe.ibm.com/cloud/bluemix/network/vra/vyatta-network-os-5.2r1-productguide.pdf) This guide describes the Brocade Vyatta Network OS (referred to as a virtual router, vRouter, or router in the guide).
[Brocade Vyatta Network OS NAT Configuration Guide, 5.2R1](https://public.dhe.ibm.com/cloud/bluemix/network/vra/vyatta-network-os-5.2r1-nat.pdf) This guide describes how to configure NAT on Brocade products that run on the Brocade Vyatta Network OS (referred to as a virtual router, vRouter, or router in the guide). 
 [Brocade Vyatta Network OS Policy-based Routing Configuration Guide, 5.2R1](https://public.dhe.ibm.com/cloud/bluemix/network/vra/vyatta-network-os-5.2r1-policy-based-routing.pdf) This guide describes how to define and configure routing policies on Brocade products that run on the Brocade Vyatta Network OS (referred to as a virtual router, vRouter, or router in the guide). 
 [Brocade Vyatta Network OS Firewall Configuration Guide, 5.2R1](https://public.dhe.ibm.com/cloud/bluemix/network/vra/vyatta-network-os-5.2r1-firewall.pdf) This guide describes firewall functionality on the Brocade 5600 vRouter (referred to as a virtual router, vRouter, or router in the guide). 
 [Brocade Vyatta Network OS Remote Access IPsec VPN Configuration Guide, 5.2R1](https://public.dhe.ibm.com/cloud/bluemix/network/vra/vyatta-network-os-5.2r1-ra-ipsec-vpn.pdf) This guide describes how to configure Remote Access VPN on the Brocade Vyatta Network OS (referred to as a virtual router, vRouter, or router in the guide).
[Brocade Vyatta Network OS IPsec Site-to-Site VPN Configuration Guide, 5.2R1](https://public.dhe.ibm.com/cloud/bluemix/network/vra/vyatta-network-os-5.2r1-ipsec-vpn.pdf) This guide describes how to configure site-to-site IPsec VPNs on Brocade products that run on the Brocade Vyatta Network OS (referred to as a virtual router, vRouter, or router in the guide). 
 [Brocade Vyatta Network OS DMVPN Configuration Guide, 5.2R1](https://public.dhe.ibm.com/cloud/bluemix/network/vra/vyatta-network-os-5.2r1-dmvpn.pdf) This guide describes how to configure DMVPN on Brocade products that run on the Brocade Vyatta Network OS (referred to as a virtual router, vRouter, or router in the guide). 
 [Brocade Vyatta Network OS VPN Support Configuration Guide, 5.2R1](https://public.dhe.ibm.com/cloud/bluemix/network/vra/vyatta-network-os-5.2r1-vpn-support.pdf) This guide describes the VPN support available on the Brocade Vyatta Network OS (referred to as a virtual router, vRouter, or router in the guide). 
 [Brocade Vyatta Network OS Routing Policies Configuration Guide, 5.2R1](https://public.dhe.ibm.com/cloud/bluemix/network/vra/vyatta-network-os-5.2r1-routing-policies.pdf) This guide describes how to configure routing policies on the Brocade Vyatta Network OS (referred to as a virtual router, vRouter, or router in the guide).
Reviewing master health 

Virtual Private Cloud

Classic infrastructure

Review your cluster master health.



 Reviewing master health, status, and states 

Your Red Hat OpenShift on IBM Cloud cluster includes an IBM-managed master with highly available replicas, automatic security patch updates applied for you, and automation in place to recover in case of an incident. You can check the health, status, and state of the cluster master by running ibmcloud oc cluster get --cluster <cluster_name_or_ID>.

The Master Health reflects the state of master components and notifies you if something needs your attention. The health might be one of the following states.



* error: The master is not operational. IBM is automatically notified and takes action to resolve this issue. You can continue monitoring the health until the master is normal. You can also [open an IBM Cloud support case](https://cloud.ibm.com/docs/containers?topic=containers-get-help).
* normal: The master is operational and healthy. No action is required.
* unavailable: The master might not be accessible, which means some actions such as resizing a worker pool are temporarily unavailable. IBM is automatically notified and takes action to resolve this issue. You can continue monitoring the health until the master is normal.
* unsupported: The master runs an unsupported version of Kubernetes. You must [update your cluster](https://cloud.ibm.com/docs/containers?topic=containers-update) to return the master to normal health.



The Master Status provides details of what operation from the master state is in progress. The status includes a timestamp of how long the master has been in the same state, such as Ready (1 month ago). The Master State reflects the lifecycle of possible operations that can be performed on the master, such as deploying, updating, and deleting. Each state is described in the following table.



Master states

 Master state Description 

 deployed The master is successfully deployed. Check the status to verify that the master is Ready or to see if an update is available. 
 deploying The master is currently deploying.
-f
: Optional: Force the command to run with no user prompts.

-q
: Optional: Do not show the message of the day or update reminders.

Example:

ibmcloud oc cluster master satellite-service-endpoint allowlist disable --cluster my-cluster





 ibmcloud oc cluster master satellite-service-endpoint allowlist enable 

Satellite

Enable the allowlist for a Satellite cluster. When the allowlist is enabled, authorized requests to the cluster master are permitted through the Satellite service endpoint only if they originate from a subnet specified in the allowlist. This command can be used only with Satellite clusters that are CoreOS-enabled.

ibmcloud oc cluster master satellite-service-endpoint allowlist enable --cluster CLUSTER [-f] [-q]

Minimum required permissions: IBM Cloud IAM Administrator platform access role for Satellite.

Command options:

-c, --cluster CLUSTER
: Required. The name or ID of the cluster.

-f
: Optional: Force the command to run with no user prompts.

-q
: Optional: Do not show the message of the day or update reminders.

Example:

ibmcloud oc cluster master satellite-service-endpoint allowlist enable --cluster my-cluster





 ibmcloud oc cluster master satellite-service-endpoint allowlist get 

Satellite

Get a Satellite cluster's service endpoint allowlist. The allowlist contains the subnets from which requests to the cluster master are permitted through the Satellite service endpoint. This command can be used only with Satellite clusters that are CoreOS-enabled.

ibmcloud oc cluster master satellite-service-endpoint allowlist get --cluster CLUSTER [-q]

Minimum required permissions: IBM Cloud IAM Viewer platform access role for Satellite.

Command options:

-c, --cluster CLUSTER
: Required. The name or ID of the cluster.

-q
: Optional: Do not show the message of the day or update reminders.

Example:

ibmcloud oc cluster master satellite-service-endpoint allowlist get --cluster my-cluster
For more information about Kubernetes project version 1.21, see the [Kubernetes change log](https://relnotes.k8s.io/).



 Release timeline 

The following table includes the expected release timeline for version 1.21 of IBM Cloud® Kubernetes Service. You can use this information for planning purposes, such as to estimate the general time that the version might become unsupported.

Dates that are marked with a dagger (†) are tentative and subject to change.



Release timeline for IBM Cloud Kubernetes Service version 1.21

 Version Supported? IBM Cloud Kubernetes Service <br>release date IBM Cloud Kubernetes Service <br>unsupported date 

 1.21 Yes 09 June 2021 14 September 2022 







 Preparing to update 

This information summarizes updates that are likely to have and impact on deployed apps when you update a cluster to version 1.21. For a complete list of changes, review the [community Kubernetes change log](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.21.md) and [IBM version change log](https://cloud.ibm.com/docs/containers?topic=containers-changelog_121) for version 1.21. You can also review the [Kubernetes helpful warnings](https://kubernetes.io/blog/2020/09/03/warnings/).

There is a known issue when updating an existing classic cluster to version 1.21. If your classic cluster has both private and public service endpoints enabled, but you don't have both VRF and Service Endpoint enabled in your account, don't update to 1.21. For more information, see [After upgrading my classic cluster to version 1.21, I'm finding connectivity issues](https://cloud.ibm.com/docs/containers?topic=containers-ts-network-classic121).



 Update before master 

The following table shows the actions that you must take before you update the Kubernetes master.
To determine whether you can enable the private cloud service endpoint, see [Worker-to-master and user-to-master communication](https://cloud.ibm.com/docs/openshift?topic=openshift-plan_basicsworkeruser-master). Note that you can't disable the private cloud service endpoint after you enable it.



1. Enable [VRF](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpointvrf) in your IBM Cloud infrastructure account. To check whether a VRF is already enabled, use the ibmcloud account show command.
2. [Enable your IBM Cloud account to use service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpointservice-endpoint).
3. Enable the private cloud service endpoint.

ibmcloud oc cluster master private-service-endpoint enable --cluster <cluster_name_or_ID>
4. Refresh the Kubernetes master API server to use the private cloud service endpoint. You can follow the prompt in the CLI, or manually run the following command. It might take several minutes for the master to refresh.

ibmcloud oc cluster master refresh --cluster <cluster_name_or_ID>
5. [Create a configmap](https://cloud.ibm.com/docs/containers?topic=containers-updateworker-up-configmap) to control the maximum number of worker nodes that can be unavailable at a time in your cluster. When you update your worker nodes, the ConfigMap helps prevent downtime for your apps as the apps are rescheduled orderly onto available worker nodes.
6. Update all the worker nodes in your cluster to pick up the private cloud service endpoint configuration.

By issuing the update command, the worker nodes are reloaded to pick up the service endpoint configuration.