vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Kubernetes N/A N/A N/A 
 HAPROXY c619f4 508bf6 [CVE-2016-3709](https://nvd.nist.gov/vuln/detail/CVE-2016-3709), [CVE-2022-42898](https://nvd.nist.gov/vuln/detail/CVE-2022-42898), [CVE-2022-1304](https://nvd.nist.gov/vuln/detail/CVE-2022-1304). 
 CUDA fd4353 0ab756 [CVE-2022-42898](https://nvd.nist.gov/vuln/detail/CVE-2022-42898). 







 Change log for worker node fix pack 1.23.14_1553, released 21 November 2022 

The following table shows the changes that are in the worker node fix pack 1.23.14_1553. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.23.13_1551

 Component Previous Current Description
Why does strongSwan VPN connectivity fail after I add or delete worker nodes? 

Classic infrastructure

 What’s happening 

You previously established a working VPN connection by using the strongSwan IPSec VPN service. However, after you added or deleted a worker node on your cluster, you experience one or more of the following symptoms:



* You don't have a VPN status of ESTABLISHED
* You can't access new worker nodes from your on-prem network
* You can't access the remote network from pods that are running on new worker nodes



 Why it’s happening 

If you added a worker node to a worker pool:



* The worker node was provisioned on a new private subnet that is not exposed over the VPN connection by your existing localSubnetNAT or local.subnet settings.
* VPN routes can't be added to the worker node because the worker has taints or labels that are not included in your existing tolerations or nodeSelector settings.
* The VPN pod is running on the new worker node, but the public IP address of that worker node is not allowed through the on-premises firewall.



If you deleted a worker node:



* That worker node was the only node where a VPN pod was running, due to restrictions on certain taints or labels in your existing tolerations or nodeSelector settings.



 How to fix it 

Update the Helm chart values to reflect the worker node changes.



1. Delete the existing Helm chart.

helm uninstall <release_name> -n <project>
2. Open the configuration file for your strongSwan VPN service.

helm show values iks-charts/strongswan > config.yaml
3. Check the following settings and change the settings to reflect the deleted or added worker nodes as necessary.

If you added a worker node:localSubnetNAT : The added worker might be deployed on a new, different private subnet than the other existing subnets that other worker nodes are on. If you use subnet NAT to remap your cluster's private local IP addresses and the worker was added on a new subnet, add the new subnet CIDR to this setting.

nodeSelector
Why does strongSwan VPN connectivity fail after I add or delete worker nodes? 

Classic infrastructure

 What’s happening 

You previously established a working VPN connection by using the strongSwan IPSec VPN service. However, after you added or deleted a worker node on your cluster, you experience one or more of the following symptoms:



* You don't have a VPN status of ESTABLISHED
* You can't access new worker nodes from your on-prem network
* You can't access the remote network from pods that are running on new worker nodes



 Why it’s happening 

If you added a worker node to a worker pool:



* The worker node was provisioned on a new private subnet that is not exposed over the VPN connection by your existing localSubnetNAT or local.subnet settings.
* VPN routes can't be added to the worker node because the worker has taints or labels that are not included in your existing tolerations or nodeSelector settings.
* The VPN pod is running on the new worker node, but the public IP address of that worker node is not allowed through the on-premises firewall.



If you deleted a worker node:



* That worker node was the only node where a VPN pod was running, due to restrictions on certain taints or labels in your existing tolerations or nodeSelector settings.



 How to fix it 

Update the Helm chart values to reflect the worker node changes.



1. Delete the existing Helm chart.

helm uninstall <release_name> -n <namespace>
2. Open the configuration file for your strongSwan VPN service.

helm show values iks-charts/strongswan > config.yaml
3. Check the following settings and change the settings to reflect the deleted or added worker nodes as necessary.

If you added a worker node:localSubnetNAT : The added worker might be deployed on a new, different private subnet than the other existing subnets that other worker nodes are on. If you use subnet NAT to remap your cluster's private local IP addresses and the worker was added on a new subnet, add the new subnet CIDR to this setting.
Why doesn't replacing a worker node create a worker node? 

Virtual Private Cloud

Classic infrastructure

Satellite

  What’s happening 

When you [replace a worker node](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clicli_worker_replace) or [update a VPC worker node](https://cloud.ibm.com/docs/containers?topic=containers-updatevpc_worker_node), a worker node is not automatically added back to your cluster.

  Why it’s happening 

By default, your worker pools are set to automatically rebalance when you replace a worker node. However, you might have disabled automatic rebalancing by manually removing a worker node, such as in the following scenario.



1.  You have a worker pool that automatically rebalances by default.
2.  You have a troublesome worker node in the worker pool that you removed individually, such as with the ibmcloud oc worker rm command.
3.  Now, automatic rebalancing is disabled for your worker pool, and is not reset unless you try to rebalance or resize the worker pool.
4.  You try to replace a worker node with the ibmcloud oc worker replace command or update a VPC worker node with the ibmcloud oc worker replace --update command. The worker node is removed, but another worker node is not added back to your worker pool.



You might also have issued the remove command shortly after the replace command. If the remove command is processed before the replace command, the worker pool automatic rebalancing is still disabled, so your worker node is not replaced.

  How to fix it 

To enable automatic rebalancing, [rebalance](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_rebalance) or [resize](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_worker_pool_resize) your worker pool. Now, when you replace a worker node, another worker node is created for you.
: If you replace multiple worker nodes at the same time, they are deleted and replaced concurrently, not one by one. Make sure that you have enough capacity in your cluster to reschedule your workloads before you replace worker nodes.

What if a replacement worker node is not created?
: A replacement worker node is not created if the worker pool does not have [automatic rebalancing enabled](https://cloud.ibm.com/docs/containers?topic=containers-auto-rebalance-off).



 Prerequisites 

Before you update your VPC infrastructure worker nodes, review the prerequisite steps.

Updates to worker nodes can cause downtime for your apps and services. Your worker node machine is removed, and data is deleted if not [stored outside the pod](https://cloud.ibm.com/docs/containers?topic=containers-storage-plan).



* [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)
* [Update the master](https://cloud.ibm.com/docs/containers?topic=containers-updatemaster). The worker node version can't be higher than the API server version that runs in your Kubernetes master.
* Make any changes that are marked with Update after master in the [Kubernetes version preparation guide](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions).
* If you want to apply a patch update, review the [Kubernetes clusters](https://cloud.ibm.com/docs/containers?topic=containers-changelog) version change log.
* Make sure that you have the [Operator or Administrator IBM Cloud IAM platform access role](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-perms).







 Updating VPC worker nodes in the CLI 

Complete the following steps to update your worker nodes by using the CLI.



1.
By default, only 20% of the worker nodes in the cluster can be unavailable at a time. You can override the default value by adding the default check to your config map. In the example, every worker node that is not specified in the zone and region checks (dal13 or us-south) can be unavailable during the update.

MaxUnavailablePercentage
: The maximum number of nodes that are allowed to be unavailable for a specified label key and value, which is specified as a percentage. A worker node is unavailable during the deploying, reloading, or provisioning process. The queued worker nodes are blocked from updating if it exceeds any defined maximum unavailable percentages.

NodeSelectorKey
: The label key of the worker node for which you want to set a rule. You can set rules for the default labels that are provided by IBM, as well as on worker node labels that you created. If you want to add a rule for worker nodes that belong to one worker pool, you can use the ibm-cloud.kubernetes.io/machine-type label.

NodeSelectorValue
: The label value that the worker node must have to be considered for the rule that you define.
5. Create the configuration map in your cluster.

oc apply -f <filepath/configmap.yaml>
6. Verify that the config map is created.

oc get configmap --namespace kube-system
7. Update the worker nodes.

ibmcloud oc worker update --cluster CLUSTER --worker WORKER-NODE-1-ID --worker WORKER-NODE-2-ID
8. Optional: Verify the events that are triggered by the config map and any validation errors that occur. The events can be reviewed in the Events section of your CLI output.

oc describe -n kube-system cm ibm-cluster-update-configuration
9. Confirm that the update is complete by reviewing the Kubernetes version of your worker nodes.

oc get nodes
10. Verify that you don't have duplicate worker nodes.
Your worker node instances reside in your IBM Cloud infrastructure account, but you can manage them through IBM Cloud Kubernetes Service. You own the worker node instances. 
 Security Built-in security features that help you protect your cluster infrastructure, isolate resources, and ensure security compliance. For more information, see the [classic Network Infrastructure documentation](https://cloud.ibm.com/docs/cloud-infrastructure?topic=cloud-infrastructure-compare-infrastructure). 
 High availability For both classic and VPC clusters, the master includes three replicas for high availability. Further, if you create your cluster in a multizone metro, the master replicas are spread across zones and you can also spread your worker pools across zones. For more information, see [High availability for IBM Cloud Kubernetes Service](https://cloud.ibm.com/docs/containers?topic=containers-ha). 
 Reservations [Create a reservation](https://cloud.ibm.com/docs/containers?topic=containers-reservations) with contracts for 1 or 3 year terms for classic worker nodes to lock in a reduced cost for the life of the contract. Typical savings range between 30-50% compared to regular worker node costs. 
 Cluster administration Classic clusters support the entire set of v1 API operations, such as resizing worker pools, reloading worker nodes, and updating masters and worker nodes across major, minor, and patch versions. When you delete a cluster, you can choose to remove any attached subnet or storage instances. 
 Cluster networking Your worker nodes are provisioned on private VLANs that provide private IP addresses to communicate on the private IBM Cloud infrastructure network. For communication on the public network, you can also provision the worker nodes on a public VLAN. Communication to the cluster master can be on the public or private cloud service endpoint. For more information, see [Understanding cluster network basics](https://cloud.ibm.com/docs/containers?topic=containers-plan_clusters). 
 Apps and container platform You can choose to create [community Kubernetes or Red Hat OpenShift clusters](https://cloud.ibm.com/docs/containers?topic=containers-faqscontainer_platforms) to manage your containerized apps.
kubectl describe node <worker_node_private_IP>

Example output

NAME: 10.xxx.xx.xxx
Roles: <none>
Labels: arch=amd64
beta.kubernetes.io/arch=amd64
beta.kubernetes.io/instance-type=b3c.4x16.encrypted
beta.kubernetes.io/os=linux
failure-domain.beta.kubernetes.io/region=us-south
failure-domain.beta.kubernetes.io/zone=dal10
ibm-cloud.kubernetes.io/encrypted-docker-data=true
ibm-cloud.kubernetes.io/ha-worker=true
ibm-cloud.kubernetes.io/iaas-provider=softlayer
ibm-cloud.kubernetes.io/machine-type=b3c.4x16.encrypted
ibm-cloud.kubernetes.io/sgx-enabled=false
ibm-cloud.kubernetes.io/worker-pool-id=00a11aa1a11aa11a1111a1111aaa11aa-11a11a
ibm-cloud.kubernetes.io/worker-version=1.26_1534
kubernetes.io/hostname=10.xxx.xx.xxx
privateVLAN=1234567
publicVLAN=7654321
Annotations: node.alpha.kubernetes.io/ttl=0
...
4. [Add an affinity rule](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/) for the worker pool ID label to the app deployment.

Example YAML

apiVersion: apps/v1
kind: Deployment
metadata:
name: with-node-affinity
spec:
template:
spec:
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
Why doesn't replacing a worker node create a worker node? 

Virtual Private Cloud

Classic infrastructure

Satellite

  What’s happening 

When you [replace a worker node](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clicli_worker_replace) or [update a VPC worker node](https://cloud.ibm.com/docs/containers?topic=containers-updatevpc_worker_node), a worker node is not automatically added back to your cluster.

  Why it’s happening 

By default, your worker pools are set to automatically rebalance when you replace a worker node. However, you might have disabled automatic rebalancing by manually removing a worker node, such as in the following scenario.



1.  You have a worker pool that automatically rebalances by default.
2.  You have a troublesome worker node in the worker pool that you removed individually, such as with the ibmcloud ks worker rm command.
3.  Now, automatic rebalancing is disabled for your worker pool, and is not reset unless you try to rebalance or resize the worker pool.
4.  You try to replace a worker node with the ibmcloud ks worker replace command or update a VPC worker node with the ibmcloud ks worker replace --update command. The worker node is removed, but another worker node is not added back to your worker pool.



You might also have issued the remove command shortly after the replace command. If the remove command is processed before the replace command, the worker pool automatic rebalancing is still disabled, so your worker node is not replaced.

  How to fix it 

To enable automatic rebalancing, [rebalance](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_rebalance) or [resize](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_worker_pool_resize) your worker pool. Now, when you replace a worker node, another worker node is created for you.
To update Satellite worker nodes, see [Updating hosts that are assigned as worker nodes to Satellite-enabled services](https://cloud.ibm.com/docs/satellite?topic=satellite-host-update-workers).



* Multiple worker nodes are replaced concurrently: If you replace multiple worker nodes at the same time, they are deleted and replaced concurrently, not one by one. Make sure that you have enough capacity in your cluster to reschedule your workloads before you replace worker nodes.
* Node-level customizations are not preserved: Any custom labels or taints that you applied at the individual worker node level are not applied to the replacement worker node. Instead, apply [labels](https://cloud.ibm.com/docs/openshift?topic=openshift-add_workersworker_pool_labels) or [taints](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-cliworker_pool_taint) at the worker pool level so that the replacement worker node gets these attributes.
* Automatic rebalancing: A replacement worker node is not created if the worker pool does not have [automatic rebalancing enabled](https://cloud.ibm.com/docs/openshift?topic=openshift-auto-rebalance-off).



Before you begin, make sure that your cluster has enough other worker nodes so that your pods can be rescheduled and continue to run.



1. List all worker nodes in your cluster and note the name of the worker node that you want to replace.

oc get nodes

The name that is returned in this command is the private IP address that is assigned to your worker node. You can find more information about your worker node when you run the ibmcloud oc worker ls --cluster <cluster_name_or_ID> command and look for the worker node with the same Private IP address.
2. Replace the worker node. As part of the replace process, the pods that run on the worker node are drained and rescheduled onto remaining worker nodes in the cluster. The worker node is also cordoned, or marked as unavailable for future pod scheduling.
* Worker node subnet CIDRs: If you anticipate changing the number of worker nodes in your cluster frequently, such as if you enable the [cluster autoscaler](https://cloud.ibm.com/docs/containers?topic=containers-cluster-scaling-classic-vpc), you might not want to update your allowlist for each new worker node. Instead, you can add the VPC subnets that the cluster uses. Keep in mind that the VPC subnet might be shared by worker nodes in other clusters.



1. Get the Worker Zones and VPCs that your cluster is created in.

ibmcloud ks cluster get -c <cluster>

Example output

...
Worker Zones: us-south-1, us-south-2, us-south-3
Ingress Subdomain: vpc-prod.us-south.containers.appdomain.cloud
Ingress Secret: vpc-prod
Creator: -
Public Service Endpoint URL: https://c2.us-south.containers.cloud.ibm.com:20267
Private Service Endpoint URL: https://c2.private.us-south.containers.cloud.ibm.com:20267
Pull Secrets: enabled in the default namespace
VPCs: ff537d43-a5a4-4b65-9627-17eddfa5237b
...
2. For the subnets in the zones and VPC that your cluster is in, note the Subnet CIDR.

ibmcloud is subnets

Example output

ID Name Status Subnet CIDR Addresses ACL Public Gateway VPC Zone
5f5787a4-f560-471b-b6ce-20067ac93439 vpc-prod-dal1 available 10.240.0.0/24 183/256 allow-all-network-acl-ff537d43-a5a4-4b65-9627-17eddfa5237b - prod us-south-1
Worker node drain automation N/A N/A Fixes a race condition that can cause worker node drain automation to fail. 







 Change log for master fix pack 3.11.219_1554_openshift and worker node fix pack 3.11.232_1554_openshift, released 22 June 2020 

The following table shows the changes that are in the master fix pack update 3.11.219_1554_openshift and in worker node fix pack update 3.11.232_1554_openshift. Master patch updates are applied automatically. Worker node patch updates can be applied by updating or reloading the worker node For more information, see [Update types](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_versions).



Changes since version 3.11.219_1552_openshift

 Component Location Previous Current Description 

 Calico Master v3.8.6 v3.8.9 See the [Calico release notes](https://docs.tigera.io/archive). 
 Cluster health image Master v1.1.5 v1.1.8 Additional status information is included when an add-on health state is critical. Improved performance when handling cluster status updates. 
 Cluster master operations Master N/A N/A Cluster master operations such as refresh or update are now canceled if a broken [Kubernetes admission webhook](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/) is detected. 
 etcd Master v3.3.20 v3.3.22 See the [etcd release notes](https://github.com/etcd-io/etcd/releases/v3.3.22). 
 IBM Cloud Controller Manager Master v1.15.12-316 v1.15.12-343 Updated to use calicoctl version 3.8.9. 
 IBM Cloud File Storage for Classic plug-in Master 373 375 Fixed a bug that might cause error handling to create additional persistent volumes.
* [Reload_pending state](https://cloud.ibm.com/docs/containers?topic=containers-worker-node-state-referenceworker-node-reload-pending)
* [Unknown state](https://cloud.ibm.com/docs/containers?topic=containers-worker-node-state-referenceworker-node-unknown)
* [Warning state](https://cloud.ibm.com/docs/containers?topic=containers-worker-node-state-referenceworker-node-warning)



[Common issues with worker nodes](https://cloud.ibm.com/docs/containers?topic=containers-common_worker_nodes_issuescommon_worker_nodes_issues)



* [Account prohibited from ordering](https://cloud.ibm.com/docs/containers?topic=containers-common_worker_nodes_issuesorder-prohibit)
* [Could not place order](https://cloud.ibm.com/docs/containers?topic=containers-common_worker_nodes_issuesorder-not-placed)
* [Could not obtain network VLAN](https://cloud.ibm.com/docs/containers?topic=containers-common_worker_nodes_issuesno-network-vlan)
* [Location invalid](https://cloud.ibm.com/docs/containers?topic=containers-common_worker_nodes_issueslocation-invalid)
* [Permissions error](https://cloud.ibm.com/docs/containers?topic=containers-common_worker_nodes_issuespermissions-error)
* [Firewall error](https://cloud.ibm.com/docs/containers?topic=containers-common_worker_nodes_issuesfirewall-error)
* [Hard reboot](https://cloud.ibm.com/docs/containers?topic=containers-common_worker_nodes_issueshard-reboot)
* [Instance can't be found](https://cloud.ibm.com/docs/containers?topic=containers-common_worker_nodes_issuesinstance-not-found)
containers-kubernetes.cluster-worker-pool-zone.list The worker pools for a cluster in a particular zone are listed as part of cluster autoscaler operations. 
 containers-kubernetes.cluster-worker-pool-zone.resize A worker node is added to or removed from a zone that the worker pool spans. 
 containers-kubernetes.cluster-worker-pool-zone-network.add The networking data, such as public and private VLAN data, is added for a zone that the worker pool spans. 
 containers-kubernetes.cluster-worker-pool-zone-worker.list The worker nodes within a zone that a the worker pool spans are listed as part of cluster autoscaler operations. 
 containers-kubernetes.worker.delete A worker node is deleted from the cluster. 
 containers-kubernetes.worker.get The details of a worker node in the cluster are returned. 
 containers-kubernetes.worker.reboot A worker node is rebooted. 
 containers-kubernetes.worker.reload A worker node is reloaded. 
 containers-kubernetes.worker.replace A worker node is removed and another worker node of the same flavor is created in the cluster. 
 containers-kubernetes.worker.update A worker node version is updated. 







 Viewing your cluster events 

To [view events](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-view_events) that are sent to IBM Cloud Activity Tracker, you select the Activity Tracker instance that matches with the location of your Red Hat OpenShift on IBM Cloud cluster.

The following table shows the Activity Tracker location where your events are sent to. To view your events, make sure that you have an Activity Tracker instance in the location that matches your cluster location. Note that clusters in the Montreal, Toronto, and Washington, D.C. locations forward all events to the Dallas Activity Tracker location.



Corresponding Activity Tracker instance and Red Hat OpenShift on IBM Cloud cluster locations.

 Red Hat OpenShift on IBM Cloud classic location Activity Tracker event location 

 Dallas (dal10, dal12, dal13) Dallas 
 Montreal (mon01) Washington, D.C.