vania-janet/multiturn-rag-retrieval-data huggingface dataset:
[IBM Developer<br><br>Visit IBM Developer for technical articles, code patterns, tutorials, and more.<br><br>![112-Developer-tools.svg](https://cloud.ibm.com/media/docs/images/homepage/112-Developer-tools.svg)](https://developer.ibm.com/depmodels/cloud/gettingstarted/)[Architecture Center<br><br>Discover the architecture references available for this product.<br><br>![190-Application-Platform.svg](https://cloud.ibm.com/media/docs/images/homepage/190-Application-Platform.svg)](https://www.ibm.com/cloud/architecture/architectures/public-cloud)[IBM Training<br><br>Build your skills with IBM Cloud training.<br><br>![83-Elements-of-the-cloud.svg](https://cloud.ibm.com/media/docs/images/homepage/83-Elements-of-the-cloud.svg)](https://www.ibm.com/training/cloud)[Community<br><br>Join the IBM Cloud community and collaborate with others.<br><br>![35-Connectivity.svg](https://cloud.ibm.com/media/docs/images/homepage/35-Connectivity.svg)](https://community.ibm.com/community/user/cloud/home)

 Latest updates 

[View more](https://cloud.ibm.com/docs/overview?topic=overview-whatsnew)06 June 2023 | New event notifications added for projects

You can now send out notifications when a deployment is complete or when resources are successfully destroyed.

06 June 2023 | Support for access management tags in the projects UI

You can now add, edit, and delete access management tags directly in the projects UI. Previously, you could manage these tags only by using the command-line interface (CLI) or API.

25 April 2023 | Customized compliance validation
Classic infrastructure 



 Resources Data sources 

 <br><br> * [ibm_cdn](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/cdn)<br> * [ibm_compute_autoscale_group](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/compute_autoscale_group)<br> * [ibm_compute_autoscale_policy](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/compute_autoscale_policy)<br> * [ibm_compute_bare_metal](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/compute_bare_metal)<br> * [ibm_compute_dedicated_host](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/compute_dedicated_host)<br> * [ibm_compute_monitor](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/compute_monitor)<br> * [ibm_compute_placement_group](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/compute_placement_group)<br> * [
[Get started with the IBM Cloud CLI ](https://cloud.ibm.com/docs/cli)

Use IBM Cloud's powerful CLIs and tooling to interact with your applications, containers, infrastructure, and other services.

[APIs and SDKs ](https://cloud.ibm.com/docs?tab=api-docs)

Check out our library of APIs and SDKs

 DevOps 

Continuous delivery with insights.

[Creating a toolchain ](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-toolchains_getting_started)

Toolchains are a set of tool integrations that support development, deployment, and operations tasks.

[Building and deploying with continuous delivery ](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-create_cd_service)

Automate the building and deployment of applications.

[Adding DevOps Insights to your toolchain ](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-add-devops-insights)

View data about build failures, build time consumed, or total number of jobs.

[Managing your source code and tracking work ](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-git_working)

Collaborate with your team and track issues with GitLab.

 Start deploying 

Set up and extend your infrastructure.

[Building infrastructure ](https://cloud.ibm.com/docs/cloud-infrastructure)

After you plan and design your infrastructure, you're ready to build it.

[Infrastructure availability ](https://cloud.ibm.com/docs/overview?topic=overview-services_regioniaas-service-infra)

We make it easy for you to implement, host, and scale services, infrastructure, and apps but not all services and infrastructure are available for purchase in every IBM Cloud location.

[Locations for resource deployment ](https://cloud.ibm.com/docs/overview?topic=overview-locations)
* [ibmcloud oc locations](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_locations)
* [ibmcloud oc messages](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_messages)
* [ibmcloud oc versions](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_versions)
* [ibmcloud oc api](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_api)
* [ibmcloud oc init](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_init)
* [ibmcloud oc script](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_script)
* [ibmcloud oc security-group](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_security_group)
* [ibmcloud oc storage](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_storage)



[Red Hat OpenShift on IBM Cloud CLI reference](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clikubernetes-service-cli)



* [Red Hat OpenShift on IBM Cloud commands](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clicli_commands)
[Setting up the API](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_api_installcs_api_install)



* [About the API](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_api_installapi_about)
* [Automating cluster deployments with the API](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_api_installcs_api)
* [Refreshing IAM access tokens and obtaining new refresh tokens with the API](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_api_installcs_api_refresh)
* [Refreshing IBM Cloud IAM access tokens and obtaining new refresh tokens with the CLI](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_api_installcs_cli_refresh)



[Uninstalling the stand-alone IBM Cloud CLI](https://cloud.ibm.com/docs/openshift?topic=openshift-uninstall-ibmcloud-cliuninstall-ibmcloud-cli)



* [Uninstalling on Windows](https://cloud.ibm.com/docs/openshift?topic=openshift-uninstall-ibmcloud-cliuninstall-cli-windows)
* [Uninstalling on Linux and macOS](https://cloud.ibm.com/docs/openshift?topic=openshift-uninstall-ibmcloud-cliuninstall-cli-linux-macos)







 Planning your cluster environment 

[Moving your environment to Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-strategystrategy)
By default, your hosts get a cpu, an os, and a memory label, but you might want to add more to control the auto assignment, such as env=prod or service=database. Note that the default value for os is rhel.
4. Enter a file name for your script or use the name that is generated for you.
5. Select RHEL or RHCOS to download the host script for your host system.
6. Click Download script to generate the host script and download the script to your local machine. Note that the token in the script is an API key, which should be treated and protected as sensitive information.



* To get the host attachment script from the CLI:



1. Generate a script to run on your machines to attach them to your location by using the sat host attach command and specify the host operating system by using the --operating-system command option. When you run the command to generate the script, you might also want to include labels to identify the purpose of the hosts, such as use:satloc. Your hosts are automatically assigned labels for the CPU and memory size if these values can be detected on the machine.

Example host attach command for a RHCOS host.

ibmcloud sat host attach --location <location_name> [-hl "use=satloc"] --operating-system RHCOS

Example host attach command for a RHEL host.

ibmcloud sat host attach --location <location_name> [-hl "use=satloc"] --operating-system RHEL

Example output

Creating host registration script...
OK
The script to attach hosts to Satellite location 'mylocation' was downloaded to the following location:
<filepath_to_script>/register-host_mylocation_attach_hypershift.ign





2. Optional: If your hosts are RHEL hosts, you need to update the [required packages](https://cloud.ibm.com/docs/satellite?topic=satellite-host-reqs) on your hosts before you can run the script. If your hosts are running the latest Red Hat CoreOS images, you do not need to update the packages.
For more information, see [Bastion instance](https://access.redhat.com/documentation/en-us/reference_architectures/2018/html/deploying_and_managing_openshift_3.9_on_google_cloud_platform/components_and_considerationsbastion_instance)![External link icon](https://cloud.ibm.com/docs-content/v1/content/4cd6263f39a034d265ddb4b0a5e6d50c55d13ee8/ibm-cloud-provider-for-terraform/icons/launch-glyph.svg). B1_4X16X100 
 datacenter Enter the zone where you want to provision your IBM Cloud classic infrastructure. To find existing zones, run ibmcloud ks zones. dal12 
 ibm_sl_api_key The IBM Cloud classic infrastructure API key to access classic infrastructure resources. Do not enter this information in this file. Instead, you are prompted to enter this information when you create the classic infrastructure resources. To retrieve your API key, see [Managing classic infrastructure API keys](https://cloud.ibm.com/docs/account?topic=account-classic_keys). n/a 
 ibm_sl_username The IBM Cloud classic infrastructure user name to access classic infrastructure resources. Do not enter this information in this file. Instead, you are prompted to enter this information when you create the classic infrastructure resources. To retrieve your user name, see [Managing classic infrastructure API keys](https://cloud.ibm.com/docs/account?topic=account-classic_keys). n/a 
 infra_count Enter the number of infrastructure nodes that you want to create. Infrastructure nodes are used to run infrastructure-related pods, such as router or registry pods. 1 
 master_count Enter the number of master nodes that you want to create. The master runs the API server, controller manager server, and etcd database instance. n/a 
 pool_id The Red Hat pool ID that is linked to the subscription that you set up with Red Hat. Do not enter this information here.
To get your SSH login command, go to the Schematics > Workspaces page in the IBM Cloud console, and then select your workspace. You can find your SSH login command in the Apply plan log file in the Jobs section of your workspace. The following command is an example:

ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null root@169.63.100.221
2. In the IBM Cloud console, go to Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/9de14ae11cc0bda57c240e5b42f2964edeaab3c6/icons/icon_hamburger.svg) > OpenShift > Clusters, and then select your cluster.
3. Click OpenShift web console.
4. Go to IAM#your-IBMid > Copy login command, and then click Display Token.
5. Copy the command in the Log in with this token section and run the command in the login server. The following command is an example:

oc login --token=sha25681NTZ5iEbzWtraVyBX7ZAX9qanowKHce_tIZe65KnSs --server=https://c108-e.eu-gb.containers.cloud.ibm.com:30637







 Access the cluster from the login node with Red Hat OpenShift config file 



1. You first need to SSH into the login server node. To get your SSH login command, go to the Schematics > Workspaces page in the IBM Cloud console, and then select your workspace. You can find your SSH login command in the Apply plan log file in the Jobs section of your workspace. The following command is an example:

ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null root@169.63.100.221
2.
* Viewer role on all resource groups in your account
* Writer role on the Secrets Manager service



5. Install the IBM Cloud CLI and the IBM Cloud Schematics plug-in. See [Setting up the CLI](https://cloud.ibm.com/docs/schematics?topic=schematics-setup-cli) for more information.



For containerized apps, complete the following prerequisites:



1. Create your [Kubernetes cluster](https://cloud.ibm.com/docs/containers?topic=containers-getting-started) or [Red Hat OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-getting-started).
2. For deployments to IBM Cloud Kubernetes Service, [set up your Helm chart](https://cloud.ibm.com/docs/containers?topic=containers-helm).
3. For deployments to Red Hat OpenShift, set up your [Helm chart](https://cloud.ibm.com/docs/openshift?topic=openshift-helm) or [Operator](https://cloud.ibm.com/docs/openshift?topic=openshift-operators).



For virtual server images, complete the following prerequisites:



1. Review the list of [supported images](https://cloud.ibm.com/docs/vpc?topic=vpc-about-images).
2. If required, create your [Terraform template](https://cloud.ibm.com/docs/schematics?topic=schematics-create-tf-config). Virtual server image for VPC does not require a Terraform template.
3. Create an instance of [IBM Cloud Object Storage](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-getting-started-cloud-object-storage) and add your image to a bucket.
* [init command](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_init)
* [script commands](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-cliscript)



* [ibmcloud oc script update](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-cliscript_update)



* [security-group commands](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clisecurity_group)



* [ibmcloud oc security-group reset](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clisecurity_group_reset)
* [ibmcloud oc security-group sync](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clisecurity_group_sync)



* [Beta: storage commands](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_storage)



* [ibmcloud oc storage attachment create](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_storage_att_cr)
* [ibmcloud oc storage attachment get](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_storage_att_get)
* [ibmcloud oc storage attachment ls](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_storage_att_ls)
If you're already logged in to the console, you can use the following steps:



1. In the IBM Cloud console, click the Avatar icon ![Avatar icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/i-avatar-icon.svg) > Log in to CLI and API.
2. Copy the information for the IBM Cloud CLI into the CLI.







 From the Red Hat OpenShift CLI 

You can log in with a one-time passcode by using the following steps:



1. Log in to the console, and from the console, click the Avatar icon ![Avatar icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/i-avatar-icon.svg) > Log in to CLI and API.
2. Copy the information for the Red Hat OpenShift CLI and paste into the CLI.









 Using an API key in the CLI for authentication 

The required API key is the IBM Cloud API key that is used to authenticate with the IBM Cloud platform, not the classic infrastructure API key, or IBM Cloud service API key.



1. Create an API key with the [ibmcloud iam api-key-create command](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iamibmcloud_iam_api_key_create). Use the --file option to generate an API key file instead of showing the key in the command window:

ibmcloud iam api-key-create NAME [-d DESCRIPTION] [--file FILE]
2. Log in with the API key. You can use the API key with the IBM Cloud CLI in any of the following ways:



* Call the API key directly:
Retrieve the host registration script that you must run on your hosts to make them visible to your IBM Cloud Satellite location.



1. From the Hosts tab, click Attach host.
2. Optional: Add host labels that are used later to [automatically assign](https://cloud.ibm.com/docs/satellite?topic=satellite-assigning-hostshost-autoassign-ov) hosts to Satellite-enabled IBM Cloud services in the location. Labels must be provided as key-value pairs, and must match the request from the service. By default, your hosts get a cpu, os, and memory label, but you might want to add more to control the auto assignment, such as env=prod or service=database.
3. Enter a file name for your script or use the name that is generated for you.
4. Click Download script to generate the host script and download the script to your local machine. Note that the token in the script is an API key, which should be treated and protected as sensitive information.



3. RHEL 7 only Open the registration script. After the API_URL line, add a section to pull the required RHEL packages with the subscription manager.

 Grow the base volume group first
echo -e "rnenynwnynyn" | gdisk /dev/sda
 Mark result as true as this returns a non-0 RC when syncing disks
echo -e "nnnnnnwn" | fdisk /dev/sda || true
partx -l /dev/sda || true
partx -v -a /dev/sda || true
pvcreate /dev/sda5
vgextend rootvg /dev/sda5
 Grow the TMP LV
lvextend -L+10G /dev/rootvg/tmplv
xfs_growfs /dev/rootvg/tmplv
 Grow the var LV
lvextend -L+20G /dev/rootvg/varlv
xfs_growfs /dev/rootvg/varlv

 Enable Azure RHEL Updates
Otherwise, you should consider setting up hosts in your management plane that can provide shell access with oc or kubectl CLI tools to complete Red Hat OpenShift on IBM Cloud management. Operators should access those hosts through SSH connecting through a bastion.





 Access to Red Hat OpenShift on IBM Cloud management UI 

Red Hat OpenShift on IBM Cloud cluster that is deployed on a Satellite location provides a management UI (web console). You should consider UI access as an exception, preferring the operator actions should CLI or CI/CD automation for effective access control, reliability, and audit.

If the operators or administrators need to access this UI, the access should be facilitated by the bastion solution as well. In this scenario, a bastion solution would act as an HTTPS reverse proxy that the operator would use to access the Red Hat OpenShift on IBM Cloud management UI.





 Access to Satellite hosts through SSH 

In general, the Satellite architecture discourages shell to the host OS, including SSH. Host OS updates and other maintenance (for example, backups) should be automated or completed by creating and attaching a new host instance. Login with a root account is explicitly blocked after a host is attached to a Satellite location.

If operator access to a Satellite host is required for troubleshooting purposes, SSH connection should be completed through a bastion that uses a nonroot account.





 Set up a bastion host 

You need to install and manage your own bastion solution within your management plane. A bastian solution can be implemented in a variety of ways. For one example that uses Teleport Enterprise Edition in the VPC reference architecture, see [Setting up a bastion host for secure connectivity](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-bastion-tutorial-teleport).





 Related controls in IBM Cloud Framework for Financial Services 

The following [IBM Cloud Framework for Financial Services controls](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-aboutframework-control-requirements) are most related to this guidance. However, in addition to following the guidance here, do your own due diligence to ensure you meet the requirements.
* IBM Cloud Pak® for Multicloud Management 2.0 - Automation navigation for IBM Cloud Pak for Multicloud Management 2.0 - CC734EN
* IBM Cloud Pak® for Multicloud Management 1.3 - Red Hat Ansible Tower key - CC79QEN
* IBM Cloud Pak® for Multicloud Management 1.3 - Automation navigation for IBM Cloud Pak for Multicloud Management 1.3 - CC66KEN









 Installing Red Hat Ansible Tower 



1. Log in to OpenShift as an administrator from your Linux system.

oc login --token=<token> --server=<URL>

For example:

oc login --token=EtZqGLpwxpL8b6CAjs9Bvx6kxe925a1HlB__AR3gIOs --server=https://c100-e.us-east.containers.cloud.ibm.com:32653

You can find the oc login for your OpenShift cluster where IBM Cloud Pak for Multicloud Management is installed by using these steps:

a. Log in to IBM Cloud: [https://cloud.ibm.com/](https://cloud.ibm.com/)
b. Select OpenShift>Clusters and select the cluster where IBM Cloud Pak for Multicloud Management is installed.
c. Log in to the OpenShift web console and select the IAM <yourID> menu, then select "Copy Login Command".
d. Click the Display Token link.
e. Copy the provided oc login ... CLI command to log in to OpenShift.
2. On your Linux system, download the installation package by running the following command:

wget https://releases.ansible.com/ansible-tower/setup_openshift/ansible-tower-openshift-setup-latest.tar.gz
3. Extract the package by running the following commands:

tar xvf ansible-tower-openshift-setup-latest.tar.gz

cd ansible-tower-openshift-<version_from_step2>
subscription-manager repos --enable rhel-7-server-supplementary-rpms
subscription-manager repos --enable rhel-7-server-extras-rpms
yum install rh-python36 -y
yum install container-selinux -y

Depending on your custom image, these packages might already be installed.









 4. Upload and run the host attach script 



1. Locate your host script file on your system that you downloaded in step [1. Download the host script](https://cloud.ibm.com/docs/satellite?topic=satellite-alibabaalibaba-host-script).
2. Upload the host script file to your Alibaba instance.

scp -i <PEM-FILE> <Path2HostScript> cloud-user@<PUBLIC_IP>:/tmp/attach.sh
3. Log in to your instance.

ssh -i <path-to-pemfile> cloud-user@<PUBLIC_IP>
4. Run the host script file. For example,

sudo nohup bash /tmp/attach.sh &
5. Review the status of the registration script.

journalctl -f -u ibm-host-attach
6. Check that your hosts are shown in the Hosts tab of your [Satellite console](https://cloud.ibm.com/satellite/locations). All hosts show a Status of Ready when a connection to the machine can be established. Note that the hosts show a Status of Unassigned as the hosts are not yet assigned to your Satellite location control plane or a Red Hat OpenShift on IBM Cloud cluster.
7. Repeat [step 3](https://cloud.ibm.com/docs/satellite?topic=satellite-alibabaalibaba-host-install-packages) and [step 4](https://cloud.ibm.com/docs/satellite?topic=satellite-alibabaalibaba-host-install-packages) for each instance that you want to add to your location.







 5. Configure the control plane
* [ibmcloud oc worker-pool](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_worker-pool)
* [ibmcloud oc zone](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_zone)
* [ibmcloud oc ingress](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_ingress)
* [ibmcloud oc logging](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_logging)
* [ibmcloud oc nlb-dns](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_nlb-dns)
* [ibmcloud oc webhook-create](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_webhook-create)
* [ibmcloud oc api-key](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_api-key)
* [ibmcloud oc credential](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_credential)
* [ibmcloud oc infra-permissions](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_infra-permissions)
* [ibmcloud oc kms](https://cloud.ibm.com/docs/openshift?topic=openshift-icks_mapicks_map_kms)