vania-janet/multiturn-rag-retrieval-data huggingface dataset:
endpoint instance job metrics_path namespace node persistentvolumeclaim prometheus service value
https-metrics 11.111.1.1:XX kubelet /metrics default 11.111.1.1 PVC-NAME openshift-monitoring/k8s kubelet 0.003596851526321722



For more information, see [Monitoring](https://docs.openshift.com/container-platform/4.11/monitoring/monitoring-overview.html).

If your volume is reaching capacity, try setting up [volume expansion](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-blockvpc-block-volume-expand).







 Forwarding cluster and app metrics to IBM Cloud Monitoring 

Use the Red Hat OpenShift on IBM Cloud observability plug-in to create a monitoring configuration for IBM Cloud Monitoring in your cluster, and use this monitoring configuration to automatically collect and forward metrics to IBM Cloud Monitoring.

With IBM Cloud Monitoring, you can collect cluster and pod metrics, such as the CPU and memory usage of your worker nodes, incoming and outgoing HTTP traffic for your pods, and data about several infrastructure components. In addition, the agent can collect custom application metrics by using either a Prometheus-compatible scraper or a statsd facade.

Considerations for using the Red Hat OpenShift on IBM Cloud observability plug-in:



* You can have only one monitoring configuration for IBM Cloud Monitoring in your cluster at a time. If you want to use a different IBM Cloud Monitoring service instance to send metrics to, use the [ibmcloud ob monitoring config replace](https://cloud.ibm.com/docs/containers?topic=containers-observability_climonitoring_config_replace) command.
* Red Hat OpenShift clusters in Satellite can't currently use the Red Hat OpenShift on IBM Cloud console or the observability plug-in CLI to enable monitoring for Satellite clusters. You must manually deploy monitoring agents to your cluster to forward metrics to Monitoring.
To follow an example CBR scenario, see [Setting up context-based restrictions](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr-tutorial).





 Allowing Red Hat OpenShift on IBM Cloud to access other IBM Cloud resources by using CBR 

You must add the containers-kubernetes to your network zones for rules created against the following services.

IAM Identity service
: Allow Red Hat OpenShift on IBM Cloud to create tokens and API Keys like the cluster API Key and the IBM Cloud Container Registry token and API Key.

IAM Access Management Service
: Allow Red Hat OpenShift on IBM Cloud to create an IAM Access Policy for Reader service access role to IBM Cloud Container Registry.

IAM Access Groups Service
: Allow Red Hat OpenShift on IBM Cloud to look up access groups when syncing IAM access policies with RBAC in the cluster.

User Management
: Allow Red Hat OpenShift on IBM Cloud to access user information when syncing IAM access policies with RBAC in the cluster.

IBM Cloud Object Storage
: Allow Red Hat OpenShift on IBM Cloud to back up the internal registry images in VPC clusters.

Key protect:
: Allow Red Hat OpenShift on IBM Cloud to enable encryption on the cluster.







 Creating network zones 

Network zones act as allowlists for the target resources you define when you create CBR rules. After you create a network zone, or allowlist, you can create rules that define which resources the network zone can access.

Make sure to add the containers-kubernetes service to your network zones for rules that apply to other IBM Cloud resources, such as a rule that protects IBM Cloud Object Storage or some cluster operations might fail. For more information, see [Allowing Red Hat OpenShift on IBM Cloud to access other IBM Cloud resources by using CBR](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr&interface=uicbr-integrations).

Review the [limitations](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr&interface=uicbr-limitations) before you create network zones.
To follow an example CBR scenario, see [Setting up context-based restrictions](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr-tutorial).





 Allowing Red Hat OpenShift on IBM Cloud to access other IBM Cloud resources by using CBR 

You must add the containers-kubernetes to your network zones for rules created against the following services.

IAM Identity service
: Allow Red Hat OpenShift on IBM Cloud to create tokens and API Keys like the cluster API Key and the IBM Cloud Container Registry token and API Key.

IAM Access Management Service
: Allow Red Hat OpenShift on IBM Cloud to create an IAM Access Policy for Reader service access role to IBM Cloud Container Registry.

IAM Access Groups Service
: Allow Red Hat OpenShift on IBM Cloud to look up access groups when syncing IAM access policies with RBAC in the cluster.

User Management
: Allow Red Hat OpenShift on IBM Cloud to access user information when syncing IAM access policies with RBAC in the cluster.

IBM Cloud Object Storage
: Allow Red Hat OpenShift on IBM Cloud to back up the internal registry images in VPC clusters.

Key protect:
: Allow Red Hat OpenShift on IBM Cloud to enable encryption on the cluster.







 Creating network zones 

Network zones act as allowlists for the target resources you define when you create CBR rules. After you create a network zone, or allowlist, you can create rules that define which resources the network zone can access.

Make sure to add the containers-kubernetes service to your network zones for rules that apply to other IBM Cloud resources, such as a rule that protects IBM Cloud Object Storage or some cluster operations might fail. For more information, see [Allowing Red Hat OpenShift on IBM Cloud to access other IBM Cloud resources by using CBR](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr&interface=clicbr-integrations).

Review the [limitations](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr&interface=clicbr-limitations) before you create network zones.
For more information about the corresponding RBAC roles that are assigned to a user and associated permissions, see [IBM Cloud IAM service access roles](https://cloud.ibm.com/docs/openshift?topic=openshift-iam-service-access-roles).
* Classic infrastructure: Enables access to your classic IBM Cloud infrastructure resources. Example actions that are permitted by classic infrastructure roles are viewing the details of cluster worker node machines or editing networking and storage resources.
* VPC infrastructure: Enables access to VPC infrastructure resources. Example actions that are permitted by VPC infrastructure roles are creating a VPC, adding subnets, changing floating IP addresses, and creating VPC Block Storage instances.



For more information about access control in a cluster, see [Assigning cluster access](https://cloud.ibm.com/docs/openshift?topic=openshift-users).

Admission controllers
: Admission controllers are implemented for specific features in Kubernetes and Red Hat OpenShift on IBM Cloud. With admission controllers, you can set up policies in your cluster that determine whether a particular action in the cluster is allowed or not. In the policy, you can specify conditions when a user can't perform an action, even if this action is part of the general permissions that you assigned the user by using RBAC roles. Therefore, admission controllers can provide an extra layer of security for your cluster before an API request is processed by the Red Hat OpenShift API server.

When you create a cluster, Red Hat OpenShift on IBM Cloud automatically installs the default [Kubernetes admission controllers](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/) in a particular order in the Red Hat OpenShift master, which can't be changed by the user. Review the order of default admission controllers by cluster version in the [kube-apiserver component reference information](https://cloud.ibm.com/docs/containers?topic=containers-service-settingskube-apiserver).
To follow an example CBR scenario, see [Setting up context-based restrictions](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr-tutorial).





 Allowing Red Hat OpenShift on IBM Cloud to access other IBM Cloud resources by using CBR 

You must add the containers-kubernetes to your network zones for rules created against the following services.

IAM Identity service
: Allow Red Hat OpenShift on IBM Cloud to create tokens and API Keys like the cluster API Key and the IBM Cloud Container Registry token and API Key.

IAM Access Management Service
: Allow Red Hat OpenShift on IBM Cloud to create an IAM Access Policy for Reader service access role to IBM Cloud Container Registry.

IAM Access Groups Service
: Allow Red Hat OpenShift on IBM Cloud to look up access groups when syncing IAM access policies with RBAC in the cluster.

User Management
: Allow Red Hat OpenShift on IBM Cloud to access user information when syncing IAM access policies with RBAC in the cluster.

IBM Cloud Object Storage
: Allow Red Hat OpenShift on IBM Cloud to back up the internal registry images in VPC clusters.

Key protect:
: Allow Red Hat OpenShift on IBM Cloud to enable encryption on the cluster.







 Creating network zones 

Network zones act as allowlists for the target resources you define when you create CBR rules. After you create a network zone, or allowlist, you can create rules that define which resources the network zone can access.

Make sure to add the containers-kubernetes service to your network zones for rules that apply to other IBM Cloud resources, such as a rule that protects IBM Cloud Object Storage or some cluster operations might fail. For more information, see [Allowing Red Hat OpenShift on IBM Cloud to access other IBM Cloud resources by using CBR](https://cloud.ibm.com/docs/openshift?topic=openshift-cbrcbr-integrations).

Review the [limitations](https://cloud.ibm.com/docs/openshift?topic=openshift-cbrcbr-limitations) before you create network zones.



 Creating network zones from the API
For more information, see [Checking your host set up](https://cloud.ibm.com/docs/satellite?topic=satellite-host-network-check).







 Planning your operating system 

Choose your operating system for your hosts. You can choose Red Hat Enterprise Linux or Red Hat CoreOS. If you want to use Red Hat CoreOS for your managed services, you must create and enable a location to use RHCOS hosts. See [Creating a Satellite location](https://cloud.ibm.com/docs/satellite?topic=satellite-locations).

The type of location that you create dictates the type of operating systems that can run on your hosts. If your location is RHCOS enabled, then you can attach hosts that are running either RHEL and RHCOS. If your location isn't RHCOS enabled, then you can attach only hosts that are running RHEL. You can check whether your [location is RHCOS enabled](https://cloud.ibm.com/docs/satellite?topic=satellite-locationsverify-coreos-location).

Red Hat Enterprise Linux 7 (RHEL 7)
: RHEL 7 is the default operating system supported for Satellite hosts on Red Hat OpenShift version 4.9 or earlier. Note that support for RHEL 7 hosts in your control plane ends on March 2nd, 2023. [Follow the steps](https://cloud.ibm.com/docs/satellite?topic=satellite-host-update-locationmigrate-cp-rhel8) to migrate your hosts to RHEL 8.

Red Hat Enterprise Linux 8 (RHEL 8)
: RHEL 8 is supported for Satellite hosts on Red Hat OpenShift version 4.9 or later and on infrastructure hosts. RHEL 8 is the recommended operating system and will become the default in the coming months.

Red Hat CoreOS (RHCOS)
: RHCOS is a minimal operating system for running containerized workloads securely and at scale. It is based on RHEL and includes automated, remote upgrade features.
* Compute resource limitation: To ensure that every team has the necessary resources to deploy services and run apps in the cluster, you must set up [resource quotas](https://kubernetes.io/docs/concepts/policy/resource-quotas/) for every namespace. Resource quotas determine the deployment constraints for a project, such as the number of Kubernetes resources that you can deploy, and the amount of CPU and memory that can be consumed by those resources. After you set a quota, users must include resource requests and limits in their deployments.
* Shared cluster resources: If you run multiple tenants in one cluster, some cluster resources, such as the Red Hat OpenShift router, Ingress application load balancer (ALB) or available portable IP addresses are shared across tenants. Smaller services might have a hard time using shared resources if they must compete against large services in the cluster.
* Updates: You can run one Red Hat OpenShift API version at a time only. All apps that run in a cluster must comply with the current Red Hat OpenShift API version independent of the team that owns the app. When you want to update a cluster, you must ensure that all teams are ready to switch to a new Red Hat OpenShift API version and that apps are updated accordingly. This also means that individual teams have less control over the Red Hat OpenShift API version they want to run.
* Changes in cluster setup: If you want to change the cluster setup or reschedule workloads onto new worker nodes, you must roll out this change across tenants. This roll out requires more reconciliation and testing than in a single-tenant cluster.
* Communication process: When you manage multiple tenants, consider setting up a communication process so that tenants know where to go when an issue with the cluster exists, or when they need more resources for their services. This communication process also includes informing your tenants about all changes in the cluster setup or planned updates.



Although single-tenant and multi-tenant clusters come with roughly the same costs, single-tenant clusters provide a higher level of isolation than the projects in a multi-tenant cluster. For better workload isolation, use single-tenant clusters.
Create a [Satellite-enabled IBM Cloud service](https://cloud.ibm.com/docs/satellite?topic=satellite-managed-services), such as a [Red Hat OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-satellite-clusters). You assign the additional hosts that you previously attached as worker nodes to provide the compute power for the cluster. You can even [register existing Red Hat OpenShift clusters to your location](https://cloud.ibm.com/docs/satellite?topic=satellite-register-openshift-clusters) to use as deployment targets.
3. [Manage your applications](https://cloud.ibm.com/docs/satellite?topic=satellite-cluster-config) with Satellite Config.
4. Create [Satellite cluster storage templates](https://cloud.ibm.com/docs/satellite?topic=satellite-storage-template-ov).
5. Learn more about the [Satellite Link component](https://cloud.ibm.com/docs/satellite?topic=satellite-link-location-cloud) and how you can use endpoints to manage the network traffic between your location and IBM Cloud.



Need help? Check out [Getting support](https://cloud.ibm.com/docs/satellite?topic=satellite-get-help) where you can find information about cloud status, issues, and logging; contacting support; and setting your email notification preferences for IBM Cloud platform-related items.
: See [Overview of potential points of failure in Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-hafault_domains).

Where is the service located?
: See [Locations](https://cloud.ibm.com/docs/openshift?topic=openshift-regions-and-zonesregions-and-zones).

What am I responsible to configure disaster recovery options for?
: See [Your responsibilities with using Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-responsibilities_iks).





 Overview of potential points of failure in Red Hat OpenShift on IBM Cloud 

The Red Hat OpenShift on IBM Cloud architecture and infrastructure is designed to ensure reliability, low processing latency, and a maximum uptime of the service. However, failures can happen. Depending on the service that you host in IBM Cloud, you might not be able to tolerate failures, even if failures last for only a few minutes.

Red Hat OpenShift on IBM Cloud provides several approaches to add more availability to your cluster by adding redundancy and anti-affinity. Review the following image to learn about potential points of failure and how to eliminate them.

Zoom

![Overview of fault domains in a high availability cluster within an IBM Cloud region.](https://cloud.ibm.com/docs-content/v1/content/bce0f0917a9eea684d1b4b704ac6343a1f65f446/openshift/images/ha-failure-ov.svg)

Figure 1. Overview of fault domains in a high availability cluster

Potential failure point 1: Container or pod availability
: Containers and pods are, by design, short-lived and can fail unexpectedly. For example, a container or pod might crash if an error occurs in your app. To make your app highly available, you must ensure that you have enough instances of your app to handle the workload plus additional instances in the case of a failure.
ibmcloud oc cluster create vpc-gen2 --name myvpc-cluster --zone us-south-1 --version 4.11_openshift --flavor bx2.4x16 --workers 2 [--operating-system (REDHAT_7_64|REDHAT_8_64)] --vpc-id <vpc_ID> --subnet-id <vpc_subnet_ID> --cos-instance <COS_CRN>
5. List your cluster details. Review the cluster State, check the Ingress Subdomain, and note the Master URL. Your cluster creation might take some time to complete. After the cluster state shows Normal, the cluster network and Ingress components take about 10 more minutes to deploy and update the cluster domain that you use for the Red Hat OpenShift web console and other routes. Before you continue, wait until the cluster is ready by checking that the Ingress Subdomain follows a pattern of <cluster_name>.<globally_unique_account_HASH>-0001.<region>.containers.appdomain.cloud.

ibmcloud oc cluster get --cluster myvpc-cluster
6. Add yourself as a user to the Red Hat OpenShift cluster by setting the cluster context.

ibmcloud oc cluster config --cluster myvpc-cluster --admin
7. In your browser, navigate to the address of your Master URL and append /console. For example, https://c0.containers.cloud.ibm.com:23652/console. If time permits, you can explore the different areas of the Red Hat OpenShift web console.
8. From the Red Hat OpenShift web console menu bar, click your profile IAM#user.name@email.com > Copy Login Command. Display and copy the oc login token command into your command line to authenticate via the CLI.

Save your cluster master URL to access the Red Hat OpenShift console later. In future sessions, you can skip the cluster config step and copy the login command from the console instead.
9.
* You cannot enable FAQ extraction when you add a web crawl data collection to the search skill.
* You cannot use the Activity Tracker service to track user actions for auditing purposes.
* The intent recommendations feature and the enhanced intent detection model are not supported.
* The Learning center and its associated product tours are not available.
* You cannot manage user access at the individual skill and assistant level. You can control only who can access the entire service instance, which includes all of its skills and assistants. For more information about granting access to services in IBM Cloud Pak for Data, see [3.5 Managing users](https://www.ibm.com/support/knowledgecenter/SSQNUZ_3.5.0/cpd/admin/users.html) or [3.0.1 Managing users](https://www.ibm.com/support/knowledgecenter/SSQNUZ_3.0.1/cpd/admin/users.html).







 19 June 2020 

IBM Watson® Assistant for IBM Cloud Pak® for Data 1.4.2 is available
: Watson Assistant for IBM Cloud Pak® for Data 1.4.2 is compatible with IBM Cloud Pak® for Data 3.0.1 on OpenShift Red Hat 3.11 or 4.5 and IBM Cloud Pak® for Data 2.5 deployments on OpenShift Red Hat 3.11. The 1.4.2 release is certified on Red Hat OpenShift 4.5.

Autocorrection support was added
: Autocorrection helps your assistant understand what your customers want. It corrects misspellings in the input that customers submit before the input is evaluated. With more precise input, your assistant can more easily recognize entity mentions and understand the customer's intent. This feature is not available in all languages. See [Correcting user input](https://cloud.ibm.com/docs/assistant-data?topic=assistant-data-dialog-runtime-spell-check) for more details.

French-language dialog skill improvements
: Added full support for fuzzy matching and contextual entities and added beta support for autocorrection.
For example, the GET zones list returns some results such as mon01 that are available only in the classic infrastructure provider, while other results such as us-south-01 are available only in the VPC infrastructure provider.

Cluster, worker node, and worker-pool responses
: v1 API: Responses include only information that is specific to the classic infrastructure provider, such as the VLANs in GET cluster and worker responses.
: v2 API: The information that is returned varies depending on the infrastructure provider. For such provider-specific responses, you can specify the provider in your request. For example, VPC clusters don't return VLAN information since they don't have VLANs. Instead, they return subnet and CIDR network information.





 Automating cluster deployments with the API 

You can use the Red Hat OpenShift on IBM Cloud API to automate the creation, deployment, and management of your Red Hat OpenShift clusters.

The Red Hat OpenShift on IBM Cloud API requires header information that you must provide in your API request and that can vary depending on the API that you want to use. To determine what header information is needed for your API, see the [Red Hat OpenShift on IBM Cloud API documentation](https://containers.cloud.ibm.com/global/swagger-global-api//).

To authenticate with Red Hat OpenShift on IBM Cloud, you must provide an IBM Cloud Identity and Access Management (IAM) token that is generated with your IBM Cloud credentials and that includes the IBM Cloud account ID where the cluster was created. Depending on the way you authenticate with IBM Cloud, you can choose between the following options to automate the creation of your IBM Cloud IAM token.

You can also use the [API swagger JSON file](https://containers.cloud.ibm.com/global/swagger-global-api/swagger.json) to generate a client that can interact with the API as part of your automation work.

Unfederated ID
: