IBM Cloud Advocate (C1000-176) - 8-Week Practice Plan¶

# Objectives:
# - Create IBM Cloud account
# - Navigate the IBM Cloud Console
# - Explore the catalog

Tasks:
1. Sign up for IBM Cloud Lite account
2. Complete account verification
3. Tour the IBM Cloud Console
4. Browse the service catalog
5. View account settings and profile

# Install IBM Cloud CLI
curl -fsSL https://clis.cloud.ibm.com/install/linux | sh

# Login to IBM Cloud
ibmcloud login

# Explore basic commands
ibmcloud account list
ibmcloud account show
ibmcloud regions
ibmcloud catalog search

# Install essential plugins
ibmcloud plugin install vpc-infrastructure
ibmcloud plugin install kubernetes-service
ibmcloud plugin install container-registry

# List available services
ibmcloud catalog service-marketplace

# Create resource group
ibmcloud resource group-create dev-environment

# Target resource group
ibmcloud target -g dev-environment

# View current target
ibmcloud target

# List all resource groups
ibmcloud resource groups

# Tag resources for organization
ibmcloud resource tag-attach \
  --resource-name my-service \
  --tag-names env:dev,team:engineering

# Create VPC
ibmcloud is vpc-create my-vpc \
  --address-prefix-management manual

# Create address prefix
ibmcloud is vpc-address-prefix-create my-prefix \
  my-vpc \
  us-south-1 \
  10.240.0.0/24

# Create subnet
ibmcloud is subnet-create my-subnet \
  my-vpc \
  --ipv4-cidr-block 10.240.0.0/24 \
  --zone us-south-1

# Create public gateway
ibmcloud is public-gateway-create my-pgw \
  my-vpc \
  us-south-1

# Attach gateway to subnet
ibmcloud is subnet-update my-subnet \
  --public-gateway my-pgw

# List VPC resources
ibmcloud is vpcs
ibmcloud is subnets
ibmcloud is public-gateways

# List available instance profiles
ibmcloud is instance-profiles

# Get SSH key (create if needed)
ibmcloud is keys

# Create SSH key
ibmcloud is key-create my-key @~/.ssh/id_rsa.pub

# Create security group
ibmcloud is security-group-create my-sg my-vpc

# Add SSH rule
ibmcloud is security-group-rule-add my-sg \
  inbound tcp \
  --port-min 22 \
  --port-max 22 \
  --remote 0.0.0.0/0

# Add HTTP rule
ibmcloud is security-group-rule-add my-sg \
  inbound tcp \
  --port-min 80 \
  --port-max 80 \
  --remote 0.0.0.0/0

# Get image ID
ibmcloud is images --visibility public | grep ubuntu

# Create instance
ibmcloud is instance-create my-instance \
  my-vpc \
  us-south-1 \
  bx2-2x8 \
  my-subnet \
  --image <image-id> \
  --keys my-key \
  --security-groups my-sg

# Wait for instance to be running
ibmcloud is instance my-instance

# Create and associate floating IP
ibmcloud is floating-ip-reserve my-ip \
  --zone us-south-1

ibmcloud is instance-network-interface-floating-ip-add \
  my-instance \
  <network-interface-id> \
  my-ip

# SSH to instance
ssh root@<floating-ip>

# Create COS instance
ibmcloud resource service-instance-create my-cos \
  cloud-object-storage standard global

# Create service credentials
ibmcloud resource service-key-create my-cos-key \
  --instance-name my-cos \
  --role Writer

# Get credentials
ibmcloud resource service-key my-cos-key

# Install AWS CLI (S3 compatible)
pip install awscli

# Configure AWS CLI with COS credentials
aws configure set aws_access_key_id <access_key_id>
aws configure set aws_secret_access_key <secret_access_key>

# Create bucket
aws s3 mb s3://my-unique-bucket-name \
  --endpoint-url=https://s3.us-south.cloud-object-storage.appdomain.cloud

# Upload file
echo "Hello IBM Cloud" > test.txt
aws s3 cp test.txt s3://my-unique-bucket-name/ \
  --endpoint-url=https://s3.us-south.cloud-object-storage.appdomain.cloud

# List objects
aws s3 ls s3://my-unique-bucket-name/ \
  --endpoint-url=https://s3.us-south.cloud-object-storage.appdomain.cloud

# Download object
aws s3 cp s3://my-unique-bucket-name/test.txt downloaded.txt \
  --endpoint-url=https://s3.us-south.cloud-object-storage.appdomain.cloud

# Create Cloudant instance (Lite plan)
ibmcloud resource service-instance-create my-cloudant \
  cloudantnosqldb lite us-south

# Create credentials
ibmcloud resource service-key-create my-cloudant-key \
  --instance-name my-cloudant \
  --role Manager

# Get connection details
ibmcloud resource service-key my-cloudant-key

# Using curl to interact with Cloudant
# Create database
curl -X PUT https://<username>.cloudantnosqldb.appdomain.cloud/testdb \
  -u <username>:<password>

# Insert document
curl -X POST https://<username>.cloudantnosqldb.appdomain.cloud/testdb \
  -H "Content-Type: application/json" \
  -d '{"name":"John Doe","email":"john@example.com","age":30}' \
  -u <username>:<password>

# Query all documents
curl -X GET https://<username>.cloudantnosqldb.appdomain.cloud/testdb/_all_docs?include_docs=true \
  -u <username>:<password>

# Create index
curl -X POST https://<username>.cloudantnosqldb.appdomain.cloud/testdb/_index \
  -H "Content-Type: application/json" \
  -d '{"index":{"fields":["name"]},"name":"name-index","type":"json"}' \
  -u <username>:<password>

# Find documents
curl -X POST https://<username>.cloudantnosqldb.appdomain.cloud/testdb/_find \
  -H "Content-Type: application/json" \
  -d '{"selector":{"name":"John Doe"}}' \
  -u <username>:<password>

# Create PostgreSQL instance (trial plan if available)
ibmcloud resource service-instance-create my-postgres \
  databases-for-postgresql standard us-south \
  -p '{
    "members_memory_allocation_mb": "2048",
    "members_disk_allocation_mb": "10240"
  }'

# Create credentials
ibmcloud resource service-key-create my-postgres-key \
  --instance-name my-postgres \
  --role Administrator

# Get connection string
ibmcloud resource service-key my-postgres-key

# Install PostgreSQL client (if needed)
# Ubuntu/Debian: sudo apt-get install postgresql-client
# macOS: brew install postgresql

# Connect to PostgreSQL
psql "postgres://username:password@host:port/ibmclouddb?sslmode=verify-full"

# Inside psql:
-- Create table
CREATE TABLE users (
  id SERIAL PRIMARY KEY,
  name VARCHAR(100),
  email VARCHAR(100) UNIQUE,
  created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

-- Insert data
INSERT INTO users (name, email) VALUES
  ('Alice', 'alice@example.com'),
  ('Bob', 'bob@example.com');

-- Query data
SELECT * FROM users;

-- Exit
\q

# Prerequisite: Create multiple virtual server instances (Lab 2.2)

# Create application load balancer
ibmcloud is load-balancer-create my-alb \
  --type public \
  --subnet <subnet-id>

# Wait for load balancer to be active
ibmcloud is load-balancer my-alb

# Create backend pool
ibmcloud is load-balancer-pool-create my-pool \
  my-alb \
  round_robin \
  http \
  30 \
  --health-monitor-delay 5 \
  --health-monitor-max-retries 2 \
  --health-monitor-timeout 2 \
  --health-monitor-type http \
  --health-monitor-url /health

# Add pool members (your virtual server instances)
ibmcloud is load-balancer-pool-member-create \
  my-alb \
  my-pool \
  80 \
  <instance1-id>

ibmcloud is load-balancer-pool-member-create \
  my-alb \
  my-pool \
  80 \
  <instance2-id>

# Create listener
ibmcloud is load-balancer-listener-create my-alb \
  80 \
  http \
  --default-pool my-pool

# Get load balancer hostname
ibmcloud is load-balancer my-alb

# Test load balancer
curl http://<load-balancer-hostname>

# Install Container Registry plugin
ibmcloud plugin install container-registry

# Login to registry
ibmcloud cr login

# Create namespace
ibmcloud cr namespace-add my-namespace

# List namespaces
ibmcloud cr namespaces

# Build sample Docker image
cat > Dockerfile <<EOF
FROM nginx:alpine
COPY index.html /usr/share/nginx/html/
EXPOSE 80
CMD ["nginx", "-g", "daemon off;"]
EOF

cat > index.html <<EOF
<html>
<body>
<h1>Hello from IBM Cloud!</h1>
</body>
</html>
EOF

# Build image
docker build -t us.icr.io/my-namespace/hello-nginx:v1 .

# Push to registry
docker push us.icr.io/my-namespace/hello-nginx:v1

# List images
ibmcloud cr images

# Scan for vulnerabilities
ibmcloud cr vulnerability-assessment us.icr.io/my-namespace/hello-nginx:v1

# Pull image
docker pull us.icr.io/my-namespace/hello-nginx:v1

# Install Kubernetes Service plugin
ibmcloud plugin install kubernetes-service

# Create free cluster (note: limited to 1 per account, expires after 30 days)
ibmcloud ks cluster create classic \
  --name my-free-cluster

# Wait for cluster to be ready (10-20 minutes)
ibmcloud ks cluster get --cluster my-free-cluster

# Download cluster configuration
ibmcloud ks cluster config --cluster my-free-cluster

# Verify kubectl access
kubectl version
kubectl get nodes

# View cluster info
kubectl cluster-info
kubectl get namespaces

# Create deployment YAML
cat > deployment.yaml <<EOF
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello-nginx
spec:
  replicas: 2
  selector:
    matchLabels:
      app: hello-nginx
  template:
    metadata:
      labels:
        app: hello-nginx
    spec:
      containers:
      - name: nginx
        image: us.icr.io/my-namespace/hello-nginx:v1
        ports:
        - containerPort: 80
EOF

# Create service YAML
cat > service.yaml <<EOF
apiVersion: v1
kind: Service
metadata:
  name: hello-nginx
spec:
  type: NodePort
  selector:
    app: hello-nginx
  ports:
  - port: 80
    targetPort: 80
EOF

# Apply configuration
kubectl apply -f deployment.yaml
kubectl apply -f service.yaml

# Check deployment status
kubectl get deployments
kubectl get pods
kubectl get services

# View pod logs
kubectl logs <pod-name>

# Scale deployment
kubectl scale deployment hello-nginx --replicas=3

# Get service details
kubectl describe service hello-nginx

# Access application (for free cluster, use NodePort)
ibmcloud ks worker ls --cluster my-free-cluster
# Access via http://<worker-public-ip>:<node-port>

# Update deployment
kubectl set image deployment/hello-nginx nginx=us.icr.io/my-namespace/hello-nginx:v2

# Rollback deployment
kubectl rollout undo deployment/hello-nginx

# Delete resources
kubectl delete -f deployment.yaml
kubectl delete -f service.yaml

# Install Code Engine plugin
ibmcloud plugin install code-engine

# Create project
ibmcloud ce project create --name my-project

# Select project
ibmcloud ce project select --name my-project

# Deploy application from container image
ibmcloud ce application create --name hello-app \
  --image icr.io/codeengine/hello \
  --min-scale 0 \
  --max-scale 5 \
  --cpu 0.25 \
  --memory 0.5G

# Get application URL
ibmcloud ce application get --name hello-app

# Test application
curl <application-url>

# View logs
ibmcloud ce application logs --name hello-app

# Update application
ibmcloud ce application update --name hello-app \
  --min-scale 1 \
  --max-scale 10

# Create job
cat > job.sh <<'EOF'
#!/bin/bash
echo "Starting batch job..."
for i in {1..10}; do
  echo "Processing item $i"
  sleep 1
done
echo "Batch job complete!"
EOF

# Build job image (requires Dockerfile)
cat > Dockerfile <<'EOF'
FROM alpine:latest
COPY job.sh /job.sh
RUN chmod +x /job.sh
CMD ["/job.sh"]
EOF

# Build and push
docker build -t us.icr.io/my-namespace/batch-job:v1 .
docker push us.icr.io/my-namespace/batch-job:v1

# Create Code Engine job
ibmcloud ce job create --name batch-job \
  --image us.icr.io/my-namespace/batch-job:v1

# Run job
ibmcloud ce jobrun submit --job batch-job

# View job runs
ibmcloud ce jobrun list

# View job logs
ibmcloud ce jobrun logs --jobrun <jobrun-name>

# Create Watson Assistant instance (Lite plan)
ibmcloud resource service-instance-create my-assistant \
  conversation lite us-south

# Create service credentials
ibmcloud resource service-key-create my-assistant-key \
  --instance-name my-assistant \
  --role Manager

# Get credentials
ibmcloud resource service-key my-assistant-key --output json

# Install Watson SDK (Python example)
pip install ibm-watson

# Create Python script
cat > watson_assistant_test.py <<'EOF'
from ibm_watson import AssistantV2
from ibm_cloud_sdk_core.authenticators import IAMAuthenticator

# Replace with your credentials
authenticator = IAMAuthenticator('YOUR_API_KEY')
assistant = AssistantV2(
    version='2023-06-15',
    authenticator=authenticator
)
assistant.set_service_url('YOUR_SERVICE_URL')

# Create session
session = assistant.create_session(
    assistant_id='YOUR_ASSISTANT_ID'
).get_result()
print(f"Session ID: {session['session_id']}")

# Send message
response = assistant.message(
    assistant_id='YOUR_ASSISTANT_ID',
    session_id=session['session_id'],
    input={
        'message_type': 'text',
        'text': 'Hello'
    }
).get_result()

print(f"Response: {response['output']['generic'][0]['text']}")

# Delete session
assistant.delete_session(
    assistant_id='YOUR_ASSISTANT_ID',
    session_id=session['session_id']
)
EOF

# Note: Configure assistant through web UI first
# https://cloud.ibm.com/services/conversation/my-assistant

# Create Watson NLU instance (Lite plan)
ibmcloud resource service-instance-create my-nlu \
  natural-language-understanding free us-south

# Create credentials
ibmcloud resource service-key-create my-nlu-key \
  --instance-name my-nlu \
  --role Manager

# Get credentials
ibmcloud resource service-key my-nlu-key --output json

# Create Python script
cat > watson_nlu_test.py <<'EOF'
from ibm_watson import NaturalLanguageUnderstandingV1
from ibm_watson.natural_language_understanding_v1 import Features, EntitiesOptions, KeywordsOptions, SentimentOptions
from ibm_cloud_sdk_core.authenticators import IAMAuthenticator

# Replace with your credentials
authenticator = IAMAuthenticator('YOUR_API_KEY')
nlu = NaturalLanguageUnderstandingV1(
    version='2022-04-07',
    authenticator=authenticator
)
nlu.set_service_url('YOUR_SERVICE_URL')

# Analyze text
text = """
IBM Cloud is a suite of cloud computing services from IBM that offers
both platform as a service (PaaS) and infrastructure as a service (IaaS).
With IBM Cloud, you can build, deploy, and manage applications securely
across multiple regions worldwide.
"""

response = nlu.analyze(
    text=text,
    features=Features(
        entities=EntitiesOptions(sentiment=True, limit=5),
        keywords=KeywordsOptions(sentiment=True, limit=5),
        sentiment=SentimentOptions()
    )
).get_result()

print("Overall Sentiment:", response['sentiment']['document']['label'])
print("\nEntities:")
for entity in response['entities']:
    print(f"- {entity['text']} ({entity['type']})")

print("\nKeywords:")
for keyword in response['keywords']:
    print(f"- {keyword['text']} (relevance: {keyword['relevance']})")
EOF

python watson_nlu_test.py

# Install Terraform (if not already installed)
# macOS: brew install terraform
# Linux: Download from terraform.io

# Create Terraform configuration
mkdir terraform-lab
cd terraform-lab

cat > main.tf <<'EOF'
terraform {
  required_providers {
    ibm = {
      source = "IBM-Cloud/ibm"
      version = "~> 1.58"
    }
  }
}

provider "ibm" {
  region = "us-south"
  ibmcloud_api_key = var.ibmcloud_api_key
}

variable "ibmcloud_api_key" {
  description = "IBM Cloud API Key"
  type        = string
  sensitive   = true
}

variable "resource_group_id" {
  description = "Resource Group ID"
  type        = string
}

# Create Object Storage instance
resource "ibm_resource_instance" "cos" {
  name              = "my-terraform-cos"
  service           = "cloud-object-storage"
  plan              = "lite"
  location          = "global"
  resource_group_id = var.resource_group_id
}

# Output instance details
output "cos_instance_id" {
  value = ibm_resource_instance.cos.id
}
EOF

cat > terraform.tfvars <<EOF
ibmcloud_api_key = "YOUR_API_KEY"
resource_group_id = "YOUR_RESOURCE_GROUP_ID"
EOF

# Initialize Terraform
terraform init

# Plan deployment
terraform plan

# Apply configuration
terraform apply

# View state
terraform show

# Destroy resources
terraform destroy

# Create GitHub repository with Terraform config or use existing one

# Create Schematics workspace
ibmcloud schematics workspace new \
  --name my-workspace \
  --location us-south \
  --resource-group default \
  --github-url https://github.com/IBM-Cloud/terraform-provider-ibm/tree/master/examples/ibm-resource-instance \
  --terraform-version 1.5

# Get workspace ID
ibmcloud schematics workspace list

# Pull latest from Git
ibmcloud schematics workspace update --id <workspace-id>

# Generate plan
ibmcloud schematics plan --id <workspace-id>

# Check plan status
ibmcloud schematics workspace get --id <workspace-id>

# Apply plan
ibmcloud schematics apply --id <workspace-id>

# View outputs
ibmcloud schematics workspace output --id <workspace-id>

# View state
ibmcloud schematics state list --id <workspace-id>

# Destroy resources
ibmcloud schematics destroy --id <workspace-id>

# Delete workspace
ibmcloud schematics workspace delete --id <workspace-id>

# Create a simple Node.js application
mkdir myapp
cd myapp

cat > package.json <<'EOF'
{
  "name": "myapp",
  "version": "1.0.0",
  "description": "Simple app for CI/CD",
  "main": "server.js",
  "scripts": {
    "start": "node server.js",
    "test": "echo \"Running tests...\" && exit 0"
  },
  "dependencies": {
    "express": "^4.18.0"
  }
}
EOF

cat > server.js <<'EOF'
const express = require('express');
const app = express();
const port = process.env.PORT || 8080;

app.get('/', (req, res) => {
  res.send('Hello from IBM Cloud CI/CD!');
});

app.listen(port, () => {
  console.log(`Server running on port ${port}`);
});
EOF

# Initialize git repository
git init
git add .
git commit -m "Initial commit"

# Create repository on GitHub/GitLab
# Push code to repository

# Create toolchain in IBM Cloud Console
# https://cloud.ibm.com/devops/create
# Select "Develop a Kubernetes app" template
# Configure Git repository
# Configure delivery pipeline
# Deploy to Code Engine or Kubernetes

# Create service ID
ibmcloud iam service-id-create my-app-service \
  --description "Service ID for my application"

# Create API key for service ID
ibmcloud iam service-api-key-create my-app-key my-app-service \
  --description "API key for CI/CD" \
  --file service-key.json

# View service IDs
ibmcloud iam service-ids

# Create access group
ibmcloud iam access-group-create developers \
  --description "Developer access group"

# Add user to access group
ibmcloud iam access-group-user-add developers your-email@example.com

# Add service ID to access group
ibmcloud iam access-group-service-id-add developers my-app-service

# Create policy for access group
ibmcloud iam access-group-policy-create developers \
  --roles Viewer,Operator \
  --resource-group-name development

# Create resource-specific policy
ibmcloud iam access-group-policy-create developers \
  --roles Editor \
  --service-name kubernetes \
  --resource-group-name development

# List policies
ibmcloud iam access-group-policies developers

# View access group details
ibmcloud iam access-group developers

# Remove user from access group
ibmcloud iam access-group-user-remove developers your-email@example.com

# Create Key Protect instance
ibmcloud resource service-instance-create my-key-protect \
  kms tiered-pricing us-south

# Get instance ID
KP_INSTANCE_ID=$(ibmcloud resource service-instance my-key-protect --output json | jq -r '.[0].guid')

# Install Key Protect plugin
ibmcloud plugin install key-protect

# Create root key
ibmcloud kp create my-root-key \
  --instance-id $KP_INSTANCE_ID \
  --description "Root key for encryption"

# List keys
ibmcloud kp list --instance-id $KP_INSTANCE_ID

# Get key ID
KEY_ID=$(ibmcloud kp list --instance-id $KP_INSTANCE_ID --output json | jq -r '.[0].id')

# Wrap (encrypt) a data encryption key
DEK=$(echo "my-secret-data-encryption-key" | base64)
ibmcloud kp wrap $KEY_ID \
  --instance-id $KP_INSTANCE_ID \
  --plaintext $DEK

# Rotate key
ibmcloud kp rotate $KEY_ID \
  --instance-id $KP_INSTANCE_ID

# Enable key for deletion (requires 4 authorizations in production)
ibmcloud kp enable-delete $KEY_ID \
  --instance-id $KP_INSTANCE_ID

# Create Secrets Manager instance
ibmcloud resource service-instance-create my-secrets-manager \
  secrets-manager trial us-south

# Get instance ID
SM_INSTANCE_ID=$(ibmcloud resource service-instance my-secrets-manager --output json | jq -r '.[0].guid')

# Install Secrets Manager plugin
ibmcloud plugin install secrets-manager

# Set target instance
ibmcloud secrets-manager config set instance-id $SM_INSTANCE_ID

# Create arbitrary secret
ibmcloud secrets-manager secret-create \
  --secret-type arbitrary \
  --name "database-password" \
  --description "Production database password" \
  --secret-data '{"password":"super-secret-password"}'

# Create IAM credentials (dynamic)
ibmcloud secrets-manager secret-create \
  --secret-type iam_credentials \
  --name "dynamic-api-key" \
  --description "Dynamic API key for application" \
  --service-id <service-id>

# List secrets
ibmcloud secrets-manager secrets

# Get secret value
ibmcloud secrets-manager secret \
  --secret-type arbitrary \
  --id <secret-id>

# Update secret
ibmcloud secrets-manager secret-update \
  --secret-type arbitrary \
  --id <secret-id> \
  --secret-data '{"password":"new-password"}'

# Delete secret
ibmcloud secrets-manager secret-delete \
  --secret-type arbitrary \
  --id <secret-id>

# Create Monitoring instance
ibmcloud resource service-instance-create my-monitoring \
  sysdig-monitor graduated-tier us-south

# Configure platform metrics
ibmcloud ob monitoring config create \
  --instance my-monitoring

# Access monitoring dashboard
ibmcloud ob monitoring dashboard open --instance my-monitoring

# Explore:
# - Default dashboards
# - Kubernetes metrics (if cluster deployed)
# - Custom dashboards
# - Alerts configuration

# Create Logging instance
ibmcloud resource service-instance-create my-logging \
  logdna 7-day us-south

# Configure platform logs
ibmcloud ob logging config create \
  --instance my-logging

# Access logging dashboard
ibmcloud ob logging dashboard open --instance my-logging

# Explore:
# - Log sources
# - Search and filtering
# - Views creation
# - Alerts setup

# 1. Create VPC infrastructure
# 2. Deploy PostgreSQL database
# 3. Create Kubernetes cluster
# 4. Build and push container image
# 5. Deploy application to Kubernetes
# 6. Configure load balancer
# 7. Set up IAM policies
# 8. Enable encryption with Key Protect
# 9. Configure monitoring and logging
# 10. Create backup strategy

# This exercise combines all concepts from previous weeks
# Refer to individual lab exercises for specific commands