vania-janet/multiturn-rag-retrieval-data huggingface dataset:
- ReadWriteMany
resources:
requests:
storage: 24Gi
Show more





 Packaging apps for reuse in multiple environments with Kustomize 

As part of a [twelve-factor](https://12factor.net/), cloud-native app, you want to maintain dev-to-prod parity by setting up a continuous development and delivery pipeline that uses a common, version-controlled code base source. In your code base repositories, you store your Kubernetes resource configuration manifest files, often in YAML format. You can use the Kubernetes project [Kustomize](https://kustomize.io/) both to standardize and customize your deployments across multiple environments.

For example, you can set up a base kustomization YAML file to declare Kubernetes objects such as deployments and PVCs that are shared in your development, testing, and production environments. Next, you can set up separate kustomization YAML files that have customized configurations for each environment, such as more replicas in production than testing. These customized YAML files can then overlay, or build on, the shared base YAML file so that you can manage environments that are mostly identical except for a few overlay configuration differences that you source-control. For more information about Kustomize such as a glossary and FAQs, check out the [Kustomize docs](https://kubectl.docs.kubernetes.io/references/kustomize/).

Before you begin:



* Make sure that your [kubectl version](https://cloud.ibm.com/docs/containers?topic=containers-cli-install) matches your cluster version.
* [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)



To set up configuration files with Kustomize:



1.
About the managed Istio add-on 

Istio on IBM Cloud® Kubernetes Service provides a seamless installation of Istio, automatic updates and lifecycle management of Istio control plane components, and integration with platform logging and monitoring tools.

With one click, you can get all Istio core components up and running. Istio on IBM Cloud Kubernetes Service is offered as a managed add-on so that IBM Cloud automatically keeps all your Istio components up-to-date.



 What is Istio? 

[Istio](https://www.ibm.com/cloud/istio) is an open service mesh platform to connect, secure, control, and observe microservices on cloud platforms such as Kubernetes in IBM Cloud Kubernetes Service.

When you shift monolith applications to a distributed microservice architecture, a set of new challenges arises such as how to control the traffic of your microservices, do dark launches and canary rollouts of your services, handle failures, secure the service communication, observe the services, and enforce consistent access policies across the fleet of services. To address these difficulties, you can leverage a service mesh. A service mesh provides a transparent and language-independent network for connecting, observing, securing, and controlling the connectivity between microservices. Istio provides insights and control over the service mesh by so that you can manage network traffic, load balance across microservices, enforce access policies, verify service identity, and more.

For example, using Istio in your microservice mesh can help you:



* Achieve better visibility into the apps that run in your cluster.
* Deploy canary versions of apps and control the traffic that is sent to them.
* Enable automatic encryption of data that is transferred between microservices.



An Istio service mesh is composed of a data plane and a control plane. The data plane consists of Envoy proxy sidecars in each app pod, which mediate communication between microservices. The control plane consists of Pilot, Mixer telemetry and policy, and Citadel, which apply Istio configurations in your cluster.
Calico v2.6.5 v3.1.1 See the Calico [release notes](https://docs.tigera.io/calico/latest/release-notes/.). 
 Kubernetes Heapster v1.5.0 v1.5.2 See the Kubernetes Heapster [release notes](https://github.com/kubernetes-retired/heapster/releases/tag/v1.5.2). 
 Kubernetes v1.9.7 v1.10.1 See the Kubernetes [release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.10.1). 
 Kubernetes Configuration N/A N/A Added StorageObjectInUseProtection to the --enable-admission-plugins option for the cluster's Kubernetes API server. 
 Kubernetes DNS 1.14.8 1.14.10 See the Kubernetes DNS [release notes](https://github.com/kubernetes/dns/releases/tag/1.14.10). 
 IBM Cloud Provider v1.9.7-102 v1.10.1-52 Updated to support Kubernetes 1.10 release. 
 GPU support N/A N/A Support for [graphics processing unit (GPU) container workloads](https://cloud.ibm.com/docs/containers?topic=containers-deploy_appgpu_app) is now available for scheduling and execution. For a list of available GPU flavors, see [Hardware for worker nodes](https://cloud.ibm.com/docs/containers?topic=containers-planning_worker_nodesplanning_worker_nodes). For more information, see the Kubernetes documentation to [Schedule GPUs](https://kubernetes.io/docs/tasks/manage-gpus/scheduling-gpus/).
A Chief Marketing Officer (CMO) needs to increase customer traffic by 20% in stores by making the stores a differentiating asset. Large retail competitors and online retailers are stealing sales. At the same time, the CMO needs to reduce inventory without markdowns because holding inventory too long locks up millions in capital.

IBM Cloud Kubernetes Service provides easy spin-up of more compute, where Developers quickly add Cloud Analytics services for sales behavior insights and digital market adaptability.

Key technologies:



* [Horizontal scaling to accelerate development](https://cloud.ibm.com/docs/containers?topic=containers-plan_deployhighly_available_apps)
* [Clusters that fit varied CPU, RAM, storage needs](https://cloud.ibm.com/docs/containers?topic=containers-planning_worker_nodesplanning_worker_nodes)
* [Insights to market trends with Watson Discovery](https://www.ibm.com/products/watson-discovery)
* [DevOps native tools, including open toolchains in IBM Cloud® Continuous Delivery](https://www.ibm.com/cloud/architecture/toolchains/)
* [Inventory management with IBM® Event Streams for IBM Cloud®](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-aboutabout)





 Context 

Traditional grocer increases customer traffic and sales with digital insights.



* Competitive pressures from online retailers and large retail stores disrupted traditional grocery retail models. Sales are declining, evidenced by low foot traffic in physical stores.
* Their loyalty program needs a boost in the arm with a modern take on the printed coupons at check out. So Developers must constantly evolve the related apps, but traditional tools slow their ability to deploy updates and features frequently.
* Certain high-value inventory isn’t moving as well as expected, but yet the “foodie” movement seems to be growing in major metropolitan markets.





 Solution 

The grocer needs an app to increase conversion and store traffic to generate new sales and build customer loyalty in a reusable cloud analytics platform.
When you need more capacity, you must increase the control plane evenly across zones and in multiples of 3, such as 6, 9, or 12 hosts.<br> * Establish initial network configuration so that hosts can connect to Satellite locations, such as allowing connectivity through firewalls or virtual private networks (VPNs).<br> * In the on-prem or other user-provided environment, set up hosts in a [highly available architecture](https://cloud.ibm.com/docs/satellite?topic=satellite-hasatellite-ha-setup), such as in three separate zones.<br> * Use the provided tools to manage hosts and [debug](https://cloud.ibm.com/docs/satellite?topic=satellite-ts-hosts-debug) any issues that might happen in the hosts.<br><br><br> 
 Satellite Config <br><br> * Provide a highly available configuration management service that you can use to manage the deployment of Kubernetes resources across clusters that are registered with the location.<br> * Provide an interface to initiate operational activities, such as to create and delete configurations.<br> * Provide a kubectl command that users can run in a Red Hat OpenShift cluster to register the cluster to Satellite Config.<br> * Provide the ability to create Kubernetes resource configurations, upload new versions, and subscribe a subset of cluster to a version, including to a previous version.<br> * Store app configuration files in a highly available, back-end data store (etcd).<br> * Automatically forward configuration events to your IBM Cloud Activity Tracker instance.<br><br><br> <br><br> * Use the provided tools to [set up clusters](https://cloud.ibm.com/docs/satellite?topic=satellite-setup-clusters-satconfig), upload your Kubernetes configuration file content as versions in the configuration, and subscribe your clusters to the [configuration](https://cloud.ibm.com/docs/satellite?topic=satellite-satcon-manage-direct-upload).
[API reference](https://cloud.ibm.com/apidocs/blockchain)





 Hyperledger Fabric 

[Hyperledger Fabric](https://cloud.ibm.com/docs/blockchain?topic=blockchain-hyperledger-fabrichyperledger-fabric)



* [Peers](https://cloud.ibm.com/docs/blockchain?topic=blockchain-hyperledger-fabrichyperledger-fabric-peer)
* [Certificate Authority](https://cloud.ibm.com/docs/blockchain?topic=blockchain-hyperledger-fabrichyperledger-fabric-certificate-authority)
* [Membership Service Provider](https://cloud.ibm.com/docs/blockchain?topic=blockchain-hyperledger-fabrichyperledger-fabric-membership-service-provider)
* [Ordering service](https://cloud.ibm.com/docs/blockchain?topic=blockchain-hyperledger-fabrichyperledger-fabric-ordering-service)
* [The Fabric SDKs](https://cloud.ibm.com/docs/blockchain?topic=blockchain-hyperledger-fabrichyperledger-fabric-fabric-sdks)
* [Transaction flow](https://cloud.ibm.com/docs/blockchain?topic=blockchain-hyperledger-fabrichyperledger-fabric-transaction-flow)







 Kubernetes 

[Kubernetes](https://cloud.ibm.com/docs/blockchain?topic=blockchain-k8s-overviewk8s-overview)



* [Key Kubernetes objects](https://cloud.ibm.com/docs/blockchain?topic=blockchain-k8s-overviewk8s-overview-key-obj)
* [IBM Cloud Kubernetes Service](https://cloud.ibm.com/docs/blockchain?topic=blockchain-k8s-overviewk8s-overview-iks)
If a container exceeds a request, its pod might be evicted if the worker node runs out of that resource that is exceeded. For more information about troubleshooting, see [Pods repeatedly fail to restart or are unexpectedly removed](https://cloud.ibm.com/docs/containers?topic=containers-ts-app-pod-fail).

Request
: The minimum amount of the resource that the scheduler reserves for the container to use. If the amount is equal to the limit, the request is guaranteed. If the amount is less than the limit, the request is still guaranteed, but the scheduler can use the difference between the request and the limit to fulfill the resources of other containers.

Limit
: The maximum amount of the resource that the container can consume. If the total amount of resources that is used across the containers exceeds the amount available on the worker node, containers can be evicted to free up space. To prevent eviction, set the resource request equal to the limit of the container. If no limit is specified, the default is the worker node's capacity.

For more information, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/).

resources:
requests:
memory: "512Mi"
cpu: "500m"
limits:
memory: "1024Mi"
cpu: "1000m"





 Liveness and readiness probes 

By default, Kubernetes sends traffic to your app pods after all containers in the pod start, and restarts containers when they crash. However, you can set health checks to improve the robustness of service traffic routing.

For example, your app might have a startup delay. The app processes might begin before the entire app is completely ready, which can affect responses especially when scaling up across many instances. With health checks, you can let your system can know whether your app is running and ready to receive requests. By setting these probes, you can also help prevent downtime when you perform a [rolling update](https://cloud.ibm.com/docs/containers?topic=containers-update_appapp_rolling) of your app.
App networking [Shared](https://cloud.ibm.com/docs/containers?topic=containers-responsibilities_iksincident-and-ops) IBM IBM IBM IBM 
 Cluster networking [Shared](https://cloud.ibm.com/docs/containers?topic=containers-responsibilities_iksincident-and-ops) IBM IBM IBM IBM 
 Cluster version IBM [Shared](https://cloud.ibm.com/docs/containers?topic=containers-responsibilities_ikschange-management) IBM IBM IBM 
 Worker nodes [Shared](https://cloud.ibm.com/docs/containers?topic=containers-responsibilities_iksincident-and-ops) [Shared](https://cloud.ibm.com/docs/containers?topic=containers-responsibilities_ikschange-management) IBM [Shared](https://cloud.ibm.com/docs/containers?topic=containers-responsibilities_ikssecurity-compliance) IBM 
 Master IBM IBM IBM IBM IBM 
 Service IBM IBM IBM IBM IBM 
 Virtual storage IBM IBM IBM IBM IBM 
 Virtual network IBM IBM IBM IBM IBM 
 Hypervisor IBM IBM IBM IBM IBM 
 Physical servers and memory IBM IBM IBM IBM IBM 
 Physical storage IBM IBM IBM IBM IBM 
 Physical network and devices IBM IBM IBM IBM IBM 
 Facilities and Data Centers IBM IBM IBM IBM IBM 







 Tasks for shared responsibilities by area 

After reviewing the [overview](https://cloud.ibm.com/docs/containers?topic=containers-responsibilities_iksoverview-by-resource), see what tasks you and IBM share responsibility for each area and resource when you use IBM Cloud Kubernetes Service.



 Incident and operations management 

You and IBM share responsibilities for the set up and maintenance of your IBM Cloud Kubernetes Service cluster environment for your application workloads. You are responsible for incident and operations management of your application data.



Table 2. Responsibilities for incident and operations management

 Resource IBM responsibilities Your responsibilities
* [Integration with IBM Cloud Kubernetes Service](https://cloud.ibm.com/docs/containers?topic=containers-service-partnersportworx-integration)
* [Billing and support](https://cloud.ibm.com/docs/containers?topic=containers-service-partnersportworx-billing-support)





[IBM Cloud services and third-party integrations](https://cloud.ibm.com/docs/containers?topic=containers-ibm-3rd-party-integrationsibm-3rd-party-integrations)



* [IBM Cloud services](https://cloud.ibm.com/docs/containers?topic=containers-ibm-3rd-party-integrationsibm-cloud-services)



* [IBM Cloud platform services](https://cloud.ibm.com/docs/containers?topic=containers-ibm-3rd-party-integrationsplatform-services)
* [IBM Cloud classic infrastructure services](https://cloud.ibm.com/docs/containers?topic=containers-ibm-3rd-party-integrationsinfrastructure-services)
* [IBM Cloud VPC infrastructure services](https://cloud.ibm.com/docs/containers?topic=containers-ibm-3rd-party-integrationsvpc-infrastructure-services)



* [Kubernetes community and open source integrations](https://cloud.ibm.com/docs/containers?topic=containers-ibm-3rd-party-integrationskube-community-tools)



* [Integrations operated in partnership](https://cloud.ibm.com/docs/containers?topic=containers-ibm-3rd-party-integrationsopen-source-partners)
* [Managed add-ons](https://cloud.ibm.com/docs/containers?topic=containers-ibm-3rd-party-integrationscluster-add-ons)
* [Other third-party integrations](https://cloud.ibm.com/docs/containers?topic=containers-ibm-3rd-party-integrationskube-community-helm)
IBM Cloud Code Engine 

IBM® Cloud Foundry is deprecated and no longer supported as of 1 June 2023. For more information, see the [deprecation details](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-deprecationdep_details).

IBM Cloud Code Engine excels at delivering a broad set of capabilities for application developers:



*  Deploy any kind of container-based workload (webapps, containers, event-driven serverless functions, micro-service, and batch jobs).
*  No infrastructure management needed. Cluster sizing, scaling and networking are all automatically managed.
*  Auto-scaling of your application based on load, even "scale-to-zero" when idle.
*  Subscribing to event producers, such as IBM Cloud Object Storage and Cron.
*  Apps are automatically secured with TLS and isolated from other workloads.
*  Less expensive in almost all cases (when compared to other IBM Cloud compute options).
*  "Push your code" from local disk developer experience.





  Learning resources 



*  [IBM information page](https://www.ibm.com/cloud/code-engine)
*  [IBM Cloud service creation page](https://cloud.ibm.com/codeengine/overview) (log-in needed)
*  [Documentation](https://cloud.ibm.com/docs/codeengine)



*  [Migration from Cloud Foundry](https://cloud.ibm.com/docs/codeengine?topic=codeengine-migrate-cf-ce-tutorial)
*  [Getting started with your migration from Cloud Foundry to Code Engine](https://cloud.ibm.com/docs/codeengine?topic=codeengine-migrate-cf-ce-getstart)
* [Checking if the user's credentials are used for infrastructure permissions](https://cloud.ibm.com/docs/containers?topic=containers-usersremoving_check_infra)
* [Removing a user from your account](https://cloud.ibm.com/docs/containers?topic=containers-usersremove_user)
* [Removing specific permissions](https://cloud.ibm.com/docs/containers?topic=containers-usersremove_permissions)





[Authorizing pods in your cluster to IBM Cloud services with IAM trusted profiles](https://cloud.ibm.com/docs/containers?topic=containers-pod-iam-identitypod-iam-identity)



* [Prerequisites](https://cloud.ibm.com/docs/containers?topic=containers-pod-iam-identityiam-identity-prereqs)
* [Creating an IAM trusted profile for your cluster in the API](https://cloud.ibm.com/docs/containers?topic=containers-pod-iam-identityiam-identity-create-api)
* [Creating an IAM trusted profile for your cluster in the UI](https://cloud.ibm.com/docs/containers?topic=containers-pod-iam-identityiam-identity-create-ui)
* [Configure your application pods to authenticate with IBM Cloud services](https://cloud.ibm.com/docs/containers?topic=containers-pod-iam-identityiam-identity-pod)



[Assigning cluster access by using Terraform for IBM Cloud Kubernetes Service](https://cloud.ibm.com/docs/containers?topic=containers-terraform-setupterraform-setup)



* [Creating a Kubernetes Service cluster by using Terraform](https://cloud.ibm.com/docs/containers?topic=containers-terraform-setupterraform-cluster-create)
Depending on the cluster version, the time lapse between the root key expiring and the cluster no longer being able to decrypt secrets might be about an hour, or when the master is refreshed.
3. Make sure that you have the correct permissions in IBM Cloud Identity and Access Management (IAM) to enable KMS in your cluster.



* Ensure that you have the [Administrator IBM Cloud IAM platform access role](https://cloud.ibm.com/docs/openshift?topic=openshift-userschecking-perms) for the cluster.
* Ensure that the API key owner of the [API key](https://cloud.ibm.com/docs/openshift?topic=openshift-access-credsapi_key_about) that is set for the region and resource group that your cluster is in has the correct permissions for the KMS provider. For more information on granting access in IAM to the KMS provider, see the [Key Protect user access documentation](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-access) or [Hyper Protect Crypto Services user access documentation](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-accessplatform-mgmt-roles).



* For example, to create an instance and root key, you need at least the Editor platform and Writer service access roles for your KMS provider.
* If you plan to use an existing KMS instance and root key, you need at least the Viewer platform and Reader service access roles for your KMS provider.



* An additional Reader[service-to-service authorization policy](https://cloud.ibm.com/docs/account?topic=account-serviceauth) between Red Hat OpenShift on IBM Cloud and Key Protect is automatically created for your cluster, if the policy does not already exist. Without this policy, your cluster can't use all the [Key Protect features](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionkms-keyprotect-features).



4. Enable KMS encryption.
* [Creating an IAM trusted profile for your cluster in the API](https://cloud.ibm.com/docs/openshift?topic=openshift-pod-iam-identityiam-identity-create-api)
* [Creating an IAM trusted profile for your cluster in the UI](https://cloud.ibm.com/docs/openshift?topic=openshift-pod-iam-identityiam-identity-create-ui)
* [Configure your application pods to authenticate with IBM Cloud services](https://cloud.ibm.com/docs/openshift?topic=openshift-pod-iam-identityiam-identity-pod)



[Assigning cluster access by using Terraform for Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-terraform-setupterraform-setup)



* [Creating a Red Hat OpenShift cluster by using Terraform](https://cloud.ibm.com/docs/openshift?topic=openshift-terraform-setupterraform-cluster-create)
* [Assigning IAM user access to Red Hat OpenShift clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-terraform-setupterraform-cluster-IAM)







 Securing cluster workloads 

[Protecting sensitive information in your cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionencryption)



* [Overview of cluster encryption](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionencrypt_ov)
* [Understanding Key Management Service (KMS) providers](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionkms)



* [Available KMS providers](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionkms-providers)
DevOps operator [Operator platform access role for a cluster](https://cloud.ibm.com/docs/containers?topic=containers-iam-platform-access-roles), [Writer service access role not scoped to a namespace (for the whole cluster)](https://cloud.ibm.com/docs/containers?topic=containers-iam-service-access-roles), [Cloud Foundry developer space role](https://cloud.ibm.com/docs/containers?topic=containers-cloud-foundry-roles). 
 Operator or site reliability engineer [Administrator platform access role for a cluster, region, or resource group](https://cloud.ibm.com/docs/containers?topic=containers-iam-platform-access-roles), [Reader service access role for a cluster or region](https://cloud.ibm.com/docs/containers?topic=containers-iam-service-access-roles) or [Manager service access role for all cluster namespaces](https://cloud.ibm.com/docs/containers?topic=containers-iam-service-access-roles) to be able to use kubectl top nodes,pods commands. 







 Assigning IBM Cloud IAM roles with the console 

Grant users access to your IBM Cloud Kubernetes Service clusters by assigning IBM Cloud IAM platform access and service access roles with the IBM Cloud console.

don't assign platform access roles at the same time as a service access role. You must assign platform and service access roles separately.

Before you begin, verify that you're assigned the Administrator platform access role for the IBM Cloud account in which you're working.



1. Log in to the [IBM Cloud console](https://cloud.ibm.com/). From the menu bar, select Manage > Access (IAM).
2. Select users individually or create an access group of users.



* To assign roles to an individual user



1. Click the Users page, and then click the name of the user that you want to set permissions for. If the user isn't shown, click Invite users to add them to the account.
2.