vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Worker node With IBM Cloud Kubernetes Service, the virtual machines that your cluster manages are instances that are called worker nodes. These worker nodes virtual machines and all the worker node components are dedicated to you only and are not shared with other IBM customers. However, the underlying hardware is shared with other IBM customers. For more information, see [Virtual machines](https://cloud.ibm.com/docs/containers?topic=containers-planning_worker_nodesvm). You manage the worker nodes through the automation tools that are provided by IBM Cloud Kubernetes Service, such as the API, CLI, or console. Unlike classic clusters, you don't see VPC compute worker nodes in your infrastructure portal or separate infrastructure bill, but instead manage all maintenance and billing activity for the worker nodes from IBM Cloud Kubernetes Service. Worker nodes include the same [components](https://cloud.ibm.com/docs/containers?topic=containers-service-archworker-components) as described in the Classic architecture. Community Kubernetes worker nodes run on Ubuntu 18.04 x86_64, 16.04 x86_64 (deprecated). 
 Cluster networking Your worker nodes are created in a VPC subnet in the zone that you specify. By default, the public and private cloud service endpoints for your cluster are enabled. Communication between the master and worker nodes is over the private network. Authenticated external users can communicate with the master over the public network, such as to run kubectl commands. You can optionally set up your cluster to communicate with on-prem services by setting up a VPC VPN on the private network. 
 App networking You can create a Kubernetes LoadBalancer service for your apps in the cluster, which automatically provisions a VPC load balancer in your VPC outside the cluster. The load balancer is multizonal and routes requests for your app through the private NodePorts that are automatically opened on your worker nodes. For more information, see [Exposing apps with VPC load balancers](https://cloud.ibm.com/docs/containers?topic=containers-vpc-lbaas). Calico is used as the cluster networking policy fabric.
For example, on Linux operating systems, run the sync command to force an immediate write of all cached data to disk.

For customers with special access, data isolation is provided to store snapshots that you created from your dedicated hosts. With data isolation's extra security, your data is encrypted at rest with a unique key and access to your data is protected by a private firewall.





 How snapshots work 

When you take a snapshot, read and write operations from your virtual server instance to the volume continue uninterrupted. After volume data is retrieved, the snapshot enters a pending state until the snapshot is created. When the snapshot is successfully created and in a stable state, you can resume volume management activities, such as deleting, resizing, or detaching a volume. You can also take more snapshots.

Volume data that is retrieved for the requested snapshot is encrypted while in transit from the hypervisor to IBM Cloud® Object Storage. The initial snapshot is the entire copy of your Block Storage for VPC volume. Subsequent snapshots copy only what was changed since the last snapshot.

You can restore a boot or data volume from a running virtual server instance in the UI, CLI, API, or Terraform. Restoring a data from a snapshot creates a new, fully provisioned volume. Restoring from a snapshot of a boot volume creates a new boot volume that you can use to provision a new instance. Restoring from a snapshot of a data volume creates a secondary volume that is attached to the instance.

You can also restore a [stand-alone (unattached) data volume from a snapshot](https://cloud.ibm.com/docs/vpc?topic=vpc-snapshots-vpc-restore&interface=apirestoring-from-an-unattached-snapshot) by using the UI, CLI, or the volumes API and specifying the snapshot ID. The volume from which the snapshot was created does not have to be attached to an instance.





 Limitations 

The following limitations apply to this release:
WARNING: A manual nodetool repair or a repair operation from the OpsCenter node administration menu fails to run if a NodeSync-enabled table is targeted.





 Recommendations 



 Benchmark before production 



* Do not use cqlsh and COPY for benchmarking, as COPY does not mimic typical client behavior. Instead, [nosqlbench](https://github.com/nosqlbench/nosqlbench) can be used for benchmarking.







 Data migrations 



* DSBULK is recommended for data migration. For more information, see [DSBULK documentation](https://docs.datastax.com/en/dsbulk/doc/dsbulk/reference/dsbulkCmd.html).







 Resource configurations 



* The recommended configuration for a node is:



* 16 CPUs
* 32 GB to 64 GB RAM
* 16 K disk IOPS (16 k IOPS == 1.6 TB disk)











 Next steps 

Detailed information on CQL, the Cassandra Query Language, can be found by consulting [CQL for DSE Documentation](https://docs.datastax.com/en/dse/6.0/cql/).

Looking to administer your deployment? Consult DataStax's documentation on using the [stand-alone CQLSH client](https://docs.datastax.com/en/astra/docs/connecting-to-databases-using-standalone-cqlsh.html).

You can manage your deployment with [IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli), the [Cloud Databases CLI plug-in](https://cloud.ibm.com/docs/databases-cli-plugin?topic=databases-cli-plugin-cdb-reference), or by using the [Cloud Databases API](https://cloud.ibm.com/apidocs/cloud-databases-api).
Tuning performance for Red Hat CoreOS worker nodes 

Satellite

Supported worker node operating systems
: Red Hat CoreOS (RHCOS)

You can tune your Red Hat CoreOS worker node performance by enabling CPU Pinning, non-uniform memory access (NUMA), and huge pages configurations. These configurations can be beneficial for applications that have strict performance requirements. However, these customizations might cause issues with scheduling workloads.

Instead of tuning worker node performance with MachineConfig files in Red Hat OpenShift, you can modify the host with a daemonset file. For more information, see [Changing the Calico MTU](https://cloud.ibm.com/docs/openshift?topic=openshift-kernelcalico-mtu) or [Tuning performance for Red Hat CoreOS worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-rhcos-performance).



 Deploying the Node Feature Discovery Operator 

Before you can enable NUMA, CPU pinning, and huge pages on your worker nodes, you must deploy the Node Feature Discovery Operator. For more information, see [The Node Feature Discovery Operator](https://docs.openshift.com/container-platform/4.8/scalability_and_performance/psap-node-feature-discovery-operator.html).





 Enabling non-uniform memory access (NUMA), CPU pinning, and huge pages on your worker nodes 

Before you begin, make sure that you have deployed the [Node Feature Discovery Operator](https://cloud.ibm.com/docs/openshift?topic=openshift-rhcos-performancerhcos-node-feature-discovery).



1. Save the following DaemonSet to a file called customize.yaml

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: ibm-user-custom-configurator-privileged
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: system:openshift:scc:privileged
subjects:
Next, prevent other [workloads from running on edge worker nodes](https://cloud.ibm.com/docs/containers?topic=containers-edgeedge_workloads) and [block inbound traffic to NodePorts on worker nodes](https://cloud.ibm.com/docs/containers?topic=containers-network_policiesblock_ingress).





 Preventing app workloads from running on edge worker nodes 

A benefit of edge worker nodes is that they can be specified to run networking services only.

Using the dedicated=edge toleration means that all network load balancer (NLB) and Ingress application load balancer (ALB) services are deployed to the labeled worker nodes only. However, to prevent other workloads from running on edge worker nodes and consuming worker node resources, you must use [Kubernetes taints](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/).

Before you begin



* Ensure you that have the [Manager IBM Cloud IAM service access role for all namespaces](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-perms).
* [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)



Complete the following steps to prevent other workloads from running on edge worker nodes.

If you want to allow the Sysdig agent to run on your edge nodes, see [Deploying the Sysdig agent to edge worker nodes](https://cloud.ibm.com/docs/containers?topic=containers-edgesysdig-edge).



1. Apply a taint to the worker nodes with the dedicated=edge label. The taint prevents pods from running on the worker node and removes pods that don't have the dedicated=edge label from the worker node. The pods that are removed are redeployed to other worker nodes with capacity.

To apply a taint to all existing and future worker nodes in a worker pool:
Migrating data from IBM Cloud classic infrastructure to VPC 

The following guide shows you how to connect your IBM Cloud® classic infrastructure to VPC to migrate your data, especially for block or file volumes, as part of your migration journey. While many different data migration tools are available, the following guide uses rsync. Rsync Is an open source utility that provides file transfer between two devices. It is available for both Linux and Windows platforms.

You can use other data migration tools instead of rsync to move your data to VPC.



 Before you begin 

Before you begin migrating your data, review the following requirements and considerations:



1. You need an existing VPC environment.
2. You are aware of the storage capabilities and differences between classic and VPC.
3. Back up your data before you begin the migration process.







 Step 1: Create IBM Cloud Transit Gateway and establish connection between classic and VPC 

Your classic infrastructure and VPC infrastructure need to be able to reach each other, which can be achieved in many ways: public interfaces, VPN, transit gateway. If you need to move data from a few machines, you might want to use a public interface. However, if you have a large amount of data from different sources or large data sets, then you need to use IBM Cloud Transit Gateway, which uses IBM Cloud to interconnect between classic and VPC.

Before you create your IBM Cloud Transit Gateway, review the following requirements and considerations:



1. Make sure that VRF is enabled on the classic infrastructure.
2. Make sure that the IP network spaces don't overlap. Your VPC IP address must not be present in the classic infrastructure IP range.
3. Make sure that your classic infrastructure data centers are able to connect to VPC.



To create IBM Cloud Transit Gateway and establish connection between classic and VPC, review the following information:



* [Planning for IBM Cloud Transit Gateway](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-helpful-tips)
* [Ordering IBM Cloud Transit Gateway](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-ordering-transit-gateway)
curl -LO https://github.com/prometheus/node_exporter/releases/download/v1.1.2/node_exporter-1.1.2.linux-amd64.tar.gz
tar -xvf node_exporter-1.1.2.linux-amd64.tar.gz
mv node_exporter-1.1.2.linux-amd64/node_exporter /usr/local/bin/



1. Create a custom node exporter service file in /etc/systemd/system/node_exporter.service with the following content:



[Unit]
Description=Node Exporter
After=network.target

[Service]
User=node_exporter
Group=node_exporter
Type=simple
ExecStart=/usr/local/bin/node_exporter

[Install]
WantedBy=multi-user.target



2. Register the node exporter service:



sudo useradd --system --shell /bin/false node_exporter
sudo systemctl daemon-reload
sudo systemctl start node_exporter
sudo systemctl enable node_exporter







 Windows 



1. To monitor Windows host metrics, you can install the [Prometheus exporter for Windows machines](https://github.com/prometheus-community/windows_exporter).







 Custom endpoint for exposing-metrics 

Your application can also expose an endpoint that you can use to provide metrics to Prometheus.



1. Allow TCP inbound traffic to port 9100 and any other ports that your application uses to expose metrics within the VPC [access control list](https://cloud.ibm.com/docs/vpc?topic=vpc-using-acls) and [security group](https://cloud.ibm.com/docs/vpc?topic=vpc-using-security-groups) that your virtual server instance is in.
2.
* Wait for user input: Your assistant pauses until new input is provided by the user.
* Skip user input: Your assistant jumps directly to the first child node. This option is only available if the current node has at least one child node.
* Jump to: Your assistant continues the dialog by processing the node you specify. You can choose whether your assistant should evaluate the target node's condition or skip directly to the target node's response. See [Configuring the Jump to action](https://cloud.ibm.com/docs/assistant?topic=assistant-dialog-overviewdialog-overview-jump-to-config) for more details.



8. Optional: If you want this node to be considered when users are shown a set of node choices at run time, and asked to pick the one that best matches their goal, then add a short description of the user goal handled by this node to the external node name field. For example, Open an account.

![Plus or higher plans only](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/plus.png) The external node name field is only displayed only to users of paid plans. See [Disambiguation](https://cloud.ibm.com/docs/assistant?topic=assistant-dialog-runtimedialog-runtime-disambiguation) for more details.
9. To add more nodes, select a node in the tree, and then click the More![More icon](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/kebab.png) icon.



* To create a peer node that is checked next if the condition for the existing node is not met, select Add node below.
* To create a peer node that is checked before the condition for the existing node is checked, select Add node above.
Load balancer and load balancer monitor for IBM Cloud Provider 1165 1274 Fixed a bug that might cause version 2.0 network load balancers (NLBs) to crash and restart on load balancer updates. 







 Change log for worker node fix pack 1.17.17_1558, released 29 March 2021 

The following table shows the changes that are in the worker node fix pack 1.17.17_1558. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.17.17_1556

 Component Previous Current Description 

 Ubuntu 18.04 packages 4.15.0-136-generic 4.15.0-140-generic Updated worker node images with kernel and package updates for [CVE-2020-27170](https://nvd.nist.gov/vuln/detail/CVE-2020-27170), [CVE-2020-27171](https://nvd.nist.gov/vuln/detail/CVE-2020-27171), [CVE-2021-27363](https://nvd.nist.gov/vuln/detail/CVE-2021-27363), [CVE-2021-27365](https://nvd.nist.gov/vuln/detail/CVE-2021-27365), [CVE-2021-28153](https://nvd.nist.gov/vuln/detail/CVE-2021-28153), and [CVE-2021-3449](https://nvd.nist.gov/vuln/detail/CVE-2021-3449).
Gateway-enabled cluster controller 2106 2322 Updated image to resolve [CVE-2023-2650](https://nvd.nist.gov/vuln/detail/CVE-2023-2650). 
 IBM Cloud File Storage for Classic plug-in and monitor 431 433 Updated Go to version 1.20.4. Updated UBI base image. 
 Key Management Service provider v2.6.6 v2.6.7 Updated Go dependencies and to Go version 1.19.10. 
 Load balancer and load balancer monitor for IBM Cloud Provider 2486 2584 Updated Go dependencies and to Go version 1.19.9. Updated base image. 
 OpenVPN client 2.5.8-r0-IKS-674-amd64 2.6.4-r0-IKS-34-amd64 Upgrade openvpn to version 2.6.4-r0. 
 OpenVPN server 2.5.8-r0-IKS-673-amd64 2.6.4-r0-IKS-33-amd64 Upgrade openvpn to version 2.6.4-r0. 
 OpenVPN Operator image v1.4.23 v1.4.25 Updated OpenVPN configuration to provide shutdown grace period before terminating connections. 







 Change log for worker node fix pack 4.9.59_1593_openshift, released 19 June 2023 

The following table shows the changes that are in the worker node fix pack 4.9.59_1593_openshift. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 4.9.59_1592_openshift

 Component Previous Current Description 

 Red Hat OpenShift on IBM Cloud. N/A N/A N/A
Kubernetes NodeLocal DNS cache 1.21.4 1.22.6 See the [Kubernetes NodeLocal DNS cache release notes](https://github.com/kubernetes/dns/releases/tag/1.22.6). 
 Load balancer and load balancer monitor for IBM Cloud Provider 2058 2110 Updated Go dependencies and to Go version 1.17.13. 
 Portieris admission controller v0.12.5 v0.12.6 See the [Portieris admission controller release notes](https://github.com/IBM/portieris/releases/tag/v0.12.6). 







 Change log for worker node fix pack 1.23.10_1543, released 29 August 2022 

The following table shows the changes that are in the worker node fix pack 1.23.10_1543. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.23.9_1541

 Component Previous Current Description 

 Ubuntu 18.04 packages N/A N/A Worker node kernel & package updates for [CVE-2019-5815](https://nvd.nist.gov/vuln/detail/CVE-2019-5815), [CVE-2021-30560](https://nvd.nist.gov/vuln/detail/CVE-2021-30560), [CVE-2022-31676](https://nvd.nist.gov/vuln/detail/CVE-2022-31676), [CVE-2022-37434](https://nvd.nist.gov/vuln/detail/CVE-2022-37434). 
 Kubernetes 1.23.9 1.23.10 For more information, see the [change log](https://github.com/kubernetes/kubernetes/releases/tag/v1.23.10).
* There are no additional considerations for reusing a Node.js application as no service bindings are required by Secure Gateway.



* What is the recommended approach to creation automation across multiple orgs?

Consider an environment that has three orgs: one for development, one for staging, and one for production. Is a Secure Gateway service instance required for each org and is the configuration available to all spaces within that org?

For automation across orgs, the approach is as follows:



* You are not required to have a Secure Gateway service instance in each org. You could have an instance in one org and use the gateways within that instance from all of your other environments. With this setup, you must remember the gateway and destination [limitations for your specific plan](https://cloud.ibm.com/docs/services/SecureGateway?topic=SecureGateway-secure-gateway-service-plans).
* You can have a Secure Gateway service instance in each org and the configuration will be available to all your spaces.



* Does my app need to be in the same space?

Do I need to run the Node.js app in the same IBM Cloud space as the Secure Gateway service? No, you do not need to run your app in the same IBM Cloud space as the Secure Gateway service.
* Can a Secure Gateway client handle two gateways on the same machine?

Yes. For a client to handle two gateways, you can specify multiple connections through the command line as shown in this excerpt from [Startup Argument Examples](https://cloud.ibm.com/docs/SecureGateway?topic=SecureGateway-client-interactingstartup-examples):

node lib/secgwclient.js <gateway_id_1> <gateway_id_2> -t <security_token_1>--<security_token_2>
* Can I retrieve error level logs for the Secure Gateway server?

Error level logs on the server cannot be retrieved. Only errors that are made at the time of the request can be seen.
* Where can I find the client logs for the Secure Gateway client?

By default, the client logs can be found at the following locations:
Kubernetes NodeLocal DNS cache Master 1.15.12 1.15.13 See the [Kubernetes NodeLocal DNS cache release notes](https://github.com/kubernetes/dns/releases/tag/1.15.13). Updated the node-local-dns daemon set to include the prometheus.io/port and prometheus.io/scrape annotations on the pods. 
 Load balancer and load balancer monitor for IBM Cloud Provider Master 207 211 Updated the version 2.0 network load balancers (NLB) to clean up unnecessary IPVS rules. 
 Ubuntu 18.04 packages Worker 4.15.0-99-generic 4.15.0-101-generic Updated worker node images with kernel and package updates for [CVE-2019-20795](https://nvd.nist.gov/vuln/detail/CVE-2019-20795), [CVE-2020-11494](https://nvd.nist.gov/vuln/detail/CVE-2020-11494), [CVE-2020-12762](https://nvd.nist.gov/vuln/detail/CVE-2020-12762), [CVE-2020-3810](https://nvd.nist.gov/vuln/detail/CVE-2020-3810), [CVE-2020-8616](https://nvd.nist.gov/vuln/detail/CVE-2020-8616), and [CVE-2020-8617](https://nvd.nist.gov/vuln/detail/CVE-2020-8617).
See [Hypertext Transfer Protocol Secure](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx2237225).





 human annotator 

A subject matter expert who reviews, modifies, and augments the results of pre-annotation by identifying mentions, entity type relationships, and mention coreferences. By examining text in context, a human annotator helps determine ground truth and improve the accuracy of the machine learning model.





 HVM 

See [hardware virtual machine mode](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx9736811).





 hybrid cloud 

A cloud computing environment that consists of multiple public and private resources.





 Hyperledger fabric 

The implementation of the Linux Hyperledger project. See also [Linux Hyperledger project](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx8888396).





 Hypertext Transfer Protocol Secure (HTTPS) 

An Internet protocol that is used by web servers and web browsers to transfer and display hypermedia documents securely across the Internet.







 I 



 IaaS 

See [infrastructure as a service](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx4585332).





 IAM 

See [identity and access management](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx7547040).





 IBM Cloud 

An open-standards, cloud-based platform for building, managing, and running apps of all types, such as web, mobile, big data, and smart devices. Capabilities include Java, mobile back-end development, and application monitoring, as well as features from ecosystem partners and open source—all provided as-a-service in the cloud.





 identity and access management (IAM) 

The process of controlling access of authorized users to data and applications, while helping companies comply with various regulatory requirements.





 identity provider (IdP) 

A service that creates, maintains, and manages identity information, account authentication and credential management services for one or more systems.