vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* Complete the SSL VPN requirements listed in [Service network (on back-end/private network)](https://cloud.ibm.com/docs/cloud-infrastructure?topic=cloud-infrastructure-ibm-cloud-ip-rangesservice-network).
* Open the RHEL endpoint rhha01.updates.us-south.iaas.service.networklayer.com. This requires adding the IP 161.26.112.28 to the firewall rules. Since DNS round robin is involved, this endpoint is not a single endpoint and could be moved as needed.
* Allow access to the service network as follows. Otherwise, updates and licensing do not function properly.





Table 12: Red Hat Enterprise Linux server requirements

 Server location Allow private service network for this data center 

 Amsterdam (ams03) fra02 
 Chennai (che01) tok02 
 Dallas (dal05, dal09, dal10, dal12, dal13) dal09 
 Frankfurt (fra02, fra04, fra05) fra02 
 London (lon02, lon04, lon05, lon06) lon02 
 Milan (mil01) fra02 
 Montreal (mon01) mon01 
 Paris (par01) fra02 
 San Jose (sjc01, sjc03, sjc04) dal09 
 Sao Paulo (sao01) dal09 
 Singapore (sng01) syd01 
 Sydney (syd01, syd04, syd05) syd01 
 Tokyo (tok02, tok04, tok05) tok02 
 Toronto (tor01) mon01 
 Washington DC (wdc01, wdc04, wdc06, wdc07) mon01 
 Any data center not listed dal09 



To resolve common provisioning issues, permit access to the entire service network by allowing the IP 161.26.0.0/16.





 Windows VSI server requirements
* doc - Provides both HTML and Markdown-formatted documentation files.
* examples/config - Files that let you tell the crawler which data to use for its crawl, where to send your collection of crawled data after the crawl finishes, and other crawl management options.
* man - In-product manual page crawler documentation.









 Known limitations in this release 



* The Data Crawler might hang when running the Filesystem connector with an invalid or missing URL.
* Configure the urls_to_filter value in the crawler.conf file, such that all the allowlist URLs or RegExes are included in a single RegEx expression. See [Configuring crawl options](https://cloud.ibm.com/docs/discovery?topic=discovery-configuring-the-data-crawlerconfiguring-crawl-options) for more information.
* The path to the configuration file passed in the --config -c option must be a qualified path. That is, it must be in the relative formats config/crawler.conf or ./crawler.conf, or absolute path /path/to/config/crawler.conf. Specifying just crawler.conf is only possible if the orchestration_service.conf file is in-lined instead of referenced using include in the crawler.conf file.
Specification overview 



  OpenAPI 

The primary format for representing the API for a service MUST be an API document that conforms to [the OpenAPI specification](https://github.com/OAI/OpenAPI-Specification/blob/master/versions/3.0.2.md). API documents using version 2 of OpenAPI (aka Swagger) SHOULD be updated to version 3.x as soon as practical.

The API document for a service MUST be a complete and accurate description of the operations and resource models exposed by service.
If your client was accessing properties in network_interfaces[] beyond the properties in NetworkInterfaceReference, your client needs to call GET /instances/{instance_id}/network_interfaces/{id} to retrieve those properties separately.







 Examples 

These examples compare differences between before and after the 2022-03-29 versioned change.



 IP address examples 

The following examples compare how to make a POST /instances call to provision an instance with a specific IP address on its primary network interface before and after the 2022-03-29 versioned change, and how to retrieve that IP address.

Specifying API version 2022-03-28 or earlier:

curl -X POST "$vpc_api_endpoint/v1/instances?version=2022-03-28&generation=2" -H "Authorization: Bearer $iam_token" -d '{
"image": {"id": "'"$image_id"'"},
"keys": [{"id": "'"$key_id"'"}],
"primary_network_interface": {
"primary_ipv4_address": "10.240.0.5",
"subnet": {"id": "'"$subnet_id"'"}
},
"zone": {"name": "'"$zone"'"}
}'

To retrieve the address:

curl -X GET "$vpc_api_endpoint/v1/instances/$instance_id?version=2022-03-28&generation=2" -H "Authorization: Bearer $iam_token" | jq '.primary_network_interface.primary_ipv4_address'

Specifying API version 2022-03-29 or later:

curl -X POST "$vpc_api_endpoint/v1/instances?version=2022-03-29&generation=2" -H "Authorization: Bearer $iam_token" -d '{
"image": {"id": "'"$image_id"'"},
[--service-name SERVICE_NAME] [--service-instance SERVICE_INSTANCE_GUID] [--region REGION] [--resource-type RESOURCE_TYPE] [--resource RESOURCE] [--resource-group-name RESOURCE_GROUP_NAME] [--resource-group-id RESOURCE_GROUP_ID] [--account-management] [--attributes name=value,name=value...]} [--output FORMAT] [-q, --quiet] [-f, --force] [--api-version v1 | v2]



 Command options 

SERVICE_ID (required)
: Name or UUID of service ID.

--file
: JSON file of policy definition. This option is exclusive with the -r, --roles, --service-name, --service-instance, --region, --resource-type, --resource, --resource-group-name and --resource-group-id options. You can use advanced operators in a JSON policy document to grant access to resources that satisfy specific naming conventions. For more information about using advanced operators to create wildcard policies, see [Assigning access by using wildcard policies](https://cloud.ibm.com/docs/account?topic=account-wildcard).

-r, --roles
: Role names of the policy definition. For supported roles of a specific service, run ibmcloud iam roles --service SERVICE_NAME option. This option is exclusive with the --file option.

--service-name
: Service name of the policy definition. This option is exclusive with the --file option.

--service-instance SERVICE_INSTANCE_GUID
: GUID of service instance of the policy definition. This option is exclusive with the --file option.

-region
: Region of the policy definition. This option is exclusive with the --file option.

--resource-type
: Resource type of the policy definition. This option is exclusive with the --file option.

--resource
: Resource of the policy definition. This option is exclusive with the --file option.
","unit":"ns","value":35.55555555555556}],"qubits":8]},{"gate":"x","name":"x9","parameters":{"date":"2022-03-29T04:52:30Z","name":"gate_error","unit":"","value":0.00023456679385229807},{"date":"2022-03-29T16:20:11Z","name":"gate_length","unit":"ns","value":35.55555555555556}],"qubits":9]},{"gate":"x","name":"x10","parameters":{"date":"2022-03-29T04:47:30Z","name":"gate_error","unit":"","value":0.0003269142853757712},{"date":"2022-03-29T16:20:11Z","name":"gate_length","unit":"ns","value":35.55555555555556}],"qubits":10]},{"gate":"x",
":"gate_length","unit":"ns","value":341.3333333333333}],"qubits":24,25]},{"gate":"cx","name":"cx25_24","parameters":{"date":"2022-03-29T07:58:07Z","name":"gate_error","unit":"","value":0.012676594418506687},{"date":"2022-03-26T16:20:11Z","name":"gate_length","unit":"ns","value":376.88888888888886}],"qubits":25,24]},{"gate":"cx","name":"cx15_18","parameters":{"date":"2022-03-29T07:47:17Z","name":"gate_error","unit":"","value":0.017329520597709702},{"date":"2022-03-26T16:20:11Z","name":"gate_length","unit":"ns","value":412.4444444444444}],"qubits
","unit":"","value":0.00940753592962229},{"date":"2022-03-26T16:20:11Z","name":"gate_length","unit":"ns","value":298.66666666666663}],"qubits":16,14]},{"gate":"cx","name":"cx13_14","parameters":{"date":"2022-03-29T06:53:41Z","name":"gate_error","unit":"","value":0.01087547291403837},{"date":"2022-03-26T16:20:11Z","name":"gate_length","unit":"ns","value":263.1111111111111}],"qubits":13,14]},{"gate":"cx","name":"cx14_13","parameters":{"date":"2022-03-29T06:53:41Z","name":"gate_error","unit":"","value":0.01087547291403837},{"date":"2022-03-26T16:20
4.5.1 4.5.x 4.6 
 4.5.0 4.5.x 4.10 
 4.5.0 4.5.x 4.8 
 4.5.0 4.5.x 4.6 
 4.0.8 4.0.x 4.8 
 4.0.8 4.0.x 4.6 
 4.0.7 4.0.x 4.8 
 4.0.7 4.0.x 4.6 
 4.0.6 4.0.x 4.8 
 4.0.6 4.0.x 4.6 
 4.0.5 4.0.x 4.8 
 4.0.5 4.0.x 4.6 
 4.0.4 4.0.x 4.8 
 4.0.4 4.0.x 4.6 
 4.0.2 4.0.x 4.8 
 4.0.2 4.0.x 4.6 
 4.0.0 4.0.x 4.6 
 1.5.0 3.5 4.6 
 1.5.0 3.5 3.11 
 1.5.0 3.0.1 4.5 
 1.5.0 3.0.1 3.11 



N/A means not applicable.
_nwd_1_tl_Enforce_20HTTPS_20on_20all_20pages_20in_20your_20app_20_7C_20IBM_20Cloud_20Docs_p_https_3A_2F_2Fcloud.ibm.com_2Fdocs_2Fcloud-foundry-public_3Ftopic_3Dcloud-foundry-public-nodejs-enforce_https_r_lt_964_evt_pageLoad_sv_1_rn_477891](https://bat.bing.com/action/0?ti=146001191&Ver=2&mid=53b3b0ed-33e5-48c4-91d5-d18c42c04d6e&sid=cca51480229211eeac887b94c5a6c542&vid=cca50460229211ee874f7dc32b9b9a8d&vids=0&msclkid=N&pi=918639831&lg=en-US&sw=3840&sh=2160&sc=30&nwd=1&tl=Enforce%20HTTPS%20on%20all%20pages%20in%20your%20app%20%7C%20IBM%20Cloud%20Docs&p=https%3A%2F%2Fcloud.ibm.com%2Fdocs%2Fcloud-foundry-public%3Ftopic%3Dcloud-foundry-public-nodejs-enforce_https&r=&lt=964&evt=pageLoad&sv=1&rn=477891)
* [Worker communication to other services or networks with internet-facing workloads](https://cloud.ibm.com/docs/containers?topic=containers-plan_basicsinternet-facing-services)
* [External communication to apps that run on worker nodes with internet-facing workloads](https://cloud.ibm.com/docs/containers?topic=containers-plan_basicsinternet-facing-external)



* [Scenario: Allow limited public connectivity with a gateway appliance](https://cloud.ibm.com/docs/containers?topic=containers-plan_basicsvyatta-gateway)



* [Worker-to-worker communication, worker-to-master and user-to-master communication with a gateway appliance](https://cloud.ibm.com/docs/containers?topic=containers-plan_basicslimited-public-gw-worker)
* [Worker communication to other services or networks with a gateway appliance](https://cloud.ibm.com/docs/containers?topic=containers-plan_basicslimited-public-gw-services)
* [External communication to apps that run on worker nodes with a gateway appliance](https://cloud.ibm.com/docs/containers?topic=containers-plan_basicslimited-public-gw-external)



* [Scenario: Extend your on-premises data center to a classic cluster](https://cloud.ibm.com/docs/containers?topic=containers-plan_basicsprivate_clusters)



* [Worker-to-worker communication for private clusters](https://cloud.ibm.com/docs/containers?topic=containers-plan_basicsprivate_clusters-worker)
* [Worker-to-master and user-to-master communication for private clusters](https://cloud.ibm.com/docs/containers?topic=containers-plan_basicsprivate_clusters-master)
* [Worker communication to other services or networks for private clusters](https://cloud.ibm.com/docs/containers?topic=containers-plan_basicsprivate_clusters-services)
Reservations and limits for PIDs
: Worker nodes that run Kubernetes version 1.14 or later set [process ID (PID) reservations and limits that vary by flavor](https://cloud.ibm.com/docs/containers?topic=containers-planning_worker_nodesresource_limit_node), to help prevent malicious or runaway apps from consuming all available PIDs.

Version change log
: Worker node patch updates are available.
: Kubernetes [1.16.3_1518](https://cloud.ibm.com/docs/containers?topic=containers-116_changelog1163_1518_worker), [1.15.6_1525](https://cloud.ibm.com/docs/containers?topic=containers-115_changelog1156_1525_worker), [1.14.9_1541](https://cloud.ibm.com/docs/containers?topic=containers-114_changelog1149_1541_worker), and [1.13.12_1544](https://cloud.ibm.com/docs/containers?topic=containers-113_changelog11312_1544_worker)





 22 November 2019 

Bring your own DNS for load balancers
: Added steps for bringing your own custom domain for [NLBs](https://cloud.ibm.com/docs/containers?topic=containers-loadbalancer_hostnameloadbalancer_hostname_dns) in classic clusters and [VPC load balancers](https://cloud.ibm.com/docs/containers?topic=containers-vpc-lbaasvpc_lb_dns) in VPC clusters.

Gateway appliance firewalls
: Updated the [required IP addresses and ports](https://cloud.ibm.com/docs/containers?topic=containers-firewallvyatta_firewall) that you must open in a public gateway device firewall.

Ingress ALB subdomain format
Use case Example roles and scope 

 App auditor [Viewer platform access role for a cluster, region, or resource group](https://cloud.ibm.com/docs/containers?topic=containers-iam-platform-access-roles), [Reader service access role for a cluster, region, or resource group](https://cloud.ibm.com/docs/containers?topic=containers-iam-service-access-roles). 
 App developers [Editor platform access role for a cluster](https://cloud.ibm.com/docs/containers?topic=containers-iam-platform-access-roles), [Writer service access role scoped to a namespace](https://cloud.ibm.com/docs/containers?topic=containers-iam-service-access-roles), [Cloud Foundry developer space role](https://cloud.ibm.com/docs/containers?topic=containers-cloud-foundry-roles). 
 Billing [Viewer platform access role for a cluster, region, or resource group](https://cloud.ibm.com/docs/containers?topic=containers-iam-platform-access-roles). 
 Create a cluster See [Permissions to create a cluster](https://cloud.ibm.com/docs/containers?topic=containers-access_referencecluster_create_permissions). 
 Cluster administrator [Administrator platform access role for a cluster](https://cloud.ibm.com/docs/containers?topic=containers-iam-platform-access-roles), [Manager service access role not scoped to a namespace (for the whole cluster)](https://cloud.ibm.com/docs/containers?topic=containers-iam-service-access-roles).
Working with listeners 

IBM Cloud® Network Load Balancer for VPC (NLB) listeners are used to configure how the load balancer receives your traffic. The attributes that you can define on a listener are protocols, ports, and pools.

You can configure listeners when [creating a network load balancer](https://cloud.ibm.com/docs/vpc?topic=vpc-nlb-ui-creating-network-load-balancer), or later with the following procedure:



1.  From your browser, open the [IBM Cloud console](https://cloud.ibm.com/login) and log in to your account.
2.  Select the Navigation Menu icon ![Navigation Menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg), then click VPC Infrastructure > Load balancers.
3.  Click the NLB that you want to change.
4.  On the network load balancer details page, click the front-end listeners tab, then select the listener that you want to edit.
5.  Select the new options for your listener. You have the following options:



*  Protocol: The network protocol for the inbound customer traffic.
*  Port: The port that the load balancer receives your inbound customer traffic.
*  Back-end pool: The pool the load balancer distributes to the inbound customer traffic.





When you use the UI, you must create a pool before you create a listener. You cannot set the pool of an existing listener to empty.
For more information about the options in this command, see the [CLI reference](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-vpc-resources-with-cli-and-api&interface=clicreate-a-subnet-cli).

ibmcloud is subnet-create <subnet_name> <vpc_id> --zone <vpc_zone> --ipv4-address-count <number_of_ip_address>



* VPC subnets provide IP addresses for your worker nodes and load balancer services in the cluster, so [create a VPC subnet with enough IP addresses](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-subnetsvpc_basics_subnets), such as 256. You can't change the number of IPs that a VPC subnet has later.
* If you are running Red Hat OpenShift 4.7 or earlier, don't use the following reserved ranges: 172.16.0.0/16, 172.18.0.0/16, 172.19.0.0/16, and 172.20.0.0/16.



3. Check whether you have a public gateway in the zones where you want to create a cluster. Within one VPC, you can create only one public gateway per zone, but that public gateway can be attached to multiple subnets within the zone.

ibmcloud is public-gateways

Example output

ID Name VPC Zone Floating IP Created Status Resource group
26426426-6065-4716-a90b-ac7ed7917c63 test-pgw testvpc(36c8f522-.) us-south-1 169.xx.xxx.xxx(26466378-.) 2019-09-20T16:27:32-05:00 available -
This non-persistent VPC load balancer follows the kube-<cluster_ID>-<kubernetes_lb_service_UID> naming convention.





 Attaching a VPC load balancer to a cluster 

After a persistent VPC load balancer is detached from a cluster, you can attach to a different cluster by creating a new Kubernetes LoadBalancer service definition that references the VPC load balancer, or by updating an existing Kubernetes LoadBalancer service that exists on the new cluster.

Versions 1.24 and later: If you create a new LoadBalancer service on the new cluster, you can use the service.kubernetes.io/ibm-load-balancer-cloud-provider-vpc-lb-name annotation to specify the name of the VPC load balancer you want to attach.

Whether you create a new LoadBalancer service or update an existing one, the VPC load balancer type (ALB, NLB) and IP type (public, private) must match the specifications in the LoadBalancer service. For instance, an existing LoadBalancer service on the new cluster that specifies an NLB type cannot be used to attach a VPC ALB to the cluster. The annotations that specify the load balancer type and IP type are service.kubernetes.io/ibm-load-balancer-cloud-provider-enable-features and service.kubernetes.io/ibm-load-balancer-cloud-provider-ip-type, respectively.

The port and node ports specified in the LoadBalancer service do not need to match those that the VPC load balancer was created with. The VPC load balancer re-configures with the port definitions of whichever LoadBalancer service it is associated with in the new cluster.







 Health checks for load balancers 

VPC load balancers are automatically configured with health checks, which you configure with the externalTrafficPolicy annotation. You can use additional annotations to [customize health checks](https://cloud.ibm.com/docs/containers?topic=containers-vpc-lbaasvpc_lb_health_custom) on your load balancers.
However, custom pod and service subnets can't be shared between multiple clusters.
* VPC subnets are bound to a single zone and can't span multiple zones or regions.
* After you create a subnet, you can't move it to a different zone, region, or VPC.
* If you have worker nodes that are attached to an existing subnet in a zone, you can't change the subnet for that zone in the cluster.
* The 172.16.0.0/16, 172.18.0.0/16, 172.19.0.0/16, and 172.20.0.0/16 ranges are prohibited.
* Within one VPC, you can create only one public gateway per zone, but that public gateway can be attached to multiple subnets within the zone.
* The [classic access default address prefixes](https://cloud.ibm.com/docs/vpc?topic=vpc-setting-up-access-to-classic-infrastructureclassic-access-default-address-prefixes) conflict with the subnets for the Red Hat OpenShift on IBM Cloud control plane. You must [create the VPC without the automatic default address prefixes, and then create your own address prefixes and subnets within those ranges for your cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-subnetsclassic_access_subnets).









 Creating a VPC subnet and attaching a public gateway 

Create a VPC subnet for your cluster and optionally attach a public gateway to the subnet.



 Creating a VPC subnet in the console 

Use the IBM Cloud console to create a VPC subnet for your cluster and optionally attach a public gateway to the subnet.



1. From the [VPC subnet dashboard](https://cloud.ibm.com/vpc/network/subnets), click Create.
2. Enter a name for your subnet and select the name of the VPC that you created.
3. Select the location and zone where you want to create the subnet.
4. Specify the number of IP addresses to create.
This non-persistent VPC load balancer follows the kube-<cluster_ID>-<kubernetes_lb_service_UID> naming convention.





 Attaching a VPC load balancer to a cluster 

After a persistent VPC load balancer is detached from a cluster, you can attach to a different cluster by creating a new Kubernetes LoadBalancer service definition that references the VPC load balancer, or by updating an existing Kubernetes LoadBalancer service that exists on the new cluster.

Versions 4.11 and later: If you create a new LoadBalancer service on the new cluster, you can use the service.kubernetes.io/ibm-load-balancer-cloud-provider-vpc-lb-name annotation to specify the name of the VPC load balancer you want to attach.

Whether you create a new LoadBalancer service or update an existing one, the VPC load balancer type (ALB, NLB) and IP type (public, private) must match the specifications in the LoadBalancer service. For instance, an existing LoadBalancer service on the new cluster that specifies an NLB type cannot be used to attach a VPC ALB to the cluster. The annotations that specify the load balancer type and IP type are service.kubernetes.io/ibm-load-balancer-cloud-provider-enable-features and service.kubernetes.io/ibm-load-balancer-cloud-provider-ip-type, respectively.

The port and node ports specified in the LoadBalancer service do not need to match those that the VPC load balancer was created with. The VPC load balancer re-configures with the port definitions of whichever LoadBalancer service it is associated with in the new cluster.







 Health checks for load balancers 

VPC load balancers are automatically configured with health checks, which you configure with the externalTrafficPolicy annotation. You can use additional annotations to [customize health checks](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-lbaasvpc_lb_health_custom) on your load balancers.
* [Security groups applied to VPE gateways and VPC ALBs](https://cloud.ibm.com/docs/containers?topic=containers-vpc-security-groupvpc-sg-vpe-alb)



* [Viewing VPC security groups in the CLI](https://cloud.ibm.com/docs/containers?topic=containers-vpc-security-groupvpc-sg-cli)
* [Viewing the default VPC security groups in the UI](https://cloud.ibm.com/docs/containers?topic=containers-vpc-security-groupvpc-sg-ui)
* [Minimum inbound and outbound requirements](https://cloud.ibm.com/docs/containers?topic=containers-vpc-security-groupvpc-sg-inbound-outbound)



* [Required inbound and outbound rules for cluster workers](https://cloud.ibm.com/docs/containers?topic=containers-vpc-security-grouprequired-group-rules-workers)
* [Required inbound and outbound rules for VPC ALBs](https://cloud.ibm.com/docs/containers?topic=containers-vpc-security-grouprequired-group-rules-alb)



* [Creating security group rules](https://cloud.ibm.com/docs/containers?topic=containers-vpc-security-groupvpc-sg-create-rules)



* [Creating rules in the console](https://cloud.ibm.com/docs/containers?topic=containers-vpc-security-groupsecurity-group-inbound-rules)
* [Creating rules in the command line](https://cloud.ibm.com/docs/containers?topic=containers-vpc-security-groupsecurity_groups_cli)



* [Adding VPC security groups to clusters and worker pools during create time](https://cloud.ibm.com/docs/containers?topic=containers-vpc-security-groupvpc-sg-cluster)
Carefully plan by [designing an addressing plan for a VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-addressing-plan-design) and use non-overlapping CIDR blocks.

It is tempting to divide up the CIDR space first by VPC but this complicates routing. Instead think of an availability zone as a single CIDR block and each VPC as consuming a slice of it.

Zoom

![Zones](https://cloud.ibm.com/docs-content/v1/content/6a28e4ae2660b609a18e90e1239ed772f80373d6/transit-gateway/includes/solution-tutorials/includes/solution-tutorials/images/vpc-transit/vpc-transit-zones.svg)

Zones

This diagram shows just zone 1 in more detail. The subnet sizes and layout are identical in the other zones:

Zoom

![VPC Layout](https://cloud.ibm.com/docs-content/v1/content/6a28e4ae2660b609a18e90e1239ed772f80373d6/transit-gateway/includes/solution-tutorials/includes/solution-tutorials/images/vpc-transit/vpc-transit-vpc-layout.svg)

VPC Layout

Above the enterprise is on the left and the IBM Cloud on the right. In the IBM Cloud for simplictiy a single zone is depicted for the transit VPC and Spoke 0. Notice the CIDR blocks do not overlap and VPCs all consume a CIDR block in each zone:



* The on-premises CIDR is 192.168.0.0/16.
* The zones in this [multi-zone region](https://cloud.ibm.com/docs/overview?topic=overview-locations) are 10.*.0.0/16. The second digit: 1, 2, 3 is the zone number (shown for Dallas/us-south):