vania-janet/multiturn-rag-retrieval-data huggingface dataset:
When you [label worker nodes as edge nodes](https://cloud.ibm.com/docs/containers?topic=containers-edgeedge_nodes), NLB and ALB pods are deployed to only those specified worker nodes. Additionally, to prevent other workloads from running on edge nodes, you can [taint the edge nodes](https://cloud.ibm.com/docs/containers?topic=containers-edgeedge_workloads). Then, you can deploy both public and private NLBs and ALBs to edge nodes. For example, if your worker nodes are connected to a private VLAN only, but you need to permit public access to an app in your cluster, you can create an edge worker pool in which the edge nodes are connected to public and private VLANs. You can deploy public NLBs and ALBs to these edge nodes to ensure that only those workers handle public connections.







 Scenario: Running internet-facing app workloads in a classic cluster 

In this scenario, you want to run workloads in a classic cluster that are accessible to requests from the Internet so that end users can access your apps. You want the option of isolating public access in your cluster and of controlling what public requests are permitted to your cluster. Additionally, your workers have automatic access to any IBM Cloud services that you want to connect with your cluster.

Zoom

![Architecture image for a cluster that runs internet-facing workloads.](https://cloud.ibm.com/docs-content/v1/content/4d497aff9e27b92fbbc2ee4e343a9ec4549cb1d7/containers/images/cs_clusters_planning_internet.png)

Figure 1. Network setup for a cluster that runs internet-facing workloads



 Worker-to-worker communication in classic clusters with internet-facing workloads 

To achieve this setup, you create a cluster by connecting worker nodes to public and private VLANs.

If you create the cluster with both public and private VLANs, you can't later remove all public VLANs from that cluster. Removing all public VLANs from a cluster causes several cluster components to stop working.
* When you create your cluster, you must choose a VPC networking setup so that certain cluster components can communicate with each other and with networks or services outside of the cluster.



* Worker-to-worker communication: All worker nodes must be able to communicate with each other on the private network through VPC subnets.
* Worker-to-master and user-to-master communication: Your worker nodes and your authorized cluster users can communicate with the Kubernetes master securely over virtual private endpoints or cloud service endpoints.
* Worker communication to other services or networks: Allow your worker nodes to securely communicate with other IBM Cloud services, such as IBM Cloud® Container Registry, to on-premises networks, to other VPCs, or to classic infrastructure resources.
* External communication to apps that run on worker nodes: Allow public or private requests into the cluster as well as requests out of the cluster to a public endpoint.



* Understanding of [Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-roks-overviewservice-concepts)
* Components that are set up in a Red Hat OpenShift on IBM Cloud [VPC cluster architecture](https://cloud.ibm.com/docs/openshift?topic=openshift-service-architectureservice-arch-vpc-4)

![IKS on VPC](https://cloud.ibm.com/docs-content/v1/content/b7b9235ce6abd45b66931867c388cf107d38e15b/cloud-native-journey/roks-on-vpc/images/overview/arch_roks_vpc.svg)







 Next Steps 

The next step on the deployment journey is:



* [Prepare your IBM Cloud account](https://cloud.ibm.com/docs/cloud-native-journey?topic=cloud-native-journey-cloud-native-roks-prepare-account)
Understanding network basics of classic clusters 

When you create a classic cluster, you must choose a networking setup so that certain cluster components can communicate with each other and with networks or services outside of the cluster.



* [Worker-to-worker communication](https://cloud.ibm.com/docs/openshift?topic=openshift-plan_basicsworker-worker): All worker nodes must be able to communicate with each other on the private network. Often, communication must be permitted across multiple private VLANs to allow workers on different VLANs and in different zones to connect with each other.
* [Worker-to-master and user-to-master communication](https://cloud.ibm.com/docs/openshift?topic=openshift-plan_basicsworkeruser-master): Your worker nodes and your authorized cluster users can communicate with the Kubernetes master securely over the public network with TLS or over the private network through private cloud service endpoints.
* [Worker communication to other IBM Cloud services or on-premises networks](https://cloud.ibm.com/docs/openshift?topic=openshift-plan_basicsworker-services-onprem): Allow your worker nodes to securely communicate with other IBM Cloud services, such as IBM Cloud® Container Registry, and to an on-premises network.
* [External communication to apps that run on worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-plan_basicsexternal-workers): Allow public or private requests into the cluster as well as requests out of the cluster to a public endpoint.





 Worker-to-worker communication: classic VLANs and subnets 

When you create a classic cluster, the cluster's worker nodes are connected automatically to a private VLAN and a public VLAN. A VLAN configures a group of worker nodes and pods as if they were attached to the same physical wire and provides a channel for connectivity among the workers.

You can't create classic Red Hat OpenShift on IBM Cloud clusters that are connected to a private VLAN only. Your worker nodes must be connected to both public and private VLANs.



 VLAN connections for worker nodes
Example use cases for labels include [limiting network traffic to edge worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-edge), [deploying an app to a GPU machine](https://cloud.ibm.com/docs/containers?topic=containers-deploy_appgpu_app), and [restricting your app workloads](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/) to run on worker nodes that meet certain flavor or SDS capabilities, such as bare metal worker nodes. To see what labels are already applied to a resource, use the oc get command with the --show-labels option.

To apply labels to worker nodes, [create your worker pool](https://cloud.ibm.com/docs/openshift?topic=openshift-add_workersadd_pool) with labels or [update an existing worker pool](https://cloud.ibm.com/docs/openshift?topic=openshift-add_workersworker_pool_labels).







 How can I keep my cluster in a supported state? 

Make sure that your cluster always runs a [supported Red Hat OpenShift version](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_versions). When a new Red Hat OpenShift minor version is released, an older version is shortly deprecated after and then becomes unsupported. For more information, see [Updating the master](https://cloud.ibm.com/docs/containers?topic=containers-updatemaster) and [worker nodes](https://cloud.ibm.com/docs/containers?topic=containers-updateworker_node).







 Making your resources highly available 

While no system is entirely failsafe, you can take steps to increase the high availability of your apps and services in Red Hat OpenShift on IBM Cloud.

Review more information about making resources highly available.
Key Management Service provider 277 v1.0.0 Updated the IBM Key Protect Go client. 
 OpenVPN client N/A N/A Fixed a problem that might cause the vpn-config secret in the kube-system namespace to be deleted during cluster master operations. 







 Change log for worker node fix pack 1.14.10_1551, released 13 April 2020 

The following table shows the changes that are in the worker node fix pack 1.14.10_1551. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.14.10_1550

 Component Previous Current Description 

 HA proxy 1.8.23 1.8.25 See the [HA proxy change logs](https://www.haproxy.org/download/1.8/src/CHANGELOG). The update addresses [CVE-2020-11100](https://nvd.nist.gov/vuln/detail/CVE-2020-11100). 
 Ubuntu 18.04 packages 4.15.0-91-generic 4.15.0-96-generic Updated worker node images with package and kernel updates for [CVE-2020-8831](https://nvd.nist.gov/vuln/detail/CVE-2020-8831), [CVE-2020-8833](https://nvd.nist.gov/vuln/detail/CVE-2020-8833), [CVE-2020-11100](https://nvd.nist.gov/vuln/detail/CVE-2020-11100), and [CVE-2020-8834](https://nvd.nist.gov/vuln/detail/CVE-2020-8834).
Common issues with worker nodes 

Virtual Private Cloud

Classic infrastructure

Review common error messages and learn how to resolve them. Messages might begin with the prefix, '<provider>' infrastructure exception:, where <provider> identifies which infrastructure provider the worker node uses.



 Account prohibited from ordering 

Message:

Your account is currently prohibited from ordering 'Computing Instances'.

Description and resolution:

Your IBM Cloud infrastructure account might be restricted from ordering compute resources. Contact IBM Cloud support by opening an [IBM Cloud support case](https://cloud.ibm.com/docs/openshift?topic=openshift-get-help).





 Could not place order 

Message:

Could not place order.

Could not place order. There are insufficient resources behind router 'router_name' to fulfill the request for the following guests: 'worker_id'.

Description and resolution: The zone that you selected might not have enough infrastructure capacity to provision your worker nodes. Or, you might have exceeded a limit in your IBM Cloud infrastructure account.

To resolve, try one of the following options:



* Infrastructure resource availability in zones can fluctuate often. Wait a few minutes and try again.
* For a single zone cluster, create the cluster in a different zone. For a multizone cluster, add a zone to the cluster.
* Specify a different pair of public and private VLANs for your worker nodes in your IBM Cloud infrastructure account. For worker nodes that are in a worker pool, you can use the ibmcloud oc zone network-set [command](
* Contact your IBM Cloud infrastructure account manager to verify that you don't exceed an account limit, such as a global quota.
* Open an [IBM Cloud infrastructure support case](https://cloud.ibm.com/docs/openshift?topic=openshift-get-help).







 Could not obtain network VLAN 

Message:

Could not obtain network VLAN with ID: <vlan-id>

Description and resolution:

Your worker node could not be provisioned because the selected VLAN ID could not be found for one of the following reasons:
Although this option is usually less expensive and sufficient, you might want to verify your performance and infrastructure requirements with your company policies. Virtual machines are billed hourly.
* Virtual - dedicated: Your worker nodes are hosted on infrastructure that is devoted to your account. Your physical resources are completely isolated. Virtual machines are billed hourly.



9. Optional: If the flavor that you want to use has a configurable secondary disk, you can modify the secondary disk by clicking the Edit icon ![Edit icon](https://cloud.ibm.com/docs-content/v1/content/4d497aff9e27b92fbbc2ee4e343a9ec4549cb1d7/icons/edit-tagging.svg). Select the storage disks that you want to add to your worker nodes and then click Apply. To view a list of VPC worker node flavors and their storage options, see [VPC flavors](https://cloud.ibm.com/docs/containers?topic=containers-vpc-flavors).
10. Set how many worker nodes to create per zone, such as 3. You must set at least 1 worker node. For more information, see [What is the smallest size cluster that I can make?](https://cloud.ibm.com/docs/containers?topic=containers-faqssmallest_cluster).
11. Enable [boot volume encryption](https://cloud.ibm.com/docs/containers?topic=containers-encryptionworker-encryption-vpc). From the drop down menus, select a key management service (KMS) instance and root key to encrypt the local disk for each worker node in the default worker pool. If you choose not to enable this option when you create your cluster, you can enable it later.
12. Configure your cluster with a private or a public and a private cloud service endpoint by setting the Master service endpoint.
Worker communication to other services or networks with internet-facing workloads 

Your worker nodes can automatically, securely communicate with other IBM Cloud services that support private cloud service endpoints over your IBM Cloud infrastructure private network. If an IBM Cloud service does not support private cloud service endpoints, workers can securely communicate with the services over the public network. You can lock down the public or private interfaces of worker nodes by using Calico network policies for public network or private network isolation. You might need to allow access to the public and private IP addresses of the services that you want to use in these Calico isolation policies.

If your worker nodes need to access services in private networks outside of your IBM Cloud account, you can configure and deploy the strongSwan IPSec VPN service in your cluster or leverage IBM Cloud IBM Cloud Direct Link services to connect to these networks.





 External communication to apps that run on worker nodes with internet-facing workloads 

To expose an app in your cluster to the internet, you can create a public network load balancer (NLB) or Ingress application load balancer (ALB) service. You can improve the security of your cluster by creating a pool of worker nodes that are labeled as edge nodes. The pods for public network services are deployed to the edge nodes so that external traffic workloads are isolated to only a few workers in your cluster. You can further control public traffic to the network services that expose your apps by creating Calico pre-DNAT policies, such as allowlist and blocklist policies.

Ready to get started with a cluster for this scenario? After you plan your [high availability](https://cloud.ibm.com/docs/openshift?topic=openshift-ha_clusters) and [worker node](https://cloud.ibm.com/docs/openshift?topic=openshift-planning_worker_nodes) setups, see [Creating clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-clusters).







 Scenario: Allow limited public connectivity with a gateway appliance 

In this scenario, you want to run workloads in a classic cluster that are accessible to services, databases, or other resources in your on-premises data center.
Change log for worker node fix pack 3.11.439_1592_openshift, released 7 June 2021 

The following table shows the changes that are in the worker node fix pack 3.11.439_1592_openshift. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 3.11.439_1591_openshift

 Component Previous Current Description 

 HA proxy 26c5cc 700dc6 Updated the image for [CVE-2021-27219](https://nvd.nist.gov/vuln/detail/CVE-2021-27219). 
 TCP keepalive optimization for VPC N/A N/A Set the net.ipv4.tcp_keepalive_time setting to 180 seconds for compatibility with VPC gateways. 
 RHEL 7 Packages N/A N/A Updated worker node image with package updates for [CVE-2021-27219](https://nvd.nist.gov/vuln/detail/CVE-2021-27219). 







 Change log for worker node fix pack 3.11.439_1591_openshift, released 24 May 2021 

The following table shows the changes that are in the worker node fix pack 3.11.439_1591_openshift. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 3.11.420_1588_openshift

 Component Previous Current Description
* [Reload_pending state](https://cloud.ibm.com/docs/openshift?topic=openshift-worker-node-state-referenceworker-node-reload-pending)
* [Unknown state](https://cloud.ibm.com/docs/openshift?topic=openshift-worker-node-state-referenceworker-node-unknown)
* [Warning state](https://cloud.ibm.com/docs/openshift?topic=openshift-worker-node-state-referenceworker-node-warning)



[Common issues with worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-common_worker_nodes_issuescommon_worker_nodes_issues)



* [Account prohibited from ordering](https://cloud.ibm.com/docs/openshift?topic=openshift-common_worker_nodes_issuesorder-prohibit)
* [Could not place order](https://cloud.ibm.com/docs/openshift?topic=openshift-common_worker_nodes_issuesorder-not-placed)
* [Could not obtain network VLAN](https://cloud.ibm.com/docs/openshift?topic=openshift-common_worker_nodes_issuesno-network-vlan)
* [Location invalid](https://cloud.ibm.com/docs/openshift?topic=openshift-common_worker_nodes_issueslocation-invalid)
* [Permissions error](https://cloud.ibm.com/docs/openshift?topic=openshift-common_worker_nodes_issuespermissions-error)
* [Firewall error](https://cloud.ibm.com/docs/openshift?topic=openshift-common_worker_nodes_issuesfirewall-error)
* [Hard reboot](https://cloud.ibm.com/docs/openshift?topic=openshift-common_worker_nodes_issueshard-reboot)
Updating hosts that are assigned as worker nodes 

IBM provides version updates for your hosts that are assigned as worker nodes to Satellite-enabled IBM Cloud services such as clusters. The version updates include OpenShift Container Platform, the operating system, and security patches. You choose when to apply the host version updates. Note that service clusters, which are the underlying platform for all IBM Cloud services are created by services such as Code Engine or IBM Cloud Object Storage and are maintained by IBM.

What happens to my apps during an update?
: If you run apps as part of a deployment on worker nodes that you update, the apps are rescheduled onto other worker nodes in the cluster. These worker nodes might be in a different worker pool, or if you have stand-alone worker nodes, apps might be scheduled onto stand-alone worker nodes. To avoid downtime for your app, you must ensure that you have enough capacity in the cluster to carry the workload.

How can I control how many worker nodes go down at a time during an update or reload?
: If you need all your worker nodes to be up and running, consider [attaching](https://cloud.ibm.com/docs/satellite?topic=satellite-attach-hosts) and [assigning](https://cloud.ibm.com/docs/satellite?topic=satellite-assigning-hostshost-assign-manual) additional hosts to your service. You can add additional hosts to your location temporarily and then remove them when the update is complete.
: In addition, you can create a Kubernetes ConfigMap that specifies the maximum number of worker nodes that can be unavailable at a time, such as during an update. Worker nodes are identified by the worker node labels. You can use IBM-provided labels or custom labels that you added to the worker node.



 Checking if a version update is available for worker node hosts 

You can check if a version update is available for a host that is assigned as a worker node to a [Satellite-enabled IBM Cloud service](https://cloud.ibm.com/docs/satellite?topic=satellite-managed-services) by using the IBM Cloud CLI or the IBM Cloud console.
When you [label worker nodes as edge nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-edgeedge_nodes), NLB and ALB pods are deployed to only those specified worker nodes. Router pods remain deployed to the non-edge worker nodes. Additionally, to prevent other workloads from running on edge nodes, you can [taint the edge nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-edgeedge_workloads). Then, you can deploy both public and private NLBs and ALBs to edge nodes. For example, if your worker nodes are connected to a private VLAN only, but you need to permit public access to an app in your cluster, you can create an edge worker pool in which the edge nodes are connected to public and private VLANs. You can deploy public NLBs and ALBs to these edge nodes to ensure that only those workers handle public connections.







 Scenario: Running internet-facing app workloads in a classic cluster 

In this scenario, you want to run workloads in a classic cluster that are accessible to requests from the Internet so that end users can access your apps. You want the option of isolating public access in your cluster and of controlling what public requests are permitted to your cluster. Additionally, your workers have automatic access to any IBM Cloud services that you want to connect with your cluster.

Zoom

![Architecture image for a cluster that runs internet-facing workloads.](https://cloud.ibm.com/docs-content/v1/content/bce0f0917a9eea684d1b4b704ac6343a1f65f446/openshift/images/cs_clusters_planning_internet.png)

Figure 1. Network setup for a cluster that runs internet-facing workloads



 Worker-to-worker communication in classic clusters with internet-facing workloads 

To achieve this setup, you create a cluster by connecting worker nodes to public and private VLANs.
Add stand-alone worker nodes to the cluster. For bare metal flavors, specify dedicated.

ibmcloud ks worker add --cluster <cluster_name_or_ID> --workers <number_of_worker_nodes> --public-vlan <public_VLAN_ID> --private-vlan <private_VLAN_ID> --flavor <flavor> --hardware <shared_or_dedicated>
5. Verify that the worker nodes are created.

ibmcloud ks worker ls --cluster <cluster_name_or_ID>







 Installing SGX drivers and platform software on SGX-capable worker nodes 

Intel Software Guard Extensions (SGX) is a technology that can protect data-in-use through hardware-based server security. With Intel SGX, you can protect select code and data from disclosure or modification. Through the use of trusted execution environments (TEE), known as enclaves, you can encrypt the pieces of your app memory that contain sensitive data while the data or code is being used. To use Intel SGX, you must install the SGX drivers and platform software on SGX-capable worker nodes. Then, design your app to run in an SGX environment.

Zoom

![An example SGX application.](https://cloud.ibm.com/docs-content/v1/content/4d497aff9e27b92fbbc2ee4e343a9ec4549cb1d7/containers/images/cc-iks.png)

Figure. Example SGX application set up

When you develop a confidential computing application, you must design it in a way that you can segment the information that needs to be encrypted. At runtime, the segmented information is kept confidential through attestation. When a request for information from the segmented code or app data is received, the enclave verifies that the request comes from the part of the application that exists outside of the enclave within the same application before sharing any information. Through the attestation process, information is kept confidential and data leakage is prevented.



 Installing with a script