vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* [External communication to apps that run on worker nodes](https://cloud.ibm.com/docs/containers?topic=containers-plan_vpc_basicsvpc-pgw-external)



* [Extend your on-premises data center to a VPC cluster](https://cloud.ibm.com/docs/containers?topic=containers-plan_vpc_basicsvpc-vpn)



* [Worker-to-worker communication](https://cloud.ibm.com/docs/containers?topic=containers-plan_vpc_basicsvpc-vpn-worker)
* [Worker-to-master and user-to-master communication](https://cloud.ibm.com/docs/containers?topic=containers-plan_vpc_basicsvpc-vpn-master)
* [Worker communication to other services or networks](https://cloud.ibm.com/docs/containers?topic=containers-plan_vpc_basicsvpc-vpn-services)
* [External communication to apps that run on worker nodes](https://cloud.ibm.com/docs/containers?topic=containers-plan_vpc_basicsvpc-vpn-external)





[Understanding network basics of classic clusters](https://cloud.ibm.com/docs/containers?topic=containers-plan_basicsplan_basics)



* [Worker-to-worker communication: classic VLANs and subnets](https://cloud.ibm.com/docs/containers?topic=containers-plan_basicsworker-worker)



* [VLAN connections for worker nodes](https://cloud.ibm.com/docs/containers?topic=containers-plan_basicsworker-worker-nodes)
* [Worker node communication across subnets and VLANs](https://cloud.ibm.com/docs/containers?topic=containers-plan_basicsworker-worker-subnets)



* [Worker-to-master and user-to-master communication: Service endpoints](https://cloud.ibm.com/docs/containers?topic=containers-plan_basicsworkeruser-master)
* [Beta: ibmcloud oc dedicated pool rm](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clidedicated_pool_rm)



* [worker commands](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-cliworker_node_commands)



* [Deprecated: ibmcloud oc worker add](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_worker_add)
* [ibmcloud oc worker get](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_worker_get)
* [ibmcloud oc worker ls](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_workers)
* [ibmcloud oc worker reboot](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_worker_reboot)
* [ibmcloud oc worker reload](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_worker_reload)
* [ibmcloud oc worker replace](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clicli_worker_replace)
* [ibmcloud oc worker rm](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_worker_rm)
* [ibmcloud oc worker update](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_worker_update)
The following diagram shows the components of your cluster and how they interact when only the [private cloud service endpoint is enabled](https://cloud.ibm.com/docs/openshift?topic=openshift-plan_vpc_basicsvpc-workeruser-master). Because only the private cloud service endpoint is enabled, your VPC creates a private load balancer for each service for inbound traffic.

Zoom

![Red Hat OpenShift on IBM Cloud on VPC cluster architecture with the private cloud service endpoint only](https://cloud.ibm.com/docs-content/v1/content/bce0f0917a9eea684d1b4b704ac6343a1f65f446/openshift/images/arch_roks_vpc_private.svg)

Figure 1. Red Hat OpenShift on VPC cluster architecture with the private cloud service endpoint only





 VPC version 4 master and worker node components 

[Masters](https://cloud.ibm.com/docs/openshift?topic=openshift-service-architectureservice-architecture-4-master) and [worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-service-architectureservice-architecture-4-workers) include the same components as described in the Classic cluster architecture for version 4 clusters. For more information about the OpenShift Container Platform architecture, see the [Red Hat OpenShift docs](https://docs.openshift.com/container-platform/4.11/architecture/architecture.html).

Master
: [Master components](https://cloud.ibm.com/docs/openshift?topic=openshift-service-architectureservice-architecture-4-master), including the API server and etcd, have three replicas and are spread across zones for even higher availability. Masters include the same components as described in the Classic cluster architecture for version 4 clusters. The master and all the master components are dedicated only to you, and are not shared with other IBM customers.

Worker node
* [Managing Satellite worker pools](https://cloud.ibm.com/docs/openshift?topic=openshift-add_workerssatcluster-worker-pools)



* [Creating Satellite worker pools with host labels for autoassignment](https://cloud.ibm.com/docs/openshift?topic=openshift-add_workerssat-pool-create-labels)
* [Maintaining Satellite worker pools](https://cloud.ibm.com/docs/openshift?topic=openshift-add_workerssat-pool-maintenance)



* [Deprecated: Adding stand-alone worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-add_workersstandalone)
* [Installing SGX drivers and platform software on SGX-capable worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-add_workersinstall-sgx)



* [Installing with a script](https://cloud.ibm.com/docs/openshift?topic=openshift-add_workersintel-sgx-script)



* [Adding tags to existing clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-add_workerscluster_tags)



* [Adding tags to clusters with the console](https://cloud.ibm.com/docs/openshift?topic=openshift-add_workersadd-tags-console)
* [Adding tags to clusters with the CLI](https://cloud.ibm.com/docs/openshift?topic=openshift-add_workersadd-tags-cli)



* [Adding labels to existing worker pools](https://cloud.ibm.com/docs/openshift?topic=openshift-add_workersworker_pool_labels)



[Creating and managing dedicated hosts on VPC Gen 2 infrastructure](https://cloud.ibm.com/docs/openshift?topic=openshift-dedicated-hostsdedicated-hosts)
* [Isolating clusters on the private network](https://cloud.ibm.com/docs/containers?topic=containers-network_policiesisolate_workers).







 Allowing traffic from your cluster in other services' allowlists or in on-premises allowlists 

If you want to access services that run inside or outside IBM Cloud or on-premises and that are protected by an allowlist, you can add the IP addresses of your worker nodes in that allowlist to allow outbound network traffic to your cluster. For example, you might want to read data from an IBM Cloud database that is protected by an allowlist, or specify your worker node subnets in an on-premises allowlist to allow network traffic from your cluster.



1. [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)
2. Get the worker node subnets or the worker node IP addresses.



* Worker node subnets: If you anticipate changing the number of worker nodes in your cluster frequently, such as if you enable the [cluster autoscaler](https://cloud.ibm.com/docs/containers?topic=containers-cluster-scaling-classic-vpc), you might not want to update your allowlist for each new worker node. Instead, you can add the VLAN subnets that the cluster uses. Keep in mind that the VLAN subnet might be shared by worker nodes in other clusters. Note that the primary public subnets that IBM Cloud Kubernetes Service provisions for your cluster come with 14 available IP addresses, and can be shared by other clusters on the same VLAN. When you have more than 14 worker nodes, another subnet is ordered, so the subnets that you need to allow can change. To reduce the frequency of change, create worker pools with worker node flavors of higher CPU and memory resources so that you don't need to add worker nodes as often.



1. List the worker nodes in your cluster.

ibmcloud ks worker ls --cluster <cluster_name_or_ID>
2.
<br> <br>Resources <br><br><br><br> * ibm_is_vpc<br> * ibm_is_subnet<br> * ibm_container_vpc_cluster<br> * ibm_container_vpc_worker_pool<br> * ibm_resource_instance<br> * ibm_container_bind_service<br><br><br> [View code snippet](https://github.com/IBM-Cloud/terraform-provider-ibm/tree/master/examples/ibm-cluster/vpc-classic-cluster) 
 vpc-Gen2-cluster Create an IBM Cloud Kubernetes Service cluster in a Virtual Private Cloud (VPC) for Generation 2 compute with worker nodes in a default worker pool that you spread across two zones. Also, you provision an IBM Cloud Object Storage service, and bind this service to the cluster. <br> <br>Resources <br><br><br><br> * ibm_is_vpc<br> * ibm_is_subnet<br> * ibm_container_vpc_cluster<br> * ibm_container_vpc_worker_pool<br> * ibm_resource_instance<br> * ibm_container_bind_service<br><br><br> [View code snippet](https://github.com/IBM-Cloud/terraform-provider-ibm/tree/master/examples/ibm-cluster/vpc-gen2-cluster) 
 ibm-iks-classic-ROKS Create a Red Hat View GitHub repository on IBM Cloud cluster that runs version 3.11 of the View GitHub repository Container Platform. <br> <br>Resources <br><br><br><br> * ibm_container_cluster<br><br><br> [View code snippet](https://github.com/IBM-Cloud/terraform-provider-ibm/tree/master/examples/ibm-iks-classic-ROKS) 
 ibm-cluster-update Cordon and drain your worker nodes to update the IBM Cloud Kubernetes Service cluster master and worker nodes to the latest version.
ID Name Status Subnet CIDR Addresses ACL Public Gateway VPC Zone
5f5787a4-f560-471b-b6ce-20067ac93439 vpc-prod-dal1 available 10.240.0.0/24 183/256 allow-all-network-acl-ff537d43-a5a4-4b65-9627-17eddfa5237b - prod us-south-1
e3c19786-1c54-4248-86ca-e60aab74ed62 vpc-prod-dal2 available 10.240.64.0/24 183/256 allow-all-network-acl-ff537d43-a5a4-4b65-9627-17eddfa5237b - prod us-south-2
2930a068-51cc-4eca-807b-3f296d0891b4 vpc-prod-dal3 available 10.240.128.0/24 249/256 allow-all-network-acl-ff537d43-a5a4-4b65-9627-17eddfa5237b - prod us-south-3



* Individual worker node IP addresses: If you have a small number of worker nodes that run only one app and don't need to scale, or if you want to add only one worker node, list all the worker nodes in your cluster and note the Primary IP addresses. Only these worker nodes are added. If you delete the worker nodes or add worker nodes to the cluster, you must update your allowlist accordingly.

ibmcloud oc worker ls --cluster <cluster_name_or_ID>



2. Add the subnet CIDRs or individual worker node IP addresses to your service's allowlist or your on-premises allowlist for outbound traffic.
3. Repeat these steps for each cluster that you want to allow traffic to or from.









 Updating IAM allowlists for Kubernetes Service IP addresses
ID Name Status Subnet CIDR Addresses ACL Public Gateway VPC Zone
5f5787a4-f560-471b-b6ce-20067ac93439 vpc-prod-dal1 available 10.240.0.0/24 183/256 allow-all-network-acl-ff537d43-a5a4-4b65-9627-17eddfa5237b - prod us-south-1
e3c19786-1c54-4248-86ca-e60aab74ed62 vpc-prod-dal2 available 10.240.64.0/24 183/256 allow-all-network-acl-ff537d43-a5a4-4b65-9627-17eddfa5237b - prod us-south-2
2930a068-51cc-4eca-807b-3f296d0891b4 vpc-prod-dal3 available 10.240.128.0/24 249/256 allow-all-network-acl-ff537d43-a5a4-4b65-9627-17eddfa5237b - prod us-south-3



* Individual worker node IP addresses: If you have a small number of worker nodes that run only one app and don't need to scale, or if you want to add only one worker node, list all the worker nodes in your cluster and note the Primary IP addresses. Only these worker nodes are added. If you delete the worker nodes or add worker nodes to the cluster, you must update your allowlist accordingly.

ibmcloud ks worker ls --cluster <cluster_name_or_ID>



2. Add the subnet CIDRs or individual worker node IP addresses to your service's allowlist or your on-premises allowlist for outbound traffic.
3. Repeat these steps for each cluster that you want to allow traffic to or from.









 Updating IAM allowlists for Kubernetes Service IP addresses
flavor = "bx2.16x64"
worker_count = "3"
resource_group_id = "<resource_group_id>"
zones {
subnet_id = "<subnet_id>"
name = "us-south-1"
}
}

name
: Required. The name of the cluster.

vpc_id
: Required. The ID of the VPC that you want to use for your cluster. To list available VPCs, run ibmcloud is vpcs.

flavor
: Required. The worker node flavor. The flavor determines the amount of memory, CPU, and disk space that is available to your worker nodes. For a list of available worker node flavors, run ibmcloud oc flavors --zone <zone> --provider classic, or see [Classic flavors](https://cloud.ibm.com/docs/containers?topic=containers-classic-flavors&interface=ui).

worker_count
: The number of worker nodes that you want to add to the default worker pool.

resource_group_id
: The ID of the resource group. To see available resource groups, run ibmcloud resource groups. If no value is provided, the default resource group is used.

zones
: A nested block that describes the zones of the VPC cluster's default worker pool.
: 

* subnet_id: Required. The ID of the VPC subnet that you want to use for your worker nodes. To find existing subnets, run ibmcloud oc subnets --provider classic --zone <zone>.



: 

* name: Required. The zone name for the default worker pool. To see available zones, run ibmcloud oc zones --provider vpc-gen2.



3. In the CLI, navigate to your Terraform directory.

cd <terraform_directory>
4. Run the commands to initialize and plan your Terraform actions. Review the plan output to make sure the correct actions are performed.

terraform init

terraform plan
ibmcloud oc zone add vpc-gen2 --zone <zone> --cluster <cluster_name_or_ID> --worker-pool <pool_name> --subnet-id <VPC_SUBNET_ID>

VPC cluster provisioned at version 4.9 with worker nodes that run the RHEL 8 operating system. For a complete list of available RHEL versions and which cluster versions they are compatible with, see [Available Red Hat OpenShift versions](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_versionsopenshift_versions_available).

ibmcloud oc cluster create vpc-gen2 --name my_cluster --zone us-south-1 --flavor b3c.4x16 --vpc_ID <vpc_id> --subnet-id <vpc_subnet_id> --version 4.9.28_openshift --operating-system REDHAT_8_64





 Creating a VPC cluster with Terraform 

Terraform on IBM Cloud enables predictable and consistent provisioning of IBM Cloud platform infrastructure and resources, including VPC clusters. To create a VPC cluster with Terraform, you first create a Terraform configuration file that declares the type of cluster resource you want to create. Then, you apply the Terraform configuration file. For more information on Terraform, see [About Terraform on IBM Cloud](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-about).

Before you begin:



* [Install the Terraform CLI and the IBM Cloud Provider plug-in](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-setup_clitf_installation).
* Make sure you have an IBM Cloud [API key](https://cloud.ibm.com/docs/account?topic=account-userapikey&interface=uicreate_user_key).





1. Create a Terraform provider file.
flavor = "bx2.16x64"
worker_count = "3"
resource_group_id = "<resource_group_id>"
zones {
subnet_id = "<subnet_id>"
name = "us-south-1"
}
}

name
: Required. The name of the cluster.

vpc_id
: Required. The ID of the VPC that you want to use for your cluster. To list available VPCs, run ibmcloud is vpcs.

flavor
: Required. The worker node flavor. The flavor determines the amount of memory, CPU, and disk space that is available to your worker nodes. For a list of available worker node flavors, run ibmcloud ks flavors --zone <zone> --provider classic, or see [Classic flavors](https://cloud.ibm.com/docs/containers?topic=containers-classic-flavors&interface=ui).

worker_count
: The number of worker nodes that you want to add to the default worker pool.

resource_group_id
: The ID of the resource group. To see available resource groups, run ibmcloud resource groups. If no value is provided, the default resource group is used.

zones
: A nested block that describes the zones of the VPC cluster's default worker pool.
: 

* subnet_id: Required. The ID of the VPC subnet that you want to use for your worker nodes. To find existing subnets, run ibmcloud ks subnets --provider classic --zone <zone>.



: 

* name: Required. The zone name for the default worker pool. To see available zones, run ibmcloud ks zones --provider vpc-gen2.



3. In the CLI, navigate to your Terraform directory.

cd <terraform_directory>
4. Run the commands to initialize and plan your Terraform actions. Review the plan output to make sure the correct actions are performed.

terraform init

terraform plan
5.
* [Worker-to-master and user-to-master communication](https://cloud.ibm.com/docs/containers?topic=containers-plan_vpc_basicsvpc-no-pgw-master)
* [Worker communication to other services or networks](https://cloud.ibm.com/docs/containers?topic=containers-plan_vpc_basicsvpc-no-pgw-services)
* [External communication to apps that run on worker nodes](https://cloud.ibm.com/docs/containers?topic=containers-plan_vpc_basicsvpc-no-pgw-external)



* [Scenario: Run internet-facing app workloads in a VPC cluster with limited public egress](https://cloud.ibm.com/docs/containers?topic=containers-plan_vpc_basicsvpc-pgw)



* [Worker-to-worker communication](https://cloud.ibm.com/docs/containers?topic=containers-plan_vpc_basicsvpc-pgw-worker)
* [Worker-to-master and user-to-master communication](https://cloud.ibm.com/docs/containers?topic=containers-plan_vpc_basicsvpc-pgw-master)
* [Worker communication to other services or networks](https://cloud.ibm.com/docs/containers?topic=containers-plan_vpc_basicsvpc-pgw-services)
* [External communication to apps that run on worker nodes](https://cloud.ibm.com/docs/containers?topic=containers-plan_vpc_basicsvpc-pgw-external)



* [Extend your on-premises data center to a VPC cluster](https://cloud.ibm.com/docs/containers?topic=containers-plan_vpc_basicsvpc-vpn)



* [Worker-to-worker communication](https://cloud.ibm.com/docs/containers?topic=containers-plan_vpc_basicsvpc-vpn-worker)
* [Supported virtual machine flavors for VPC Gen 2 worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-planning_worker_nodesvm)



: New VPC Gen 2 commands for the CLI



* [VPC cluster limitations](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_limitationsks_vpc_gen2_limits)
* [Change log for master fix pack 4.3.23_1525_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-changelog_archive4323_1525)



: Ready to get started? Try out the [Creating a cluster in your VPC on generation 2 compute tutorial](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc_rh_tutorial).

CLI change log
: Updated the Red Hat OpenShift on IBM Cloud CLI plug-in change log page for the [release of version 1.0.99](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_cli_changelog10).





 9 June 2020 

CLI change log
: Updated the Red Hat OpenShift on IBM Cloud CLI plug-in change log page for the [release of version 1.0.94](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_cli_changelog10).

Permissions
: Added a [Permissions to create a cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-access_referencecluster_create_permissions) reference topic, and restructured cluster creation and user access topics to refer to this reference topic.

New! Static routes add-on
[Auto deployment button](https://cloud.ibm.com/docs-content/v1/content/4cd6263f39a034d265ddb4b0a5e6d50c55d13ee8/ibm-cloud-provider-for-terraform/images/autodeploy_button.png)[Deploy to IBM Cloud](https://cloud.ibm.com/schematics/workspaces/create?repository=https://github.com/Cloud-Schematics/gcat-multizone-vpc&terraform_version=terraform_v1.0) <br> 
 [Multi-zone VPCs connecting using Transit Gateway](https://github.com/Cloud-Schematics/gcat-vpc-hub-spoke-cluster) Provision of two multi-zone VPCs and connects them through the IBM Cloud Transit Gateway. Also, provision a ROKS cluster on the spoke VPC and bastion VSI on the OpenShift hub VPC. ![Auto deployment button](https://cloud.ibm.com/docs-content/v1/content/4cd6263f39a034d265ddb4b0a5e6d50c55d13ee8/ibm-cloud-provider-for-terraform/images/autodeploy_button.png)[Deploy to IBM Cloud](https://cloud.ibm.com/schematics/workspaces/create?repository=https://github.com/Cloud-Schematics/gcat-vpc-hub-spoke-cluster&terraform_version=terraform_v1.0) <br> 
 [Multitiered landing zone with IAM and resource group access for a catalog offering](https://github.com/Cloud-Schematics/gcat-landing-zone-catalog) Provision a resource group, a VPC in the resource group, IAM access groups, and invites users to those access groups. This module configures the environment using a JSON object stored in Cloud Object Storage to allow users to configure and update complex environments as part of a catalog offering.
Asia Pacific India Chennai in-che che01 AP North (ap-north, jp-tok) 
 Asia Pacific Singapore Singapore sng-mtr sng01 AP North (ap-north, jp-tok) 
 Europe Italy Milan it-mil mil01 EU Central (eu-central, eu-de) 
 Europe Netherlands Amsterdam nl-ams ams03 EU Central (eu-central, eu-de) 
 North America Canada Montreal ca-mon mon01 US East (us-east) 
 North America Canada Toronto ca-tor tor01 US East (us-east) 
 North America United States San Jose us-sjc sjc03, sjc04 US South (us-south) 
 South America Brazil Sao Paulo br-sao sao01 US South (us-south) 







 VPC multizone regions 

VPC resources are provisioned in a region, which is a separate group of zones within a metro. The zones are mapped to separate data centers to ensure that resources are distributed evenly across zones in a multizone architecture. In the API and CLI, zones use the regional zone name in the API and command line (us-south-1), but in the console, zones use by the data center location (Dallas 1). For the data center code that the VPC zone and location corresponds to, such as us-south-1 and DAL10, see [Multizone regions](https://cloud.ibm.com/docs/overview?topic=overview-locationstable-mzr).



Available multizone metro locations for VPC clusters in IBM Cloud Kubernetes Service.

 Geography Country Metro Region Zones 

 Asia Pacific Australia Sydney au-syd au-syd-1, au-syd-2, au-syd-3 
 Asia Pacific Japan Osaka jp-osa jp-osa-1, jp-osa-2, jp-osa-3 
 Asia Pacific Japan Tokyo jp-tok jp-tok-1, jp-tok-2, jp-tok-3 
 Europe Germany Frankfurt eu-de eu-de-1, eu-de-2, eu-de-3 
 Europe United Kingdom London eu-gb eu-gb-1, eu-gb-2, eu-gb-3
To see available VPC zones, run ibmcloud ks zone ls --provider vpc-gen2.

--subnet-id SUBNET_ID
: Required: The ID of the subnet that you want to add. The VPC subnet must be within the zone that you specify. To see available VPC subnets, run ibmcloud ks subnets --provider vpc-gen2 --vpc-id <vpc> --zone <vpc_zone>. VPC subnets provide IP addresses for your worker nodes and load balancer services in the cluster, so use a [VPC subnet with enough IP addresses](https://cloud.ibm.com/docs/containers?topic=containers-vpc-subnetsvpc_basics_subnets), such as 256.

-c, --cluster CLUSTER
: Required: The name or ID of the cluster. To list VPC clusters, run ibmcloud ks cluster ls --provider vpc-gen2.

-p, --worker-pool WORKER_POOL
: The name of the worker pool to add the zone to. To specify multiple worker pools, use multiple options, such as -p pool1 -p pool2.

--output json
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.



 Example zone add vpc-gen2 command 

ibmcloud ks zone add vpc-gen2 --zone us-south-3 --cluster my_cluster -p pool1 -w pool2







 ibmcloud ks zone ls 

Virtual Private Cloud

Classic infrastructure

Satellite

View a list of available zones that you can create a cluster in.

The locations alias for this command is deprecated.

ibmcloud ks zone ls --provider (classic | vpc-gen2) [--location LOCATION] [--region-only] [--output json] [-q]

Minimum permissions: None

Command options:

--provider (classic | vpc-gen2)
: The infrastructure provider type to list zones for.