vania-janet/multiturn-rag-retrieval-data huggingface dataset:
ibmcloud oc infra-permissions get --region REGION [--output json] [-q]

Minimum required permissions
: Viewer platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

--region REGION
: Required: Specify a region in Red Hat OpenShift on IBM Cloud: jp-osa, jp-tok, au-syd, eu-de, eu-gb, us-east, or us-south.

--output json
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.



 Example infra-permissions get command 

ibmcloud oc infra-permissions get --region us-south

Example output

Missing Virtual Worker Permissions

Add Server suggested
Cancel Server suggested
View Virtual Server Details required

Missing Physical Worker Permissions

No changes are suggested or required.

Missing Network Permissions

No changes are suggested or required.

Missing Storage Permissions

Add Storage required
Manage Storage required









 kms commands 

Enable a [key management service (KMS) provider](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionkms) in your cluster to encrypt the etcd component and Kubernetes secrets with a root key that you control.



 ibmcloud oc kms crk ls 

Virtual Private Cloud

Classic infrastructure

List available customer root keys (CRKs) in a key management service instance. Root keys wrap and unwrap the local data encryption keys (DEKs) that the cluster uses to encrypt its secrets. For more information, see [Understanding Key Management Service (KMS) providers](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionkms).

Do not delete root keys in your KMS instance, even if you rotate to use a new key. If you delete a root key that a cluster uses, the cluster becomes unusable, loses all its data, and can't be recovered.
To run the Terraform scripts, you modify:



* The input.auto.tfvars file to specify the existing VPC resources for your solution. You specify the variables for the existing VPC:



* VPC name
* Security group
* Subnet
* HostName(s)





You can change the default SAP system configuration settings to match your solution. You also specify the location where you downloaded the SAP kits.

The IBM Cloud Provider plug-in for Terraform on IBM Cloud uses these configuration files to deploy HANA db backup to iCOS automation module on already installed HANA database instance on the specified VPC in your IBM Cloud account.





 Support 

There are no warranties of any kind, and there is no service or technical support available for these materials from {{site.data.keyword.ibm}}. As a recommended practice, review carefully any materials that you download from this site before you use them on a live system.

Though the materials provided herein are not supported by the IBM® Service organization, your comments are welcomed by the developers, who reserve the right to revise, re-adapt or remove the materials at any time. To report a problem, or provide suggestions or comments, open a Support case here.





 Before you begin 

Before you use the scripts in the Bastion cli: You need the following to get started with IBM Cloud Object Storage:



* An [IBM Cloud Platform account](https://cloud.ibm.com/)
* Set up your account to access the VPC. Make sure that your account is [upgraded to a paid account](https://cloud.ibm.com/docs/account?topic=account-accountfaqschangeacct)
* If you have not already, create a Bastion server to store the SAP kits. For more information, see [Automate SAP bastion server - SAP media storage repository](https://cloud.ibm.com/docs/sap?topic=sap-sap-bastion-server)
* Download the SAP kits from the SAP Portal to your Deployment Server. Make note of the download locations. Ansible decompresses the files.
* [Adding tags to clusters with the CLI](https://cloud.ibm.com/docs/openshift?topic=openshift-add_workersadd-tags-cli)



* [Adding labels to existing worker pools](https://cloud.ibm.com/docs/openshift?topic=openshift-add_workersworker_pool_labels)



[Creating and managing dedicated hosts on VPC Gen 2 infrastructure](https://cloud.ibm.com/docs/openshift?topic=openshift-dedicated-hostsdedicated-hosts)



* [Setting up dedicated hosts in the CLI](https://cloud.ibm.com/docs/openshift?topic=openshift-dedicated-hostssetup-dedicated-host-cli)
* [Removing worker nodes from a dedicated host in the CLI](https://cloud.ibm.com/docs/openshift?topic=openshift-dedicated-hostsremove-worker-nodes-cli)
* [Removing dedicated hosts in the CLI](https://cloud.ibm.com/docs/openshift?topic=openshift-dedicated-hostsremove-dedicated-hosts-cli)
* [Removing dedicated hosts pools in the CLI](https://cloud.ibm.com/docs/openshift?topic=openshift-dedicated-hostsremove-dedicated-host-pool-cli)



[Migrating to a new Red Hat Enterprise Linux version](https://cloud.ibm.com/docs/openshift?topic=openshift-rhel_migraterhel_migrate)



* [Migration actions by cluster version](https://cloud.ibm.com/docs/openshift?topic=openshift-rhel_migraterhel_migrate_versions)
* [Creating RHEL 8 worker pools in the command line](https://cloud.ibm.com/docs/openshift?topic=openshift-rhel_migraterhel-migrate-create-pools-cli)





 Autoscaling clusters
For more information, see: [Configuring CloudForms](https://access.redhat.com/documentation/en-us/red_hat_cloudforms/5.0/html/installing_red_hat_cloudforms_on_red_hat_openstack_platform/configuring-cloudforms)







 Step C. Integrating CloudForms with IBM Cloud Pak for Multicloud Management 

Enable navigation to CloudForms within the IBM Cloud Pak® console.

Complete the following steps on a Linux system. You can use the boot node from the HUB cluster where IBM Cloud Pak for Multicloud Management is installed. These steps enable navigation to CloudForms from the IBM Cloud Pak console:



1. Obtain the Automation navigation for IBM Cloud Pak for Multicloud Management 1.3 script, automation-navigation-updates.sh, from [IBM Passport Advantage®](https://www.ibm.com/software/passportadvantage/) website. This script was downloaded from IBM Passport Advantage in the "Before you begin" section.
2. Install and authenticate kubectl. For more information, see [Installing the Kubernetes CLI (kubectl)](https://www.ibm.com/support/knowledgecenter/SSFC4F_1.3.0/kubectl/install_kubectl.html).
3. Install JQ. For more information, see [Download jq](https://stedolan.github.io/jq/download/).
4. Copy the automation-navigation-updates.sh script to a directory location. Set the file permissions on the script and run the script to enable navigation to your CloudForms instance:

chmod 755 ./automation-navigation-updates.sh

./automation-navigation-updates.sh -c <CloudForms URL>



* -c Is a required parameter that refers to the URL for the CloudForms console. For example, https://vm17-cf-test.ibm.com//



5. Verify that the CloudForms instance is in the IBM Cloud Pak console navigation menu.
Make sure to include the @ sign before the path to your ignition file.

ibmcloud is instance-create INSTANCE-NAME VPC VPC-ZONE-NAME VPC-PROFILE-NAME VPC-SUBNET --image VPC-RHCOS-IMAGE-ID --user-data @ATTACH-SCRIPT-LOCATION --keys SSH-KEY-ID

Example command to create VPC Gen 2 instances and attach hosts to Red Hat CoreOS enabled location. For more information, about the instance create command, see the VPC Gen 2 [command line reference](https://cloud.ibm.com/docs/vpc?topic=vpc-infrastructure-cli-plugin-vpc-reference&interface=cliinstance-create).

ibmcloud is instance-create instance-1 my-vpc us-south-1 bx2d-4x16 0111-11e11111-1c11-1111-11aa-ba1a1d1cd111 —-keys my-key --image r001-a1f111b1-11bc-1e1e-b11c-1d11c1111111 --user-data @/var/register-host_coreos.ign
11. Repeat the previous step to create VPC Gen 2 instances for each host that you want to attach. Plan to attach at least 3 hosts to use in the control plane, and attach additional hosts for any services that you want to use.
12. Check that your hosts are shown in the Hosts tab of your [Satellite console](https://cloud.ibm.com/satellite/locations). All hosts show a Health status of Ready when a connection to the machine can be established, and a Status of Unassigned as the hosts are not yet assigned to your Satellite location control plane or a Red Hat OpenShift on IBM Cloud cluster.
13.
* [Opting out of remote health reporting](https://cloud.ibm.com/docs/openshift?topic=openshift-remote-health-monitoring-opt-outremote-health-opt-out)







 API reference 

[IBM Cloud Kubernetes Service API](https://containers.cloud.ibm.com/global/swagger-global-api//)

[IBM Cloud Kubernetes Service API JSON](https://containers.cloud.ibm.com/global/swagger-global-api/swagger.json)

[OpenShift Container Platform REST API](https://docs.openshift.com/container-platform/4.11/rest_api/index.html)





 CLI plug-in reference 

[Red Hat OpenShift on IBM Cloud CLI Map](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map)



* [ibmcloud oc cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_cluster)
* [ibmcloud oc worker](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_worker)
* [ibmcloud oc worker-pool](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_worker-pool)
* [ibmcloud oc zone](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_zone)
* [ibmcloud oc ingress](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_ingress)
...
"os": "RHEL7"
...
"state": "assigned",
"assignment": {
"zone": "us-south-1",
},

},
...
]
2. Download the host attach script for the location.

ibmcloud sat host attach --location LOCATION_ID
3. Provision a RHEL 8 host for your Satellite location in the identified zone and run the host attach script on that host. This process varies, depending on your infrastructure. For more information, see [Attaching hosts to your location](https://cloud.ibm.com/docs/satellite?topic=satellite-attach-hosts).
4. After your RHEL 8 host is attached to the location, you can assign it to the location control plane by using the host assign command.

ibmcloud sat host assign --host HOST_NAME --location LOCATION_ID --cluster infrastructure --zone ZONE
5. After you assign the RHEL 8 host to the control plane, you can remove a RHEL 7 host from the same zone that the RHEL 8 host was added to.

ibmcloud sat host rm --location LOCATION_ID --host HOST_NAME



Repeat these steps until all your RHEL 7 control plane hosts are replaced by RHEL 8 hosts and removed from the location.

If you have clusters running RHEL 7 hosts in your location, you might need to migrate your worker nodes. For more information, follow the [migration guide](https://cloud.ibm.com/docs/openshift?topic=openshift-rhel_migrate) for your cluster version.
* [ibmcloud oc infra-permissions](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_infra-permissions)
* [ibmcloud oc kms](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_kms)
* [ibmcloud oc quota](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_quota)
* [ibmcloud oc subnets](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_subnets)
* [ibmcloud oc vlan](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_vlan)
* [ibmcloud oc vpcs](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_vpcs)
* [ibmcloud oc flavors](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_flavors)
* [ibmcloud oc locations](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_locations)
* [ibmcloud oc messages](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_messages)
* [ibmcloud oc versions](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_versions)
Applying a plan using the UI 



1. After you generate a plan in the IBM Cloud console, click Apply plan. This action generates a new log that can be viewed in the Jobs tab.
2. Review the log file for any errors, fix the errors, and then click Apply plan again.
3. After you successfully apply a plan, you can review all of the resources that are deployed in this workspace by clicking the Resources tab.
4. Make sure to make a note of the SSH command that's printed at the end of the Apply plan log file (you'll use this SSH command to access your cluster).









 Step 5: Access the Red Hat OpenShift for HPC cluster 

You have different options to connect with the Red Hat OpenShift cluster either from the IBM Cloud console or the login node.



 Access the cluster from the IBM Cloud console 



1. In the IBM Cloud console, go to Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/9de14ae11cc0bda57c240e5b42f2964edeaab3c6/icons/icon_hamburger.svg) > OpenShift > Clusters, and then select your cluster.
2. Click OpenShift web console for the user interface view.







 Access the cluster from the login node with a token 



1. You first need to SSH into the login server node. To get your SSH login command, go to the Schematics > Workspaces page in the IBM Cloud console, and then select your workspace. You can find your SSH login command in the Apply plan log file in the Jobs section of your workspace. The following command is an example:

ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null root@169.63.100.221
2. In the IBM Cloud console, go to Menu icon !
In this tutorial, you provision IBM Cloud classic infrastructure for the Red Hat OpenShift Container Platform by using Terraform on IBM Cloud. Before you can start the classic infrastructure provisioning process, you must ensure that you set up Terraform on IBM Cloud, the IBM Cloud Provider plug-in, and the Terraform on IBM Cloud OpenShift project.



1. Create a Docker container that installs Terraform on IBM Cloud and the IBM Cloud Provider plug-in. To execute Terraform on IBM Cloud commands, you must be logged in to the container. You can also [install Terraform on IBM Cloud and the IBM Cloud Provider plug-in](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-setup_clisetup_cli) on your local machine to run Terraform on IBM Cloud commands without a Docker container.



1. Download the latest version of the Docker image for Terraform on IBM Cloud to your local machine.

docker pull ibmterraform/terraform-provider-ibm-docker

Example output:

Using default tag: latest
latest: Pulling from ibmterraform/terraform-provider-ibm-docker
911c6d0c7995: Pull complete
fed331e93a76: Pull complete
82a1ea1a0cd7: Pull complete
a4b4f00ab356: Pull complete
78858415d97d: Pull complete
515c9be5f236: Pull complete
94021f117e26: Pull complete
a50b454f6bba: Pull complete
dd63d43987e3: Pull complete
a098dba94337: Pull complete
Digest: sha256:df316f5ed26cbec1bc1ad7a6f6d2c978f767408080a4a4db954c94c91e8271e5
Status: Downloaded newer image for ibmterraform/terraform-provider-ibm-docker:latest
* Resource details: Review the resource prefix that is automatically added to each IBM Cloud resource that is created. You can also optionally provide your own IBM Cloud IAM API key if you don't need a new API key generated for you.
* Integrations: A new instance of each of the following IBM Cloud services is created for you by default. You can edit the template to select an existing instance.



4. In the Summary pane, click Create.







 Creating a secure cluster by using a template with the CLI 

With the secure cluster template, you can create a cluster from the CLI with IBM Cloud Provider Plug-in for Terraform that already has certain security integrations such as encryption, logging, and monitoring enabled by default.



1. [Install the IBM Cloud Provider Plug-in for Terraform CLI](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-setup_cli).
2. [Configure the IBM Cloud Provider Plug-in for Terraform](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-provider-reference).
3. [Access your Red Hat OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-access_cluster).
4. Clone the [GitHub repository for IBM Cloud Provider Plug-in for Terraform modules](https://github.com/terraform-ibm-modules/terraform-ibm-cluster/).

git@github.com:terraform-ibm-modules/terraform-ibm-cluster.git
5. Go to the examples/secure-roks-cluster directory, and review the [README.md file](https://github.com/terraform-ibm-modules/terraform-ibm-cluster/tree/master/examples/secure-roks-cluster) for more information about how to update any of the template default variables.
6.
For more information, see [Managing resource groups](https://cloud.ibm.com/docs/account?topic=account-rgs). No Default 
 ssh_key_name Comma-separated list of names of the SSH key configured in your IBM Cloud account that is used to establish a connection to the Red Hat OpenShift login node. Ensure that the SSH key is present in the same resource group and region where the cluster is being provisioned. If you do not have an SSH key in your IBM Cloud account, create one by using the [SSH keys](https://cloud.ibm.com/docs/vpc?topic=vpc-ssh-keys) instructions. Yes None 
 storage_node_instance_type Specify the virtual server instance profile type to be used to create the NFS storage node for the Red Hat OpenShift cluster. The storage node is used to create an NFS file system instance that is exported and can be mounted for sharing data among the Red Hat OpenShift cluster nodes. For more information, see [Instance Profiles](https://cloud.ibm.com/vpc?topic=vpc-profiles). No bx2-2x8 
 volume_capacity Size in GB for the block storage that will be used to build the NFS file system instance on the storage node. Enter a value in the range 10 - 16,000. For more information, see [Block storage capacity and performance](https://cloud.ibm.com/docs/vpc?topic=vpc-capacity-performance&interface=uiblock-storage-vpc-capacity). No 100 
 volume_iops Number to represent the IOPS (Input Output Per Second) configuration for block storage to be used for the NFS storage node (valid only for volume_profile=custom, dependent on volume_capacity. Enter a value in the range 100 - 48,000). For more information, see [Custom IOPS profile](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-profiles&interface=uicustom). No 100
Log in to your virtual machine. If prompted, enter the password that you retrieved earlier.

ssh root@<ip_address>

If you use an SSH key to log in, use the following command.

ssh -i <filepath_to_key_file.key> <username>@<IP_address>
8. Refresh the Red Hat packages on your machine.

subscription-manager refresh
9. Enable the package repositories on your machine.



* RHEL 7:

subscription-manager repos --enable rhel-server-rhscl-7-rpms
subscription-manager repos --enable rhel-7-server-optional-rpms
subscription-manager repos --enable rhel-7-server-rh-common-rpms
subscription-manager repos --enable rhel-7-server-supplementary-rpms
subscription-manager repos --enable rhel-7-server-extras-rpms
* RHEL 8 classic:

subscription-manager repos --enable rhel-8-for-x86_64-appstream-rpms
subscription-manager repos --enable rhel-8-for-x86_64-baseos-rpms
* RHEL 8 VPC:

subscription-manager release --set=8
subscription-manager repos --enable rhel-8-for-x86_64-baseos-rpms
subscription-manager repos --enable rhel-8-for-x86_64-appstream-rpms
subscription-manager repos --disable='eus'
yum install container-selinux -y



10. Run the registration script on your machine.

nohup bash /tmp/attach.sh &
11. Monitor the progress of the registration script.

journalctl -f -u ibm-host-attach
12. Exit the SSH session.

exit
13. Check that your hosts are shown in the Hosts tab of your [Satellite console](https://cloud.ibm.com/satellite/locations).
* [How Red Hat OpenShift on IBM Cloud integrates with context-based restrictions](https://cloud.ibm.com/docs/openshift?topic=openshift-cbrcbr-overview)



* [Protecting Red Hat OpenShift on IBM Cloud resources](https://cloud.ibm.com/docs/openshift?topic=openshift-cbrresources-types-cbr)
* [Protecting specific APIs](https://cloud.ibm.com/docs/openshift?topic=openshift-cbrprotect-api-types-cbr)
* [Allowing Red Hat OpenShift on IBM Cloud to access other IBM Cloud resources by using CBR](https://cloud.ibm.com/docs/openshift?topic=openshift-cbrcbr-integrations)



* [Creating network zones](https://cloud.ibm.com/docs/openshift?topic=openshift-cbrcreate-cbr-network-zone-openshift)



* [Creating network zones from the API](https://cloud.ibm.com/docs/openshift?topic=openshift-cbrcreate-network-zone-api)
* [Creating network zones from the CLI](https://cloud.ibm.com/docs/openshift?topic=openshift-cbrcreate-network-zone-cli)
* [Creating network zones from the console](https://cloud.ibm.com/docs/openshift?topic=openshift-cbrcreate-network-zone-console)



* [Creating rules](https://cloud.ibm.com/docs/openshift?topic=openshift-cbrcreate-cbr-rule-openshift)



* [Creating rules by using the API](https://cloud.ibm.com/docs/openshift?topic=openshift-cbrcreate-cbr-rule-api)
Optional: If you want to set up a journal device or KVDB devices, enter the device details in the Advanced Options field. Choose from the following options for journal devices.



* Enter j;auto to allow Portworx to automatically create a 3 GB partition on one of your block storage devices to use for the journal.
* Enter j;</device/path> to use a specific device for the journal. For example, enter j;/dev/vde to use the disk located at /dev/vde. To find the path of the device that you want to use for the journal, log in to a worker node and run lsblk.
* Enter kvdb_dev;<device path> to specify the device where you want to store internal KVDB data. For example, kvdb_dev;/dev/vdd. To find the path of the device that you want to use, log in to a worker node and run lsblk. To use a specific device for KVDB data, you must have an available storage device of 3GB or on at least 3 worker nodes. The devices must also and on the same path on each worker node. For example: /dev/vdd.





2. Click Create to start the Portworx installation in your cluster. This process might take a few minutes to complete. The service details page opens with instructions for how to verify your Portworx installation, create a persistent volume claim (PVC), and mount the PVC to an app.
3. From the [IBM Cloud resource list](https://cloud.ibm.com/resources), find the Portworx service that you created.
4. Review the Status column to see if the installation succeeded or failed. The status might take a few minutes to update.
5. If the Status changes to Provision failure, follow the [instructions](https://cloud.ibm.com/docs/openshift?topic=openshift-debug-portworx) to start troubleshooting why your installation failed.
6.
Build the artifacts by running the make command.

make prod







 Installation and configuration of the Mount Helper 



1. Download the Mount Helper package:

curl -LO https://github.com/IBM/vpc-file-storage-mount-helper/releases/download/latest/mount.ibmshare-latest.tar.gz
tar -xvf mount.ibmshare-latest.tar.gz

The tar file contains the following contents: install/uninstall scripts, mount helper rpm and deb packages, root CA certificates, and configuration file.

Closed environments: To install Mount Helper on a virtual server instance without internet connection, create or update a local repository on the VSI based on the OS. Copy the Mount Helper package along with its dependencies to the local directory.
2. Every installation image is accompanied by a file that contains the checksum value for the image file. For example, the image file ibmshare-0.0.1.tar.gz is accompanied by the ibmshare-0.0.1.tar.gz.sha256 file that contains checksum value. To verify the integrity of the downloaded package, use the following command to verify the file mount.ibmshare-latest.tar.gz.

sha256sum -c mount.ibmshare-latest.tar.gz.sha256

A successful response shows "OK". The output looks like the following example.

 sha256sum -c mount.ibmshare-latest.tar.gz.sha256
./mount.ibmshare-latest.tar.gz: OK
3. To install the Mount Helper and all the dependencies, use the following script.

./install.sh region=dal

The installation script accepts the command-line argument region. Example regions are dal, fra, lon, osa, sao, syd, tok, tor, wdc. This argument is used to copy region-specific root CA cert to the strongSwan certificates location. If no region is specified, then the utility copies all the root CA certs.
4.