vania-janet/multiturn-rag-retrieval-data huggingface dataset:
For more information, see [Creating Satellite clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-satellite-clusters). 







 Workload clusters 

You will create Red Hat OpenShift on IBM Cloud clusters in your Satellite location to run your application workloads. You will use the hosts of your own infrastructure that you added to your location as the worker nodes for the cluster. See [Creating Red Hat OpenShift clusters in Satellite](https://cloud.ibm.com/docs/openshift?topic=openshift-satellite-clusters).







 Other supporting components on-premises 

In addition to your Satellite locations, you will need other components that run on-premises to complete the reference architecture including an edge plane, management plane, and (optionally) other application services. One of the most important features of the reference architecture is the definition of physical and logical separation between the edge plane, management plane, and Satellite workload clusters. This is used to ensure separation of application workloads from management functions and to isolate security functions from non-security functions.

The following table describes these components in more detail.



Table 6. Overview of other on-premises components outside of Satellite location
Overview of other on-premises components outside of Satellite location

 Component Description 

 Edge plane <br><br> * Improves network isolation and boundary protection for your workloads.<br> * Includes tools like virtual network firewalls, and load balancers.<br><br><br> 
 Management plane <br><br> * Provides separation between your workloads and management operations.<br> * Includes a bastion host and tools like CI/CD, logging, and monitoring.<br><br><br> 
 Other application services (optional) <br><br> * Provides any other on-premises services that are needed by your workloads, such as databases and APIs.<br><br><br> 







 Next steps 



* [Satellite use cases](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-satellite-architecture-use-cases)
Red Hat OpenShift on IBM Cloud toolkit 4.4.0+20200821 4.4.0+20201110 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.4.0+20201110). 







 Change log for worker node fix pack 4.4.29_1524_openshift, released 9 November 2020 

The following table shows the changes that are in the worker node fix pack update 4.4.29_1524_openshift. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 4.4.27_1523_openshift

 Component Previous Current Description 

 Red Hat OpenShift 4.4.27 4.4.29 See the [Red Hat OpenShift release notes](https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.htmlocp-4-4-29). 
 RHEL 7 Packages N/A N/A Updated worker node image with package updates for [CVE-2020-15999](https://nvd.nist.gov/vuln/detail/CVE-2020-15999). 







 Change log for worker node fix pack 4.4.27_1523_openshift, released 26 October 2020 

The following table shows the changes that are in the worker node fix pack update 4.4.27_1523_openshift. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 4.4.26_1521_openshift

 Component Previous Current Description
* Document and evidence the execution of the system/service and security testing/scanning along with the results.
* Track security flaws and flaw resolution within the system and report findings to designated personnel.





 Red Hat OpenShift on IBM Cloud 

When using Red Hat OpenShift on IBM Cloud to host workloads, you must use Container Registry and the Vulnerability Advisor component it contains. Red Hat OpenShift on IBM Cloud provides a multi-tenant, highly available, scalable, and encrypted private image registry that is hosted and managed by IBM®. You can use Container Registry by setting up your own image namespace and pushing container images to your namespace. By using Container Registry, only users with access to your IBM Cloud account can access your images.

When you push images to Container Registry, you benefit from the built-in Vulnerability Advisor features that scan for potential security issues and vulnerabilities. Vulnerability Advisor checks for vulnerable packages in specific Docker base images, and known vulnerabilities in app configuration settings. When vulnerabilities are found, information about the vulnerability is provided. You can use this information to resolve security issues so that containers are not deployed from vulnerable images.

Any issues that are found by Vulnerability Advisor result in a verdict that indicates that it is not advisable to deploy this image. If you choose to deploy the image, any containers that are deployed from the image include known issues that might be used to attack or otherwise compromise the container. The verdict is adjusted based on any exemptions that you specified. This verdict can be used by Portieris to prevent the deployment of nonsecure images in Container Registry. [Portieris](https://github.com/IBM/portieris) is a Kubernetes admission controller for the enforcement of image security policies. You can create image security policies for each Kubernetes namespace, or at the cluster level, and enforce different rules for different images.

Fixing the security and configuration issues that are reported by Vulnerability Advisor can help you to secure your IBM Cloud infrastructure.

See the following for more information on Container Registry and how to set it up:



* [About Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overview)
Red Hat OpenShift on IBM Cloud toolkit 4.6.0+20210331 4.6.0+20210512 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.6.0+20210512). 







 Change log for worker node fix pack 4.6.27_1542_openshift, released 10 May 2021 

The following table shows the changes that are in the worker node fix pack 4.6.27_1542_openshift. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 4.6.25_1541_openshift

 Component Previous Current Description 

 Red Hat OpenShift 4.6.25 4.6.27 See the [Red Hat OpenShift release notes](https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.htmlocp-4-6-27). 
 RHEL 7 Packages 3.10.0-1160.24 3.10.0-1160.25 To increase resiliency, rsyslog no longer keeps old file descriptors. Updated worker node images with kernel and package updates for [CVE-2021-25215](https://nvd.nist.gov/vuln/detail/CVE-2021-25215), [CVE-2020-25692](https://nvd.nist.gov/vuln/detail/CVE-2020-25692), and [CVE-2020-25648](https://nvd.nist.gov/vuln/detail/CVE-2020-25648). 







 Change log for master fix pack 4.6.23_1540_openshift, released 27 April 2021 

The following table shows the changes that are in the master fix pack patch update 4.6.23_1540_openshift. Master patch updates are applied automatically.
Changes since version 4.4.31_1532_openshift

 Component Previous Current Description 

 Red Hat OpenShift 4.4.31 4.4.33 See the [Red Hat OpenShift release notes](https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.htmlocp-4-4-33). 
 RHEL 7 Packages 3.10.0-1160.11.1.el7 3.10.0-1160.15.2.el7 Updated worker node with image kernel and package updates for: [CVE-2020-10543](https://nvd.nist.gov/vuln/detail/CVE-2020-10543), [CVE-2020-10878](https://nvd.nist.gov/vuln/detail/CVE-2020-10878), [CVE-2020-12723](https://nvd.nist.gov/vuln/detail/CVE-2020-12723), [CVE-2020-15436](https://nvd.nist.gov/vuln/detail/CVE-2020-15436), [CVE-2020-35513](https://nvd.nist.gov/vuln/detail/CVE-2020-35513), [CVE-2019-25013](https://nvd.nist.gov/vuln/detail/CVE-2019-25013), [CVE-2020-10029](https://nvd.nist.gov/vuln/detail/CVE-2020-10029), [CVE-2020-29573](https://nvd.nist.gov/vuln/detail/CVE-2020-29573), and [CVE-2020-12321](https://nvd.nist.gov/vuln/detail/CVE-2020-12321)){: external}. 







 Change log for worker node fix pack 4.4.31_1532_openshift, released 1 February 2021
OpenVPN server 2.4.6-r3-IKS-301 2.4.6-r3-IKS-385 Updated image to implement additional IBM security controls. 
 Red Hat OpenShift on IBM Cloud Metrics Server v4.5.0-20210301 v4.5.0-20210329 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.5.0+20210329). 
 Red Hat OpenShift on IBM Cloud toolkit 4.5.0+20210301 4.5.0+20210329 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.5.0+20210329). 







 Change log for worker node fix pack 4.5.37_1537_openshift, released 26 April 2021 

The following table shows the changes that are in the worker node fix pack 4.5.37_1537_openshift. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 4.5.35_1535_openshift

 Component Previous Current Description 

 HA proxy a3b1ff e0fa2f The update addresses [CVE-2021-20305](https://nvd.nist.gov/vuln/detail/CVE-2021-20305). 
 Red Hat OpenShift 4.5.35 4.5.37 See the [Red Hat OpenShift release notes](https://docs.openshift.com/container-platform/4.5/release_notes/ocp-4-5-release-notes.htmlocp-4-5-37).
Changes since version 4.12.16_1544_openshift

 Component Previous Current Description 

 Red Hat OpenShift on IBM Cloud. 4.12.16 4.12.19 see [change logs](https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.htmlocp-4-12-19). 
 RHEL 7 Packages N/A N/A N/A 
 RHEL 8 Packages 4.18.0-477.10.1.el8_8 4.18.0-477.13.1.el8_8 Worker node kernel & package updates for [CVE-2023-22490](https://nvd.nist.gov/vuln/detail/CVE-2023-22490), [CVE-2023-23946](https://nvd.nist.gov/vuln/detail/CVE-2023-23946), [CVE-2023-25652](https://nvd.nist.gov/vuln/detail/CVE-2023-25652), [CVE-2023-25815](https://nvd.nist.gov/vuln/detail/CVE-2023-25815), [CVE-2023-29007](https://nvd.nist.gov/vuln/detail/CVE-2023-29007), [CVE-2023-32233](https://nvd.nist.gov/vuln/detail/CVE-2023-32233). 







 Change log for master fix pack 4.12.16_1545_openshift, released 25 May 2023 

The following table shows the changes that are in the master fix pack 4.12.16_1545_openshift. Master patch updates are applied automatically.



Changes since version 4.12.13_1541_openshift

 Component Previous Current Description 

 Cluster health image v1.3.19 v1.3.20 Updated Go to version 1.19.9 and updated dependencies.
Changes since version 3.11.374_1579_openshift

 Component Previous Current Description 

 Red Hat OpenShift 3.11.374 3.11.380 See the [Red Hat OpenShift release notes](https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.htmlocp-3-11-380). 
 RHEL 7 Packages 3.10.0-1160.11.1.el7 3.10.0-1160.15.2.el7 Updated worker node with image kernel and package updates for: [CVE-2020-10543](https://nvd.nist.gov/vuln/detail/CVE-2020-10543), [CVE-2020-10878](https://nvd.nist.gov/vuln/detail/CVE-2020-10878), [CVE-2020-12723](https://nvd.nist.gov/vuln/detail/CVE-2020-12723), [CVE-2020-15436](https://nvd.nist.gov/vuln/detail/CVE-2020-15436), [CVE-2020-35513](https://nvd.nist.gov/vuln/detail/CVE-2020-35513), [CVE-2019-25013](https://nvd.nist.gov/vuln/detail/CVE-2019-25013), [CVE-2020-10029](https://nvd.nist.gov/vuln/detail/CVE-2020-10029), [CVE-2020-29573](https://nvd.nist.gov/vuln/detail/CVE-2020-29573), and [CVE-2020-12321](https://nvd.nist.gov/vuln/detail/CVE-2020-12321)){: external}. 







 Change log for worker node fix pack 3.11.374_1579_openshift, released 1 February 2021
If vulnerabilities are found, Red Hat OpenShift on IBM Cloud automatically applies fixes and resolves vulnerabilities on behalf of the user to ensure master node protection.

What information is logged?
: By default, Red Hat OpenShift on IBM Cloud automatically collects logs for the following cluster components:



* Containers: Logs that are written to STDOUT or STDERR.
* Apps: Logs that are written to a specific path inside your app.
* Workers: Logs from the Red Hat Enterprise Linux operating system that are sent to /var/log/syslog and /var/log/auth.log.
* Red Hat OpenShift API server: Every cluster-related action that is sent to the Red Hat OpenShift API server is logged for auditing reasons, including the time, the user, and the affected resource. For more information, see [Kubernetes audit logs](https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/). You can access these logs by using IBM Cloud Activity Tracker. For more information, see the [getting started tutorial](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started).
* Routers: Logs inbound network traffic on routes.
* Kubernetes system components: Logs from the kubelet, the kube-proxy, and other components that run in the kube-system namespace.



To access the logs of your cluster components, set up [IBM Log Analysis](https://cloud.ibm.com/docs/openshift?topic=openshift-healthopenshift_logging). IBM Log Analysis provides access to all your logs and you can aggregate logs and build your own customized views across multiple clusters.

How can I monitor the health and performance of my cluster?
: You can verify the health, capacity, and performance of your apps, services, and worker nodes by monitoring your cluster components and compute resources from the Red Hat OpenShift on IBM Cloud console or CLI, such as the CPU and memory usage.
1.2.13 Red Hat OpenShift on IBM Cloud supports [pod security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scc) which are similar to Kubernetes pod security policies. 
 1.2.16 Red Hat OpenShift on IBM Cloud supports [pod security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scc) which are similar to Kubernetes pod security policies. 
 1.2.21 Red Hat OpenShift on IBM Cloud enables [profiling](https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/) for cluster administrator troubleshooting purposes. 
 1.2.22 Red Hat OpenShift on IBM Cloud can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/openshift?topic=openshift-health-audit). 
 1.2.23 Red Hat OpenShift on IBM Cloud can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/openshift?topic=openshift-health-audit). 
 1.2.24 Red Hat OpenShift on IBM Cloud can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/openshift?topic=openshift-health-audit). 
 1.2.25 Red Hat OpenShift on IBM Cloud can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/openshift?topic=openshift-health-audit). 
 1.2.33 Red Hat OpenShift on IBM Cloud can optionally [enable a Kubernetes Key Management Service (KMS) provider](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionkms).
For more information, see [Setting up the API](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_api_install).
3. Create your Red Hat OpenShift on IBM Cloud cluster. For more information, see [Creating a Red Hat OpenShift on IBM Cloud cluster in your VPC](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc_rh_tutorial).
4. Install [Service Mesh on Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-openshift-service-mesh) which is based on the open source [Istio](https://istio.io/) project.

Two of the most important reasons for using Service Mesh is to enable you to:



* Encrypt network traffic between microservices running in your cluster. See [Data encryption in transit](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-encryption-in-transit) and [enable mTLS between containers](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-openshift-service-meshopenshift-service-mesh-secure_services) for more details.
* Implement gateways to specify which traffic you want to enter or leave the mesh (and deny all traffic by default). You can use an egress gateway to control/allowlist all necessary endpoints and domains that your application needs to connect to.
satellite-sysdigapi-<location_ID> Allows your Satellite location to communicate with the IBM Cloud Monitoring API. Cloud One per Satellite location 
 openshift-api-<cluster_ID> Allows the Red Hat OpenShift on IBM Cloud API to communicate with the master for the service cluster. By default, your Red Hat OpenShift on IBM Cloud API Satellite link endpoints are protected to accept traffic from only the IBM Cloud control plane. To access them, you must [create a source list](https://cloud.ibm.com/docs/satellite?topic=satellite-link-endpoint-secure) for your endpoint to be accessible from other sources. Location One per Satellite-enabled IBM Cloud service in your location 



These endpoints are used to manage and update your location and are enabled by default. If you disable any of these endpoints, your client services that are running on your Satellite location can be negatively impacted. To avoid issues, do not disable these endpoints.
1.2.13 Red Hat OpenShift on IBM Cloud supports [pod security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scc) which are similar to Kubernetes pod security policies. 
 1.2.16 Red Hat OpenShift on IBM Cloud supports [pod security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scc) which are similar to Kubernetes pod security policies. 
 1.2.21 Red Hat OpenShift on IBM Cloud enables profiling for cluster administrator troubleshooting purposes. 
 1.2.22 Red Hat OpenShift on IBM Cloud can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/openshift?topic=openshift-health-audit). 
 1.2.23 Red Hat OpenShift on IBM Cloud can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/openshift?topic=openshift-health-audit). 
 1.2.24 Red Hat OpenShift on IBM Cloud can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/openshift?topic=openshift-health-audit). 
 1.2.25 Red Hat OpenShift on IBM Cloud can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/openshift?topic=openshift-health-audit). 
 1.2.33 Red Hat OpenShift on IBM Cloud can optionally [enable a Kubernetes Key Management Service (KMS) provider](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionkms).
OpenVPN Operator image v1.4.2 v1.4.3 Updated ansible operator base image to version v1.19.0 to resolve CVEs. 
 Red Hat OpenShift on IBM Cloud Control Plane Operator v4.7.0-20220308 v4.7.0-20220411 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.7.0%2B20220411). 
 Red Hat OpenShift on IBM Cloud Metrics Server v4.7.0-20220308 v4.7.0-20220411 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.7.0%2B20220411). 
 Red Hat OpenShift on IBM Cloud. 4.7.45 4.7.48 See the [Red Hat OpenShift on IBM Cloud release notes](https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.htmlocp-4-7-48). 
 Red Hat OpenShift on IBM Cloud toolkit 4.7.0+20220308 4.7.0+20220411 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.7.0%2B20220411). 







 Change log for worker node fix pack 4.7.49_1562_openshift, released 25 April 2022 



Changes since version 4.7.46_1560_openshift

 Component Previous Current Description 

 RHEL 7 Packages N/A N/A Package updates. 
 Red Hat OpenShift on IBM Cloud.
To view detailed system requirements, you can run a [software product compatibility report for Red Hat OpenShift on IBM Cloud](https://www.ibm.com/software/reports/compatibility/clarity/softwareReqsForProduct.html). Note that compliance depends on the underlying [infrastructure provider](https://cloud.ibm.com/docs/openshift?topic=openshift-infrastructure_providers) for the cluster worker nodes, networking, and storage resources.

Classic infrastructure: Red Hat OpenShift on IBM Cloud implements controls commensurate with the following security standards:



* EU-US Privacy Shield and Swiss-US Privacy Shield Framework
* Health Insurance Portability and Accountability Act (HIPAA)
* Service Organization Control standards (SOC 1 Type 2, SOC 2 Type 2)
* International Standard on Assurance Engagements 3402 (ISAE 3402), Assurance Reports on Controls at a Service Organization
* International Organization for Standardization (ISO 27001, ISO 27017, ISO 27018)
* Payment Card Industry Data Security Standard (PCI DSS)



VPC infrastructure: Red Hat OpenShift on IBM Cloud implements controls commensurate with the following security standards:



* EU-US Privacy Shield and Swiss-US Privacy Shield Framework
* Health Insurance Portability and Accountability Act (HIPAA)
* International Standard on Assurance Engagements 3402 (ISAE 3402), Assurance Reports on Controls at a Service Organization



Satellite: See the [IBM Cloud Satellite documentation](https://cloud.ibm.com/docs/satellite?topic=satellite-faqsstandards).
* Can I use IBM Cloud and other services with my cluster?

You can add IBM Cloud platform and infrastructure services as well as services from third-party vendors to your Red Hat OpenShift on IBM Cloud cluster to enable automation, improve security, or enhance your monitoring and logging capabilities in the cluster.

For a list of supported services, see [Integrating services](https://cloud.ibm.com/docs/containers?topic=containers-supported_integrationssupported_integrations).
* Does IBM support third-party and open source tools that I use with my cluster?
Moving your environment to Red Hat OpenShift on IBM Cloud 

With Red Hat® OpenShift® on IBM Cloud®, you can quickly and securely deploy container workloads for your apps in production. Learn more so that when you plan your cluster strategy, you optimize your setup to make the most of [Kubernetes](https://kubernetes.io/) automated deploying, scaling, and orchestration management capabilities.



 Moving your workloads to the IBM Cloud 

You have lots of reasons to move your workloads to IBM Cloud: reducing total cost of ownership, increasing high availability for your apps in a secure and compliant environment, scaling up and down in respond to your user demand, and many more. Red Hat OpenShift on IBM Cloud combines container technology with open source tools, such as Kubernetes so that you can build a cloud-native app that can migrate across different cloud environments, avoiding vendor lock-in.

But how do you get to the cloud? What are your options along the way? And how do you manage your workloads after you get there?

Use this page to learn some strategies for your Kubernetes deployments on Red Hat OpenShift on IBM Cloud. And engage with our team on [Slack](https://ibm-cloud-success.slack.com).

Not on slack yet? [!Request an invite](https://cloud.ibm.com/kubernetes/slack)



 What can I move to the IBM Cloud? 

With IBM Cloud, you have flexibility to create Red Hat OpenShift clusters in [off-premises, on-premises, or hybrid cloud environments](https://cloud.ibm.com/docs/containers?topic=containers-cs_ovdifferentiation). The following table provides some examples of what types of workloads that users typically move to the various types of clouds. You might also choose a hybrid approach where you have clusters that run in both environments.



IBM Cloud implementations support your workloads

 Workload Kubernetes Service off-prem on-prem 

 DevOps enablement tools Yes 
 Developing and testing apps Yes 
 Apps have major shifts in demand and need to scale rapidly Yes