vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* [Creating intermediate certificate authorities](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-intermediate-certificate-authorities)
* [Adding certificate templates](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-certificate-templates)
* [Creating private certificates](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-certificatescreate-certificates)



New Secrets Manager event notifications
: The following Secrets Manager events can now be forwarded to a connected Event Notifications instance.



* secret_deleted: Currently supported for imported certificates, private certificates, and public certificates.
* secret_revoked: Currently supported for private certificates only.



For more information about using Event Notifications to enable lifecycle notifications for your Secrets Manager instance, see [Enabling event notifications](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-event-notifications).

CLI plug-in version 1.1.18
: Version 1.1.18 of the Secrets Manager CLI is now available for download. To learn about the latest updates, see the [CLI change log](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-cli-change-log).





 11 April 2022 

Integrations with Kubernetes Service and Red Hat OpenShift on IBM Cloud
: You can now use Secrets Manager to centrally manage Ingress subdomain certificates and other secrets for your Kubernetes or Red Hat OpenShift on IBM Cloud clusters. To learn more about this integration, check out the [Kubernetes Service](https://cloud.ibm.com/docs/containers?topic=containers-ingress-types) or [Red Hat OpenShift on IBM Cloud documentation](https://cloud.ibm.com/docs/openshift?topic=openshift-ingress-roks4).





 23 March 2022 

Standard and Trial pricing plans
: You can now create an unlimited number of Secrets Manager service instances by choosing the Standard pricing plan.
Log in with your IBMid and copy the passcode.
4. Log in to your cluster with the passcode.

oc login -u passcode -p <iam_passcode> --server=https://<VPE_URL>:<port_from_the_master_URL>

The login procedure will notify that certificate signed by an unknown authority as it is a self-signed certificate generated by IBM.





3. Verify that the oc commands run properly with your cluster through the private cloud service endpoint by checking the version.

oc version

Example output

Client Version: 4.5.0-0.okd-2020-09-04-180756
Server Version: 4.5.35
Kubernetes Version: v1.18.3+cdb0358







 Accessing clusters from automation tools by using an API key 

Red Hat OpenShift on IBM Cloud is integrated with IBM Cloud Identity and Access Management (IAM). With IAM, you can authenticate users and services by using their IAM identities and authorize actions with access roles and policies. When you authenticate as a user through the Red Hat OpenShift console, your IAM identity is used to generate a Red Hat OpenShift login token that you can use to log in to the command line. You can automate logging in to your cluster by creating an IAM API key or service ID to use for the oc login command.



 Using an API key to log in to clusters 

You can create an IBM Cloud IAM API key and then use the API key to log in to a Red Hat OpenShift cluster. With API keys, you can use the credentials of one user or shared account to access a cluster, instead of logging in individually. You might also create an API key for a [service ID](https://cloud.ibm.com/docs/openshift?topic=openshift-access_clusteraccess_service_id). For more information, see [Understanding API keys](https://cloud.ibm.com/docs/account?topic=account-manapikey).



1. Create an IBM Cloud API key.
However, you can always [bring your own](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-deploy-custom-image) custom AIX, IBM i or Linux image that you have tested and deployed.





 Support for SAP NetWeaver or SAP HANA applications 

When you provision a Power Systems Virtual Server instance to support SAP NetWeaver applications, select a version of the IBM-provided AIX or Linux stock operating system image. When you provision a Power Systems Virtual Server instance to support the SAP HANA applications, select a version of the IBM provided Linux® stock image. IBM i operating system and custom AIX and Linux images are not supported for SAP workloads. For information about the supported operating system versions, see [FAQ](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-power-iaas-faqs). For more information, see [Deploying your infrastructure](https://cloud.ibm.com/docs/sap?topic=sap-power-vs-planning-items).

When provisioning a Power Systems Virtual Server to support SAP NetWeaver applications, select a version of the IBM-provided AIX operating system stock image. IBM i and operating system custom images are not supported for SAP workloads at this time.





 Support for deploying a Red Hat OpenShift Cluster 

When you provision a Red Hat OpenShift Cluster on Power Systems Virtual Server, it is easier to use the IBM™ provided automation to create the entire cluster of servers and install Red Hat OpenShift rather than individually provisioning Power Systems Virtual Server instances. For instructions to deploy a Red Hat OpenShift Cluster on Power Systems Virtual Server, including preparation of the required Operation System images for the cluster, see [Deploying Red Hat OpenShift Container Platform 4.x on IBM Power Systems Virtual Servers](https://developer.ibm.com/components/ibm-power/series/deploy-ocp-cloud-paks-power-virtual-server/).







 Hardware specifications
[Onboarding a Certified Operator from a Red Hat registry](https://cloud.ibm.com/docs/account?topic=account-catalog-opbundle-tutorial)Onboarding a Certified Operator from a Red Hat registry

This tutorial walks you through how to onboard a sample Operator bundle from a Red Hat® registry to your account. By completing this tutorial, you learn how to create a private catalog in your account, import the Operator bundle, and validate that it can be installed on a Red Hat OpenShift on IBM Cloud cluster.

Container Registry Managing your account, resources, and access



* 45 minutes
* 2022-10-26



[Onboarding an Operator from a GitHub repository](https://cloud.ibm.com/docs/account?topic=account-catalog-operator-gh)Onboarding an Operator from a GitHub repository

This tutorial walks you through how to onboard a sample Operator from a GitHub repository to your account. You can onboard an Operator bundle using a TGZ file or an Operator using a CSV file. By completing this tutorial, you learn how to create a private catalog, import your CSV or TGZ file, validate that it can be installed on a Red Hat OpenShift cluster, and make the Operator available to users who have access to your account.

Container Registry Managing your account, resources, and access



* 45 minutes
* 2022-10-26



[Onboarding your Operator bundle](https://cloud.ibm.com/docs/sell?topic=sell-bundle-onboard)Onboarding your Operator bundle

This tutorial walks you through how to onboard a Certified Operator bundle from a Red Hat registry. By completing this tutorial, you learn how to import the Red Hat OpenShift on IBM Cloud Operator bundle, configure the deployment, license, and other details, and validate that the Operator bundle can be installed on a cluster.

Container Registry Selling on IBM Cloud



* 45 minutes
* 2023-03-31



[Onboarding your Operator](https://cloud.ibm.com/docs/sell?topic=sell-operator-onboard)Onboarding your Operator
You can find more information on the [IBM Cloud File storage page](https://cloud.ibm.com/docs/containers?topic=containers-file_storagefile_storage). For a complete list of storage options, see [Persistent storage considerations](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-v2-deploy-iksibp-console-storage)
* Do I need multizone region storage for IBM Blockchain Platform nodes?

No. When the IBM Blockchain Platform is configured with a multizone cluster in IBM Cloud Kubernetes service, you can choose which zone a particular component (peer or ordering node) is deployed to, or you can let the console decide. Then, when the node is subsequently deployed, Kubernetes "pins" the associated pod to the chosen zone. Pinning means that Kubernetes will not provision the pod in another zone in the event of a whole zone failure. And because the pods are pinned to specific zones, there is no need to access the same storage from another zone. Therefore, MZR storage is not required for IBM Blockchain Platform nodes.
* What versions of Red Hat OpenShift are supported?

Currently, IBM Blockchain Platform for IBM Cloud supports linking to Red Hat OpenShift Container Platform 4.5, 4.6 and 4.7 clusters.
* Is there a trial option available for using a Red Hat OpenShift cluster on IBM Cloud?

A free 30 day trial is available in the [Red Hat Marketplace.](https://marketplace.redhat.com/en-us/products/ibm-blockchain). See [Deploy from Red Hat Marketplace](https://cloud.ibm.com/docs/blockchain-sw-254?topic=blockchain-sw-254-deploy-ocp-rhm) to learn more.
* Is it possible to deploy blockchain nodes to multiple clouds from a single blockchain console?

You cannot currently deploy blockchain nodes to multiple hosted cloud providers. However, you can use your console to operate a distributed multicloud network by importing nodes deployed by using consoles on other clouds.
You can find more information on the [IBM Cloud File storage page](https://cloud.ibm.com/docs/containers?topic=containers-file_storagefile_storage). For a complete list of storage options, see [Persistent storage considerations](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-v2-deploy-iksibp-console-storage)
* Do I need multizone region storage for IBM Blockchain Platform nodes?

No. When the IBM Blockchain Platform is configured with a multizone cluster in IBM Cloud Kubernetes service, you can choose which zone a particular component (peer or ordering node) is deployed to, or you can let the console decide. Then, when the node is subsequently deployed, Kubernetes "pins" the associated pod to the chosen zone. Pinning means that Kubernetes will not provision the pod in another zone in the event of a whole zone failure. And because the pods are pinned to specific zones, there is no need to access the same storage from another zone. Therefore, MZR storage is not required for IBM Blockchain Platform nodes.
* What versions of Red Hat OpenShift are supported?

Currently, IBM Blockchain Platform for IBM Cloud supports linking to Red Hat OpenShift Container Platform 4.5, 4.6 and 4.7 clusters.
* Is there a trial option available for using a Red Hat OpenShift cluster on IBM Cloud?

A free 30 day trial is available in the [Red Hat Marketplace.](https://marketplace.redhat.com/en-us/products/ibm-blockchain). See [Deploy from Red Hat Marketplace](https://cloud.ibm.com/docs/blockchain-sw-252?topic=blockchain-sw-252-deploy-ocp-rhm) to learn more.
* Is it possible to deploy blockchain nodes to multiple clouds from a single blockchain console?

You cannot currently deploy blockchain nodes to multiple hosted cloud providers. However, you can use your console to operate a distributed multicloud network by importing nodes deployed by using consoles on other clouds.
Operational monitoring 

Operational monitoring for gauging system health is a important complement to [monitoring for security and compliance](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-monitoring-compliance). Proper operational monitoring can help you determine whether you need to fail over to an alternative storage or processing site. In addition, operational monitoring can help you determine whether operations have returned to normal after a system disruption. Operational metrics include measurements for CPU usage, memory usage, or API response times.

Since IBM Cloud Monitoring is not Financial Services Validated, the next two sections describe "bring your own" software solutions for Red Hat OpenShift on IBM Cloud and Virtual Servers for VPC.

Generally speaking, you should strive to use only services which are Financial Services Validated in your solutions. However, depending on your circumstance there may be exceptions. See the best practice [Use only services that are IBM Cloud for Financial Services Validated](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practicesbest-practices-financial-services-validated-services) for more details and potential exceptions.



 Red Hat OpenShift on IBM Cloud 

You need to install your own software solution for monitoring in Red Hat OpenShift on IBM Cloud within your own VPC. There are various ways an operational monitoring solution can be implemented. See [Setting up an operational monitoring solution](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-monitoring-operational-tutorial) for one example that uses Red Hat OpenShift on IBM Cloud [Prometheus and Grafana](https://docs.openshift.com/container-platform/4.5/monitoring/cluster_monitoring/about-cluster-monitoring.html).





 Virtual Servers for VPC 

You need to install your own software solution for monitoring in virtual server instances.
Now that your Satellite location is set up, you are ready to start using IBM Cloud services.



1. Add compute capacity to your location by [attaching more hosts to the location](https://cloud.ibm.com/docs/satellite?topic=satellite-attach-hosts) so that you can run [Satellite-enabled IBM Cloud service](https://cloud.ibm.com/docs/satellite?topic=satellite-managed-services).
2. Create a [Satellite-enabled IBM Cloud service](https://cloud.ibm.com/docs/satellite?topic=satellite-managed-services), such as a [Red Hat OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-satellite-clusters). You assign the additional hosts that you previously attached as worker nodes to provide the compute power for the cluster. You can even [register existing Red Hat OpenShift clusters to your location](https://cloud.ibm.com/docs/satellite?topic=satellite-register-openshift-clusters) to use as deployment targets.
3. [Manage your applications](https://cloud.ibm.com/docs/satellite?topic=satellite-cluster-config) with Satellite Config.
4. Create [Satellite cluster storage templates](https://cloud.ibm.com/docs/satellite?topic=satellite-storage-template-ov).
5. Learn more about the [Satellite Link component](https://cloud.ibm.com/docs/satellite?topic=satellite-link-location-cloud) and how you can use endpoints to manage the network traffic between your location and IBM Cloud.



Need help? Check out [Getting support](https://cloud.ibm.com/docs/satellite?topic=satellite-get-help) where you can find information about cloud status, issues, and logging; contacting support; and setting your email notification preferences for IBM Cloud platform-related items.
Setting up an operational monitoring solution 

This tutorial shows you one way that can be used to meet the IBM Cloud Framework for Financial Services requirements that are related to [operational monitoring](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-monitoring-operational-tutorial) by using [Prometheus and Grafana](https://docs.openshift.com/container-platform/4.5/monitoring/cluster_monitoring/about-cluster-monitoring.html) on Red Hat OpenShift on IBM Cloud. This approach can be used to can gain insight into the health and performance of the provisioned infrastructure and the workloads that are running on the infrastructure -- all while keeping your monitoring data safe within your environment.

We provide guidance here, but you are solely responsible for installing, configuring, and operating IBM third-party software in a way that satisfies IBM Cloud Framework for Financial Services requirements. In addition, IBM does not provide support for third-party software.



 Monitoring solution architecture 

The architecture diagram shows a monitoring deployment within a Red Hat OpenShift on IBM Cloud cluster for a single region. The architecture enables gathering metrics for Red Hat OpenShift on IBM Cloud applications and virtual server instances within your VPCs. The label "Prom" in the workload clusters represents Prometheus.

Zoom

![IBM Cloud for Financial Services reference architecture with operational monitoring](https://cloud.ibm.com/docs-content/v1/content/9ac5c38b41e0aa1cb4ccc6cc7f547751ec805221/framework-financial-services/vpc/images/logmon/roks-single-region-log-mon.svg)

Figure 1. Single-region IBM Cloud for Financial Services reference architecture with operational monitoring

When you configure Red Hat OpenShift on IBM Cloud for both operational logging and operational monitoring, the worker nodes can be shared. You can use the same worker pool for both logging and monitoring. You can use the same taint tag to steer monitoring and logging pods to the shared worker pool.
After you log in with your user ID and password, the IBM Cloud Dashboard opens.
2. From the menu ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg), select Observability.
3. Select Monitoring. The list of instances that are available on IBM Cloud is displayed.
4. Find your instance and click Open dashboard. The web UI opens.



It may take some time before you see the cluster entry while the information is initally collected and processed by the monitoring agent.

You only can monitor one instance per browser. You could have multiple tabs for the same instance.





 Step 4: Step 4. Monitor your cluster 

In the Advisor tab, you can monitor and troubleshoot the health, risk, and capacity of hosts, and Kubernetes and Red Hat OpenShift clusters.

Zoom

![Advisor tab](https://cloud.ibm.com/docs-content/v1/content/220cdcbf6f4421bd7fee83fd1028048dba3f16c8/monitoring/images/advisor-tab.png)

Advisor tab



* Data is refreshed every 10 minutes.
* Metrics are prioritized by event count and severity.
* For more information, see [Advisor](https://docs.sysdig.com/en/docs/sysdig-monitor/advisor/).



In the Advisor section, you can choose to monitor your Red Hat OpenShift clusters by cluster, by node, by namespace, or by workload. Each option offers a set of predefined dashboards that you can use to monitor the health of your resources. You can also select to monitor by host.



 Monitoring Red Hat OpenShift clusters by cluster 

When you choose to monitor your clusters by cluster, you can select more filters to display data by node or by namespace, or you can choose any of the following dashboards:



* Workload Status & Performance
* Node Status & Performance
* Pod Rightsizing & Workload Capacity Optimization
: You can [install the cluster autoscaler](https://cloud.ibm.com/docs/openshift?topic=openshift-cluster-scaling-classic-vpc) Helm chart on Red Hat OpenShift clusters with Helm Tiller version 2.12 or later.

Let's Encrypt rate limits for Ingress
: Added troubleshooting steps for when no subdomain or secret is generated for the Ingress ALB when you create or delete clusters of the same name.

Version change logs
: Worker node patch updates are available for Kubernetes [1.15.4_1519](https://cloud.ibm.com/docs/containers?topic=containers-115_changelog1154_1519_worker), [1.14.7_1535](https://cloud.ibm.com/docs/containers?topic=containers-114_changelog1147_1535_worker), [1.13.11_1538](https://cloud.ibm.com/docs/containers?topic=containers-113_changelog11311_1538_worker), [1.12.10_1569](https://cloud.ibm.com/docs/containers?topic=containers-112_changelog11210_1569_worker), and Red Hat OpenShift [3.11.146_1527_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_changelog_311311146_1527).





 4 October 2019 

Version change log
: Master fix pack updates are available for Red Hat OpenShift [3.11.146_1526_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_changelog_311311146_1526).

Software-defined storage with Portworx
: You can now install Portworx on your Red Hat OpenShift cluster as a highly available data management platform for your containerized apps.
In IBM Cloud IAM, you can assign user access roles to resource instances, Kubernetes namespaces (projects in Red Hat OpenShift), or resource groups.

When you create your IBM Cloud account, the default resource group is created automatically. If you don't specify a resource group when you create the resource, resource instances (clusters) automatically belong to the default resource group. In IBM Cloud IAM, a Kubernetes namespace is a resource type of a resource instance (cluster). If you want to add a resource group in your account, see [Best practices for setting up your account](https://cloud.ibm.com/docs/account?topic=account-account_setup) and [Setting up your resource groups](https://cloud.ibm.com/docs/account?topic=account-rgs).

Resource instance
: Each IBM Cloud service in your account is a resource that has instances. The instance differs by service. For example, in Red Hat OpenShift on IBM Cloud, the instance is a cluster. By default, resources belong to the default resource group in your account. You can assign users an access role to a resource instance to grant permissions as described in the following scenarios.



* All IBM Cloud IAM services in your account, including all clusters in Red Hat OpenShift on IBM Cloud and images in IBM Cloud Container Registry.
* All instances within a service, such as all the clusters in Red Hat OpenShift on IBM Cloud.
* All instances within a region of a service, such as all the clusters in the US South region of Red Hat OpenShift on IBM Cloud.
* To an individual instance, such as one cluster.



Kubernetes namespace (projects in Red Hat OpenShift)
: As part of cluster resource instances in IBM Cloud IAM, you can assign users with service access roles to namespaces within your clusters. When you assign access to a namespace, the policy applies to all current and future instances of the namespace in all the clusters that you authorize. For example, say that you want a dev group of users to be able to deploy Kubernetes resources in a test namespace in all your clusters in AP North.
httpHeaderName1: 'Authorization'
timeInterval: 5s
tlsSkipVerify: true
name: Prometheus
secureJsonData:
httpHeaderValue1: 'Bearer <BEARER_TOKEN>'
type: prometheus
url: 'https://thanos-querier.openshift-monitoring.svc.cluster.local:9091'
name: prometheus-datasource.yaml
Show more

You can add another Prometheus for your Red Hat OpenShift on IBM Cloud cluster by including it in the data sources list. You must create a grafana-serviceaccount service account within the Red Hat OpenShift on IBM Cloud cluster that you want to connect to and grant the cluster role privileges. Then, you can generate a bearer token.

4. Create [Grafana Dashboard resources](https://github.com/integr8ly/grafana-operator/blob/v3.10.1/documentation/dashboards.md). You can also import existing dashboards by using the JSON.









 Related controls in IBM Cloud Framework for Financial Services 

See the [related controls for operational monitoring](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-monitoring-operational).