vania-janet/multiturn-rag-retrieval-data huggingface dataset:
subjects.name <br><br> * For User: Append the individual user's email address to IAM as follows: IAMuser@email.com.<br> * For Group: Specify the name of the [IBM Cloud IAM access group](https://cloud.ibm.com/docs/account?topic=account-groupsgroups) in your account.<br> * For ServiceAccount: Specify the service account name.<br><br><br> 
 subjects.apiGroup <br><br> * For User or Group: Use rbac.authorization.k8s.io.<br> * For ServiceAccount: Don't include this field.<br><br><br> 
 subjects.namespace For ServiceAccount only: Specify the name of the Kubernetes namespace that the service account is deployed to. 
 roleRef.kind Enter the same value as the kind in the role .yaml file: Role or ClusterRole. 
 roleRef.name Enter the name of the role .yaml file. 
 roleRef.apiGroup Use rbac.authorization.k8s.io. 



2. Create the role binding or cluster role binding resource in your cluster.

oc apply -f my_role_binding.yaml
3. Verify that the binding is created.

oc get rolebinding -n <namespace>



3. Optional: To enforce the same level of user access in other namespaces, you can copy the role bindings for those roles or cluster roles to other namespaces.



1. Copy the role binding from one namespace to another namespace.

oc get rolebinding <role_binding_name> -o yaml | sed 's/<namespace_1>/<namespace_2>/g' | oc -n <namespace_2> create -f -

For example, copy the custom-role role binding from the default namespace to the testns namespace.

oc get rolebinding custom-role -o yaml | sed 's/default/testns/g' | oc -n testns create -f -
2.
The host name that you enter can be the host name of your Management service. To access the Developer Portal API within the context of a Developer Portal, you must configure the base host name for the Developer Portal API calls. This action allows API Manager to map your host name to the provider organization and Catalog of the Developer Portal API calls. Your calls don't need to include the information.



7. Click the Save icon.





 Partitioning a Catalog 

To use the syndication feature in API Connect, you must enable Spaces in any Catalog in which you require syndication capabilities.

To enable Spaces in a Catalog, complete the following steps:



1. On the Dashboard of the API Manager UI, select the Catalog that you want to work with.
2. Click Settings > Overview, and click the Spaces slider control.
3. In the Enable Spaces window, click Enable, then click ![Save icon](https://cloud.ibm.com/docs-content/v1/content/78bb71851d95d7580503eb9ba10cf3ae31490ade/apiconnect/images/icon_save.png). A Manage spaces link is displayed beneath the Spaces slider control, and a Spaces link is added to the navigation list. You can manage your Spaces by clicking either of these links.



Spaces are enabled for your Catalog, and a default Space, called New Space is created.

For more information about using syndication, see the Knowledge Center topics, [Using syndication in IBM API Connect](https://www.ibm.com/support/knowledgecenter/SSFS6T/com.ibm.apic.apionprem.doc/capic_syndication_using.html).
subjects.name <br><br> * For User: Append the individual user's email address to IAM as follows: IAMuser@email.com.<br> * For Group: Specify the name of the [IBM Cloud IAM access group](https://cloud.ibm.com/docs/account?topic=account-groupsgroups) in your account.<br> * For ServiceAccount: Specify the service account name.<br><br><br> 
 subjects.apiGroup <br><br> * For User or Group: Use rbac.authorization.k8s.io.<br> * For ServiceAccount: Don't include this field.<br><br><br> 
 subjects.namespace For ServiceAccount only: Specify the name of the Kubernetes namespace that the service account is deployed to. 
 roleRef.kind Enter the same value as the kind in the role .yaml file: Role or ClusterRole. 
 roleRef.name Enter the name of the role .yaml file. 
 roleRef.apiGroup Use rbac.authorization.k8s.io. 



2. Create the role binding or cluster role binding resource in your cluster.

kubectl apply -f my_role_binding.yaml
3. Verify that the binding is created.

kubectl get rolebinding -n <namespace>



3. Optional: To enforce the same level of user access in other namespaces, you can copy the role bindings for those roles or cluster roles to other namespaces.



1. Copy the role binding from one namespace to another namespace.

kubectl get rolebinding <role_binding_name> -o yaml | sed 's/<namespace_1>/<namespace_2>/g' | kubectl -n <namespace_2> create -f -

For example, copy the custom-role role binding from the default namespace to the testns namespace.
An Accounts team deploys multiple app services in one namespace, but they need isolation to permit only necessary communication between the microservices over the public network. For the app Srv1, the team has front end, back end, and database services. They label each service with the app: Srv1 label and the tier: frontend, tier: backend, or tier: db label.

Zoom

![Use a network policy to manage cross-namepspace traffic.](https://cloud.ibm.com/docs-content/v1/content/4d497aff9e27b92fbbc2ee4e343a9ec4549cb1d7/containers/images/cs_network_policy_single_ns.png)

Figure 2. Use a network policy to manage namespace traffic

The Accounts team wants to allow traffic from the front end to the back end, and from the back end to the database. They use labels in their network policies to designate which traffic flows are permitted between microservices.

First, they create a Kubernetes network policy that allows traffic from the front end to the back end:

kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
name: backend-allow
spec:
podSelector:
matchLabels:
app: Srv1
tier: backend
ingress:
- from:
- podSelector:
matchLabels:
app: Srv1
Tier: frontend

The spec.podSelector.matchLabels section lists the labels for the Srv1 back-end service so that the policy applies only to those pods. The spec.ingress.from.podSelector.matchLabels section lists the labels for the Srv1 front-end service so that ingress is permitted only from those pods.

Then, they create a similar Kubernetes network policy that allows traffic from the back end to the database:

kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
name: db-allow
spec:
[Learn more](https://cloud.ibm.com/docs/containers?topic=containers-cs_cli_installkubectl).







 Step 1. Set the cluster context 



1. Open a terminal to log in to IBM Cloud.

ibmcloud login -a cloud.ibm.com

Select the account where you provisioned the IBM Log Analysis instance.
2. List the clusters to find out in which region and resource group the cluster is available.

ibmcloud ks clusters
3. Set the resource group and region.

ibmcloud target -g RESOURCE_GROUP -r REGION

Where

RESOURCE_GROUP is the name of the resource group where the cluster is available, for example, default.

REGION is the region where the cluster is available, for example, us-south.
4. Set the cluster where you want to configure logging as the context for this session.

ibmcloud ks cluster config --cluster <cluster_name_or_ID>







 Step 2. Create the ibm-observe namespace 

Observability services are deployed in the ibm-observe namespace.

First, check if the namespace exists. Run the following command:

kubectl get namespaces

Verify the ibm-observe namespace is active.

If you need to create the namespace, run the following command:

kubectl create namespace ibm-observe





 Step 3. Store your logging ingestion key as a Kubernetes secret 

Create a Kubernetes secret to store your logging ingestion key for your service instance.

The logging ingestion key is used to open a secure web socket to the logging ingestion server and to authenticate the logging agent with the IBM Log Analysis service.

Run the following command:

kubectl create secret generic logdna-agent-key --from-literal=logdna-agent-key=<LogDNA_ingestion_key> -n ibm-observe
To enable VRF, see [Enabling VRF](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpointvrf). To check whether a VRF is already enabled, use the ibmcloud account show command. If you can't or don't want to enable VRF, enable [VLAN spanning](https://cloud.ibm.com/docs/vlans?topic=vlans-vlan-spanningvlan-spanning). When a VRF or VLAN spanning is enabled, the NLB 1.0 can route packets to various subnets in the account.
* Ensure you have the [Writer or Manager IBM Cloud IAM service access role](https://cloud.ibm.com/docs/openshift?topic=openshift-userschecking-perms) for the default namespace.
* Ensure you have the required number of worker nodes: If you restrict network traffic to edge worker nodes, ensure that at least two [edge worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-edgeedge) are enabled in each zone so that NLBs deploy uniformly.
* When cluster nodes are reloaded or when a cluster master update includes a new keepalived image, the load balancer virtual IP is moved to the network interface of a new node. When this occurs, any long-lasting connections to your load balancer must be re-established. Consider including retry logic in your application so that attempts to re-establish the connection are made quickly.



To set up an NLB 1.0 service in a multizone cluster:



1. [Deploy your app to the cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_apps). Ensure that you add a label in the metadata section of your deployment configuration file. This custom label identifies all pods where your app runs to include them in the load balancing.
2. Create a load balancer service for the app that you want to expose to the public internet or a private network.



1.
Again, you need to determine the /dev/disk/by-uuid paths, as previously shown, and maintain /etc/fstab entries. As a final step, you need to set up the NFS to install SAP.



1. Install the NFS utilities on both virtual servers.

[root@sap-app-vsi ] yum install nfs-utils

[root@sap-app2-vsi ] yum install nfs-utils
2. Start the NFS server on the database virtual server.

[root@sap-app2-vsi ] systemctl enable nfs-server
[root@sap-app2-vsi ] systemctl start nfs-server
3. Use NFS to export /sapmnt and /usr/sap/trans from the database server to the application server by adding the required entry to /etc/exports of the database server:

/sapmnt/C10 10.243.129.0/24(rw,no_root_squash,sync,no_subtree_check)
/usr/sap/trans 10.17.139.0/24(rw,no_root_squash,sync,no_subtree_check)

You need to adapt the subnet in the previous example to your actual IP range and subnet mask. Replace the value C10 with the SAP System ID for your SAP system. C10 is a sample value. You must create the directory before you export it.
4. Run on the following command from the command line.

[root@sap-app2-vsi ] mkdir /sapmnt/C10
[root@sap-app2-vsi ] mkdir -p /usr/sap/trans
[root@sap-app2-vsi ] exportfs -a
5. Mount the NFS share on the application server by adding the following entry to its /etc/fstab and mount the application server from the command line by using the following command.

[root@sap-app-vsi ] vi /etc/fstab
...
ibmcloud dns resource-record-create $VMWARE_DNS_ZONE --type A --name nsx-1 --ipv4 $VMWARE_VNIC_NSX_T_MANAGER_1_IP

ibmcloud dns resource-record-create $VMWARE_DNS_ZONE --type A --name nsx-2 --ipv4 $VMWARE_VNIC_NSX_T_MANAGER_2_IP

ibmcloud dns resource-record-create $VMWARE_DNS_ZONE --type A --name nsx-3 --ipv4 $VMWARE_VNIC_NSX_T_MANAGER_3_IP

ibmcloud dns resource-record-create $VMWARE_DNS_ZONE --type A --name nsx --ipv4 $VMWARE_VNIC_NSX_T_MANAGER_VIP_IP







 Step 2: Create VLAN NICs for ESXi host TEPs 

In this step, the following Bare Metal Servers for VPC VLAN interfaces will be created for each host to be used as NSX-T Tunnel Endpoints (TEPs).



Table 2. Host management networks and VMkernel adapters

 Interface name Interface type VLAN ID Subnet Allow float VMkernel Adapter Distributed Port Group Name 

 vlan-nic-tep-vmk10 vlan 400 vpc-tep-subnet false vmk10 dpg-tep 





1. Allow PCI NICs to use the VLANs stated above. Repeat for each host.

ibmcloud is bm-nicu $VMWARE_BMS001 $VMWARE_BMS001_PNIC --allowed-vlans 100,200,300,400

ibmcloud is bm-nicu $VMWARE_BMS002 $VMWARE_BMS002_PNIC --allowed-vlans 100,200,300,400
List images. GET /api/v1/images container-registry.image.list container-registry.image.list 
 Delete more than one image. POST /api/v1/images/bulkdelete container-registry.image.delete container-registry.image.bulkdelete 
 List images by digest. POST /api/v1/images/digests container-registry.image.list container-registry.image.list 
 Create tag. POST /api/v1/images/tags container-registry.image.pull<br><br>container-registry.image.push container-registry.image.tag 
 Delete image. DELETE /api/v1/images/{image} container-registry.image.delete container-registry.image.delete 
 Inspect an image. GET /api/v1/images/{image}/json container-registry.image.inspect container-registry.image.inspect 
 Get image manifest. GET /api/v1/images/{image}/manifest container-registry.image.inspect container-registry.manifest.inspect 







 Message API methods 



Table 3. Messages

 Action Method IAM ACTION AT ACTION 

 Return any published system messages. GET /api/v1/messages 







 Namespace API methods 



Table 4. Namespaces

 Action Method IAM ACTION AT ACTION 

 List namespaces. GET /api/v1/namespaces container-registry.namespace.list container-registry.namespace.list 
 Detailed namespace list. GET /api/v1/namespaces/details container-registry.namespace.list container-registry.namespace.list 
 Create namespace. PUT /api/v1/namespaces/{namespace} container-registry.namespace.create container-registry.namespace.create 
 Assign namespace. PATCH /api/v1/namespaces/{namespace} container-registry.namespace.create container-registry.namespace.update 
 Delete namespace.
The shared team and the network team are now nicely separated. But how is Application1 isolated from Shared and Application2? They are Editor for the same types of services.

This is where resource groups can help out. Each service instance (i.e. resource) has a resource group attribute that is initialized upon creation and cannot be changed. In other words, each resource is in one resource group.

Resource Group diagram:

Zoom

![Resource Group diagram](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/includes/solution-tutorials/includes/solution-tutorials/images/solution59-vpc-tg-dns-iam/vpc-tg-dns-iam-resource-groups.png)

Resource Group diagram

Each microservice team will be allowed the access in the corresponding resource group. The network team will have access to all of these resource groups.

The network resource group contains Transit Gateway and the DNS service. The network team has access to these resources. The shared team will have Manager acess to the DNS service. The shared team needs to write the DNS entries for the shared services.

Later in the tutorial, after all resources have been created, it can be informative to open the [Resources list](https://cloud.ibm.com/resources) in the IBM Cloud console. It is possible to filter on resource group.









 Step 1: Create a local working environment 

All the operations will be performed in a bash shell and making use of terraform and ibmcloud command. You will find instructions to download and install these tools for your operating environment in the [Getting started with solution tutorials](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-tutorials) guide.



1. Git clone the following [repository](https://github.com/IBM-Cloud/vpc-tg-dns-iam):
For more information about how Kubernetes network policies control pod-to-pod traffic and for more example policies, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/services-networking/network-policies/).



 Isolate app services within a namespace 

The following scenario demonstrates how to manage traffic between app microservices within one namespace.

An Accounts team deploys multiple app services in one namespace, but they need isolation to permit only necessary communication between the microservices over the public network. For the app Srv1, the team has front end, back end, and database services. They label each service with the app: Srv1 label and the tier: frontend, tier: backend, or tier: db label.

Zoom

![Use a network policy to manage cross-namepspace traffic.](https://cloud.ibm.com/docs-content/v1/content/bce0f0917a9eea684d1b4b704ac6343a1f65f446/openshift/images/cs_network_policy_single_ns.png)

Figure 2. Use a network policy to manage namespace traffic

The Accounts team wants to allow traffic from the front end to the back end, and from the back end to the database. They use labels in their network policies to designate which traffic flows are permitted between microservices.

First, they create a Kubernetes network policy that allows traffic from the front end to the back end:

kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
name: backend-allow
spec:
podSelector:
matchLabels:
app: Srv1
tier: backend
ingress:
- from:
- podSelector:
matchLabels:
app: Srv1
Tier: frontend

The spec.podSelector.matchLabels section lists the labels for the Srv1 back-end service so that the policy applies only to those pods.
The shared team and the network team are now nicely separated. But how is Application1 isolated from Shared and Application2? They are Editor for the same types of services.

This is where resource groups can help out. Each service instance (i.e. resource) has a resource group attribute that is initialized upon creation and cannot be changed. In other words, each resource is in one resource group.

Resource Group diagram:

Zoom

![Resource Group diagram](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/solution-tutorials/includes/solution-tutorials/images/solution59-vpc-tg-dns-iam/vpc-tg-dns-iam-resource-groups.png)

Resource Group diagram

Each microservice team will be allowed the access in the corresponding resource group. The network team will have access to all of these resource groups.

The network resource group contains Transit Gateway and the DNS service. The network team has access to these resources. The shared team will have Manager acess to the DNS service. The shared team needs to write the DNS entries for the shared services.

Later in the tutorial, after all resources have been created, it can be informative to open the [Resources list](https://cloud.ibm.com/resources) in the IBM Cloud console. It is possible to filter on resource group.









 Step 1: Create a local working environment 

All the operations will be performed in a bash shell and making use of terraform and ibmcloud command. You will find instructions to download and install these tools for your operating environment in the [Getting started with solution tutorials](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-tutorials) guide.



1. Git clone the following [repository](https://github.com/IBM-Cloud/vpc-tg-dns-iam):
To perform previous steps through ansible automation, download ansible-galaxy collection ibm.power_linux_sap.

ansible-galaxy collection install ibm.power_linux_sap

After the ansible collection is installed, to set up proxy, update the variable file playbook/vars/sample_services_variable_file.yml.

server_config: {
ntp: { enable: true }
}

After the file is updated, run the following ansible-playbook command.

ansible-playbook --connection=local -i "localhost," powervs-services.yml -e @vars/sample_services_variable_file.yml

This ansible execution ensures that the NTP proxy is configured on the host for workload services.





 Setting up IBM Cloud-native DNS service (DNS option 1) 

You can use IBM Cloud DNS service that is directly reachable from IBM Power Virtual Servers over custom resolver. For more information, see the following links.



* [Setting up an instance](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-setting-up-your-dns-instance)
* [Managing DNS zones](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-managing-dns-zones&interface=ui)
* [Managing permitted networks](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-managing-permitted-networks&interface=ui)
* [Managing DNS records](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-managing-dns-records)
* [Configuring custom resolver](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-ui-create-cr). Specify VPE subnet of IBM Cloud VPC for workload services as location in the resolver.
[Resource Group diagram](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/solution59-vpc-tg-dns-iam/vpc-tg-dns-iam-resource-groups.png)

Resource Group diagram

Each microservice team will be allowed the access in the corresponding resource group. The network team will have access to all of these resource groups.

The network resource group contains Transit Gateway and the DNS service. The network team has access to these resources. The shared team will have Manager acess to the DNS service. The shared team needs to write the DNS entries for the shared services.

Later in the tutorial, after all resources have been created, it can be informative to open the [Resources list](https://cloud.ibm.com/resources) in the IBM Cloud console. It is possible to filter on resource group.









 Step 1: Create a local working environment 

All the operations will be performed in a bash shell and making use of terraform and ibmcloud command. You will find instructions to download and install these tools for your operating environment in the [Getting started with solution tutorials](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-tutorials) guide.



1. Git clone the following [repository](https://github.com/IBM-Cloud/vpc-tg-dns-iam):

git clone https://github.com/IBM-Cloud/vpc-tg-dns-iam
cd vpc-tg-dns-iam

Verify there is a directory for each team (skipping application2 for now):



* admin/
* network/
* shared/
* application1/



2. Create the terraform.tfvars file:

cp terraform.tfvars.template terraform.tfvars
Verify that the NodeLocal DNS cache daemon set is available.

kubectl get ds -n kube-system node-local-dns

Example output

NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR AGE
node-local-dns 4 4 4 4 4 ibm-cloud.kubernetes.io/node-local-dns-enabled=true 82d
2. Confirm that the NodeLocal DNS cache has a ConfigMap.



1. Determine if the NodeLocal DNS cache ConfigMap exists.

kubectl get cm -n kube-system node-local-dns-config

Example output if no ConfigMap exists

Error from server (NotFound): ConfigMaps "node-local-dns-config" not found
2. If the ConfigMap does not exist, create a NodeLocal DNS cache ConfigMap.

kubectl create cm -n kube-system node-local-dns-config

Example output

configmap/node-local-dns-config created



3. Edit the NodeLocal DNS cache ConfigMap. The ConfigMap uses the KubeDNS syntax to customize stub domains and upstream DNS servers. For more information, see the [Kubernetes documentation](https://kubernetes.io/docs/tasks/administer-cluster/dns-custom-nameservers/kube-dns).

kubectl edit cm -n kube-system node-local-dns-config

Example output

apiVersion: v1
kind: ConfigMap
metadata:
name: node-local-dns-config
namespace: kube-system
data:
stubDomains: 
{"abc.com" : ["1.2.3.4"]}
4. After a few minutes, the NodeLocal DNS cache pods pick up the ConfigMap changes.









 Setting up zone-aware DNS