vania-janet/multiturn-rag-retrieval-data huggingface dataset:
kubectl create clusterrole razee-viewer --verb=get,list,watch --resource="."



Understanding this command's components

 Component Description 

 razee-viewer The name of the cluster role, such as razee-viewer. 
 --verb=get,list,watch A comma-separated list of actions that the role authorizes. In this example, the action verbs are for roles typical for a viewer or auditor, get,list,watch. For other possible verbs, see the [Kubernetes documentation](https://kubernetes.io/docs/reference/access-authn-authz/authorization/determine-the-request-verb). 
 --resource="." A comma-separated list of the Kubernetes resources that the role authorizes actions to. In this example, access is granted for all Kubernetes resources in all API groups, ".". For other possible resources, run kubectl api-resources -o wide. 



2. Create a cluster role binding that binds the Satellite Config service account to the cluster role that you previously created. Now, Satellite Config has the custom access to the cluster.

kubectl create clusterrolebinding razee-viewer --clusterrole=razee-viewer --serviceaccount=razeedeploy:razee-viewer



Understanding this command's components

 Component Description 

 razee-viewer The name of the cluster role binding, such as razee-viewer. 
 --clusterrole=razee-viewer The name of the cluster role that you previously created, such as razee-viewer. 
 --serviceaccount=razeedeploy:razee-viewer The name of one of the service accounts that the Satellite Config components are set up by default to use, either razeedeploy:razee-viewer or razeedeploy:razee-editor. 









 Custom access, scoped to a project 

Create custom RBAC policies to grant Satellite Config access to the actions, Kubernetes resources, and projects (namespaces) that you want.



1.
Multizone clusters: Allow worker nodes in one subnet to communicate with the worker nodes in all other subnets within the cluster. Create one rule for each subnet that you want to connect to. Allow ALL Any <br><br> * <br><br><br> Other subnet's CIDR <br><br> * <br><br><br> After 2 
 Allow incoming traffic requests to apps that run on your worker nodes. Allow TCP Any 30000 - 32767 Any Any After 3 
 To expose apps by using load balancers or Ingress, allow traffic through VPC load balancers. Allow TCP Any 443 Any Any After 4 
 For clusters with public and private service endpoints, allow Red Hat OpenShift Console pods to contact the master Allow ALL Master IPs <br><br> * <br><br><br> Any <br><br> * <br><br><br> After 5 
 * Allow access from the Red Hat OpenShift control plane IP addresses that are used to health check and report the overall status of your Ingress components. Create one rule for each [control plane CIDR for the region where your cluster is located](https://github.com/IBM-Cloud/kube-samples/tree/master/control-plane-ips). Allow TCP Any 80 Each [control plane CIDR for the region where your cluster is located](https://github.com/IBM-Cloud/kube-samples/tree/master/control-plane-ips). Any After 6 
 Deny all other traffic that does not match the previous rules. Deny ALL Any <br><br> * <br><br><br> Any <br><br> * <br><br><br> Set to bottom 



 Master IPs can be found by looking at the server: entry in the cluster's kubeconfig file (kubectl config view) and then running the nslookup or dig command to determine which IPs that it resolves to. The Master IP can be from 1 to 3 different IPs depending on the region and the control plane cluster.
Example request to create a version 4.12 configuration.

curl -X POST "https://containers.cloud.ibm.com/global/v2/storage/satellite/createStorageConfigurationByController" -H "accept: application/json" -H "Authorization: TOKEN" -H "Content-Type: application/json" -d "{ "config-name": "string", "controller": "string", "storage-class-parameters": [ { "additionalProp1": "string", "additionalProp2": "string", "additionalProp3": "string" } ], "storage-template-name": "local-volume-file", "storage-template-version": "4.12", "update-assignments": true, "user-config-parameters": { "entry.name": "AUTO-DISCOVER-DEVICES", { "entry.name": "LABEL-KEY", { "entry.name": "LABEL-VALUE", { "entry.name": "DEVICEPATH", { "entry.name": "FSTYPE","user-secret-parameters": }







 Creating a storage assignment in the console 

If you didn't assign your configuration to a cluster or service when you created it, you can create an assignment by completing the following steps.



1. Open the [Satellite console](https://cloud.ibm.com/satellite/locations) in your browser.
2. Select the location where you created your storage configuration.
3. Click the Locations tab, then click Storage.
4. Click the storage configuration that you want to assign to a cluster group.
5. On the Configuration details page, click Create storage assignment.
6. In the Create an assignment pane, enter a name for your assignment.
7. From the Version drop-down list, select the storage configuration version that you want to assign.
8. From the Cluster group drop-down list, select the cluster group that you want to assign to the storage configuration.
ibmcloud ks nlb-dns create classic --cluster <cluster_name_or_id> --ip <LB_IP> [--ip <LB_zone2_IP> ...]

Example command for VPC clusters.

ibmcloud ks nlb-dns create vpc-gen2 -c <cluster_name_or_ID> --lb-host <LB_hostname>
7. Verify that the subdomain is created. In the output, copy the name of your SSL secret in the SSL Cert Secret Name field.

ibmcloud ks nlb-dns ls --cluster <cluster_name_or_id>

Example output for classic clusters.

Hostname IP(s) Health Monitor SSL Cert Status SSL Cert Secret Name
mycluster-a1b2cdef345678g9hi012j3kl4567890-0001.us-south.containers.appdomain.cloud ["168.1.1.1"] None created <certificate>

Example output for VPC clusters.

Subdomain Load Balancer Hostname Health Monitor SSL Cert Status SSL Cert Secret Name
mycluster-a1b2cdef345678g9hi012j3kl4567890-0001.us-south.containers.appdomain.cloud ["1234abcd-us-south.lb.appdomain.cloud"] None created <certificate>
8. Verify that traffic is routed to your Istio-managed microservices by entering the URL of the app microservice.

http://<host_name>/<service_path>



Looking for even more fine-grained control over routing? To create rules that are applied after the load balancer routes traffic to each microservice, such as rules for sending traffic to different versions of one microservice, you can create and apply [DestinationRules](https://istio.io/latest/docs/reference/config/networking/destination-rule/).

Need to debug ingress or egress setups?
* ibmcloud is instance-create my-instance-name my-vpc us-south-1 bx2-2x8 my-subnet --image ibm-ubuntu-20-04-2-minimal-amd64-1 --volume-attach '[{"volume": {"name":"my-vol-1"}}]' Create instance with existing volume in volume attachment by using resource name.
* ibmcloud is instance-create my-instance-name my-vpc us-south-1 mx2-2x16 my-subnet --image r123-72b27b5c-f4b0-48bb-b954-5becc7c1dcb8 --dedicated-host my-dedicated-host Create instance to be placed in the wanted dedicated host by using resource name.
* ibmcloud is instance-create my-instance-name my-vpc us-south-1 mx2-2x16 my-subnet --image r123-72b27b5c-f4b0-48bb-b954-5becc7c1dcb8 --dedicated-host-group my-dedicated-host-group Create instance to be placed in the wanted dedicated host group by using resource name.
* ibmcloud is instance-create my-instance-name my-vpc us-south-1 mx2-2x16 my-subnet --image r123-72b27b5c-f4b0-48bb-b954-5becc7c1dcb8 --placement-group my-placement-host-group Create instance to be placed in the wanted placement group by using resource name.
3. Create a Satellite configuration.

ibmcloud sat config create --name <config_name> [--data-location <location>] [-q]



Understanding this command's components

 Component Description 

 --name <config_name> Enter the name of the Satellite configuration. 
 --data-location <location> Enter the location to store your Satellite configurations, for example us-east. Satellite configurations are Kubernetes resource definitions, such as ConfigMaps, storage classes, or secrets that are deployed to the clusters in your location through subscriptions. If --data-location is not specified, your configurations are stored in us-east by default. These locations are IBM Cloud Object Storage buckets that are owned by IBM and are pre-provisioned for each region. For more information about how your data is stored, see [How is my information stored, backed up, and encrypted?](https://cloud.ibm.com/docs/satellite?topic=satellite-data-security). For a list of locations, see [Supported locations](https://cloud.ibm.com/docs/satellite?topic=satellite-sat-regions). 
 -q Do not show the message of the day or update reminders. 



Example output

Creating configuration...
OK
Configuration <config_name> was successfully created with ID 116fffde-0835-467c-8987-67dd42e4e393.
4. Create a Subscription for your cluster group to the Satellite configuration. After you create the subscription, Satellite Config automatically downloads the Kubernetes resource file for the version that you specified and starts applying this file across all clusters that belong to the cluster group. This process takes a few minutes to complete. In addition, information about all Kubernetes resources that you create are sent back from your clusters to Satellite Config and can be reviewed in the Satellite [Cluster resources](https://cloud.ibm.com/satellite/resources) dashboard. Review the command options by running ibmcloud sat subscription create.
Example request to create a version 1.23.0 configuration.

curl -X POST "https://containers.cloud.ibm.com/global/v2/storage/satellite/createStorageConfigurationByController" -H "accept: application/json" -H "Authorization: TOKEN" -H "Content-Type: application/json" -d "{ "config-name": "string", "controller": "string", "storage-class-parameters": [ { "additionalProp1": "string", "additionalProp2": "string", "additionalProp3": "string" } ], "storage-template-name": "azuredisk-csi-driver", "storage-template-version": "1.23.0", "update-assignments": true, "user-config-parameters": { "entry.name": "LOCATION", { "entry.name": "RESOURCEGROUP", { "entry.name": "VMTYPE", { "entry.name": "SECURITYGROUPNAME", { "entry.name": "VNETNAME","user-secret-parameters": { "entry.name": "TENANTID",{ "entry.name": "SUBSCRIPTIONID",{ "entry.name": "AADCLIENTID",{ "entry.name": "AADCLIENTSECRET",}







 Creating a storage assignment in the console 

If you didn't assign your configuration to a cluster or service when you created it, you can create an assignment by completing the following steps.



1. Open the [Satellite console](https://cloud.ibm.com/satellite/locations) in your browser.
2. Select the location where you created your storage configuration.
3. Click the Locations tab, then click Storage.
4. Click the storage configuration that you want to assign to a cluster group.
5. On the Configuration details page, click Create storage assignment.
6. In the Create an assignment pane, enter a name for your assignment.
7.
The prefix for running commands is ibmcloud is.

ibmcloud plugin install infrastructure-service
2. Target the region that your VPC is in.

ibmcloud target -r <region>



To create an ACL for each subnet that your cluster is attached to,



1. List your VPC subnets. For each subnet that your cluster is attached to, get the ID and Subnet CIDR.

If you can't remember which subnets your cluster is attached to, you can run ibmcloud ks worker get -c <cluster_name_or_ID> -w <worker_node_ID> for one worker node in each zone of your cluster, and get the ID and CIDR of the subnet that the worker is attached to.

ibmcloud is subnets

Example output

ID Name Status Subnet CIDR Addresses ACL Public Gateway VPC Zone Resource group
0717-2224d664-d435-425e-b5ec-f324af2df445 mysubnet1 available 10.240.0.0/28 11/16 armored-never-chitchat-gangly-skylight-prototype - myvpc us-south-1 default
0717-1eff410a-a47e-4bc2-b4a3-5f742f320008 mysubnet2 available 10.240.1.0/24 251/256 armored-never-chitchat-gangly-skylight-prototype pgw-ed8f6970-9b71-11ea-b94a-956de1af1ccd myvpc us-south-2 default
2. Create an ACL. After you create the ACL, you can add rules to your ACL and apply the ACL to one subnet. Because the rules that you add to your ACL are specific to one subnet, consider naming the ACL in the format <cluster>-<subnet>-acl, such as mycluster-mysubnet1-acl, for easy identification.
Example request to create a version 1.22.0 configuration.

curl -X POST "https://containers.cloud.ibm.com/global/v2/storage/satellite/createStorageConfigurationByController" -H "accept: application/json" -H "Authorization: TOKEN" -H "Content-Type: application/json" -d "{ "config-name": "string", "controller": "string", "storage-class-parameters": [ { "additionalProp1": "string", "additionalProp2": "string", "additionalProp3": "string" } ], "storage-template-name": "azurefile-csi-driver", "storage-template-version": "1.22.0", "update-assignments": true, "user-config-parameters": { "entry.name": "LOCATION", { "entry.name": "RESOURCEGROUP", { "entry.name": "VMTYPE", { "entry.name": "SECURITYGROUPNAME", { "entry.name": "VNETNAME", { "entry.name": "SUBNETNAME","user-secret-parameters": { "entry.name": "TENANTID",{ "entry.name": "SUBSCRIPTIONID",{ "entry.name": "AADCLIENTID",{ "entry.name": "AADCLIENTSECRET",}







 Creating a storage assignment in the console 

If you didn't assign your configuration to a cluster or service when you created it, you can create an assignment by completing the following steps.



1. Open the [Satellite console](https://cloud.ibm.com/satellite/locations) in your browser.
2. Select the location where you created your storage configuration.
3. Click the Locations tab, then click Storage.
4. Click the storage configuration that you want to assign to a cluster group.
5. On the Configuration details page, click Create storage assignment.
6. In the Create an assignment pane, enter a name for your assignment.
7.
For more information, see the CBR [CLI reference](https://cloud.ibm.com/docs/account?topic=cli-cbr-plugin).



1. To create rules from the CLI, [install the CBR CLI plug-in](https://cloud.ibm.com/docs/cli?topic=cli-cbr-plugininstall-cbr-plugin).
2. You can use the ibmcloud cbr rule-create[command](https://cloud.ibm.com/docs/cli?topic=cli-cbr-plugincbr-cli-rule-create-command) to create CBR rules. For more information, see the CBR [CLI reference](https://cloud.ibm.com/docs/cli?topic=cli-cbr-plugincbr-zones-cli). Note that the service_name for Secrets Manager is secrets-manager. To find a list of service names, run the ibmcloud cbr service-ref-targets command. To find a list of API types for a service, run the ibmcloud cbr api-types --service-name SERVICE command.



Example command to create a rule that uses the addresses key and the cluster API type and the ipAddress type.

ibmcloud cbr rule-create my-rule-1 --service-name secrets-manager --api-type crn:v1:bluemix:public:secrets-manager::::api-type:cluster --zone-id ZONE-ID

The following command creates a rule that protects the CLUSTER-ID cluster. Only resources in the NETWORK-ZONE-ID network zone can access the cluster. This rule includes both the cluster and management API types.

ibmcloud cbr rule-create my-rule-2 --service-name secrets-manager --service-instance CLUSTER-ID --zone-id NETWORK-ZONE-ID







 Next steps 

You must follow the creation or modification of zones or rules with adequate testing to ensure access and availability.
Example command to create a worker pool with your own security groups applied:

ibmcloud oc worker-pool create vpc-gen2 --name <worker_pool_name> --cluster <cluster_name_or_ID> --flavor <flavor> --size-per-zone <number_of_workers_per_zone> --security-group <group-id-1> --security-group <group-id-2> --security-group <group-id-3>

The security groups applied to the workers in the worker pool are a combination of those applied to the cluster that the worker pool is attached to and those applied to the worker pool at create time.







 Allow the worker nodes to connect to the public service endpoint IPs for the OAuth service 

Required for VPC clusters with a public service endpoint.

[Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)



1. Get the URL used to connect to the oauth service in the form https://cXXX-e.<region>.containers.cloud.ibm.com:<PORT>. Make a note of the region and port.

oc get --raw /.well-known/oauth-authorization-server | grep issuer

Example output

"issuer": "https://c104-e.us-east.containers.cloud.ibm.com:31062",
2. Run dig +short or nslookup to get the IPs associated with the hostname in the URL. For single zone regions there is only one public IP associated with the hostname. For multizone regions, there are 3. Look up the individual IPs by replacing e with 1, 2, and 3.

dig +short cXXX-1.<region>.containers.cloud.ibm.com
dig +short cXXX-2.<region>.containers.cloud.ibm.com
curl -X POST "https://containers.cloud.ibm.com/global/v2/storage/satellite/createStorageConfigurationByController" -H "accept: application/json" -H "Authorization: TOKEN" -H "Content-Type: application/json" -d "{ "config-name": "string", "controller": "string", "storage-class-parameters": [ { "additionalProp1": "string", "additionalProp2": "string", "additionalProp3": "string" } ], "storage-template-name": "local-volume-block", "storage-template-version": "4.12", "update-assignments": true, "user-config-parameters": { "entry.name": "AUTO-DISCOVER-DEVICES", { "entry.name": "LABEL-KEY", { "entry.name": "LABEL-VALUE", { "entry.name": "DEVICEPATH","user-secret-parameters": }







 Creating a storage assignment in the console 

If you didn't assign your configuration to a cluster or service when you created it, you can create an assignment by completing the following steps.



1. Open the [Satellite console](https://cloud.ibm.com/satellite/locations) in your browser.
2. Select the location where you created your storage configuration.
3. Click the Locations tab, then click Storage.
4. Click the storage configuration that you want to assign to a cluster group.
5. On the Configuration details page, click Create storage assignment.
6. In the Create an assignment pane, enter a name for your assignment.
7. From the Version drop-down list, select the storage configuration version that you want to assign.
8. From the Cluster group drop-down list, select the cluster group that you want to assign to the storage configuration. Note that the clusters in your cluster group where you want to assign storage must all be in the same Satellite location.
9. Click Create to create the assignment.
10.
Before you begin



1. Install the infrastructure-service plug-in. The prefix for running commands is ibmcloud is.

ibmcloud plugin install infrastructure-service
2. Target the region that your VPC is in.

ibmcloud target -r <region>



To create an ACL for each subnet that your cluster is attached to,



1. List your VPC subnets. For each subnet that your cluster is attached to, get the ID and Subnet CIDR.

If you can't remember which subnets your cluster is attached to, you can run ibmcloud oc worker get -c <cluster_name_or_ID> -w <worker_node_ID> for one worker node in each zone of your cluster, and get the ID and CIDR of the subnet that the worker is attached to.

ibmcloud is subnets

Example output

ID Name Status Subnet CIDR Addresses ACL Public Gateway VPC Zone Resource group
0717-2224d664-d435-425e-b5ec-f324af2df445 mysubnet1 available 10.240.0.0/28 11/16 armored-never-chitchat-gangly-skylight-prototype - myvpc us-south-1 default
0717-1eff410a-a47e-4bc2-b4a3-5f742f320008 mysubnet2 available 10.240.1.0/24 251/256 armored-never-chitchat-gangly-skylight-prototype pgw-ed8f6970-9b71-11ea-b94a-956de1af1ccd myvpc us-south-2 default
2. Create an ACL. After you create the ACL, you can add rules to your ACL and apply the ACL to one subnet. Because the rules that you add to your ACL are specific to one subnet, consider naming the ACL in the format <cluster>-<subnet>-acl, such as mycluster-mysubnet1-acl, for easy identification.
Run the following command to access the compute cluster:

ssh -L 21443:localhost:443 root@{COMPUTE_NODE_IP_ADDRESS} root@{FLOATING_IP_ADDRESS}

where COMPUTE_NODE_IP_ADDRESS needs to be replaced with the storage IP address associated with <prefix>-primary-0, which you gathered earlier, and FLOATING_IP_ADDRESS needs to be replaced with the floating IP address that you identified.
3. Open a browser on the local machine, and run [https://localhost:21443](https://localhost:21443). You will get an SSL self-assigned certificate warning with your browser the first time that you access this URL.
4. Enter your login credentials that you set up when you created your workspace to access the Spectrum Scale GUI.
ibmcloud sat storage assignment ls (--cluster CLUSTER | --config CONFIG | --location LOCATION | --service-cluster-id CLUSTER)







 Creating a storage assignment in the API 



1. Copy one of the following example requests.

Example request to assign a [configuration to a cluster](https://containers.cloud.ibm.com/global/swagger-global-api//satellite/createAssignmentByCluster).

curl -X POST "https://containers.cloud.ibm.com/global/v2/storage/satellite/createAssignmentByCluster" -H "accept: application/json" -H "Authorization: Bearer TOKEN" -H "Content-Type: application/json" -d "{ "channelName": "CONFIGURATION-NAME", "cluster": "CLUSTER-ID", "controller": "LOCATION-ID", "name": "ASSIGNMENT-NAME"}"

Example request to [assign configuration to a cluster group](https://containers.cloud.ibm.com/global/swagger-global-api//satellite/createAssignment).

curl -X POST "https://containers.cloud.ibm.com/global/v2/storage/satellite/createAssignment" -H "accept: application/json" -H "Authorization: Bearer TOKEN" -H "Content-Type: application/json" -d "{ "channelName": "CONFIGURATION-NAME", "cluster": "string", "groups": [ "CLUSTER-GROUP" ], "name": "ASSIGNMENT-NAME"}"
2. Replace the variables with your details and run the request.
3. Verify the assignment was created by listing your assignments.

curl -X GET "https://containers.cloud.ibm.com/global/v2/storage/satellite/getAssignments" -H "accept: application/json" -H "Authorization: Bearer TOKEN"
4. Verify that the storage configuration resources are deployed. Get a list of all the resources in the local-storage namespace.

oc get all -n local-storage

Example output

NAME READY STATUS RESTARTS AGE
* [ibmcloud ks cluster service unbind](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_cluster_service_unbind)



* cluster subnet: Add and create portable subnets for a classic cluster.



* [ibmcloud ks cluster subnet add](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_cluster_subnet_add)
* [ibmcloud ks cluster subnet create](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_cluster_subnet_create)
* [ibmcloud ks cluster subnet detach](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_cluster_subnet_detach)









 ibmcloud ks worker 

[View and modify worker nodes for a cluster](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-cliworker_node_commands).



* Deprecated[ibmcloud ks worker add](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_worker_add)
* [ibmcloud ks worker get](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_worker_get)
* [ibmcloud ks worker ls](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_workers)
* [ibmcloud ks worker reboot](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_worker_reboot)
* [ibmcloud ks worker reload](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_worker_reload)