vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Red Hat OpenShift on IBM Cloud version 4.11 CIS Kubernetes Benchmark 

The Center for Internet Security (CIS) publishes the [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/) as a framework of specific steps to configure Kubernetes more securely and with standards that are commensurate to various industry regulations. This document contains the results of the version 1.5 CIS Kubernetes benchmark for clusters that run Red Hat OpenShift on IBM Cloud version 4.11. For more information or help understanding the benchmark, see [Using the benchmark](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark).



 1 Master node security configuration 

Review the Master node security configuration results of the version 1.5 CIS Kubernetes benchmark.



 1.1 Master node configuration files 



Section 1.1 Master node benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive Scored 1 Pass IBM 
 1.1.2 Ensure that the API server pod specification file ownership is set to root:root Scored 1 Pass IBM 
 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive Scored 1 Pass IBM 
 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root Scored 1 Pass IBM 
 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive Scored 1 Pass IBM 
 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root Scored 1 Pass IBM 
 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive Scored 1 Pass IBM 
 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root Scored 1 Pass IBM 
 1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive Not Scored 1 Pass IBM
[Red Hat OpenShift on IBM Cloud version 4.10 CIS Kubernetes Benchmark](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410cis-benchmark-410)



* [1 Master node security configuration](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410cis-benchmark-1-410)



* [1.1 Master node configuration files](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410cis-benchmark-11-410)
* [1.2 API server](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410cis-benchmark-12-410)
* [1.3 Controller manager](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410cis-benchmark-13-410)
* [1.4 Scheduler](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410cis-benchmark-14-410)



* [2 Etcd node configuration](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410cis-section-2-410)
* [3 Control plane configuration](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410cis-section-3-410)



* [3.1 Authentication and authorization](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410cis-benchmark-31-410)
* [3.2 Logging](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410cis-benchmark-32-410)
Red Hat OpenShift on IBM Cloud version 4.12 CIS Kubernetes Benchmark 

The Center for Internet Security (CIS) publishes the [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/) as a framework of specific steps to configure Kubernetes more securely and with standards that are commensurate to various industry regulations. This document contains the results of the version 1.5 CIS Kubernetes benchmark for clusters that run Red Hat OpenShift on IBM Cloud version 4.12. For more information or help understanding the benchmark, see [Using the benchmark](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark).



 1 Master node security configuration 

Review the Master node security configuration results of the version 1.5 CIS Kubernetes benchmark.



 1.1 Master node configuration files 



Section 1.1 Master node benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive Scored 1 Pass IBM 
 1.1.2 Ensure that the API server pod specification file ownership is set to root:root Scored 1 Pass IBM 
 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive Scored 1 Pass IBM 
 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root Scored 1 Pass IBM 
 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive Scored 1 Pass IBM 
 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root Scored 1 Pass IBM 
 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive Scored 1 Pass IBM 
 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root Scored 1 Pass IBM 
 1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive Not Scored 1 Pass IBM
5 Kubernetes policies 

Review the Kubernetes Policies results of the version 1.5 CIS Kubernetes benchmark.



 5.1 RBAC and service accounts 



Section 5.1 RBAC and Service Accounts benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 5.1.1 Ensure that the cluster-admin role is only used where required. Not Scored 1 Pass Shared 
 5.1.2 Minimize access to secrets. Not Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-remediations-120) Shared 
 5.1.3 Minimize wildcard use in Roles and ClusterRoles. Not Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-remediations-120) Shared 
 5.1.4 Minimize access to create pods. Not Scored 1 Pass Shared 
 5.1.5 Ensure that default service accounts are not actively used. Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-remediations-120) Shared 
 5.1.6 Ensure that Service Account Tokens are only mounted where necessary. Not Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-remediations-120) Shared 







 5.2 Pod Security Policies 



Section 5.2 Pod Security Policies benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 5.2.1 Minimize the admission of privileged containers. Not Scored 1 [Pass](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-remediations-120) Shared 
 5.2.2 Minimize the admission of containers wanting to share the host process ID namespace.
* [Change log for 1.19.2_1524, released 13 October 2020](https://cloud.ibm.com/docs/containers?topic=containers-changelog_1191192_1524)





[Version 1.19 CIS Kubernetes benchmark](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-119cis-benchmark-119)



* [1 Master node security configuration](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-119cis-section-1-119)



* [1.1 Master node configuration files](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-119cis-benchmark-11-119)
* [1.2 API server](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-119cis-benchmark-12-119)
* [1.3 Controller manager](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-119cis-benchmark-13-119)
* [1.4 Scheduler](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-119cis-benchmark-14-119)



* [2 Etcd node configuration](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-119cis-section-2-119)
* [3 Control plane configuration](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-119cis-section-3-119)



* [3.1 Authentication and authorization](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-119cis-benchmark-31-119)
* [3.2 Logging](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-119cis-benchmark-32-119)
Comparing the CIS Kubernetes and the Compliance Operator benchmarks 

Review the following tables for an overview of the differences between the CIS Kubernetes and the compliance operator benchmarks.



 Major differences 



Major difference between the CIS Kubernetes Benchmark and the Red Hat OpenShift Compliance Operator Benchmark

 Section CIS Kubernetes benchmark Compliance Operator benchmark Description 

 1.2.1 Ensure that the --anonymous-auth option is set to false. Ensure that anonymous requests are authorized. Different approaches to achieve the same purpose. 
 1.2.10 Ensure that the admission control plug-in EventRateLimit is set. Ensure that the APIPriorityAndFairness feature gate is enabled. Different approaches to achieve the same purpose. 
 1.2.12 Ensure that the admission control plug-in AlwaysPullImages is set. Ensure that the admission control plug-in AlwaysPullImages is not set AlwaysPullImages causes error on Red Hat OpenShift. 
 1.2.13 Ensure that the admission control plug-in SecurityContextDeny is set if PodSecurityPolicy is not used. Ensure that the admission control plug-in SecurityContextDeny is not set SecurityContextDeny admission controller can't be enabled as it conflicts with the SecurityContextConstraint admission controller. 
 1.2.16 Ensure that the admission control plug-in PodSecurityPolicy is set. Ensure that the admission control plug-in SecurityContextConstraint is set. SecurityContextConstraint is unique to Red Hat OpenShift 
 1.2.21 Ensure that the --profiling option is set to false. Ensure that the healthz endpoint is protected by RBAC. Profiling is enabled by default in Red Hat OpenShift, but the profiling data is sent through the healthz port and the port must be protected by RBAC. 
 1.2.23 Ensure that the --audit-log-maxage option is set to 30 or as appropriate. Ensure that the audit logs are forwarded off the cluster for retention. Red Hat OpenShift has an operator for logging instead of retaining logs in the cluster.
* [5 Kubernetes policies](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-125cis-section-5-125)



* [5.1 RBAC and service accounts](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-125cis-benchmark-51-125)
* [5.2 Pod Security Policies](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-125cis-benchmark-52-125)
* [5.3 Network policies and CNI](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-125cis-benchmark-53-125)
* [5.4 Secrets management](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-125cis-benchmark-54-125)
* [5.5 Extensible admission control](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-125cis-benchmark-55-125)
* [5.6 General policies](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-125cis-benchmark-56-125)



* [IBM remediations and explanations](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-125cis-benchmark-remediations-125)







 Version 1.24 

[1.24 version information and update actions](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_124cs_versions_124)



* [Release timeline](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_124release_timeline_124)
* [Preparing to update](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_124prep-up-124)
* [4.1 Worker node configuration files](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-41-127)
* [4.2 Kubelet](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-42-127)



* [5 Kubernetes policies](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-section-1-127)



* [5.1 RBAC and service accounts](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-51-127)
* [5.2 Pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-52-127)
* [5.3 Network policies and CNI](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-53-127)
* [5.4 Secrets management](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-54-127)
* [5.5 Extensible admission control](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-55-127)
* [5.6 General policies](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-56-127)



* [IBM remediations and explanations](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-remediations-127)







 Version 1.26
* [5.5 Extensible admission control](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-55-127)
* [5.6 General policies](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-56-127)



* [IBM remediations and explanations](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-remediations-127)







 Version 1.26 

[1.26 version information and update actions](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_126cs_versions_126)



* [Release timeline](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_126release_timeline_126)
* [Preparing to update](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_126prep-up-126)



* [Update before master](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_126before_126)
* [Update after master](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_126anchor)





[Kubernetes version 1.26 change log](https://cloud.ibm.com/docs/containers?topic=containers-changelog_126changelog_126)



* [Overview](https://cloud.ibm.com/docs/containers?topic=containers-changelog_126changelog_overview_126)
* [Version 1.26 change log](https://cloud.ibm.com/docs/containers?topic=containers-changelog_126126_changelog)
4.2.12 Ensure that the RotateKubeletServerCertificate argument is set to true Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-remediations-127) IBM 
 4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers Not Scored 1 Pass IBM 









 5 Kubernetes policies 

Review the Kubernetes Policies results of the version 1.5 CIS Kubernetes benchmark.



 5.1 RBAC and service accounts 



Section 5.1 RBAC and service accounts benchmark results

 Section Recommendation Scored? Level Result Responsibility 

 5.1.1 Ensure that the cluster-admin role is only used where required Not Scored 1 Pass Shared 
 5.1.2 Minimize access to secrets Not Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-remediations-127) Shared 
 5.1.3 Minimize wildcard use in Roles and ClusterRoles Not Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-remediations-127) Shared 
 5.1.4 Minimize access to create pods Not Scored 1 Pass Shared 
 5.1.5 Ensure that default service accounts are not actively used. Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-remediations-127) Shared 
 5.1.6 Ensure that Service Account Tokens are only mounted where necessary Not Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-remediations-127) Shared 







 5.2 Pod security policies 



Section 5.2 Pod security policies benchmark results

 Section Recommendation Scored? Level Result Responsibility
* [5.3 Network policies and CNI](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-benchmark-53-123)
* [5.4 Secrets management](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-benchmark-54-123)
* [5.5 Extensible admission control](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-benchmark-55-123)
* [5.6 General policies](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-benchmark-56-123)



* [IBM remediations and explanations](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-benchmark-remediations-123)







 Version 1.22 

[1.22 version information and update actions](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_122cs_versions_122)



* [Release timeline](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_122release_timeline_122)
* [Preparing to update](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_122prep-up-122)



* [Update before master](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_122122_before)
* [Update after master](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_122122_after)





[Kubernetes version 1.22 change log](https://cloud.ibm.com/docs/containers?topic=containers-changelog_122changelog_122)
* [Change log for 1.20.2_1528 (master) and 1.20.2_1527 (worker node), released 17 February 2021](https://cloud.ibm.com/docs/containers?topic=containers-changelog_1201202_1528)





[Version 1.20 CIS Kubernetes benchmark](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-120)



* [1 Master node security configuration](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-section-1-120)



* [1.1 Master node configuration files](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-11-120)
* [1.2 API server](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-12-120)
* [1.3 Controller manager](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-13-120)
* [1.4 Scheduler](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-14-120)



* [2 Etcd node configuration](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-section-2-120)
* [3 Control plane configuration](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-section-3-120)



* [3.1 Authentication and authorization](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-31-120)
* [1.2 API server](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-12-127)
* [1.3 Controller manager](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-13-127)
* [1.4 Scheduler](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-14-127)



* [2 Etcd node configuration](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-section-2-127)
* [3 Control plane configuration](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-section-3-127)



* [3.1 Authentication and authorization](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-31-127)
* [3.2 Logging](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-32-127)



* [4 Worker node security configuration](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-section-1-127)



* [4.1 Worker node configuration files](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-41-127)
* [4.2 Kubelet](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-42-127)



* [5 Kubernetes policies](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-section-1-127)
Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-121cis-benchmark-remediations-121) Shared 









 IBM remediations and explanations 

Review information from IBM on the CIS Benchmark results.



Explanation and remediation

 Section Remediation/Explanation 

 1.2.1 IBM Cloud Kubernetes Service utilizes RBAC for cluster protection, but allows anonymous discovery, which is considered reasonable per [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/). 
 1.2.10 IBM Cloud Kubernetes Service does not enable the [EventRateLimit](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/eventratelimit) admission controller since it is a Kubernetes alpha feature. 
 1.2.12 IBM Cloud Kubernetes Service does not enable the [AlwaysPullImages](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/alwayspullimages) admission controller since it overrides a container's imagePullPolicy and may impact performance. 
 1.2.21 IBM Cloud Kubernetes Service enables [profiling](https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/) for cluster administrator troubleshooting purposes. 
 1.2.22 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server). 
 1.2.23 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server).
* [Change log for master fix pack 1.24.1_1523 and worker node fix pack 1.24.1_1522, released 9 June 2022](https://cloud.ibm.com/docs/containers?topic=containers-changelog_1241241_1522)





[Version 1.24 CIS Kubernetes benchmark](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-124cis-benchmark-124)



* [1 Master node security configuration](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-124cis-section-1-124)



* [1.1 Master node configuration files](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-124cis-benchmark-11-124)
* [1.2 API server](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-124cis-benchmark-12-124)
* [1.3 Controller manager](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-124cis-benchmark-13-124)
* [1.4 Scheduler](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-124cis-benchmark-14-124)



* [2 Etcd node configuration](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-124cis-section-2-124)
* [3 Control plane configuration](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-124cis-section-3-124)



* [3.1 Authentication and authorization](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-124cis-benchmark-31-124)
Kubernetes benchmarks
: Added how to [run the CIS Kubernetes benchmark tests on your own worker nodes](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmarkcis-worker-test).

Removal of data center support
: Updated the documentation to reflect that Melbourne (mel01) is no longer available as an option to create IBM Cloud resources in.





 7 January 2021 

Ingress ALB change log
: Updated the latest [Kubernetes Ingress image build to 0.35.0_869_iks](https://cloud.ibm.com/docs/containers?topic=containers-cluster-add-ons-changelog0_35_0).





 6 January 2021 

Master versions
: Master fix pack update change log documentation is available.
: [1.19.6_1531](https://cloud.ibm.com/docs/containers?topic=containers-changelog_1191196_1531), [1.18.14_1537](https://cloud.ibm.com/docs/containers?topic=containers-118_changelog11814_1537), [1.17.16_1550](https://cloud.ibm.com/docs/containers?topic=containers-117_changelog11716_1550), and [1.16.15_1556](https://cloud.ibm.com/docs/containers?topic=containers-116_changelog11615_1556).







 December 2020 



 21 December 2020 

Gateway firewalls and Calico policies
: For classic clusters in Tokyo, updated the IBM Cloud Kubernetes Service IP addresses that you must open in a [public gateway firewall device](https://cloud.ibm.com/docs/containers?topic=containers-firewallfirewall_outbound) or [Calico network isolation policies](https://github.com/IBM-Cloud/kube-samples/tree/master/calico-policies/public-network-isolation).

Worker node versions
: Worker node fix pack update change log documentation is available.