vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Resources:
Resource Group ID a8a12accd63b437bbd6d58fb6a462ca7
Resource Group Name test-rg
Service Name containers-kubernetes
Service Instance
Region
Resource Type
Resource
Memo Policy applies to the resource(s) within the resource group
3. If you have both of these policies, skip to Step 4, first bullet. If you don't have the policy from Step 2a, but you do have the policy from Step 2b, skip to Step 4, second bullet. If you don't have either of these policies, continue to Step 3.



3. Check if you have access to the cluster, but not as part of access to the resource group that the cluster is in.



1. Look for a policy that has no values besides the Policy ID and Roles fields. If you have this policy, you have access to the cluster as part of access to the entire account. For example, this policy indicates that a user has access to all resources in the account:

Policy ID: 8898bdfd-d520-49a7-85f8-c0d382c4934e
Roles: Administrator, Manager
Resources:
Service Name
Service Instance
Region
Resource Type
Resource
2. Look for a policy that has a Service Name value of containers-kubernetes and a Service Instance value of the cluster's ID. You can find a cluster ID by running ibmcloud ks cluster get --cluster <cluster_name>. For example, this policy indicates that a user has access to a specific cluster:

Policy ID: 140555ce-93ac-4fb2-b15d-6ad726795d90
Roles: Administrator
Resources:
Service Name containers-kubernetes
Service Instance df253b6025d64944ab99ed63bb4567b6
Region
Resource Type
Resource
3. If you have either of these policies, skip to the second bullet point of step 4.
Creating your own Ingress domain 

When you create a standard cluster, an Ingress subdomain is registered by default for your cluster in the format <cluster_name>.<globally_unique_account_HASH>-0000.<region>.containers.appdomain.cloud. Additionally, you can create your own domain registered with IBM Cloud's internal domain provider, or a domain registered with an external provider. Currently, IBM Cloud supports external domains registered with IBM Cloud Internet Services, Akamai, or Cloudflare.

This functionality is available in beta and is subject to change.



 Setting up domains with the IBM Cloud internal provider 

IBM Cloud provides a managed, internal provider that you can use to create your own domains. You can use the ibmcloud oc ingress domain create command to create a new domain, or you can specify an existing domain that you want to add to your cluster. When you create a domain with the internal provider, you specify a subdomain name, such as exampledomain. The new domain is named in the format exampledomain.<zone>.containers.appdomain.cloud.

The IBM Cloud internal provider runs on Akamai, but is separate from and should not be confused with an external Akamai domain that you create on your own. When you get the details of a domain, you may see the provider type listed as akamai or akamai-ext. The akamai provider type refers to the internal IBM Cloud domain provider, and akamai-ext refers to the external Akamai provider that you directly register the domain with.

ibmcloud oc ingress domain create --cluster CLUSTER [--is-default] [--domain DOMAIN] [--hostname HOSTNAME] [--ip IP] [--output OUTPUT] [-q] [--secret-namespace NAMESPACE]

-c, --cluster CLUSTER
: Required. The name or ID of the cluster where you want to create the domain.

--is-default
: Optional. Include this option to set the relevant domain as the default domain for the cluster.

--domain DOMAIN
: The domain to create or add to your cluster.
app.kubernetes.io/managed-by: "ibm-ibp"
spec:
email: <EMAIL>
password: <PASSWORD>
imagePullSecrets:
- regcred
registryURL: cp.icr.io/cp
license:
accept: <ACCEPT>
networkinfo:
domain: <DOMAIN>
storage:
console:
class: ''
size: 5Gi
serviceAccountName: ibm-blockchain
usetags: true
version: 2.5.4
Show more



* Accept the IBM Blockchain Platform license by replacing <ACCEPT> with the text true.
* Replace <EMAIL> with the email address that you want to use for the console administrator.
* Replace <PASSWORD> with the password of your choice. This password becomes the default password for the console administrator but they are required to change it the first time they log in.
* Replace <DOMAIN> with the name of your cluster domain. You can find this value from your OpenShift web console URL. Examine the URL for the current page. It is similar to: https://console-openshift-console.pa-0803-ocp43-0defdaa0c51bd4a2dcb024eab4bf04a1-0000.us-south.containers.appdomain.cloud/k8s/ns/pa0804/clusterserviceversions/ibm-blockchain.v2.5.4/ibp.comv1beta1IBPConsole/new. The value of the domain then would be pa-0803-ocp43-0defdaa0c51bd4a2dcb024eab4bf04a1-0000.us-south.containers.appdomain.cloud, after you remove console-openshift-console and /k8s/ns/pa0804/clusterserviceversions/ibm-blockchain.v2.5.4/ibp.comv1beta1IBPConsole/new.
In general, when you are deploying vSphere HA clusters, it is also important to consider the overall size of the cluster. Smaller sized clusters require a larger relative percentage of all the available cluster resources to be reserved to handle failures. For example, a cluster of three nodes requires at least 33% of the cluster resources to be held on reserve for failover where a cluster of eight nodes requires 12.5% of cluster resources that are reserved for failover. In a production environment, always consider at least one host as a failover minimum per 8 to 10 ESXi hosts to achieve N+1 redundancy.

It is also considered the best practice to build the cluster out of identical server hardware. In IBM Cloud VPC, use the same Bare Metal Server profiles for hosts in the same cluster. This practice greatly simplifies the management and configuration of servers. It also reduces resource fragmentation and increases the ability to handle server failures. The use of different hardware in a cluster leads to an unbalanced cluster and makes the cluster less productive.





 IBM Cloud account access 

To manage access to your IBM Cloud account, ensure that you have proper access to provision and manage required assets. Depending on your solution design, you might need proper IBM Cloud IAM access to the following services:



* [Deploy and manage services in IBM Cloud VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-user-permissions-for-vpc-resources)
* [Deploy and manage IBM Cloud DNS Services](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-iam)
* Deploy and manage IBM Cloud Interconnectivity Services:



* [Direct Link](https://cloud.ibm.com/docs/dl?topic=dl-iam)
* [Transit Gateway](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-iam)





For more information, see [How IBM Cloud IAM works](https://cloud.ibm.com/docs/account?topic=account-iamoverview).





 VMware licensing 

For licensing, you have two options:
To use the private cloud service endpoint to connect to your cluster, you must be in your IBM Cloud private network or connected to the private network through a [VPC VPN connection](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-onprem-example), or for classic infrastructure, a [classic VPN connection](https://cloud.ibm.com/docs/iaas-vpn?topic=iaas-vpn-getting-started) or [IBM Cloud Direct Link](https://cloud.ibm.com/docs/dl?topic=dl-get-started-with-ibm-cloud-dl).

ibmcloud oc cluster config -c <cluster_name_or_ID> [--endpoint private]



3. Exchange your IBM Cloud IAM API key credentials for a Red Hat OpenShift access token. You can log in from the CLI or API. For more information, see the [Red Hat OpenShift docs](https://docs.openshift.com/container-platform/4.11/authentication/configuring-internal-oauth.html).

Log in by using the oc CLI: Log in to your cluster with the oc login command. The username (-u) is apikey and the password (-p) is your IBM Cloud IAM API key value. To use the private cloud service endpoint, include the --server=<private_service_endpoint> option.

oc login -u apikey -p <API_key> [--server=<private_service_endpoint>]

Log in by running Red Hat OpenShift API requests directly against your cluster: Log in to your cluster with the API such as via a curl request.



1. Get the Master URL of your cluster.

ibmcloud oc cluster get -c <cluster_name_or_ID>

Example output

NAME: mycluster
ID: 1234567
State: normal
Created: 2020-01-22T19:22:16+0000
Location: dal10
Resources:
Resource Group ID a8a12accd63b437bbd6d58fb6a462ca7
Resource Group Name test-rg
Service Name containers-kubernetes
Service Instance
Region
Resource Type
Resource
Memo Policy applies to the resource(s) within the resource group
3. If you have both of these policies, skip to Step 4, first bullet. If you don't have the policy from Step 2a, but you do have the policy from Step 2b, skip to Step 4, second bullet. If you don't have either of these policies, continue to Step 3.



3. Check if you have access to the cluster, but not as part of access to the resource group that the cluster is in.



1. Look for a policy that has no values besides the Policy ID and Roles fields. If you have this policy, you have access to the cluster as part of access to the entire account. For example, this policy indicates that a user has access to all resources in the account:

Policy ID: 8898bdfd-d520-49a7-85f8-c0d382c4934e
Roles: Administrator, Manager
Resources:
Service Name
Service Instance
Region
Resource Type
Resource
2. Look for a policy that has a Service Name value of containers-kubernetes and a Service Instance value of the cluster's ID. You can find a cluster ID by running ibmcloud oc cluster get --cluster <cluster_name>. For example, this policy indicates that a user has access to a specific cluster:

Policy ID: 140555ce-93ac-4fb2-b15d-6ad726795d90
Roles: Administrator
Resources:
Service Name containers-kubernetes
Service Instance df253b6025d64944ab99ed63bb4567b6
Region
Resource Type
Resource
3. If you have either of these policies, skip to the second bullet point of step 4.
Cluster health image v1.2.15 v1.2.16 Updated universal base image (UBI) to the latest 8.4 version to resolve CVEs: [CVE-2021-36222](https://nvd.nist.gov/vuln/detail/CVE-2021-36222), [CVE-2021-37750](https://nvd.nist.gov/vuln/detail/CVE-2021-37750), [CVE-2021-22922](https://nvd.nist.gov/vuln/detail/CVE-2021-22922), [CVE-2021-22923](https://nvd.nist.gov/vuln/detail/CVE-2021-22923), and [CVE-2021-22924](https://nvd.nist.gov/vuln/detail/CVE-2021-22924). 
 etcd v3.4.16 v3.4.17 See the [etcd release notes](https://github.com/etcd-io/etcd/releases/v3.4.17). 
 IBM Calico extension 763 864 Updated to use Go version 1.16.9. Updated universal base image (UBI) to the latest 8.4 version to resolve CVEs. 
 IBM Cloud Block Storage for Classic driver and plug-in v2.1.1 v2.1.2 Updated universal base image (UBI) to version 8.4-210 to resolve CVEs. 
 IBM Cloud Controller Manager v1.19.15-1 v1.19.15-3 Updated to ignore VPC load balancer (LB) state when a LB delete is requested. 
 IBM Cloud File Storage for Classic plug-in and monitor 400 401 Updated universal base image (UBI) to the latest 8.4-210 version to resolve CVEs.
See ci_cluster_name and cd_cluster_name to set different clusters. By default, the cluster namespace for CI is set to dev and for CD is to prod. You can change these settings by using ci_cluster_namespace and cd_cluster_namespace. string mycluster-free 
 sm_location The region location of the Secrets Manager instance. This applies to the CI, CD, and CC Secret Manager integrations. See ci_sm_location, cd_sm_location, and cc_sm_location to set separately. string us-south 
 sm_name The name of the Secret Manager instance. This applies to the CI, CD, and CC Secret Manager integrations. See ci_sm_name, cd_sm_name, and cc_sm_name to set separately. string sm-instance 
 sm_resource_group The resource group containing the Secrets Manager instance. This applies to the CI, CD, and CC Secret Manager integrations. See ci_sm_resource_group, cd_sm_resource_group, and cc_sm_resource_group to set separately. string Default 
 sm_secret_group Group in Secrets Manager for organizing/grouping secrets. This applies to the CI, CD and CC Secret Manager integrations. See ci_sm_secret_group, cd_sm_secret_group, and cc_sm_secret_group to set separately. string Default 
 ibmcloud_api_key API key that creates the toolchains. 



The variables that are prefixed with ci, cd, and cc apply to the CI, CD, and CC toolchains. Nonprefixed variables apply to all the toolchains. Also, modifying the default values for the prefixed variable inputs causes the prefixed variables inputs to take precedence over nonprefixed variable inputs.





 Optional input variables 



 Group level variables 



Table 2. Group level variables

 Name Description Type Default 

 cos_endpoint Set the Cloud Object Storage endpoint for accessing your COS bucket. This setting sets the same endpoint for COS in the CI, CD, and CC toolchains.
This cluster is attached to both IBM Cloud private and public networks through untagged transit networks. These transit networks are used for static routes to route public and private traffic through the firewall that is hosted on the gateway cluster.
2. You can associate and route traffic through vSRX (or the third-party device) by assigning VLANs to the gateway cluster. You can choose the VLANs to be assigned and routed through it by using IBM Cloud classic portal. You must manually configure the required VLAN interfaces and IP addresses to the vSRX or third-party devices, the related firewall zones, the rules, and the policies. Every interface that is associated and routed though VLAN is tagged with the specific VLAN ID in the gateway cluster's trunked-distributed port group. Therefore, VLAN tagged interfaces must also be used on the firewall appliance configuration.
3. In this example, a new VLAN is ordered in the private network, but you can follow the same process and logic for public side. Primary private and public VLANs are untagged (VLAN 0), while all other extra VLANs are tagged (for example VLAN 2222 or 3333 in the previous example). This tagging must be taken care of in the clusters' distributed port groups. In addition, you must manually request to trunk these VLANs to your ESXi hosts though the IBM Cloud console (Classic Infrastructure > Network > Gateway appliances) so that NSX-T edge node VMs that are running on the specific vSphere cluster can access these VLANs. Also, note, that if you add new hosts to the cluster, you must handle the trunking by yourself to avoid connectivity issues.
4. Your edge transport node virtual machines (VMs) use a private N-VDS host switch internally, and the edge nodes have their virtual network interfaces attached to vSphere distributed port groups, for example private VLAN uplinks. The edge transport nodes' private uplinks must be attached to a trunked-distributed port group, which allow the new VLAN ID to pass through. You can specify or limit the allowed VLANs on this trunked port group, if needed.
5.
To use the private cloud service endpoint to connect to your cluster, you must be in your IBM Cloud private network or connected to the private network through a [VPC VPN connection](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-onprem-example), or for classic infrastructure, a [classic VPN connection](https://cloud.ibm.com/docs/iaas-vpn?topic=iaas-vpn-getting-started) or [IBM Cloud Direct Link](https://cloud.ibm.com/docs/dl?topic=dl-get-started-with-ibm-cloud-dl).

ibmcloud oc cluster config -c <cluster_name_or_ID> [--endpoint private]



5. [Use the service ID's API key to log in to your Red Hat OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-access_clusteraccess_api_key). The username (-u) is apikey and the password (-p) is your API key value. To use the private cloud service endpoint, include the --server=<private_service_endpoint> option.

oc login -u apikey -p <API_key> [--server=<private_service_endpoint>]
6. Verify that the service ID can perform the actions that you authorized.

Example: If you assigned a Reader service access role, the service ID can list pods in your Red Hat OpenShift project.

oc get pods

Example: If you assigned a Manager service access role, the service ID can list the users in your Red Hat OpenShift cluster. The ID of your IAM service ID is in the Identities output. Other individual users might be identified by their email address and IBMid.

oc get users

Example output

NAME UID FULL NAME IDENTITIES
: The on-premises VPN endpoint from the remote network initiates the VPN connection, and the cluster listens for the connection.

Outbound
: The cluster initiates the VPN connection, and the on-premises VPN endpoint from the remote network listens for the connection.

To establish an inbound VPN connection, modify the following settings.



1. Verify that ipsec.auto is set to add.
2. Optional: Set loadBalancerIP to a portable public IP address for the strongSwan VPN service. Specifying an IP address is useful when you need a stable IP address, such as when you must designate which IP addresses are permitted through an on-premises firewall. The cluster must have at least one available public load balancer IP address. [You can check to see your available public IP addresses](https://cloud.ibm.com/docs/openshift?topic=openshift-subnetsreview_ip) or [free up a used IP address](https://cloud.ibm.com/docs/openshift?topic=openshift-subnetsfree).



* If you leave this setting blank, one of the available portable public IP addresses is used.
* You must also configure the public IP address that you select for or the public IP address that is assigned to the cluster VPN endpoint on the on-premises VPN endpoint.





To establish an outbound VPN connection, modify the following settings.



1. Change ipsec.auto to start.
2. Set remote.gateway to the public IP address for the on-premises VPN endpoint in the remote network.
3. Choose one of the following options for the IP address for the cluster VPN endpoint:



* Public IP address of the cluster's private gateway: If your worker nodes are connected to a private VLAN only, then the outbound VPN request is routed through the private gateway to reach the internet. The public IP address of the private gateway is used for the VPN connection.
Cluster health image v1.2.15 v1.2.16 Updated universal base image (UBI) to the latest 8.4 version to resolve CVEs: [CVE-2021-36222](https://nvd.nist.gov/vuln/detail/CVE-2021-36222), [CVE-2021-37750](https://nvd.nist.gov/vuln/detail/CVE-2021-37750), [CVE-2021-22922](https://nvd.nist.gov/vuln/detail/CVE-2021-22922), [CVE-2021-22923](https://nvd.nist.gov/vuln/detail/CVE-2021-22923), and [CVE-2021-22924](https://nvd.nist.gov/vuln/detail/CVE-2021-22924). 
 etcd v3.4.16 v3.4.17 See the [etcd release notes](https://github.com/etcd-io/etcd/releases/v3.4.17). 
 IBM Calico extension 763 864 Updated to use Go version 1.16.9. Updated universal base image (UBI) to the latest 8.4 version to resolve CVEs. 
 IBM Cloud Block Storage for Classic driver and plug-in v2.1.1 v2.1.2 Updated universal base image (UBI) to version 8.4-210 to resolve CVEs. 
 IBM Cloud Controller Manager v1.20.11-1 v1.20.11-2 Updated to ignore VPC load balancer (LB) state when a LB delete is requested. 
 IBM Cloud File Storage for Classic plug-in and monitor 400 401 Updated universal base image (UBI) to the latest 8.4-210 version to resolve CVEs.
When multiple entities, such as different business units, are sharing an instance and require isolation from each other, follow naming guidelines to simplify the management and operation of mirrored clusters.

Name Kafka resources by using the following template: <ENTITY_PREFIX><SEPARATOR><NAME>

Where:



* <ENTITY_PREFIX> is the prefix for the entity that uses this topic.
* <SEPARATOR> is an optional character that is used to easily separate the entities and resource names.
* <NAME> is the name of the Kafka resource.



For example, if the accounting business unit requires a topic that is called invoices, you can call it accounting.invoices.

The required access policies must be adjusted. For example, for the accounting business unit, the following policies are required on cluster B:



Table 4. Access policies needed on cluster B

 Resource type Resource ID Role 

 cluster Reader 
 group accounting.* As required by the application 
 topic accounting.* As required by the application 
 txnid accounting.* As required by the application 
 topic (note, this is specific to the checkpoint topic) A.checkpoints.internal Reader 



Cluster A must have the same access policies apart from the last one that must be on B.checkpoints.internal.





 Mirroring user controls 

You can configure mirroring by using the [CLI](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-cli) or [Administration REST API](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-admin_api). All mirroring user controls are performed on the target cluster.



 Setting the topic selection 

The mirroring selection is made based on the topic names on the source cluster by using patterns. Choose the names of the topics on your source cluster carefully, by considering the advice from the [Considerations when you share clusters between multiple entities](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-mirroringsharing_clusters) section.
In a classic cluster, list the network load balancer (NLB) IP addresses that are registered to DNS subdomains. In a VPC cluster, list the VPC load balancer hostnames that are registered to DNS subdomains.

ibmcloud ks nlb-dns ls --cluster CLUSTER [--output json] [-q]

Minimum required permissions
: Editor platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

--output json
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.



 Example nlb-dns ls command 

ibmcloud ks nlb-dns ls --cluster mycluster







 ibmcloud ks nlb-dns monitor configure 

Classic infrastructure

Configure and optionally enable a health check monitor for an existing NLB subdomain in a cluster. When you enable a monitor for your subdomain, the monitor health checks the NLB IP in each zone and keeps the DNS lookup results updated based on these health checks.

You can use this command to create and enable a health check monitor, or to update the settings for an existing health check monitor. To create a new monitor, include the --enable option and the options for all settings that you want to configure.

To update an existing monitor, you must include all the options for the settings that you want, including existing settings.
Cluster health image v1.1.9 v1.1.11 Updated Go version for [CVE-2020-16845](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16845) and [CVE-2020-24553](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24553). 
 etcd v3.3.22 v3.3.25 See the [etcd release notes](https://github.com/etcd-io/etcd/releases/v3.3.25). 
 GPU device plug-in and installer bacb9e1 edd26a4 Updated Go version for [CVE-2020-16845](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16845) and [CVE-2020-24553](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24553). Updated the GPU drivers to version [450.51.06](https://www.nvidia.com/download/driverResults.aspx/162630). 
 IBM Cloud File Storage for Classic plug-in and monitor 377 378 Updated Go version for [CVE-2020-16845](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16845). 
 IBM Cloud Provider v1.16.14-311 v1.16.15-331 Updated to support the Kubernetes 1.16.15 release.