vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Note that no public gateway is required on your VPC subnet to allow public requests to your VPC ALB. However, if your app must access a public URL, you must attach public gateways to the VPC subnets that your worker nodes are connected to.
* If you create a private Kubernetes LoadBalancer service, your app is accessible only to systems that are connected to your private subnets within the same region and VPC. If you are connected to your private VPC network, you can access your app through the hostname that is assigned by the VPC ALB to the Kubernetes LoadBalancer service in the format 1234abcd-<region>.lb.appdomain.cloud.



The following diagram illustrates how a user accesses an app from the internet through the VPC ALB.

Zoom

![Load balancing for a cluster through the VPC ALB.](https://cloud.ibm.com/docs-content/v1/content/bce0f0917a9eea684d1b4b704ac6343a1f65f446/openshift/images/vpc-alb-mz.svg)

Figure 2. Load balancing for a cluster through the VPC ALB



1. A request to your app uses the hostname that is assigned to the Kubernetes LoadBalancer service by the VPC ALB, such as 1234abcd-<region>.lb.appdomain.cloud.
2. The request is automatically forwarded by the VPC ALB to one of the node ports on the worker node, and then to the private IP address of the app pod.
3. If app instances are deployed to multiple worker nodes in the cluster, the load balancer routes the requests between the app pods on various worker nodes. Additionally, if you have a multizone cluster, the VPC ALB routes requests to worker nodes across all subnets and zones in your cluster.







 Setting up a Network Load Balancer for VPC
: Required: The zone that you want to add. It must be a VPC zone within the cluster's region. To see available VPC zones, run ibmcloud oc zone ls --provider vpc-gen2.

--subnet-id SUBNET_ID
: Required: The ID of the subnet that you want to add. The VPC subnet must be within the zone that you specify. To see available VPC subnets, run ibmcloud oc subnets --provider vpc-gen2 --vpc-id <vpc> --zone <vpc_zone>. VPC subnets provide IP addresses for your worker nodes and load balancer services in the cluster, so use a [VPC subnet with enough IP addresses](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-subnetsvpc_basics_subnets), such as 256.

-c, --cluster CLUSTER
: Required: The name or ID of the cluster. To list VPC clusters, run ibmcloud oc cluster ls --provider vpc-gen2.

-p, --worker-pool WORKER_POOL
: The name of the worker pool to add the zone to. To specify multiple worker pools, use multiple options, such as -p pool1 -p pool2.

--output json
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.



 Example zone add vpc-gen2 command 

ibmcloud oc zone add vpc-gen2 --zone us-south-3 --cluster my_cluster -p pool1 -w pool2







 ibmcloud oc zone ls 

Virtual Private Cloud

Classic infrastructure

Satellite

View a list of available zones that you can create a cluster in.

The locations alias for this command is deprecated.

ibmcloud oc zone ls --provider (classic | satellite | vpc-gen2) [--location LOCATION] [--region-only] [--output json] [-q]
Note that no public gateway is required on your VPC subnet to allow public requests to your VPC ALB. However, if your app must access a public URL, you must attach public gateways to the VPC subnets that your worker nodes are connected to.
* If you create a private Kubernetes LoadBalancer service, your app is accessible only to systems that are connected to your private subnets within the same region and VPC. If you are connected to your private VPC network, you can access your app through the hostname that is assigned by the VPC ALB to the Kubernetes LoadBalancer service in the format 1234abcd-<region>.lb.appdomain.cloud.



The following diagram illustrates how a user accesses an app from the internet through the VPC ALB.

Zoom

![Load balancing for a cluster through the VPC ALB.](https://cloud.ibm.com/docs-content/v1/content/4d497aff9e27b92fbbc2ee4e343a9ec4549cb1d7/containers/images/vpc-alb-mz.svg)

Figure 2. Load balancing for a cluster through the VPC ALB



1. A request to your app uses the hostname that is assigned to the Kubernetes LoadBalancer service by the VPC ALB, such as 1234abcd-<region>.lb.appdomain.cloud.
2. The request is automatically forwarded by the VPC ALB to one of the node ports on the worker node, and then to the private IP address of the app pod.
3. If app instances are deployed to multiple worker nodes in the cluster, the load balancer routes the requests between the app pods on various worker nodes. Additionally, if you have a multizone cluster, the VPC ALB routes requests to worker nodes across all subnets and zones in your cluster.







 Setting up a Network Load Balancer for VPC
* IBM-provided domain, VPC clusters only: Create a DNS entry for the service's VPC hostname. When you run the following command, the subdomain that you specified in step 2 is automatically generated, and is registered with the Ingress controller service.

ibmcloud oc nlb-dns create vpc-gen2 --cluster <cluster_name_or_ID> --lb-host <router_VPC_hostname> --type private



6. Optional: If you want to use Ingress controller sharding so that specific routes are handled by a specific Ingress controller, for example private routes be admitted only to a private router, then you can use either route labels or namespace labels to specify the sharding method. To add the selector during creation time, include it in the ingresscontroller yaml under spec. For example, to allow an Ingress controller to only handle ingress/routes with label type=sharded, you can add a routeSelector. For more information, see [Ingress controller sharding](https://docs.openshift.com/container-platform/4.8/networking/ingress-operator.htmlnw-ingress-sharding_configuring-ingress).

routeSelector:
matchLabels:
type: sharded



1. To add selectors to an existing Ingress controller, get a list of Ingress controllers.

oc get ingresscontroller -n openshift-ingress-operator
2. Add the selectors to Ingress controllers where you want to use sharding.

oc patch -n openshift-ingress-operator IngressController/<name> --type='merge' -p '{"spec":{"routeSelector":{"matchLabels":{"type":"sharded"}}}}'
3. Note that no selectors are added to the default IngressController, so all routes are still admitted to the default Ingress controller on the cluster. You can use the relevant route or a namespace label selectors to change this behavior.
* VPC: If you have a custom security group on the VPC LBaaS (LoadBalancer-as-a-Service) instances for the cluster ingress, ensure that the security group rules allow the necessary health-check traffic from the Kubernetes [control plane IP addresses](https://github.com/IBM-Cloud/kube-samples/tree/master/control-plane-ips) to port 443.



2. Get the external IP addresses that the Ingress controller services are listening on. If you have a multizone cluster, note that the Ingress controller service in the first zone where you have workers nodes is always named router-default, and Ingress controller services in the zones that you subsequently add to your cluster have names such as router-dal12. In VPC clusters, the external IP addresses are behind a hostname that is assigned by the VPC load balancer, such as aabb1122-us-south.lb.appdomain.cloud.

oc get svc -n openshift-ingress

Example output for a classic multizone cluster with worker nodes in dal10 and dal13:

NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
router-dal13 LoadBalancer 172.21.47.119 169.XX.XX.XX 80:32318/TCP,443:30915/TCP 26d
router-default LoadBalancer 172.21.47.119 169.XX.XX.XX 80:32637/TCP,443:31719/TCP 26d
router-internal-default ClusterIP 172.21.51.30 <none> 80/TCP,443/TCP,1936/TCP 26d

If a Ingress controller has no external IP address (classic) or hostname (VPC), see [Version 4: Why doesn't the Ingress controller deploy in a zone?](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_subnet_limit_43).
3. Check the health of your Ingress controller pods (classic) or hostname (VPC).
For site-to-site VPN setups, you must follow the [Accessing service endpoints through VPN guide](https://cloud.ibm.com/docs/vpc?topic=vpc-build-se-connectivity-using-vpn) and configure the IBM Cloud VPC Private DNS service addresses.
4. Verify that you are connected to the VPC through your IBM Cloud VPC VPN connection.



2. To log in to your cluster, choose from the following options.



* Log in as admin:



1. Make sure that you have the [Administrator platform access role for the cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-usersadd_users).
2. Set your command line context for the cluster and download the TLS certificates and permission files for the administrator.

ibmcloud oc cluster config -c <cluster_name_or_ID> --admin --endpoint vpe



* Log in with an API key: See [Using an API key to log in to Red Hat OpenShift](https://cloud.ibm.com/docs/openshift?topic=openshift-access_clusteraccess_api_key).
* Log in with IBM Cloud passcode:



1. Get the VPE address and the master URL in the output of the following command.

ibmcloud oc cluster get -c <cluster_name_or_ID>
2. In your browser, open the following IBM Cloud IAM passcode website.

https://iam.cloud.ibm.com/identity/passcode
3. Log in with your IBMid and copy the passcode.
4. Log in to your cluster with the passcode.

oc login -u passcode -p <iam_passcode> --server=https://<VPE_URL>:<port_from_the_master_URL>

The login procedure will notify that certificate signed by an unknown authority as it is a self-signed certificate generated by IBM.





3.
On NODE1, assign the reserved IP address to a VIP environment variable and create the virtual IP address cluster resource by running the following commands.

export VIP=<reserved IP address>

echo $VIP

pcs resource create vip_${SID}_${INSTNO} IPaddr2 ip=$VIP

Check the configured virtual IP address and the cluster status.

pcs resource config vip_${SID}_${INSTNO}

ip addr show

pcs status --full





 Creating constraints 

Make sure that SAPHanaTopology resources are started before you start the SAPHana resources.

The virtual IP address must be present on the node where the primary resource of "SAPHana" is running.



1. Create constraint to start "SAPHanaTopology" before "SAPHana". This constraint mandates the start order of these resources.

On NODE1, use the following command to create the SAPHanaTopology order constraint:

pcs constraint order SAPHanaTopology_${SID}_${INSTNO}-clone then SAPHana_${SID}_${INSTNO}-clone symmetrical=false

Check the configuration.

pcs constraint
2. Create constraint to colocate the virtual IP address with primary. This constraint colocates the virtual IP address resource with the SAPHana resource that was promoted as primary.

On NODE1, run the following command to create the virtual IP address colocation constraint.

pcs constraint colocation add vip_${SID}_${INSTNO} with master SAPHana_${SID}_${INSTNO}-clone 2000

Check the configuration and the cluster status.

pcs constraint

pcs status --full







 Enabling automated registration of secondary instance 

You need to set the parameter AUTOMATED_REGISTER according to your operational requirements. If you want to keep the ability to revert to the state of the previous primary SAP HANA instance, then AUTOMATED_REGISTER=false avoids an automatic registration of the previous primary as a new secondary.

If you experience an issue with the data after a takeover that was triggered by the cluster, you can manually revert if AUTOMATED_REGISTER is set to false.
Before you continue, wait until the cluster is ready by checking that the Ingress subdomain follows a pattern of <cluster_name>.<region>.containers.appdomain.cloud.
* Every worker node is assigned a unique worker node ID and domain name that must not be changed manually after the cluster is created. Changing the ID or domain name prevents the Red Hat OpenShift master from managing your cluster. Is your cluster not in a Normal state? Check out the [Debugging clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-debug_clusters) guide for help. For example, if your cluster is provisioned in an account that is protected by a firewall gateway appliance, you must [configure your firewall settings to allow outgoing traffic to the appropriate ports and IP addresses](https://cloud.ibm.com/docs/openshift?topic=openshift-firewallfirewall_outbound).



20. After your cluster is created, you can [begin working with your cluster by configuring your CLI session](https://cloud.ibm.com/docs/openshift?topic=openshift-access_cluster). For more possibilities, review the [Next steps](https://cloud.ibm.com/docs/openshift?topic=openshift-clustersnext_steps).







 Creating VPC clusters from the CLI 

Create your single zone or multizone VPC cluster by using the IBM Cloud CLI.

Before you begin:



* Make sure that you complete the prerequisites to [prepare your account](https://cloud.ibm.com/docs/containers?topic=containers-clusters&interface=ui) and decide on your cluster setup.
* Install the IBM Cloud CLI and the [Red Hat OpenShift on IBM Cloud plug-in](https://cloud.ibm.com/docs/containers?topic=containers-cli-install).
Then, [create a cluster](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_cluster_create) that uses this new VLAN.

Option 2: If you have another VLAN that is available, you can [set up VLAN spanning](https://cloud.ibm.com/docs/vlans?topic=vlans-vlan-spanningvlan-spanning) in your existing cluster. After, you can add new worker nodes to the cluster that use the other VLAN with available subnets. To check if VLAN spanning is already enabled, use the ibmcloud ks vlan spanning get --region <region>[command](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_vlan_spanning_get).

Option 3: If you are not using all the subnets in the VLAN, you can reuse subnets on the VLAN by adding them to your cluster.



1. Check that the subnet that you want to use is available. The infrastructure account that you use might be shared across multiple IBM Cloud accounts. In this case, even if you run the ibmcloud ks subnets command to see subnets with Bound Clusters, you can see information only for your clusters. Check with the infrastructure account owner to make sure that the subnets are available and not in use by any other account or team.
2. Use the [ibmcloud ks cluster subnet add command](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_cluster_subnet_add) to make an existing subnet available to your cluster.
3. Verify that the subnet was successfully created and added to your cluster. The subnet CIDR is listed in the Subnet VLANs section.

ibmcloud ks cluster get --cluster <cluster_name> --show-resources

In this example output, a second subnet was added to the 2234945 public VLAN:

Subnet VLANs
VLAN ID Subnet CIDR Public User-managed
To order a subnet,



1. Provision a new subnet.

ibmcloud ks cluster subnet create --cluster <cluster_name_or_id> --size <subnet_size> --vlan <VLAN_ID>



Table 1. Parameters for a subnet

 Parameter Description 

 <cluster_name_or_id> Replace <cluster_name_or_id> with the name or ID of the cluster. 
 <subnet_size> Replace <subnet_size> with the number of IP addresses that you want to create in the portable subnet. Accepted values are 8, 16, 32, or 64. Note that when you add portable IP addresses for your subnet, three IP addresses are used to establish cluster-internal networking. You can't use these three IP addresses for your Ingress application load balancers (ALBs) or to create network load balancer (NLB) services. For example, if you request eight portable public IP addresses, you can use five of them to expose your apps to the public. 
 <VLAN_ID> Replace <VLAN_ID> with the ID of the public or private VLAN on which you want to allocate the portable public or private IP addresses. You must select a public or private VLAN that an existing worker node is connected to. To review the public or private VLANs that your worker nodes are connected to, run ibmcloud ks cluster get --cluster <cluster> --show-resources and look for the Subnet VLANs section in the output. The subnet is provisioned in the same zone that the VLAN is in. 



2. Verify that the subnet was successfully created and added to your cluster. The subnet CIDR is listed in the Subnet VLANs section.

ibmcloud ks cluster get --cluster <cluster_name_or_ID> --show-resources

In this example output, a second subnet was added to the 2234945 public VLAN.

Subnet VLANs
VLAN ID Subnet CIDR Public User-managed
2234947 10.xxx.xx.xxx/29 false false
To create a multizone cluster, [add more zones with the subnets](https://cloud.ibm.com/docs/openshift?topic=openshift-add_workers) that you created earlier to your cluster after the cluster is created. To list the IDs of your subnets in all resource groups, run ibmcloud oc subnets --provider vpc-gen2 --vpc-id &lt,VPC_ID> --zone <subnet_zone>.

--flavor <worker_flavor>
: Enter the worker node flavor that you want to use. The flavor determines the amount of virtual CPU, memory, and disk space that is set up in each worker node and made available to your apps. VPC worker nodes can be created as virtual machines on shared infrastructure only. Bare metal or software-defined storage machines are not supported. For more information, see [Planning your worker node setup](https://cloud.ibm.com/docs/openshift?topic=openshift-planning_worker_nodes). To view available flavors, first list available VPC zones with ibmcloud oc zone ls --provider vpc-gen2, and then use the zone to list supported flavors by running ibmcloud oc flavors --zone <VPC_zone> --provider vpc-gen2. After you create your cluster, you can add different flavors by adding a worker node or worker pool to the cluster.

--version 4.11_openshift
: VPC clusters are supported for Red Hat OpenShift version 4 only.

--cos-instance <cos_CRN>
: Include the CRN ID of a standard IBM Cloud Object Storage instance to back up the internal registry of your cluster. To list the CRN of existing instances, run ibmcloud resource service-instances --long and find the ID of your object storage instance. To create a standard object storage instance, run ibmcloud resource service-instance-create <name> cloud-object-storage standard global and note its ID.

--workers <number>
: Specify at least 2 worker nodes to include in the cluster.
Get the configuration for your existing Ingress controller in your cluster and save this configuration to a YAML file on your local machine.

oc get ingresscontroller default -n openshift-ingress-operator -o yaml > ingress.yaml
2. With your preferred editor, open the file and remove the following blocks:



* annotations
* creationTimestamp
* managedFields
* status
* finalizers
* generation
* resourceVersion
* selfLink
* uid



In addition, change the endpointPublishingStrategy to Private instead of LoadBalancerService. Your final YAML file looks similar to the following example.

apiVersion: operator.openshift.io/v1
kind: IngressController
metadata:
name: default
namespace: openshift-ingress-operator
spec:
defaultCertificate:
name: mycluster-97db6e22bd363f060fa80637cd5e2463-0000
endpointPublishingStrategy:
type: Private
nodePlacement:
tolerations:
- key: dedicated
value: edge
3. Scale down the IngressController operator.

oc scale --replicas=0 deployment/ingress-operator -n openshift-ingress-operator
4. Remove the finalizer from the current default Ingress controller.

oc patch ingresscontroller default -n openshift-ingress-operator -p '{"metadata":{"finalizers":null}}' --type=merge
5. Remove the existing Ingress controller from your cluster.

oc delete ingresscontroller default -n openshift-ingress-operator
6. Re-create the Ingress controller by using the YAML file that you created earlier. Note that you must re-create the Ingress controller before Red Hat OpenShift can automatically re-create the controller with the old configuration.

oc apply -f ingress.yaml
Create a [classic cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-clusters) with a minimum of one worker node per zone across three zones. Choose worker nodes of flavor type mb4c.32x384.3.8tb.ssd or mb4c.20x64.2x1.9tb.ssd that have the required local disks for ODF.
5. [Prepare your classic cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-deploy-odf-classicodf-cluster-prepare-classic).





 Optional: Setting up an IBM Cloud Object Storage service instance 

If you want to set up IBM Cloud Object Storage as the default backing store in your storage cluster, create an instance of IBM Cloud Object Storage. Then, create a set of HMAC credentials and a Kubernetes secret that uses your Object Storage HMAC credentials. If you don't specify IBM Cloud Object Storage credentials during installation, then the default backing store in your storage cluster is created by using the PVs in your cluster. You can set up additional backing stores after deploying ODF, but you can't change the default backing store.

[Access your Red Hat OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-access_cluster).



1. Create an openshift-storage namespace in your cluster. The driver pods are deployed to this namespace. Copy the following YAML and save it as os-namespace.yaml on your local machine.

apiVersion: v1
kind: Namespace
metadata:
labels:
openshift.io/cluster-monitoring: "true"
name: openshift-storage
2. Create the openshift-storage namespace by using the YAML file that you saved.

oc create -f os-namespace.yaml
3. Verify that the namespace is created.

oc get namespaces | grep storage
4. Create an IBM Cloud Object Storage service instance.
4. Select the Create from form tab.



1. Enter a name for your app, such as liberty.
2. Enter websphere-liberty for your container image. Remember that your cluster's VPC subnet must have a public gateway so that the cluster can pull an image from DockerHub.
3. Enter the number of pods for your app deployment, such as 1.
4. From the Service drop-down menu, select External to create a LoadBalancer service that external users can use to access the app. Configure the external service as follows.



* Port: 80
* Target port: 9080
* Protocol: TCP





5. Click Deploy. During the deployment, the cluster downloads the websphere-liberty container image from Docker Hub and deploys the app in your cluster. Your app is exposed by a Layer 4, version 1.0 network load balancer (NLB) so that it can be accessed by other users internally or externally. For other ways to expose an app such as Ingress, see [Planning in-cluster and external networking for apps](https://cloud.ibm.com/docs/containers?topic=containers-cs_network_planning).
6. From the Pods menu, click your liberty pod and check that its status is Running.
7. From the Services menu, click the External Endpoint of your liberty service. For example, 169.xx.xxx.xxx:80 for classic clusters or http://<hash>-<region>.lb.appdomain.cloud/ for VPC clusters. The Welcome to Liberty page is displayed.



Great job! You just deployed your first app in your Kubernetes cluster.







 What's next? 

Go through a tutorial to install the CLI, create a private image registry, set up your cluster environment, add an IBM Cloud service to the cluster, and deploy an app.



* [VPC clusters tutorial](https://cloud.ibm.com/docs/containers?topic=containers-vpc_ks_tutorial)



Set up the correct environment for your workloads.