vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Bind the service to your cluster to create service credentials for your service that use the public cloud service endpoint and store the credentials in a Kubernetes secret. If you have existing service credentials, use the --key option to specify the name of the credentials. For IAM-enabled services, the credentials are automatically created with the Writer service access role, but you can use the --role option to specify a different service access role. If you use the --key option, don't include the --role option.

If your service supports private cloud service endpoints, you can manually create the service credentials with the private cloud service endpoint, and then use the --key option to specify the name of your credentials.

ibmcloud ks cluster service bind --cluster <cluster_name_or_ID> --namespace <namespace> --service <service_instance_name> [--key <service_instance_key>] [--role <IAM_service_role>]

When the creation of the service credentials is successful, a Kubernetes secret with the name binding-<service_instance_name> is created.

Example output

ibmcloud ks cluster service bind --cluster mycluster --namespace mynamespace --service cleardb
Binding service instance to namespace...
OK
Namespace: mynamespace
Secret name: binding-<service_instance_name>
5. Verify the service credentials in your Kubernetes secret.



1. Get the details of the secret and note the binding value. The binding value is base64 encoded and holds the credentials for your service instance in JSON format.

kubectl get secrets binding-<service_instance_name> --namespace=<namespace> -o yaml

Example output

apiVersion: v1
data:
binding: <binding>
kind: Secret
metadata:
annotations:
service-instance-id: 1111aaaa-a1aa-1aa1-1a11-111aa111aa11
service-key-id: 2b22bb2b-222b-2bb2-2b22-b22222bb2222
: The port that your service listens to. Use the same port that you defined when you created the Kubernetes service for your app.
2. Create the Ingress resource for your cluster. Ensure that the resource deploys into the same project as the app services that you specified in the resource.

oc apply -f myingressresource.yaml -n <project>
3. Verify that the Ingress resource was created successfully. If messages in the events describe an error in your resource configuration, fix the values in your resource file and reapply the file for the resource.

oc describe ingress myingressresource



Your Ingress resource is created in the same project as your app services, and your apps are registered with the Ingress controller.





 Step 4: Access your app from the internet 

In a web browser, enter the URL of the app service to access.

https://<domain>/<app1_path>

If you exposed multiple apps, access those apps by changing the path that is appended to the URL.

https://<domain>/<app2_path>

If you use a wildcard domain, access those apps with their own subdomains.

http://<subdomain1>.<domain>/<app1_path>

http://<subdomain2>.<domain>/<app1_path>

Can't connect to your app through Ingress? Try [Troubleshooting Ingress](https://cloud.ibm.com/docs/openshift?topic=openshift-ingress-status).







 Publicly exposing apps in VPC clusters with a private cloud service endpoint only 

Virtual Private Cloud

If your cluster is created on VPC infrastructure and you enabled only the private cloud service endpoint when you created it, your cluster is created with only a private Ingress controller by default. To publicly expose your apps, you must first create a public Ingress controller. Then, you must register your Ingress controller with a subdomain and, optionally, import your own TLS certificate.



 Step 1: Deploy apps and create app services
Set the Service name to secure-file-storage-activity-tracker.
2. Ensure you have the right permissions assigned to manage the service instance by following [these instructions](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-iam_manage_eventsadmin_account_opt1).







 Create a cluster for the application 

Kubernetes Service provides an environment to deploy highly available apps in containers that run in Kubernetes clusters.

Skip this section if you have an existing Standard cluster you want to reuse with this tutorial, throughout the remainder of this tutorial the cluster name is referenced as secure-file-storage-cluster, simply substitute with the name of your cluster. Note the minimum required Kubernetes version of 1.19.

A minimal cluster with one (1) zone, one (1) worker node and the smallest available size (Flavor) is sufficient for this tutorial. A minimum Kubernetes version of 1.19 is required. Make sure to select an appropriate version when creating the cluster.

Open the [Kubernetes clusters](https://cloud.ibm.com/kubernetes/clusters) and click Create cluster. See the documentation referenced below for more details based on the cluster type. Summary:



* Click Standard tier cluster
* For Kubernetes on VPC infrastructure see reference documentation [Creating VPC clusters](https://cloud.ibm.com/docs/containers?topic=containers-cluster-create-vpc-gen2&interface=ui).



* Click Create VPC:



* Enter a name for the VPC.
* Chose the same resource group as the cluster.
* Click Create.



* Attach a Public Gateway to each of the subnets that you create:



* Navigate to the [Virtual private clouds](https://cloud.ibm.com/vpc-ext/network/vpcs).
* Click the previously created VPC used for the cluster.
* Scroll down to subnets section and click a subnet.
* In the Public Gateway section, click Detached to change the state to Attached.
* UI
* CLI
* API







 Generating a plan 

After you've created your workspace, you need to generate a plan to validate all of the configuration properties.



 Generating a plan using the UI 



1. In the IBM Cloud® console, after the workspace is created, you can review the properties and the variables that are associated with that workspace by using the Settings tab. Make sure to update the following required parameters: api_key, region, and ssh_key_name. In addition, review the cluster_prefix and worker_nodes_per_zone values to make sure that they are correct according to your specifications and requirements.
2. After you review all of the values, make any applicable changes, click Generate plan.
3. When you click Generate plan, a new log is generated that can be viewed in the Jobs tab by clicking Jobs.
4. Review the log file for any errors, fix the properties, and regenerate the plan by clicking Generate plan again.







 Next steps 

After you've successfully generated a plan, you can begin [Applying a plan](https://cloud.ibm.com/docs/hpc-openshift?topic=hpc-openshift-applying-plan&interface=ui) to deploy your IBM Cloud resources to build a Red Hat® OpenShift® cluster instance.





 Generating a plan using the CLI 

Run the following command to generate the plan for your workspace.

ibmcloud schematics plan --id <WORKSPACE_ID>

You can view the log file to look for errors or confirm that the action was completed successfully. You might need to run this command multiple times to track the outcome of the command until it's completed.

ibmcloud schematics logs --id <WORKSPACE_ID>





 Next steps 

After you've successfully generated a plan, you can begin [Applying a plan](https://cloud.ibm.com/docs/hpc-openshift?topic=hpc-openshift-applying-plan&interface=cli) to deploy your IBM Cloud resources to build a Red Hat® OpenShift® cluster instance.





 Generating a plan using the API 



1.
The values in the example file are the default values allocated to each container. Allocating more resources to your console allows you to operate a larger number of nodes or channels.
* If you plan to use the console with a multizone Kubernetes cluster, you need to add the zones to the clusterdata.zones: section of the file. When zones are provided to the deployment, you can select the zone that a node is deployed to using the console or the APIs. As an example, if you are deploying to a cluster across the zones of dal10, dal12, and dal13, you would add the zones to the file by using the format below.

clusterdata:
zones:
- dal10
- dal12
- dal13



When you finish editing the file, click Create.

Unlike the resource allocation, you cannot add zones to a running network. If you have already deployed a console and used it to create nodes on your cluster, you will lose your previous work. After the console restarts, you need to deploy new nodes.





 Use your own TLS Certificates (Optional) 

The IBM Blockchain Platform console uses TLS certificates to secure the communication between the console and your blockchain nodes and between the console and your browser. You have the option of creating your own TLS certificates and providing them to the console by using a Kubernetes secret. If you skip this step, the console creates its own self-signed TLS certificates during deployment.

This step needs to be performed before the console is deployed.

You can use a Certificate Authority or tool to create the TLS certificates for the console. The TLS certificate needs to include the hostname of the console and the proxy in the subject name or the alternative domain names. The console and proxy hostname are in the following format:

Console hostname:<PROJECT_NAME>-ibpconsole-console.<DOMAIN>
Proxy hostname:<PROJECT_NAME>-ibpconsole-proxy.<DOMAIN>



* Replace <PROJECT_NAME> with the name of your IBM Blockchain Platform deployment project.
* Replace <DOMAIN> with the name of your cluster domain. You can find this value from your OpenShift web console URL.
Use this option to retain stable static IP addresses across cluster removals and creations, or to order larger blocks of IP addresses. If instead you want to get more portable public or private IP addresses to create network load balancer (NLB) or Ingress application load balancer (ALB) services, see [Adding portable IP addresses](https://cloud.ibm.com/docs/openshift?topic=openshift-subnetsadding_ips).

All subnets that were automatically ordered during cluster creation are immediately marked for deletion after you delete a cluster, and you can't reuse the subnets to create a new cluster.

Before you begin



* [Access your Red Hat OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-access_cluster).
* To reuse user-managed private subnets from a cluster that you no longer need, delete the unneeded cluster.

ibmcloud oc cluster rm --cluster <cluster_name_or_ID>
* The 172.16.0.0/16, 172.18.0.0/16, 172.19.0.0/16, and 172.20.0.0/16 subnet ranges are prohibited.



To create a cluster by using existing subnets:



1. Get the subnet ID and the ID of the VLAN that the subnet is on.

ibmcloud oc subnets --provider classic

In this example output, the subnet ID is 1602829 and the VLAN ID is 2234945:

GETting subnet list...
OK
ID Network Gateway VLAN ID Type Bound Cluster
1550165 10.xxx.xx.xxx/26 10.xxx.xx.xxx 2234947 private
1602829 169.xx.xxx.xxx/28 169.xx.xxx.xxx 2234945 public
2. [Create a cluster from the CLI](https://cloud.ibm.com/docs/openshift?topic=openshift-cluster-create-classic) by using the VLAN ID that you identified.
To specify custom pod and service subnets during cluster creation, use the --pod-subnet and --service-subnet options in the ibmcloud oc cluster create CLI command.

To see the pod and service subnets that your cluster uses, look for the Pod Subnet and Service Subnet fields in the output of ibmcloud oc cluster get.





 Pods 

Default range
: In the first cluster that you create in a VPC, the default pod subnet is 172.17.0.0/18. In the second cluster that you create in that VPC, the default pod subnet is 172.17.64.0/18. In each subsequent cluster, the pod subnet range is the next available, non-overlapping /18 subnet.

Size requirements
: When you specify a custom subnet, consider the size of the cluster that you plan to create and the number of worker nodes that you might add in the future. The subnet must have a CIDR of at least /23, which provides enough pod IPs for a maximum of four worker nodes in a cluster. For larger clusters, use /22 to have enough pod IP addresses for eight worker nodes, /21 to have enough pod IP addresses for 16 worker nodes, and so on.

Range requirements
: The pod and service subnets can't overlap each other, and the pod subnet can't overlap the VPC subnets for your worker nodes. The subnet that you choose must be within one of the following ranges.



* 172.17.0.0 - 172.17.255.255
* 172.21.0.0 - 172.31.255.255
* 192.168.0.0 - 192.168.254.255
* 198.18.0.0 - 198.19.255.255







 Services 

Default range
: All services that are deployed to the cluster are assigned a private IP address in the 172.21.0.0/16 range by default.

Size requirements
: When you specify a custom subnet, the subnet must be specified in CIDR format with a size of at least /24, which allows a maximum of 255 services in the cluster, or larger.

Range requirements
To run default Red Hat OpenShift components such as the web console or OperatorHub, and to allow your cluster to access public endpoints such as a public URL of another app or an IBM Cloud service that supports public cloud service endpoints only, you must attach a public gateway to your subnet.
7. Click Create subnet.



4. Use the subnets to [create a cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-cluster-create-vpc-gen2). Do not delete the subnets that you attach to your cluster during cluster creation or when you add worker nodes in a zone. If you delete a VPC subnet that your cluster used, any load balancers that use IP addresses from the subnet might experience issues, and you might be unable to create new load balancers.







 Creating VPC subnets for classic access from the CLI 



1. In your command line, log in to your IBM Cloud account and target the IBM Cloud region and resource group where you want to create your VPC cluster. For supported regions, see [Creating a VPC in a different region](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-in-a-different-region). The cluster's resource group can differ from the VPC resource group. Enter your IBM Cloud credentials when prompted. If you have a federated ID, use the --sso option to log in.

ibmcloud login -r <region> [-g <resource_group>] [--sso]
2. Create a classic access VPC without default address prefixes. In the output, copy the VPC ID.

ibmcloud is vpc-create <name> --classic-access --address-prefix-management manual
3. For each zone in which you plan to create subnets, create one or more address prefixes.
To specify custom pod and service subnets during cluster creation, use the --pod-subnet and --service-subnet options in the ibmcloud ks cluster create CLI command.

To see the pod and service subnets that your cluster uses, look for the Pod Subnet and Service Subnet fields in the output of ibmcloud ks cluster get.





 Pods 

Default range
: In the first cluster that you create in a VPC, the default pod subnet is 172.17.0.0/18. In the second cluster that you create in that VPC, the default pod subnet is 172.17.64.0/18. In each subsequent cluster, the pod subnet range is the next available, non-overlapping /18 subnet.

Size requirements
: When you specify a custom subnet, consider the size of the cluster that you plan to create and the number of worker nodes that you might add in the future. The subnet must have a CIDR of at least /23, which provides enough pod IPs for a maximum of four worker nodes in a cluster. For larger clusters, use /22 to have enough pod IP addresses for eight worker nodes, /21 to have enough pod IP addresses for 16 worker nodes, and so on.

Range requirements
: The pod and service subnets can't overlap each other, and the pod subnet can't overlap the VPC subnets for your worker nodes. The subnet that you choose must be within one of the following ranges.



* 172.17.0.0 - 172.17.255.255
* 172.21.0.0 - 172.31.255.255
* 192.168.0.0 - 192.168.254.255
* 198.18.0.0 - 198.19.255.255







 Services 

Default range
: All services that are deployed to the cluster are assigned a private IP address in the 172.21.0.0/16 range by default.

Size requirements
: When you specify a custom subnet, the subnet must be specified in CIDR format with a size of at least /24, which allows a maximum of 255 services in the cluster, or larger.

Range requirements
For more information, see [Creating an allowlist for the private cloud service endpoint](https://cloud.ibm.com/docs/containers?topic=containers-access_clusterprivate-se-allowlist).





 Rotating CA certificates in your cluster 

Revoke existing certificate authority (CA) certificates in your cluster and issue new CA certificates.

By default, certificate authority (CA) certificates are administered to secure access to various components of your cluster, such as the master API server. As you use your cluster, you might want to revoke the certificates issued by the existing CA. For example, the administrators of your team might use a certificate signing request (CSR) to manually generate certificates that are signed by the cluster's CA for worker nodes in the cluster. If an administrator leaves your organization, you can ensure that they no longer have admin access to your cluster by creating a new CA and certificates for your cluster, and removing the old CA and certificates.



1. Create a CA for your cluster. Certificates that are signed by this new CA are issued for the cluster master components, and the API server is refreshed.

ibmcloud ks cluster ca create -c CLUSTER
2. Ensure that your cluster's master health is normal, the API server refresh is complete, and any master updates are complete. It might take several minutes for the master API server to refresh.

ibmcloud ks cluster get --cluster CLUSTER
3. Check the status of the CA creation. In the output, note the timestamp in the Action Completed field.

ibmcloud ks cluster ca status -c CLUSTER

Example output

Status: CA certificate creation complete. Ensure that your worker nodes are reloaded before you start a CA certificate rotation.
Action Started: 2020-08-30T16:17:56+0000
Action Completed: 2020-08-30T16:21:13+0000
4. Download the updated Kubernetes configuration data and certificates in your cluster's kubeconfig file.

ibmcloud ks cluster config -c CLUSTER --admin --network
5. Update any tooling that relies on the previous certificates.
To specify custom pod and service subnets during cluster creation, use the --pod-subnet and --service-subnet options in the ibmcloud oc cluster create CLI command.



 Pods 

Default range
: All services that are deployed to the cluster are assigned a private IP address in the 172.30.0.0/16 range by default.

Size requirements
: When you specify a custom subnet, consider the size of the cluster that you plan to create and the number of worker nodes that you might add in the future. The subnet must have a CIDR of at least /23, which provides enough pod IPs for a maximum of four worker nodes in a cluster. For larger clusters, use /22 to have enough pod IP addresses for eight worker nodes, /21 to have enough pod IP addresses for 16 worker nodes, and so on.

Range requirements
: The pod and service subnets can't overlap each other, and the pod subnet can't overlap the subnets for your worker nodes. The subnet that you choose must be within one of the following ranges. - 172.17.0.0 - 172.17.255.255 - 172.21.0.0 - 172.31.255.255 - 192.168.0.0 - 192.168.254.255 - 198.18.0.0 - 198.19.255.255
: The 172.16.0.0/16, 172.18.0.0/16, 172.19.0.0/16, and 172.20.0.0/16 ranges are prohibited.





 Services 

Default range
: All services that are deployed to the cluster are assigned a private IP address in the 172.21.0.0/16 range by default.

Size requirements
: When you specify a custom subnet, the subnet must be specified in CIDR format with a size of at least /24, which allows a maximum of 255 services in the cluster, or larger.

Range requirements
: The pod and service subnets can't overlap each other.
* If worker nodes must access public endpoints, or if you plan to enable both the public and private cloud service endpoints, you must [attach a public gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-vpc-resources-with-cli-and-api&interface=cliattach-public-gateway-cli) to each subnet to access default Red Hat OpenShift components such as the web console or OperatorHub.
* Important: Do not delete the subnets that you attach to your cluster during cluster creation or when you add worker nodes in a zone. If you delete a VPC subnet that your cluster used, any load balancers that use IP addresses from the subnet might experience issues, and you might be unable to create new load balancers.
* For more information, see [Overview of VPC networking in Red Hat OpenShift on IBM Cloud: Subnets](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-subnetsvpc_basics_subnets).



4. Create the cluster in your VPC. You can use the ibmcloud oc cluster create vpc-gen2 command to create a single zone cluster in your VPC with worker nodes that are connected to one VPC subnet only. If you want to create a multizone cluster, you can use the IBM Cloud console, or [add more zones](https://cloud.ibm.com/docs/openshift?topic=openshift-add_workersvpc_add_zone) to your cluster after the cluster is created. The cluster takes a few minutes to provision.
Virtual Private Cloud

If your cluster is created on VPC infrastructure and you enabled only the private cloud service endpoint when you created it, your cluster is created with only a private Ingress controller by default. To publicly expose your apps, you must first create a public Ingress controller. Then, you must register your Ingress controller with a subdomain and, optionally, import your own TLS certificate.



 Step 1: Deploy apps and create app services 

Start by deploying your apps and creating Kubernetes services to expose them.



1. [Deploy your app to the cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_apps). Ensure that you add a label to your deployment in the metadata section of your configuration file, such as app: code. This label is needed to identify all pods where your app runs so that the pods are in the Ingress load balancing.
2. For each app deployment that you want to expose, create a Kubernetes ClusterIP service. Your app must be exposed by a Kubernetes service to be included in the Ingress load balancing.



oc expose deploy <app_deployment_name> --name my-app-svc --port <app_port> -n <namespace>





 Step 2: Set up TLS termination with TLS certificates and Kubernetes secrets 

Your TLS certificate must be stored as a Kubernetes secret in each namespace where your apps exist.



 TLS secrets for custom Ingress domains 

To use a domain that you created yourself, such as a domain that is registered with an external provider, see [Setting up TLS secrets for custom subdomains](https://cloud.ibm.com/docs/containers?topic=containers-secretstls-custom).





 TLS secrets for IBM-managed Ingress domains 

Follow the steps to set up TLS secrets for the IBM-managed Ingress domain.



1. List the existing subdomains in your cluster. In the Subdomain column of the output, copy the subdomain that has the highest i00<n> value.