vania-janet/multiturn-rag-retrieval-data huggingface dataset:
IBM Blockchain Platform offers an Ansible collection that includes the pertinent roles, modules, and documentation for rapidly deploying, replicating, and tearing down blockchain networks in a reproducible fashion.

The Ansible collection includes a set of playbooks that automate the tasks that you would otherwise perform from the console UI or by using the APIs, for example deploy a Certificate Authority (CA). But the playbooks are more robust than just that. The playbooks automate a logical series of tasks that you would repeatedly perform in the console, for example create a CA, register identities, create an organization MSP definition, and create a peer. And all of these steps can be performed by running a single playbook.

This tutorial series is designed for users who are unfamiliar with how to use Ansible playbooks. Experienced Ansible users can go directly to the collection [documentation](https://ibm-blockchain.github.io/ansible-collection/) to get started.





 How does the IBM Blockchain Platform Ansible collection work? 

The IBM Blockchain Platform Ansible collection uses the [IBM Blockchain Platform REST APIs](https://cloud.ibm.com/apidocs/blockchain). It includes an entire set of playbooks that can be used to deploy your peer, Certificate Authority (CA), and ordering service nodes, create organizations, identities, channels, and deploy smart contracts. And when you need to start over, there are scripts for tearing it all back down. These playbooks will run on your blockchain network that is running on IBM Cloud or on your own Kubernetes cluster where the IBM Blockchain Platform is installed.





 Why would I want to use an Ansible playbook? 

The Ansible playbooks include a set of modules that you can use to automate the deployment of your nodes, registering of identities, channel creation, and smart contracts installation and instantiation.



* Deploying your blockchain network After you deploy the IBM Blockchain Platform to a Kubernetes cluster on IBM Cloud, or on your supported Kubernetes distribution, there are three ways to build your network. To understand the benefit of using the Ansible playbooks, we compare the options:



1.
[Why does my cluster stay in a pending state?](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_cluster_pendingcs_cluster_pending)

[Why can't I view or work with my cluster?](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_cluster_accesscs_cluster_access)

[Why does my cluster master status say it is approaching its resource limit?](https://cloud.ibm.com/docs/openshift?topic=openshift-master_resource_limitmaster_resource_limit)

[Why can't I create a new admin certificate?](https://cloud.ibm.com/docs/openshift?topic=openshift-ts_admin-certts_admin-cert)





 Worker nodes 

[Debugging worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-debug_worker_nodesdebug_worker_nodes)



* [Check worker node notifications and maintenance updates](https://cloud.ibm.com/docs/openshift?topic=openshift-debug_worker_nodesworker-debug-notifs)
* [Quick steps to resolve worker node issues](https://cloud.ibm.com/docs/openshift?topic=openshift-debug_worker_nodesworker-debug-quick)
* [Debugging your worker node](https://cloud.ibm.com/docs/openshift?topic=openshift-debug_worker_nodesworker-debug-steps)



* [Step 1: Get the worker node state](https://cloud.ibm.com/docs/openshift?topic=openshift-debug_worker_nodesworker-debug-get-state)
How can I add my Code Engine job to an allowlist? 

Your Code Engine workload needs to access a protected resource. You need to create an allowlist for your Code Engine workload. How can you find the IP addresses that your Code Engine workload uses?

  Why it’s happening 

When you deploy your Code Engine app or job, the workload is deployed to a known list of possible network addresses, depending on the deployment region. You can add these IP addresses to an allowlist in your firewall; however, you must accept the drawbacks and risks that are involved in this action.



*  When Code Engine runs an application or job, it selects an arbitrary system from a large pool of systems for running the workload. Load conditions and system health influence the system selection. Systems are also dynamically added and removed from this pool without warning, making the list of potential network addresses large and dynamic. Your allowlist might not be stable and work reliably.
*  These network addresses are not exclusive to a single tenant and by granting access to these network addresses, you are also granting access for all other workloads, which might be owned by other tenants that are running on Code Engine.



  How to fix it 

Consider instead to send requests to a third-party proxy service. Proxy services provide static IP addresses that you can add to your allowlist. When you purchase a proxy service, you receive credentials for the proxy. Configure your workload to send all requests to the proxy by using the proxy credentials. The proxy service uses a unique, static IP address as the sender address when it forwards all requests to the target service. Because these IP addresses are static, they are stable to use in an allowlist.

If this scenario does not work for you and you want to accept the risks previously stated, you can list all egress IP addresses, both public and private that are used by Code Engine workloads in a specific project with the Code Engine API. For more information, see [List egress IP addresses](https://cloud.ibm.com/apidocs/codeengine/v2get-project-egress-ips).
How can I add my Code Engine app to an allowlist? 

Your Code Engine workload needs to access a protected resource. You need to create an allowlist for your Code Engine workload. How can you find the IP addresses that your Code Engine workload uses?

  Why it’s happening 

When you deploy your Code Engine app or job, the workload is deployed to a known list of possible network addresses, depending on the deployment region. You can add these IP addresses to an allowlist in your firewall; however, you must accept the drawbacks and risks that are involved in this action.



*  When Code Engine runs an application or job, it selects an arbitrary system from a large pool of systems for running the workload. Load conditions and system health influence the system selection. Systems are also dynamically added and removed from this pool without warning, making the list of potential network addresses large and dynamic. Your allowlist might not be stable and work reliably.
*  These network addresses are not exclusive to a single tenant and by granting access to these network addresses, you are also granting access for all other workloads, which might be owned by other tenants that are running on Code Engine.



  How to fix it 

Consider instead to send requests to a third-party proxy service. Proxy services provide static IP addresses that you can add to your allowlist. When you purchase a proxy service, you receive credentials for the proxy. Configure your workload to send all requests to the proxy by using the proxy credentials. The proxy service uses a unique, static IP address as the sender address when it forwards all requests to the target service. Because these IP addresses are static, they are stable to use in an allowlist.

If this scenario does not work for you and you want to accept the risks previously stated, you can list all egress IP addresses, both public and private that are used by Code Engine workloads in a specific project with the Code Engine API. For more information, see [List egress IP addresses](https://cloud.ibm.com/apidocs/codeengine/v2get-project-egress-ips).
[Why can't the cluster pull images from IBM Cloud Container Registry during creation?](https://cloud.ibm.com/docs/containers?topic=containers-ts_image_pull_createts_image_pull_create)

[Why do cluster master operations fail due to a broken webhook?](https://cloud.ibm.com/docs/containers?topic=containers-webhooks_updatewebhooks_update)

[Deleting webhooks from a cluster](https://cloud.ibm.com/docs/containers?topic=containers-ts-delete-webhooksts-delete-webhooks)

[Why is my Portieris cluster image security enforcement installation canceled?](https://cloud.ibm.com/docs/containers?topic=containers-portieris_enableportieris_enable)

[Why does my cluster stay in a pending state?](https://cloud.ibm.com/docs/containers?topic=containers-cs_cluster_pendingcs_cluster_pending)

[Why can't I view or work with my cluster?](https://cloud.ibm.com/docs/containers?topic=containers-cs_cluster_accesscs_cluster_access)

[Classic: Why can't I access resources in my cluster?](https://cloud.ibm.com/docs/containers?topic=containers-cs_firewallcs_firewall)

[Why doesn't the kubectl exec command automatically timeout?](https://cloud.ibm.com/docs/containers?topic=containers-ts-kubectl-exec-timeoutts-kubectl-exec-timeout)



* [Links to additional information](https://cloud.ibm.com/docs/containers?topic=containers-ts-kubectl-exec-timeoutadditional-link-info)



[Why does my cluster master status say it is approaching its resource limit?]
Why does PVC or pod creation fail due to not finding the Kubernetes secret? 

Virtual Private Cloud

Classic infrastructure

  What’s happening 

When you create your PVC or deploy a pod that mounts the PVC, the creation or deployment fails.

Example error message for a PVC creation failure.

can't get credentials: can't get secret tsecret-key: secrets "secret-key" not found

Example error message for a pod creation failure.

persistentvolumeclaim "pvc-3" not found (repeated 3 times)

  Why it’s happening 

The Kubernetes secret that you created is not referenced correctly in your deployment yaml or is not set to the ibm/ibmc-s3fs type.

  How to fix it 

This task requires [Writer or Manager IBM Cloud IAM service access role](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-perms) for all namespaces.



1.  List the secrets in your cluster and review the secret type. The secret must show ibm/ibmc-s3fs as the Type.

kubectl get secrets --all-namespaces
2.  If your secret does not show ibm/ibmc-s3fs as the Type, [re-create your secret](https://cloud.ibm.com/docs/containers?topic=containers-storage-cos-understandcreate_cos_secret).
3.  Check your YAML configuration file for your PVC and pod to verify that you used the correct secret.
* [FAQs for CDN](https://cloud.ibm.com/docs/CDN?topic=CDN-faqs)
* [FAQs for HTTPS](https://cloud.ibm.com/docs/CDN?topic=CDN-faq-for-https)
* [FAQs for rules and naming conventions](https://cloud.ibm.com/docs/CDN?topic=CDN-rules-and-naming-conventions)
* [FAQs for limits and maximum values](https://cloud.ibm.com/docs/CDN?topic=CDN-limits-and-maximum-values)
* Troubleshooting



* [How do I know that my CDN is working?](https://cloud.ibm.com/docs/CDN?topic=CDN-troubleshoot-cdn-working)
* [I received a 503 error message. Why?](https://cloud.ibm.com/docs/CDN?topic=CDN-troubleshoot-cdn-503-error)
* [Why doesn't my hostname load on the browser when IBM Cloud Object Storage (COS) is the origin?](https://cloud.ibm.com/docs/CDN?topic=CDN-troubleshoot-cdn-hostname-does-not-load)
* [Why can't I connect through a curl command or browser using the hostname with HTTPS?](https://cloud.ibm.com/docs/CDN?topic=CDN-troubleshoot-cdn-cannot-connect-https)
* [What is the expected behavior when loading the CNAME or hostname on your browser for the supported protocols?](https://cloud.ibm.com/docs/CDN?topic=CDN-troubleshoot-cdn-loading-cname-hostname)



* [Getting help and support for CDN](https://cloud.ibm.com/docs/CDN?topic=CDN-gettinghelp)
What permissions do I need to manage storage and create PVCs? 

Virtual Private Cloud

Classic infrastructure

 What’s happening 

When you create a PVC, the PVC remains pending. When you run oc describe pvc <pvc_name>, you see an error message similar to the following:

User doesn't have permissions to create or manage Storage

 Why it’s happening 

The IAM API key or the IBM Cloud infrastructure API key that is stored in the storage-secret-store Kubernetes secret of your cluster does not have all the required permissions to provision persistent storage.

 How to fix it 



1. Retrieve the IAM key or IBM Cloud infrastructure API key that is stored in the storage-secret-store Kubernetes secret of your cluster and verify that the correct API key is used.

oc get secret storage-secret-store -n kube-system -o yaml | grep slclient.toml: | awk '{print $2}' | base64 --decode

Example output

[Bluemix]
iam_url = "https://iam.bluemix.net"
iam_client_id = "bx"
iam_client_secret = "bx"
iam_api_key = "<iam_api_key>"
refresh_token = ""
pay_tier = "paid"
containers_api_route = "https://us-south.containers.bluemix.net"

[Softlayer]
encryption = true
softlayer_username = ""
softlayer_api_key = ""
softlayer_endpoint_url = "https://api.softlayer.com/rest/v3"
softlayer_iam_endpoint_url = "https://api.softlayer.com/mobile/v3"
softlayer_datacenter = "dal10"

The IAM API key is listed in the Bluemix.iam_api_key section of your CLI output.
What permissions do I need to manage storage and create PVCs? 

Virtual Private Cloud

Classic infrastructure

 What’s happening 

When you create a PVC, the PVC remains pending. When you run kubectl describe pvc <pvc_name>, you see an error message similar to the following:

User doesn't have permissions to create or manage Storage

 Why it’s happening 

The IAM API key or the IBM Cloud infrastructure API key that is stored in the storage-secret-store Kubernetes secret of your cluster does not have all the required permissions to provision persistent storage.

 How to fix it 



1. Retrieve the IAM key or IBM Cloud infrastructure API key that is stored in the storage-secret-store Kubernetes secret of your cluster and verify that the correct API key is used.

kubectl get secret storage-secret-store -n kube-system -o yaml | grep slclient.toml: | awk '{print $2}' | base64 --decode

Example output

[Bluemix]
iam_url = "https://iam.bluemix.net"
iam_client_id = "bx"
iam_client_secret = "bx"
iam_api_key = "<iam_api_key>"
refresh_token = ""
pay_tier = "paid"
containers_api_route = "https://us-south.containers.bluemix.net"

[Softlayer]
encryption = true
softlayer_username = ""
softlayer_api_key = ""
softlayer_endpoint_url = "https://api.softlayer.com/rest/v3"
softlayer_iam_endpoint_url = "https://api.softlayer.com/mobile/v3"
softlayer_datacenter = "dal10"

The IAM API key is listed in the Bluemix.iam_api_key section of your CLI output.
* [Checking whether your PVC is successfully provisioned.](https://cloud.ibm.com/docs/containers?topic=containers-debug_storage_filedebug_storage_file_pvc)
* [Checking and updating the kubectl CLI version](https://cloud.ibm.com/docs/containers?topic=containers-debug_storage_filedebug_storage_file_cli)



[What permissions do I need to manage storage and create PVCs?](https://cloud.ibm.com/docs/containers?topic=containers-missing_permissionsmissing_permissions)

[File storage and block storage: Why does my PVC remain in a pending state?](https://cloud.ibm.com/docs/containers?topic=containers-file_pvc_pendingfile_pvc_pending)

[Why can't my app access or write to PVCs?](https://cloud.ibm.com/docs/containers?topic=containers-file_app_failuresfile_app_failures)

[Why does my app fail with a group ID error for NFS file storage permissions?](https://cloud.ibm.com/docs/containers?topic=containers-rootroot)

[Why does my app fail when a non-root user owns the NFS file storage mount path?](https://cloud.ibm.com/docs/containers?topic=containers-nonrootnonroot)

[Why can't I add non-root user access to persistent storage?](https://cloud.ibm.com/docs/containers?topic=containers-cs_storage_nonrootcs_storage_nonroot)



* [Verifying the read and write permissions for the non-root user](https://cloud.ibm.com/docs/containers?topic=containers-cs_storage_nonrootverify-rw-permissions)



[Why are the file systems for worker nodes changed to read-only?]
Why do I see wrong s3fs or IAM API endpoints when I create a PVC? 

Virtual Private Cloud

Classic infrastructure

 What’s happening 

When you create the PVC, the PVC remains in a pending state. After you run the kubectl describe pvc <pvc_name> command, you see one of the following error messages:

Bad value for ibm.io/object-store-endpoint XXXX: scheme is missing. Must be of the form http://<hostname> or https://<hostname>

Bad value for ibm.io/iam-endpoint XXXX: scheme is missing. Must be of the form http://<hostname> or https://<hostname>

 Why it’s happening 

The s3fs API endpoint for the bucket that you want to use might have the wrong format, or your cluster is deployed in a location that is supported in IBM Cloud Kubernetes Service but is not yet supported by the IBM Cloud Object Storage plug-in.

 How to fix it 

Complete the following steps:



1. Check the s3fs API endpoint that was automatically assigned by the ibmc Helm plug-in to your storage classes during the IBM Cloud Object Storage plug-in installation. The endpoint is based on the location that your cluster is deployed to.

kubectl get sc ibmc-s3fs-standard-regional -o yaml | grep object-store-endpoint

If the command returns ibm.io/object-store-endpoint: NA, your cluster is deployed in a location that is supported in IBM Cloud Kubernetes Service but is not yet supported by the IBM Cloud Object Storage plug-in. To add the location to the IBM Cloud Kubernetes Service, post a question in our public Slack or open an IBM Cloud support case. For more information, see [Getting help and support](https://cloud.ibm.com/docs/containers?topic=containers-getting_help_storage).
2.
Why can't I log in with my MFA factors? 

You are required to use an authentication factor, in addition to your username and password, to securely log in to IBM Cloud® if at least one account that you are a member of enables MFA. You can update or reset your authentication methods if the email address or phone number that you use to authenticate changes or becomes inaccessible by going to the [Verification methods and authentication factors](https://iam.cloud.ibm.com/mysecurity) page.

  What’s happening 

When I try to log in with an authentication factor, the following error message is displayed:

> Error: Incorrect validation code.

  Why it’s happening 

One or more of the authentication factors that you use are inaccessible. For example, if one of your authentication factors sends you a one-time passcode by way of SMS, but you changed your phone number, then you need to reset your MFA factors.

  How to fix it 



1.  Go to the [Verification methods and authentication factors](https://iam.cloud.ibm.com/mysecurity) page.
2.  Validate your identity with two different verification methods.
3.  Click Show accounts.
4.  Take note of the Authentication setting for each account.



1.  If the account uses MFA for IBMid users, work with the [IBMid help desk](https://www.ibm.com/ibmid/myibm/help/us/helpdesk.html) to reset your authentication factors.
2.  If the account uses MFA for All users, you can reset your authentication factors on the Verification methods and authentication factors page.





For more information, see [Managing verification methods and MFA factors](https://cloud.ibm.com/docs/account?topic=account-verification-authentication).
Yes, they are listed in [Known limitations](https://cloud.ibm.com/docs/dl?topic=dl-known-limitations&interface=ui).





 How do I move from IBM Cloud Direct Link on Classic to the new Direct Link? 

Direct Link has a new user interface and records system, requiring you to place a brand new Direct Link order.





 Are there any performance impacts affected by moving from IBM Cloud Direct Link on Classic? 

The new Direct Link performs better as it's not required to exist inside your global VRF for classic IaaS. It is a true access platform to all of IBM Cloud.





 What are the tools for monitoring the consumption of resources associated with the service, as well as the costs and the quality of the service? 

IBM Cloud Direct Link is integrated into the [IBM Cloud usage dashboard](https://cloud.ibm.com/docs/billing-usage?topic=billing-usage-viewingusage), which provides a summary of estimated charges for all services and resources that are used per month in your organizations. This includes the number of connections and the amount of traffic flowing across your direct links. IBM Cloud Direct Link usage is billed and reported as part of the [IBM Cloud invoice process](https://cloud.ibm.com/docs/billing-usage?topic=billing-usage-managing-invoices).





 How does IBM Cloud Direct Link work? 

For every Direct Link customer, the IBM Cloud® team assigns a small private subnet to build a point-to-point network between the IBM Cloud cross-connect router (XCR) and your Edge router. Then, you and IBM Cloud configure the Border Gateway Protocol (BGP) to exchange routes between the environments. Finally, IBM Cloud places you into a VRF to allow for the implementation of non-unique routes to the private address space of your remote network.





 If I order a direct link with local routing, is it possible to upgrade and switch to global routing later? 

Yes, you can change the routing option any time after creating the gateway. To do so, click Actions on the gateway's details page and then click Edit. This is not a disruptive change.





 How can I achieve redundancy with Direct Link?
When you use a role binding to apply a cluster role, you give a user access to namespace-scoped resources that can be found in each namespace, like pods, but only within a specific namespace.

Cluster role bindings apply RBAC cluster roles to all namespaces in the cluster. When you use a cluster role binding to apply a cluster role, you give a user access to cluster-wide resources, like worker nodes, or to namespace-scoped resources in every namespace, like pods.





 What do these roles look like in my cluster? 

If you want users to be able to interact with Kubernetes resources from within a cluster, you must assign user access to one or more namespaces through [IBM Cloud IAM service access roles](https://cloud.ibm.com/docs/containers?topic=containers-usersadd_users). Every user who is assigned a service access role is automatically assigned a corresponding RBAC cluster role. These RBAC cluster roles are predefined and permit users to interact with Kubernetes resources in your cluster. Additionally, a role binding is created to apply the cluster role to a specific namespace, or a cluster role binding is created to apply the cluster role to all namespaces.

To learn more about the actions permitted by each RBAC role, check out the [IBM Cloud IAM service access roles](https://cloud.ibm.com/docs/containers?topic=containers-iam-service-access-roles) reference topic. To see the permissions that are granted by each RBAC role to individual Kubernetes resources, check out [Kubernetes resource permissions per RBAC role](https://cloud.ibm.com/docs/containers?topic=containers-iam-service-access-rolesrbac_ref).





 Can I create custom roles or cluster roles? 

The view, edit, admin, and cluster-admin cluster roles are predefined roles that are automatically created when you assign a user the corresponding IBM Cloud IAM service access role. To grant other Kubernetes permissions, you can [create custom RBAC permissions](https://cloud.ibm.com/docs/containers?topic=containers-usersrbac).