vania-janet/multiturn-rag-retrieval-data huggingface dataset:
labels:
app: testpod
spec:
containers:
- image: IMAGE
name: CONTAINER-NAME
volumeMounts:
- mountPath: /myvol
name: pvc-name
volumes:
- name: pvc-name
persistentVolumeClaim:
claimName: pvc-static The name of the PVC that you created earlier
Show more

spec.containers.image
: The name of the container image that you want to use. To list available images in your IBM Cloud Container Registry account, run ibmcloud cr image-list.

spec.containers.name
: The name of the container that you want to deploy to your cluster.

spec.containers.volumeMounts.mountPath
: Enter the absolute path of the directory to where the volume is mounted inside the container. Data that is written to the mount path is stored under the root directory in your physical File Storage for VPC instance. If you want to share a volume between different apps, you can specify [volume sub paths](https://kubernetes.io/docs/concepts/storage/volumes/using-subpath) for each of your apps.

volumeMounts.name
: Enter the name of the volume to mount to your pod.

volume.name
: Enter the name of the volume to mount to your pod. Typically this name is the same as volumeMounts.name.

volumes.persistentVolumeClaim.claimName
: Enter the name of the PVC that binds the PV that you want to use.
kubectl exec -it mypod /bin/bash
5. Verify that the permissions to the mount path are root.

root@mypod:/ ls -al /mnt/myvol/
total 8
drwxr-xr-x 2 root root 4096 Feb 7 20:49 .
drwxr-xr-x 1 root root 4096 Feb 20 18:19 .

This output shows that the UID in the first row is now owned by root (instead of previously nobody).
6. If the UID is owned by nobody, exit the pod and reboot your cluster's worker nodes. Wait for the nodes to reboot.

ibmcloud ks worker reboot --cluster <my_cluster> --worker <my_worker1>,<my_worker2>
7. Repeat Steps 4 and 5 to verify the permissions.
COS_BUCKET_NAME= Bucket Name where the artifact will be uploaded in the COS Instance (Required if you are using 'cos' backend)
COS_ENDPOINT= The COS API Endpoint matching the region where the bucket is located (Required if you are using 'cos' backend)

If you are using github, use --git-token-path field to set your GitHub Token and --git-api-url field to set the # GitHub Enterprise API URL instead of GHE_TOKEN and GH_URL environment variables. If both GHE_TOKENGH_URL and --git-token-path--git-api-url pairs are provided, then --git-token-path and --git-api-url take precedence.

Running the command:

$ cocoa artifact upload

$ cocoa artifact upload --backend=[choices: "git", "cos"] e.g. --backend=cos,git
--pipeline-run-id=<pipeline-run-id> can be substituted by PIPELINE_RUN_ID
--namespace=[choices: "ci", "cd"] Pipeline type the evidence was collected from, can be substituted by NAMESPACE
--is-summary If present, this uploads the artifact to the location where evidence summary is usually stored
<file-path>

CLI options can be also set from environment variables except for backend and upload-path.







 cocoa set-status 

Sets a commit's status. The current implementation is tested on GitHub. See documentation about [GitHub statuses](https://docs.github.com/en/rest/reference/reposstatuses).

Required Environment Variables:

GHE_ORG= Github organization/username
GHE_REPO= Github repository
GHE_COMMIT= Github commit hash

Required Environment Variables, if you are using GitHub:

GHE_TOKEN= Github token (Optional if you are using --git-token-path)
This port must be exposed on the IP of every worker node in the cluster. Autorecovery requires a constant port number across all nodes for checking servers. Use [daemon sets](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/) when you deploy a custom server into a cluster. 
 ExpectedStatus When the check type is HTTP, enter the HTTP server status that you expect to be returned from the check. For example, a value of 200 indicates that you expect an OK response from the server. 
 Route When the check type is HTTP, enter the path that is requested from the HTTP server. This value is typically the metrics path for the server that runs on all the worker nodes. 
 Enabled Enter true to enable the check or false to disable the check. 
 Namespace Optional: To restrict checkpod.json to checking only pods in one namespace, add the Namespace field and enter the namespace.
* Check Runs: Apps that perform continuous integration, code linting, or code scanning services and provide detailed feedback on commits.



Required Environment Variables:

REQUIRED_CHECKS= Minimum required checks to be compliant set by client
GIT_BRANCH= Branch name for branch protection check
GIT_COMMIT= Commit hash of the Pull Request
GHE_TOKEN= Github Enterprise API Token (Optional if you are using --git-token-path field)
GHE_ORG= The owner of the repository
GHE_REPO= The repository name

If you are using GitHub, you can use --git-token-path field to set your GitHub Token and --git-api-url field to set the # GitHub Enterprise API URL instead of GHE_TOKEN and GH_URL environment variables. If both GHE_TOKENGH_URL and --git-token-path--git-api-url pairs are provided, then --git-token-path and --git-api-url take precedence.

REQUIRED_CHECKS Example:

[
{
"type": "status",
"name": "unit-test",
"params": {
"name": "travis/ci"
}
},
{
"type": "check-run",
"name": "secret-detection",
"params": {
"name": "detect-secrets"
}
},
{
"type": "branch-protection",
"name": "code review",
"params": {
"checks": "travis/ci", "detect-secrets"]
}
},
{
"type": "check-run",
"name": "open-source-license-scan",
"params": {
"name": "ossc/ci"
}
}
]

Running the command:

cocoa check pull-request-status







 cocoa change-request commands
3. Verify that your image pull secret was added to your default service account.

oc describe serviceaccount default -n <project_name>

Example output

Name: default
Namespace: <namespace_name>
Labels: <none>
Annotations: <none>
Image pull secrets: <image_pull_secret_name>
Mountable secrets: default-token-sh2dx
Tokens: default-token-sh2dx
Events: <none>

If the Image pull secrets says <secret> (not found), verify that the image pull secret exists in the same project as your service account by running oc get secrets -n project.
4. Create a pod configuration file that is named mypod.yaml to deploy a container from an image in your registry.

apiVersion: v1
kind: Pod
metadata:
name: mypod
spec:
containers:
- name: mypod-container
image: <region>.icr.io/<project>/<image>:<tag>
5. Create the pod in the cluster by applying the mypod.yaml configuration file.

oc apply -f mypod.yaml









 Setting up a cluster to pull entitled software 

You can set up your Red Hat OpenShift on IBM Cloud cluster to pull entitled software, which is a collection of protected container images that are packaged in Helm charts that you are licensed to use by IBM. Entitled software is stored in a special IBM Cloud Container Registry cp.icr.io domain. To access this domain, you must create an image pull secret with an entitlement key for your cluster and add this image pull secret to the Kubernetes service account of each project where you want to deploy this entitled software.

Before you begin: [Access your Red Hat OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-access_cluster).



1. Get the entitlement key for your entitled software library.



1.
* COS_API_KEY: An [IBM Cloud API key](https://cloud.ibm.com/docs/account?topic=account-userapikeyuserapikey)or [Service ID API key](https://cloud.ibm.com/docs/account?topic=account-serviceidapikeys&interface=ui)that has write access to the Cloud Object Storage bucket.
* IBM_AUTH_ENDPOINT: The endpoint where the API key can be used to generate an [IAM token](https://cloud.ibm.com/docs/account?topic=account-iamtoken_from_apikey&interface=api)(defaults to https://iam.cloud.ibm.com/identity/token){: external}.





 cocoa locker asset add < URI > 

Adds an asset to the evidence locker. If the asset exists, the asset is printed.

Options:

--org (Required) Owner of the evidence locker repo, defaults to EVIDENCE_LOCKER_REPO_OWNER
--repo (Required) Name of the evidence locker repo, defaults to EVIDENCE_LOCKER_REPO_NAME
--type Type of the asset ( All types are supported )
--version Show version number
--format Output format ("id", "json", default: "id")
--git-provider Git service provider ("github")
--git-token-path Git token path to read the secret from
--git-api-url Github API url
--related The ID of a related asset (default: [])
--date Asset creation date
--details Additional asset details, as key=value pairs (default: [])
--origin Additional details about the origin of the asset, as key=value pairs (default: [])
--dry-run Shows what would be added to the locker (default: false)

Use the --dry-run flag if you don't want to add anything to the locker, and you want to check what would be added to the locker.
* Make sure that your [kubectl version](https://cloud.ibm.com/docs/containers?topic=containers-cli-install) matches your cluster version.
* [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)



To set up configuration files with Kustomize:



1. [Install the kustomize tool](https://kubectl.docs.kubernetes.io/installation/kustomize/).



* For macOS, you can use the brew package manager.

brew install kustomize
* For Windows, you can use the chocolatey package manager.

choco install kustomize



2. Create a directory for your app in a version control system, such as Git.

git init /<my_app>
3. Create your repo structure for your kustomize[base](https://kubectl.docs.kubernetes.io/references/kustomize/glossary/base) directory, [overlay](https://kubectl.docs.kubernetes.io/references/kustomize/glossary/overlay) directory, and environment directories such as staging and production. In the subsequent steps, you set up these repos for use with kustomize.

mkdir -p /<my_app>/base &&
mkdir -p /<my_app>/overlay &&
mkdir -p /<my_app>/overlay/staging &&
mkdir -p /<my_app>/overlay/prod

Example repo structure

.
├── base
└── overlay
├── prod
└── staging
4. Set up the base repo.



1. Navigate to the base repo.

cd /<my_app>/base
2.
GHE_TOKEN= Github Enterprise API Token (Required)
GHE_ORG= The owner of the repository (optional, when --org is not provided)
GHE_REPO= The repository name (optional, when --repo is not provided)

This command contains three usage methods:



* Check commits in range when both --from and --to options are provided.



Options:

--from git commit hash to calculate the changes from
--to git commit hash to calculate the changes to

Running the command:

$ cocoa changelog --org=<github-organization> --repo=<github-repo-name> --from=<commit-hash-to-calculcate-changes-from> --to=<commit-hash-to-calculate-changes-to>



* Contain all commits that belong to a specific pull request when the --pr option is provided.



Options:

--pr pull request number from which the changelog is calculated

Running the command:

$ cocoa changelog --org=<github-organization> --repo=<github-repo-name> --pr=<pull-request-number>



* If the preceding information is not provided, the changelog contains the changes of the currently merged pull request.



Running the command:

$ cocoa changelog --org=<github-organization> --repo=<github-repo-name>
kubectl patch -n <namespace_name> serviceaccount/default --type='json' -p='[{"op":"add","path":"/imagePullSecrets/-","value":{"name":"<image_pull_secret_name>"}}]'



3. Verify that your image pull secret was added to your default service account.

kubectl describe serviceaccount default -n <namespace_name>

Example output

Name: default
Namespace: <namespace_name>
Labels: <none>
Annotations: <none>
Image pull secrets: <image_pull_secret_name>
Mountable secrets: default-token-sh2dx
Tokens: default-token-sh2dx
Events: <none>

If the Image pull secrets says <secret> (not found), verify that the image pull secret exists in the same namespace as your service account by running kubectl get secrets -n namespace.
4. Create a pod configuration file that is named mypod.yaml to deploy a container from an image in your registry.

apiVersion: v1
kind: Pod
metadata:
name: mypod
spec:
containers:
- name: mypod-container
image: <region>.icr.io/<namespace>/<image>:<tag>
5. Create the pod in the cluster by applying the mypod.yaml configuration file.

kubectl apply -f mypod.yaml









 Setting up a cluster to pull entitled software 

You can set up your IBM Cloud Kubernetes Service cluster to pull entitled software, which is a collection of protected container images that are packaged in Helm charts that you are licensed to use by IBM. Entitled software is stored in a special IBM Cloud Container Registry cp.icr.io domain. To access this domain, you must create an image pull secret with an entitlement key for your cluster and add this image pull secret to the Kubernetes service account of each namespace where you want to deploy this entitled software.
For your deployment, [use an SCC](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scc) that allows chown operations and try again.
6. Verify that the volume is successfully mounted to your pod. Note the pod name and Containers/Mounts path.

oc describe pod <my-pod>

Example output

Name: mypod-123456789
Namespace: default
...
Init Containers:
...
Mounts:
/mount from volume (rw)
/var/run/secrets/kubernetes.io/serviceaccount from default-token-cp9f0 (ro)
...
Containers:
jenkins:
Container ID:
Image: jenkins
Image ID:
Port: <none>
State: Waiting
Reason: PodInitializing
Ready: False
Restart Count: 0
Environment: <none>
Mounts:
/var/jenkins_home from volume (rw)
/var/run/secrets/kubernetes.io/serviceaccount from default-token-cp9f0 (ro)
...
Volumes:
myvol:
Type: PersistentVolumeClaim (a reference to a PersistentVolumeClaim in the same namespace)
ClaimName: mypvc
ReadOnly: false
7. Log in to the pod by using the pod name that you previously noted.

oc exec -it <my-pod-123456789> /bin/bash
8. Verify the permissions of your container's mount path. In the example, the mount path is /var/jenkins_home.

ls -ln /var/jenkins_home

Example output

jenkins@mypod-123456789:/$ ls -ln /var/jenkins_home
total 12
-rw-r--r-- 1 1000 1000 102 Mar 9 19:58 copy_reference_file.log
'VirtualMachine.Provisioning.GetVmFiles',
'VirtualMachine.Provisioning.PutVmFiles',
'Resource.AssignVMToPool',
'Resource.CreatePool',
'Resource.DeletePool',
'Resource.HotMigrate',
'Resource.ColdMigrate',
'Extension.Register',
'Extension.Unregister',
'VApp.AssignVM',
'VApp.AssignResourcePool',
'VApp.Unregister',
'StoragePod.Config',
'Cryptographer.Access',
'Cryptographer.EncryptNew',
'Cryptographer.Encrypt',
'Cryptographer.Migrate',
'Cryptographer.AddDisk',
'InventoryService.Tagging.AttachTag',
'StorageProfile.Update',
'StorageProfile.View')

Connect-VIServer -Server $vcsa -Credential $creds | Out-Null
New-VIRole -Name $role -Privilege (Get-VIPrivilege -Id $privileges) | Out-Null
Get-VIRole -Name $role | Select-Object Description, PrivilegeList, Server, Name | Format-List
New-VIPermission -Principal $principal -Role $role -Entity (Get-Datacenter) -Propagate:$true -Confirm:$false
Disconnect-VIServer -Confirm:$false
Show more

The steps are completed for creating the cyber-recovery isolated environment solution architecture.

For a use case where a cyberadmin uses a PowerShell script that uses Veeam to do an instant restore of a production VM from the cyberbackup, see [Instant restore](https://cloud.ibm.com/docs/vmwaresolutions/?topic=vmwaresolutions-veeam-cr-sag-instantrestore).
: Yes, you can [create a custom storage class](https://cloud.ibm.com/docs/containers?topic=containers-block_storagetopology_yaml) for your PVC that includes the [volumeBindingMode: WaitForFirstConsumer](https://kubernetes.io/docs/concepts/storage/storage-classes/volume-binding-mode) field.

What options do I have to add block storage to a stateful set?
: If you want to automatically create your PVC when you create the stateful set, use [dynamic provisioning](https://cloud.ibm.com/docs/containers?topic=containers-block_storageblock_dynamic_statefulset). You can also choose to [pre-provision your PVCs or use existing PVCs](https://cloud.ibm.com/docs/containers?topic=containers-block_storageblock_static_statefulset) with your stateful set.



 Creating the PVC by using dynamic provisioning when you create a stateful set 

Use this option if you want to automatically create the PVC when you create the stateful set.

Before you begin: [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)

Complete the following steps to verify that all existing stateful sets in your cluster are fully deployed. If a stateful set is still being deployed, you can't start creating your stateful set. You must wait until all stateful sets in your cluster are fully deployed to avoid unexpected results.



1. List existing stateful sets in your cluster.

kubectl get statefulset --all-namespaces

Example output

NAME DESIRED CURRENT AGE
mystatefulset 3 3 6s
2. View the Pods Status of each stateful set to ensure that the deployment of the stateful set is finished.

kubectl describe statefulset <statefulset_name>

Example output

Name: nginx
Namespace: default
No. The CDN edge servers can only access the ICOS public endpoints, so objects in the ICOS buckets should provide public access.





 Will traffic sent from ICOS to CDN be charged? 

Yes. The CDN and ICOS don't have a way of measuring each other's traffic, so both traffic from ICOS and CDN are charged.





 How does the CDN edge server retrieve content from the ICOS objects? 

The CDN uses the S3 endpoint to access the ICOS objects, and replaces the path in the url to the bucket name. For example, if your ICOS S3 endpoint s3.us-south.cloud-object-storage.appdomain.cloud with bucket name xyz-bucket-name is added in path /example-cos/, when you open the CDN URL www.example.com/example-cos/, the CDN edge server retrieves the content from s3.us-south.cloud-object-storage.appdomain.cloud/xyz-bucket-name/.





 How do I use the ICOS default index page with CDN? 

The CDN does not support the default index page for the ICOS objects because the ICOS S3 endpoint does not have the default index. You must specify the complete request path in the browser's address bar (for example, www.example.com/index.html). If you want the CDN to automatically access the default index page of the ICOS, create a CDN with Server type of origin instead of an Object Storage type.
For example, a set of changes that you plan to deploy everywhere might be released to a single region first, and then gradually deployed to other regions by using continuous deployment pipelines to target those regions.







 Inventory operations 

The Inventory contains some basic operations that run by using the CLI or by using pure Git and the GitHub CLI.



 CLI commands 



1. Create a promotion pull request from master to the target branch in staging.

cocoa inventory promote --source="master" --target="staging" --priority="moderate" --assigned-to="assignee@ibm.com" --description="Change description" --purpose="Change purpose" --impact="Change impact" --backout-plan="Details on backout and rollback")
2. Conclude a deployment by moving the target_latest tag to the same commit as the pipeline-run-id tag.

cocoa inventory label move --to-label="${PIPELINE_RUN_ID}" "target_latest"







 Git and GitHub CLI 



1. Create a promotion pull request from master to the target branch in staging.

promote() {

if [ -z $1 ] || [ -z $2 ]; then
echo "Missing source and target"
exit 1
fi

local source="$1"
local target="$2"

if ! git show-ref "refs/remotes/origin/$target"; then
 Create a new target branch, from the beginning of master
git checkout master
git checkout -b "$target" $(git rev-list --max-parents=0 HEAD)
git_push
fi

git checkout "$source"
git pull --rebase

 Create a promotion branch for the PR
 this can be discarded after the Promotion PR merge
git checkout -b "promote-$source-to-$target"
git push --set-upstream origin "promote-$source-to-$target"

 Create PR from promotion branch to target branch
[Why can't I SSH into my worker node?](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_ssh_workercs_ssh_worker)



* [Debugging by using oc debug](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_ssh_workeroc-debug)
* [Debugging by using kubectl exec](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_ssh_workerkubectl-exec)
* [Debugging by creating a pod with root SSH access](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_ssh_workerpod-ssh)



* [Private network](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_ssh_workerssh-private-network)
* [Public network classic clusters that are connected to a public VLAN only](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_ssh_workerpublic-network-only-classic-debug)
* [Cleaning up after debugging](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_ssh_workerssh-debug-cleanup)





[Pods in the openshift-markeplace namespace are in ImagePullBackOff](https://cloud.ibm.com/docs/openshift?topic=openshift-ts-openshift-marketplacets-openshift-marketplace)





 Cluster autoscaler 

[Debugging the cluster autoscaler](https://cloud.ibm.com/docs/openshift?topic=openshift-debug_cluster_autoscalerdebug_cluster_autoscaler)
IAM_ACCESS_TOKEN= Access token obtained from the IAM service corresponding to pnp-ibmcloud-api-key.
SERVICENOW_URL= ServiceNow API URL

Running the command:

cocoa change-request attachment list "<insert-change-request-id-here>"





 cocoa change-request attachment update 

Updates a Change attachment in a specific Change Request.

Options:

--change-request-id The change request the change task belongs to [string] [required]
--change-task-id The change task id to be updated [string] [required]
--description A more detailed description for the Change Task. [string]
--data Data for the Change Task or a path prefixed with @ to read the data from. [string]
--provider (Optional) Change Management service provider (choices: 'servicenow', 'servicenow-v3', default: 'servicenow')

Required Environment Variables, if you are using ServiceNow v1 or v2 provider:

SERVICENOW_TOKEN= ServiceNow API Token
SERVICENOW_URL= ServiceNow API URL

Required Environment Variables, if you are using ServiceNow v3 provider:

IAM_ACCESS_TOKEN= Access token obtained from the IAM service corresponding to pnp-ibmcloud-api-key.
SERVICENOW_URL= ServiceNow API URL

Running the command:

$ cocoa change-request attachment update
--change-request-id='CHGXXXXXXX' --change-attachment-id='CTASKXXXXXXX' --data='<data-for-the-attachment>' --description='<description>'

$ cat data.txt | cocoa change-request attachment update --change-request-id='CHGXXXXXXX' --change-attachment-id='CTASKXXXXXXX' --data='@/dev/stdin'

$ cocoa change-request attachment update --change-request-id='CHGXXXXXXX' --change-attachment-id='CTASKXXXXXXX' --data='@<path/to/file>'
"pipeline_run_id": "f333b3bc-3333-3fea-3333-333d3a3b33b3",
"pipeline_id": "444aaa4a-b4c4-4444-4f4b-aa4444a444a4"
},
"details": {
"sha": "aaaaaaaabbbbbbbbccccccccddddddddeeeeeeee",
"repository": "https://github.ibm.com/foo/bar.git",
"tag": "v1.2.3"
},
"date": "2021-07-15T14:26:06.301Z",
"type": "image",
"related": []
}
Show more





 cocoa locker asset list < URI > 

Lists the related assets from the evidence locker.

Options:

--org (Required) Owner of the evidence locker repo, defaults to EVIDENCE_LOCKER_REPO_OWNER
--repo (Required) Name of the evidence locker repo, defaults to EVIDENCE_LOCKER_REPO_NAME
--type Type of the asset
--version Show version number
--git-provider Git service provider ("github")
--git-token-path Git token path to read the secret from
--git-api-url Github API url
--format Output format ("id", "json", default: "id")

Run the command:

cocoa locker asset list release:my-app@v1.2.3 --format id --type generic

Example output:

1122211111122222111111111111111111111111111111666661111111111111
2222222222555552222222222222222333333222222222222222222222222222