vania-janet/multiturn-rag-retrieval-data huggingface dataset:
GHE_REPO= Can be used instead of --repo (either the option or the variable is required)
PIPELINE_RUN_URL= Can be used instead of --pipeline-run-url (either the option or the variable is required)
APP_REPO_URL= Can be used instead of --app-repo-url (either the option or the variable is required)

Required Environment Variables, if you are using GitHub:

GHE_TOKEN= Github Enterprise API Token (Optional if you are using --git-token-path)

If you are using github, use --git-token-path field to set your GitHub Token and --git-api-url field to set the # GitHub Enterprise API URL instead of GHE_TOKEN and GH_URL environment variables. If both of them are provided, --git-token-path and --git-api-url take precedence.

Running the command:

cocoa incident add --task=<failing-task-name> --commit-hash=<abc123>





 cocoa incident process 

This command processes provided scan results and creates incident issues in the provided repository per vulnerability (not per task run like cocoa incident add does). If issues exist already for subject-incident pairs, it does not create new ones.

If --set-grace-period is set, it creates issues with Grace Period set, or update existing issues, to have Grace Period.

Grace Period is set to 15 days if enabled. If Exempt or Grace Period is set on an incident issue, the check lists the issue, but does not mark it as an error.

Exceptions are either configured in CR VA, or you can submit the Incident or CVE for an exemption approval. If approved, you can edit the Incident issue (setting Excempt: true), and link to the approved request.

Currently supported scan result files:



* Container Registry VA scan (option --type va)
* CRA Vulnerability scan (option --type cra)
* Xray (option --type xray)
* OWASP ZAP (option --type owasp-zap)
Unsupported: Select kubelet metrics The following cAdvisor kubelet metrics are removed: /stats/container, /stats/<pod_name>/<container_name>, and /stats/<namespace>/<pod_name>/<pod_uid>/<container_name>. Stop using these metrics. 
 Ingress resource API version The support for networking.k8s.io/v1beta1 and extensions/v1beta1 API versions in Ingress resources are deprecated and are planned for removal in Kubernetes version 1.22. The networking.k8s.io/v1 API version is supported instead. Although not required in version 1.21, you can begin converting your existing resources in preparation for the removal of the API versions before version 1.22.
You can exclude worker nodes from your Portworx cluster or remove the entire Portworx cluster if you don't want to use Portworx anymore.

Removing your Portworx cluster removes all the data from your Portworx cluster. Make sure to [create a snapshot for your data and save this snapshot to the cloud](https://docs.portworx.com/portworx-install-with-kubernetes/storage-operations/create-snapshots/).



* Remove a worker node from the Portworx cluster: If you want to remove a worker node that runs Portworx and stores data in your Portworx cluster, you must migrate existing pods to remaining worker nodes and then uninstall Portworx from the node. For more information, see [Decommission a Portworx node in Kubernetes](https://docs.portworx.com/portworx-install-with-kubernetes/operate-and-maintain-on-kubernetes/uninstall/decommission-a-node/).
* Remove the Portworx DaemonSet: When you remove the Portworx DaemonSet, the Portworx containers are removed from your worker nodes. However, the Portworx configuration files remain on the worker nodes and the storage devices, and the data volumes are still intact. You can use the data volumes again if you restart the Portworx DaemonSet and containers by using the same configuration files. For more information, see [Removing the Portworx DaemonSet](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_portworx_removingremove_px_daemonset).
* Remove Portworx from your cluster: If you want to remove Portworx and all your data from your cluster, follow the steps to [remove Portworx](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_portworx_removing) from your cluster.







 Removing the Portworx DaemonSet
5.1.6 IBM Cloud Kubernetes Service deploys some system components that could set [automountServiceAccountToken: false](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/use-the-default-service-account-to-access-the-api-server). 
 5.2.1 IBM Cloud Kubernetes Service can optionally configure [Pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 5.2.2 IBM Cloud Kubernetes Service can optionally configure [Pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 5.2.3 IBM Cloud Kubernetes Service can optionally configure [Pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 5.2.4 IBM Cloud Kubernetes Service can optionally configure [Pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/).
If you don't have enough resources remaining in your worker nodes, the Kubernetes scheduler can preempt (remove) pods to free up enough resources for the higher prioritized pods to be scheduled. Preemption is also affected by graceful termination periods, pod disruption budgets, and worker node affinity.

If you don't specify a priority for your pod deployment, the default is set to the priority class that is set as the globalDefault . If you don't have a globalDefault priority class, the default priority for all pods is zero (0). By default, IBM Cloud Kubernetes Service does not set a globalDefault, so the pod default priority is zero.

To understand how pod priority and Kubernetes scheduler work together, consider the scenarios in the following figure. You must place prioritized pods on worker nodes with available resources. Otherwise, high priority pods in your cluster can remain in pending at the same time that existing pods are removed, such as in Scenario 3.

Zoom

![Pod priority scenarios.](https://cloud.ibm.com/docs-content/v1/content/4d497aff9e27b92fbbc2ee4e343a9ec4549cb1d7/containers/images/pod-priority.png)

Figure 1. Pod priority scenarios



1. Three pods with high, medium, and low priority are pending scheduling. The Kubernetes scheduler finds an available worker node with room for all three pods, and schedules them in order of priority, with the highest priority pod scheduled first.
2. Three pods with high, medium, and low priority are pending scheduling. The Kubernetes scheduler finds an available worker node, but the worker node has only enough resources to support the high and medium priority pods. The low-priority pod is not scheduled and it remains in pending.
3. Two pods with high and medium priority are pending scheduling. A third pod with low priority exists on an available worker node. However, the worker node does not have enough resources to schedule any of the pending pods.
5.2.6 IBM Cloud Kubernetes Service can optionally configure [Pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 5.2.7 IBM Cloud Kubernetes Service can optionally configure [Pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 5.2.8 IBM Cloud Kubernetes Service can optionally configure [Pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 5.2.9 IBM Cloud Kubernetes Service can optionally configure [Pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 5.3.2 IBM Cloud Kubernetes Service has a set of [default Calico and Kubernetes network policies defined](https://cloud.ibm.com/docs/containers?topic=containers-network_policiesdefault_policy) and [additional network policies can optionally be added](https://cloud.ibm.com/docs/containers?topic=containers-network_policiesadding_network_policies).
Not Scored 2 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-benchmark-remediations-46) Shared 
 5.6.4 The default namespace should not be used. Scored 2 Pass Shared 









 IBM remediations and explanations 

Review information from IBM on the CIS Benchmark results.



Explanation and remediation

 Section Remediation/Explanation 

 1.2.1 Red Hat OpenShift on IBM Cloud utilizes RBAC for cluster protection, but allows anonymous discovery, which is considered reasonable per [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/). 
 1.2.10 Red Hat OpenShift on IBM Cloud does not enable the [EventRateLimit](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/eventratelimit) admission controller since it is a Kubernetes alpha feature. 
 1.2.12 Red Hat OpenShift on IBM Cloud does not enable the [AlwaysPullImages](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/alwayspullimages) admission controller since it overrides a container's imagePullPolicy and may impact performance. 
 1.2.13 Red Hat OpenShift on IBM Cloud supports [pod security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scc) which are similar to Kubernetes pod security policies. 
 1.2.16 Red Hat OpenShift on IBM Cloud supports [pod security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scc) which are similar to Kubernetes pod security policies. 
 1.2.21 Red Hat OpenShift on IBM Cloud enables profiling for cluster administrator troubleshooting purposes.
ibmcloud sat storage config get --config <config>







 Removing OpenShift Data Foundation from your apps 

If you no longer need your OpenShift Data Foundation, you can remove your PVC, PV, and the ODF operator from your clusters.



1. List your PVCs and note the name of the PVC and the corresponding PV that you want to remove.

oc get pvc
2. Remove any pods that mount the PVC.



1. List all the pods that currently mount the PVC that you want to delete. If no pods are returned, you don't have any pods that currently use your PVC.

oc get pods --all-namespaces -o=jsonpath='{range .items[]}{"n"}{.metadata.name}{":t"}{range .spec.volumes[]}{.persistentVolumeClaim.claimName}{" "}{end}{end}' | grep "<pvc_name>"

Example output

app sat-ocs-cephfs-gold
2. Remove the pod that uses the PVC. If the pod is part of a deployment, remove the deployment.

oc delete pod <pod_name>

oc delete deployment <deployment_name>
3. Verify that the pod or the deployment is removed.

oc get pods

oc get deployments



3. Delete the PVC.

oc delete pvc <pvc_name>
4. Delete the corresponding PV.

oc delete pv <pv_name>







 Removing the ODF local storage configuration from your cluster 

If you no longer plan to use OpenShift Data Foundation in your cluster, you can remove the assignment from your cluster from the storage configuration.

Note that if you remove the storage configuration, the ODF operators is then uninstalled from all assigned clusters. Your PVCs, PVs, and data are not removed. However, you might not be able to access your data until you re-install the driver in your cluster again.



1.
When you create a pod by using a resource controller such as a deployment, Kubernetes validates the pod's service account credentials against the pod security policies that the service account is authorized to use. If no policy supports the pod security requirements, the controller succeeds, but the pod is not created.

For common error messages, see [Pods fail to deploy because of a pod security policy](https://cloud.ibm.com/docs/containers?topic=containers-psp).





 Why can I still create privileged pods when I am not part of the privileged-psp-user cluster role binding? 

Other cluster role bindings or namespace-scoped role bindings might give you other pod security policies that authorize you to create privileged pods. Additionally by default, cluster administrators have access to all resources, including pod security policies, and so can add themselves to PSPs or create privileged resources.







 Customizing pod security policies 

To prevent unauthorized pod actions, you can modify existing pod security policy resources or create your own. You must be a cluster admin to customize policies.

What existing policies can I modify?
: By default, your cluster contains the following RBAC resources that enable cluster administrators, authenticated users, service accounts, and nodes to use the ibm-privileged-psp and ibm-restricted-psp pod security policies. These policies allow the users to create and update privileged and unprivileged (restricted) pods.



Default RBAC resources that you can modify

 Name Namespace Type Purpose 

 privileged-psp-user All ClusterRoleBinding Enables cluster administrators, authenticated users, service accounts, and nodes to use ibm-privileged-psp pod security policy. 
 restricted-psp-user All ClusterRoleBinding Enables cluster administrators, authenticated users, service accounts, and nodes to use ibm-restricted-psp pod security policy. 



You can modify these RBAC roles to remove or add administrators, users, services, or nodes to the policy. These modifications don't prevent cluster administrators, service accounts, and nodes from using the privileged pod security policy in the kube-system, ibm-system, and ibm-operators namespaces. Do not modify these system namespaces, which are privileged namespaces.

Before you begin
A [pod](https://kubernetes.io/docs/concepts/workloads/pods/) is the smallest deployable unit that Kubernetes can manage. You put your container (or a group of containers) into a pod and use the pod configuration file to tell the pod how to run the container and share resources with other pods. All containers that you put into a pod run in a shared context, which means that they share the virtual or physical machine.

What to put in a container
: As you think about your application's components, consider whether they have significantly different resource requirements for things like CPU and memory. Could some components run at a best effort, where going down for a little while to divert resources to other areas is acceptable? Is another component customer-facing, so it's critical for it to stay up? Split them up into separate containers. You can always deploy them to the same pod so that they run together in sync.

What to put in a pod
: The containers for your app don't always have to be in the same pod. In fact, if you have a component that is stateful and difficult to scale, such as a database service, put it in a different pod that you can schedule on a worker node with more resources to handle the workload. If your containers work correctly if they run on different worker nodes, then use multiple pods. If they need to be on the same machine and scale together, group the containers into the same pod.





 So if I can use a pod, why do I need all these different types of objects? 

Creating a pod YAML file is easy. You can write one with just a few lines as follows.

apiVersion: v1
kind: Pod
metadata:
name: nginx
spec:
containers:
- name: nginx
image: nginx
ports:
- containerPort: 80

But you don't want to stop there. If the node that your pod runs on goes down, then your pod goes down with it and isn't rescheduled.
Verify the controller and speakers pods are running.

oc -n metallb-system get pods -o wide
9. Configure a dedicated subnet, or AddressPool, for the external IP of the LoadBalancer services managed by MetalLB:

cat << EOF | oc apply -f -
apiVersion: metallb.io/v1alpha1
kind: AddressPool
metadata:
name: doc-example-ap
namespace: metallb-system
spec:
protocol: layer2
addresses:
- 192.0.2.0/26
- 192.0.2.100-192.0.2.110
- 192.0.2.200/32
10. Optional: To disable auto assignment from an AddressPool specify autoAssign: false in the spec section. If you disable auto assignment, an AddressPool with metallb.universe.tf/address-pool must be defined.

metadata:
annotations:
metallb.universe.tf/address-pool: doc-example-ap
11. To prevent IBM Cloud Controller Manager from interacting with a MetalLB LoadBalancer set the loadBalancerClass: metallb.io in your Service definition.

apiVersion: v1
kind: Service
metadata:
namespace: default
name: with-loadBalancerClass
spec:
loadBalancerClass: metal-lb.io
selector:
app: hello-node
ports:
- port: 8080
targetPort: 8080 Optional. By default, the targetPort is set to match the port value unless specified otherwise.
protocol: TCP
type: LoadBalancer



For more information, see the [MetalLB documentation](https://docs.openshift.com/container-platform/4.9/networking/metallb/about-metallb.html).





 Exposing apps with Red Hat OpenShift routes 

Quickly expose the services in your cluster on the Red Hat OpenShift Ingress controller's external IP address by using a route.
: Optional: If you use this option, zone names must be specified in three repeated options. If you do not use this option, the zones in your location are assigned names, such as zone-1.

--coreos-enabled
: Optional. Enable [Red Hat CoreOS](https://cloud.ibm.com/docs/satellite?topic=satellite-infrastructure-planinfras-plan-os) features within the Satellite location. This action cannot be undone.

--logging-account-id LOGGING_ACCOUNT
: Optional. The IBM Cloud account ID with the instance of IBM Log Analysis that you want to forward your Satellite logs to. This option is available only in select environments.

--pod-subnet SUBNET
: Optional. Specify a custom subnet CIDR to provide private IP addresses for pods. This option can be used only if you also enable Red Hat CoreOS with the --coreos-enabled option. All pods that are deployed to a worker node are assigned a private IP address in the 172.16.0.0/16 range by default. You can avoid subnet conflicts with the network that you use to connect to your location by specifying a custom subnet CIDR that provides the private IP addresses for your pods.
: When you choose a subnet size, consider the size of the cluster that you plan to create and the number of worker nodes that you might add in the future. The subnet must have a CIDR of at least /23, which provides enough pod IPs for a maximum of four worker nodes in a cluster. For larger clusters, use /22 to have enough pod IP addresses for eight worker nodes, /21 to have enough pod IP addresses for 16 worker nodes, and so on.
: The subnet that you choose must be within one of the following ranges.



* 172.16.0.0 - 172.17.255.255
* 172.21.0.0 - 172.31.255.255
* 192.168.0.0 - 192.168.254.255
* 198.18.0.0 - 198.19.255.255



: Note that the pod and service subnets can't overlap.
Setting pod priority 

With pod priority and preemption, you can configure priority classes to indicate the relative priority of the pods that make up your Kubernetes cluster's workload. The Kubernetes scheduler takes into consideration the priority of a pod and can even preempt (remove) pods with lower priority to make room on a worker node for higher priority pods.

Why do I set pod priority?
: As a cluster administrator, you want to control which pods are more critical to your cluster workload. Priority classes can help you control the Kubernetes scheduler decisions to favor higher priority pods over lower priority pods. The Kubernetes scheduler can even preempt (remove) lower priority pods that are running so that pending higher priority pods can be scheduled.

By setting pod priority, you can help prevent lower priority workloads from impacting critical workloads in your cluster, especially in cases where the cluster starts to reach its resource capacity.

Make sure that you have [set up proper user access](https://cloud.ibm.com/docs/containers?topic=containers-usersusers) to your cluster, and if applicable, [pod security policies (PSPs)](https://cloud.ibm.com/docs/containers?topic=containers-psp). Access policies and PSPs can help prevent untrusted users from deploying high priority pods that prevent other pods from scheduling.

How does priority scheduling and preemption work?

In general, pending pods that have a higher priority are scheduled before lower prioritized pods. If you don't have enough resources remaining in your worker nodes, the Kubernetes scheduler can preempt (remove) pods to free up enough resources for the higher prioritized pods to be scheduled. Preemption is also affected by graceful termination periods, pod disruption budgets, and worker node affinity.

If you don't specify a priority for your pod deployment, the default is set to the priority class that is set as the globalDefault . If you don't have a globalDefault priority class, the default priority for all pods is zero (0).
You can exclude worker nodes from your Portworx cluster or remove the entire Portworx cluster if you don't want to use Portworx anymore.

Removing your Portworx cluster removes all the data from your Portworx cluster. Make sure to [create a snapshot for your data and save this snapshot to the cloud](https://docs.portworx.com/portworx-install-with-kubernetes/storage-operations/create-snapshots/).



* Remove a worker node from the Portworx cluster: If you want to remove a worker node that runs Portworx and stores data in your Portworx cluster, you must migrate existing pods to remaining worker nodes and then uninstall Portworx from the node. For more information, see [Decommission a Portworx node in Kubernetes](https://docs.portworx.com/portworx-install-with-kubernetes/operate-and-maintain-on-kubernetes/uninstall/decommission-a-node/).
* Remove the Portworx DaemonSet: When you remove the Portworx DaemonSet, the Portworx containers are removed from your worker nodes. However, the Portworx configuration files remain on the worker nodes and the storage devices, and the data volumes are still intact. You can use the data volumes again if you restart the Portworx DaemonSet and containers by using the same configuration files. For more information, see [Removing the Portworx DaemonSet](https://cloud.ibm.com/docs/containers?topic=containers-storage_portworx_removingremove_px_daemonset).
* Remove Portworx from your cluster: If you want to remove Portworx and all your data from your cluster, follow the steps to [remove Portworx](https://cloud.ibm.com/docs/containers?topic=containers-storage_portworx_removing) from your cluster.







 Removing the Portworx DaemonSet