vania-janet/multiturn-rag-retrieval-data huggingface dataset:
(https://cloud.ibm.com/docs/CDN?topic=solution-tutorials-static-files-cdn)[Accelerate a dynamic website Learn how to use Dynamic Content Acceleration (DCA) to optimize the performance of non-static content.](https://cloud.ibm.com/docs/CDN?topic=solution-tutorials-dynamic-content-cdn)

 Video library 

[![carousel thumbnail](https://cloud.ibm.com/docs-content/v1/content/CDN//images/thumbnail1.png)<br><br>What is a Content Delivery Network?](https://cloud.ibm.com/docs/CDN?topic=CDN-content-delivery-network-video)[![carousel thumbnail](https://cloud.ibm.com/docs-content/v1/content/CDN//images/thumbnail3.png)<br><br>Setting up a web app with security group, load balancer, and CDN](https://cloud.ibm.com/docs/CDN?topic=CDN-set-up-web-app-video)

 Learn more 

[IBM Developer<br><br>Visit IBM Developer for technical articles, code patterns, tutorials, and more.<br><br>![112-Developer-tools.svg](https://cloud.ibm.com/media/docs/images/homepage/112-Developer-tools.svg)](https://developer.ibm.com/depmodels/cloud/)[Architecture Center<br><br>Discover the architecture references available for this product.<br><br>![190-Application-Platform.svg](https://cloud.ibm.com/media/docs/images/homepage/190-Application-Platform.svg)](https://www.ibm.com/cloud/architecture/architectures/hybrid-messaging/overview/)[IBM Training<br><br>Build your skills with IBM Cloud training.<br><br>!
IBM_KP_CUSTOMER_ROOT_KEY: AaAAAaZAAAAy11AAAyAAkaAaQtAAk0AAA2AzY5AjYaaa67aa your base64 encoded root key ID
  IBM_KP_SERVICE_API_KEY: AAAaaajAAAAAncmAAaaaaAAAAdAAId1AtVjBJRU1aAAaAeTh1aEw=AaaaA your base64 encoded API
kind: Secret
metadata:
  name: ibm-hpcs-secret
  namespace: openshift-storage
type: Opaque
2. Create the secret in your cluster.

oc apply -f ibm-hpcs-secret.yaml



4. Verify that your secret is created.

oc get secrets -A | grep ibm-hpcs-secret









 Installing the OpenShift Data Foundation add-on from the console 

To install ODF in your cluster, complete the following steps.



1. Before you enable the add-on, review the [change log](https://cloud.ibm.com/docs/openshift?topic=openshift-odf_addon_changelog) for the latest version information.
2. [Review the parameter reference](https://cloud.ibm.com/docs/openshift?topic=openshift-deploy-odf-vpc&interface=uiodf-vpc-param-ref).
3. From the [Red Hat OpenShift clusters console](https://cloud.ibm.com/kubernetes/clusters?platformType=openshift), select the cluster where you want to install the add-on.
4. On the cluster Overview page, on the OpenShift Data Foundation card, click Install. The Install ODF panel opens.
5. In the Install ODF panel, enter the configuration parameters that you want to use for your ODF deployment.
6. Select either Essentials or Advanced as your billing plan.
7. For VPC clusters, select Remote provisioning to dynamically provision volumes for ODF by using the Block Storage for VPC.
8.
ibmcloud oc cluster addon enable openshift-data-foundation -c <cluster_name> --version <version>

Example command for deploying the ODF and creating a storage cluster while overriding the osdSize parameter.

ibmcloud oc cluster addon enable openshift-data-foundation -c <cluster_name> --version <version> --param "osdSize=500Gi"
7. Verify the add-on is in a Ready state.

oc get storagecluster -n openshift-storage

Example output:

NAME                 AGE   PHASE   EXTERNAL   CREATED AT             VERSION
ocs-storagecluster   53m   Ready              2023-03-10T12:20:52Z   4.11.0
8. Verify that the ibm-ocs-operator-controller-manager- pod is running in the kube-system namespace.

oc get pods -A | grep ibm-ocs-operator-controller-manager
9. If you enabled the add-on with odfDeploy set to false, follow the steps to [create an ODF custom resource](https://cloud.ibm.com/docs/openshift?topic=openshift-deploy-odf-vpc&interface=uiocs-vpc-deploy-crd).







 Creating your ODF custom resource 

To create an ODF storage cluster in your VPC cluster by using dynamic provisioning for your storage volumes, you can create a custom resource to specify storage device details.

If you want to use an IBM Cloud Object Storage service instance as your default backing store, make sure that you [created the service instance](https://cloud.ibm.com/docs/openshift?topic=openshift-deploy-odf-vpc&interface=uiodf-create-cos), and created the Kubernetes secret in your cluster. When you create the ODF CRD in your cluster, ODF looks for a secret named ibm-cloud-cos-creds to set up the default backing store that uses your Object Storage HMAC credentials.



1. Create a custom resource definition called OcsCluster.
kubectl get secrets | grep my-cos

Example output.

my-cos-secret ibm/ibmc-s3fs 3 11m







 Step 3: Installing the plug-in 

When you install the plug-in in your cluster, make sure to specify the --set quotaLimit=true option. Specifying this option means any buckets you create with PVCs have a quota limit equal to the storage size in the PVC.



1. Follow the steps to [install the plug-in and enable quota limits](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_cos_install). If you've already installed the plug-in in your cluster, you can skip this step. To see if the plug-in is already installed, follow the next step.
2. Verify the plug-in is installed by listing the driver pods.

kubectl get pods -n ibm-object-s3fs | grep object

Example output.

ibmcloud-object-storage-driver-k9x4l 1/1 Running 0 6m52s
ibmcloud-object-storage-driver-kj9m6 1/1 Running 0 6m52s
ibmcloud-object-storage-driver-l8gqk 1/1 Running 0 6m52s
ibmcloud-object-storage-plugin-576fb8bd7-sxlkb 1/1 Running 0 6m52s







 Step 4: Dynamically provisioning a bucket with a quota 

You can use dynamic provisioning to automatically create a Object Storage bucket when you a create a PVC.



1. Copy the following PVC configuration and save it to a file called pvc.yaml. This example PVC automatically creates a bucket with a quota equal to 20Gi.

kind: PersistentVolumeClaim
apiVersion: v1
metadata:
name: my-cos-pvc
namespace: default
annotations:
ibm.io/auto-create-bucket: "true"
ibm.io/auto-delete-bucket: "true"
Spectrum LSF still dynamically provisions compute hosts at public virtual server instances, and dedicated hosts are used only for static compute hosts that are provisioned at the time the cluster is created. The number of dedicated hosts and the profile names for dedicated hosts are calculated from worker_node_min_count and worker_node_instance_type. No false 
 dedicated_host_placement Specify 'pack' or 'spread'. The 'pack' option deploys virtual server instances on one dedicated host until full before moving on to the next dedicated host. The 'spread' option deploys instances in round-robin fashion across all of the dedicated hosts. The 'spread' option should result in mostly even distribution of instances on the hosts, while the 'pack' option might result in one dedicated host being mostly empty. No spread 
 enable_app_center Set to "true" to install and enable the use of IBM Spectrum LSF Application Center GUI. For more information on system requirements, see [System requirements for IBM Spectrum LSF Application Center Version 10.2 Fix Pack 13](https://www.ibm.com/docs/en/slac/10.2.0?topic=requirements-system-102-fix-pack-13). No false 
 hyperthreading_enabled Setting this to true enables hyper-threading in the worker nodes of the cluster (default). Otherwise, hyper-threading is disabled. No true 
 ibm_customer_number Comma-separated list of the IBM Customer Number(s) (ICN) that is used for the Bring Your Own License (BYOL) entitlement check. For more information on how to find your ICN, see [What is my IBM Customer Number (ICN)?](https://www.ibm.com/support/pages/what-my-ibm-customer-number-icn) Yes None 
 image_name Name of the custom image that you want to use to create virtual server instances in your IBM Cloud account to deploy the IBM Spectrum LSF cluster. By default, the automation uses a base image with additional software packages documented [here](https://cloud.ibm.com/docs/ibm-spectrum-lsfcreate-custom-image).
* Diffie-Hellman (DH) - Key exchange protocol used in Phase 1 to generate a shared secret key between VPN peers. Optionally, users can enable Perfect Forward Secrecy (PFS) and a DH group for Phase 2 IPsec negotiation. IBM Cloud VPN for VPC supports DH groups 14-24 and 31.
* Encryption - IBM Cloud VPN for VPC supports AES-128, AES-192, and AES-256 for data encryption during both IKE Phase 1 and Phase 2.
* High availability - IBM Cloud VPN for VPC is built on two VPN devices to provide appliance-level redundancy. A policy-based VPN operates in Active-Standby mode with a single VPN gateway IP shared between the members, while a route-based VPN offers Active-Active redundancy with two VPN gateway IPs.

A static, route-based VPN deploys in Active-Active redundancy mode. Two VPN tunnels are connected with the peer VPN gateway; however, the IBM gateway always uses the tunnel with the small public IP as the primary egress path. The tunnel with the large public IP is the secondary egress path. Traffic from the IBM VPC to the on-prem network goes through the primary egress path if both tunnels are active. Traffic goes through the secondary egress path if the primary egress path is disabled. The on-prem VPN gateway must use route priority to choose the same preferred path.
* Internet Key Exchange (IKE) - IKE is a part of the IPsec protocol that is used to establish VPN connections. In IKE Phase 1, VPN peers use Diffie-Hellman (DH) key exchange to create a secure, authenticated communication channel. In IKE Phase 2, the peers use the secure channel from Phase 1 to negotiate parameters for IPsec tunnels. IBM Cloud VPN for VPC supports both IKEv1 (main mode) and IKEv2. See [About policy negotiation](https://cloud.ibm.com/docs/vpc?topic=vpc-using-vpnpolicy-negotiation) for the supported combinations.
* IPsec - Protocol suite that provides secure communication between devices.
/dev/mapper/pvc-a011a111-1111-1111-111a-aaa1a1111a11_encrypted 20G 45M 20G 1% /test
* Unencrypted volumes have a path structure of dev/mapper/<random_string>.

Filesystem Size Used Avail Use% Mounted on
overlay 98G 16G 78G 17% /
tmpfs 64M 0 64M 0% /dev
tmpfs 7.9G 0 7.9G 0% /sys/fs/cgroup
/dev/mapper/3600a09803830476e733f4e477370716e 24G 45M 24G 1% /test





Removing your Kubernetes secret doesn't revoke access to the volume data. If you created a pod-only deployment, you must delete the pod. If you created a deployment, you must delete the deployment.







 Adding block storage to apps 

Create a persistent volume claim (PVC) to [dynamically provision](https://cloud.ibm.com/docs/containers?topic=containers-kube_conceptsdynamic_provisioning) block storage for your cluster. Dynamic provisioning automatically creates the matching persistent volume (PV) and orders the actual storage device in your IBM Cloud infrastructure account.

Block storage comes with a ReadWriteOnce access mode. You can mount it to only one pod on one worker node in the cluster at a time.

Before you begin:



* If you have a firewall, [allow egress access](https://cloud.ibm.com/docs/containers?topic=containers-firewallvyatta_firewall) for the IBM Cloud infrastructure IP ranges of the zones that your clusters are in so that you can create PVCs.
* Install the [IBM Cloud block storage plug-in](https://cloud.ibm.com/docs/containers?topic=containers-block_storageinstall_block).
Review the section on [input precedence](https://cloud.ibm.com/docs/schematics?topic=schematics-blueprint-reuseblueprint-input-precedence) to understand input processing and sourcing of inputs.

Example of a statically defined local value

- name: provision_ats_instance
type: boolean
value: false





 inputs.default 

Type: Any valid Terraform variable type

Optional - mutually exclusive with the value key

A default value for the input. The default is used when no value is provided at run time from the blueprint configuration input file or dynamic (override) inputs. The default type is as defined by the inputs.type option.

Example of a default value

- name: place_instance
type: list(any)
default: 
[
"36",
"mqm-grand",
"madison-square-gardens"
]





 inputs.sensitive 

Type: Boolean

Default: false



Example

- name: ssh_key
sensitive: true





 inputs.max_length 

Type: Number



If max_length is not specified, the default maximum length of a variable value allowed by Blueprints is 1000 bytes. A value larger than 1000 bytes, or the specified length will result in the error Length for variable <variable name> greater than the given length

Example

- name: json_override
max_length: 10000





 inputs.min_length 

Type: Number

Optional









 outputs 

Type: list

Default: []

Optional

A list defining all the outputs that are returned by the template to the user. Each output is identified by a key-value pair.

Refer to the section [modules inputs](https://cloud.ibm.com/docs/schematics?topic=schematics-bp-template-schema-yamlbp-modules-inputs-value) for details on defining the $module interpolation to pass output values.

Example

outputs:
- name: schematics-service-url
This tutorial presents setup of a site-to-site IPSec VPN using a Virtual Router Appliance (VRA) to connect a subnet in a client data center to a secured subnet on the IBM Cloud private network.

This example builds on the [Isolate workloads with a secure private network](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-secure-network-enclosuresecure-network-enclosure) tutorial. It uses a site-to-site IPSec VPN, GRE tunnel and static routing. More complex VPN configurations that use dynamic routing (BGP etc) and VTI tunnels can be found in the [supplemental VRA documentation](https://cloud.ibm.com/docs/virtual-router-appliance?topic=virtual-router-appliance-supplemental-vra-documentationsupplemental-vra-documentation).



 Objectives 



* Document configuration parameters for IPSec VPN
* Configure IPSec VPN on a Virtual Router Appliance
* Route traffic through a GRE tunnel



Zoom

![Architecture](https://cloud.ibm.com/docs-content/v1/content/01ccb31b85637ed5f03008c920c9596354caaf98/virtual-router-appliance/includes/solution-tutorials/includes/solution-tutorials/images/solution36-configuring-IPSEC-VPN/sec-priv-vpn.png)

Figure 1. Architecture diagram of the tutorial



1. Document VPN Configuration
2. Create IPSec VPN on a VRA
3. Configuration of data center VPN and tunnel
4. Create GRE tunnel
5. Create static IP route
6. Configure firewall







 Before you begin
* Some applications such as Microsoft AD domain communication, and P2P applications could have technical problems with NAT.
* Where unknown servers need to communicate with the IBM Cloud or hundreds of bidirectional connections between IBM Cloud and on-premise servers are required. In this case all the mapping cannot be configured on the client router/NAT table because of an inability to identify the mapping beforehand.







 No address overlapping 

Is 10.0.0.0/8 used in the on-premises network? When no address overlaps exist between the on-premises and the IBM Cloud private network, GRE tunneling as described in [this tutorial](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-configuring-IPSEC-VPNconfiguring-IPSEC-VPN) can be used between on-premises and IBM Cloud to avoid the need for NAT translation. This requires a review of network address usage with onsite network team.





 Partial address overlapping 

If any of the 10.0.0.0/8 range is in use on the on-premises network, are there non-overlapping subnets available on the IBM Cloud network? Review existing network address usage with on-site network team and contact IBM Cloud technical sales to identify available non-overlapping networks.





 Is IP aliasing problematic? 

If no overlap-safe addresses exist, IP aliasing can be implemented on virtual and bare-metal servers deployed in the secure private network enclosure. IP aliasing assigns multiple subnet addresses on one or more network interfaces on each server.

IP aliasing is a commonly used technique, though it is recommended to review server and application configurations to determine if they work well under multi-home and IP alias configurations.

Additional routing configuration on the VRA will be required to create dynamic routes (for example BGP) or static routes for the BYOIP subnets.







 Related content 



* [IBM Cloud® Direct Link](https://cloud.ibm.com/docs/direct-link?topic=direct-link-configure-ibm-cloud-direct-linkconfigure-ibm-cloud-direct-link)
The NLB then looks up the hash key in a statically assigned hash table, and routes the request to the app pod that handles hashes of that range. This algorithm ensures that requests from a particular client are always directed to the same app pod. Kubernetes uses Iptables rules, which cause requests to be sent to a random pod on the worker. To use this scheduling algorithm, you must ensure that no more than one pod of your app is deployed per worker node. For example, if each pod has the label run=<app_name>, add the following anti-affinity rule to the spec section of your app deployment:

spec:
affinity:
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- weight: 100
podAffinityTerm:
labelSelector:
matchExpressions:
- key: run
operator: In
values:
- <APP_NAME>
topologyKey: kubernetes.io/hostname

You can find the complete example in [this IBM Cloud deployment pattern blog](https://www.ibm.com/cloud/blog/ibm-cloud-kubernetes-service-deployment-patterns-4-multi-zone-cluster-app-exposed-via-loadbalancer-aggregating-whole-region-capacity).





 Unsupported scheduling algorithms 

Destination Hashing (dh)
: The destination of the packet, which is the NLB IP address and port, is used to determine which worker node handles the incoming request. However, the IP address and port for NLBs in IBM Cloud Kubernetes Service don't change. The NLB is forced to keep the request within the same worker node that it is on, so only app pods on one worker handle all incoming requests.

Dynamic connection counting algorithms
: The following algorithms depend on dynamic counting of connections between clients and NLBs. However, because direct service return (DSR) prevents NLB 2.0 pods from being in the return packet path, NLBs don't track established connections.



* Least Connection (lc)
* Locality-Based Least Connection (lblc)
Placement policies define how your data is written to your backing stores. A Mirror placement policy mirrors objects across the backing stores in your bucket class and a Spread placement policy distributes the objects across the backing stores in your bucket class. 
 7 Config map ref A config map ref is a reference to a Kubernetes config map in your cluster. When you create an Object Bucket Claim, NooBaa dynamically creates a corresponding secret and config map. You can reference the secret and config map in your apps without needing to include these credentials in your applications. 
 8 Storage class A storage class in the Multicloud Object Gateway is similar to any other Kubernetes storage class in that it defines storage resource parameters. However, in the Multicloud Object Gateway, when you create a storage class, you specify the bucket class that you want to use. By creating a storage class from your bucket class, you can make your Multicloud Object Gateway resources available across namespaces. 
 9 Object bucket claim (OBC) An object bucket claim (OBC) is similar to a Kubernetes persistent volume claim (PVC) in that developers or storage admins can create OBCs to claim storage resources. When you create an OBC, you specify the storage class that you want to use and optionally provide a name for the dynamically created object bucket. 
 10 Object bucket An object bucket is a dynamically provisioned when you create an Object bucket claim. The object bucket abstracts one or more backing stores to a single resource. 
 11 Namespace bucket access key The access key is used to access your namespace bucket. Namespace buckets can include multiple namespace resources from different cloud providers or on-prem buckets. The namespace bucket access key and secret key are used in your s3 apps to configure access to your namespace bucket which then defines read and write policies to namespace resources that you configure. 
 12 Namespace bucket secret key The secret key is used to access your namespace bucket. Namespace buckets can include multiple namespace resources from different cloud providers or on-prem buckets.
* [Ubuntu ConfigMap](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-block-storage-driver-unmanagedvpc-block-ubuntu-cm)





[Removing Block Storage for VPC from your cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-storage-block-vpc-removestorage-block-vpc-remove)



* [Cleaning up Block Storage for VPC](https://cloud.ibm.com/docs/openshift?topic=openshift-storage-block-vpc-removecleaning-up-block-vpc)







 Setting up IBM Cloud File Storage for VPC 

[Enabling the IBM Cloud File Storage for VPC add-on](https://cloud.ibm.com/docs/openshift?topic=openshift-storage-file-vpc-installstorage-file-vpc-install)



* [Prerequisites](https://cloud.ibm.com/docs/openshift?topic=openshift-storage-file-vpc-installprereqs-store-file-vpc)



[Adding File Storage for VPC to apps](https://cloud.ibm.com/docs/openshift?topic=openshift-storage-file-vpc-appsstorage-file-vpc-apps)



* [Deploying an app that uses File Storage for VPC with dynamic provisioning](https://cloud.ibm.com/docs/openshift?topic=openshift-storage-file-vpc-appsvpc_add_file_dynamic)
* [Deploying an app that uses File Storage for VPC with static provisioning](https://cloud.ibm.com/docs/openshift?topic=openshift-storage-file-vpc-appsvpc_add_file_static)
ibmcloud oc cluster addon enable openshift-data-foundation -c <cluster_name> --version <version>

Example command for deploying the ODF and creating a storage cluster while overriding the osdSize parameter.

ibmcloud oc cluster addon enable openshift-data-foundation -c <cluster_name> --version <version> --param "osdSize=500Gi"
7. Verify the add-on is in a Ready state.

oc get storagecluster -n openshift-storage

Example output:

NAME                 AGE   PHASE   EXTERNAL   CREATED AT             VERSION
ocs-storagecluster   53m   Ready              2023-03-10T12:20:52Z   4.11.0
8. Verify that the ibm-ocs-operator-controller-manager- pod is running in the kube-system namespace.

oc get pods -A | grep ibm-ocs-operator-controller-manager
9. If you enabled the add-on with odfDeploy set to false, follow the steps to [create an ODF custom resource](https://cloud.ibm.com/docs/openshift?topic=openshift-deploy-odf-vpcocs-vpc-deploy-crd).







 Creating your ODF custom resource 

To create an ODF storage cluster in your VPC cluster by using dynamic provisioning for your storage volumes, you can create a custom resource to specify storage device details.

If you want to use an IBM Cloud Object Storage service instance as your default backing store, make sure that you [created the service instance](https://cloud.ibm.com/docs/openshift?topic=openshift-deploy-odf-vpcodf-create-cos), and created the Kubernetes secret in your cluster. When you create the ODF CRD in your cluster, ODF looks for a secret named ibm-cloud-cos-creds to set up the default backing store that uses your Object Storage HMAC credentials.



1. Create a custom resource definition called OcsCluster.