vania-janet/multiturn-rag-retrieval-data huggingface dataset:
: Encryption: The masking of data to prevent visibility when data is accessed by an unauthorized user.



 Non-persistent storage 

Virtual Private Cloud

Classic infrastructure

Satellite

You can use non-persistent storage options if your data is not required to be persistently stored or if you want to unit-test your app components. The following image shows available non-persistent data storage options in IBM Cloud Kubernetes Service.

Zoom

![Non-persistent data storage options](https://cloud.ibm.com/docs-content/v1/content/4d497aff9e27b92fbbc2ee4e343a9ec4549cb1d7/containers/images/cs_storage_nonpersistent.svg)

Figure 1. Non-persistent data storage options



Figure 1. Non-persistent storage options

 Characteristics Inside the container On the worker node's primary or secondary disk 

 Multizone capable No No 
 Data types All All 
 Capacity Limited to the worker node's available secondary disk. To limit the amount of secondary storage that is consumed by your pod, use resource requests and limits for [ephemeral storage](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/local-ephemeral-storage). Limited to the worker node's available space on the primary (hostPath) or secondary disk (emptyDir). To limit the amount of secondary storage that is consumed by your pod, use resource requests and limits for [ephemeral storage](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/local-ephemeral-storage). 
 Data access pattern Read and write operations of any frequency Read and write operations of any frequency 
 Access Via the container's local file system Via [Kubernetes hostPath](https://kubernetes.io/docs/concepts/storage/volumes/hostpath) for access to worker node primary storage.
Custom taints: Remove custom taints that the keepalived pods don't have tolerations for. Instead, you can [label worker nodes as edge nodes, and then taint those edge nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-edge).

If you complete one of the previous options but the keepalived pods are still not scheduled, you can get more information about the keepalived pods:



1. Get the keepalived pods.

oc get pods -n ibm-system
2. In the output, look for ibm-cloud-provider-ip pods that have a Status of Pending. Example:

ibm-cloud-provider-ip-169-61-XX-XX-55967b5b8c-7zv9t 0/1 Pending 0 2m <none> <none>
ibm-cloud-provider-ip-169-61-XX-XX-55967b5b8c-8ptvg 0/1 Pending 0 2m <none> <none>
3. Describe each keepalived pod and look for the Events section. Address any error or warning messages that are listed.

oc describe pod ibm-cloud-provider-ip-169-61-XX-XX-55967b5b8c-7zv9t -n ibm-system
kubectl delete blockaffinity <block_affinity>
4. Get the IPAMBlock for the block. Replace the periods and forward slash in the block with hyphens (-). For example, for the block 172.24.10.64/26, the format for the following command is 172-24-10-64-26.

kubectl get ipamblock | grep <block>
5. Delete the IPAMBlock.

kubectl delete ipamblock <ipam_block>
6. If you did not lock the data store in step 2: Check that no pods were created directly before you deleted the BlockAffinity and IPAMBlock. If pods were created, you must delete the BlockAffinity and IPAMBlock for this block again. Then, delete any pods that use an IP address in this block by running kubectl delete pod <pod> so the pod is recreated with an IP address from a different block.

kubectl get pods -A
7. Repeat these steps for any other blocks that that have 0 IPS IN USE.



5. If you locked the data store in step 2: Unlock the data store.

calicoctl datastore migrate unlock
Specify a custom subnet CIDR to provide private IP addresses for pods. This option can be used only if you also enable Red Hat CoreOS with the --coreos-enabled option. All pods that are deployed to a worker node are assigned a private IP address in the 172.16.0.0/16 range by default. You can avoid subnet conflicts with the network that you use to connect to your location by specifying a custom subnet CIDR that provides the private IP addresses for your pods.
: When you choose a subnet size, consider the size of the cluster that you plan to create and the number of worker nodes that you might add in the future. The subnet must have a CIDR of at least /23, which provides enough pod IPs for a maximum of four worker nodes in a cluster. For larger clusters, use /22 to have enough pod IP addresses for eight worker nodes, /21 to have enough pod IP addresses for 16 worker nodes, and so on.
: The subnet that you choose must be within one of the following ranges.The subnet that you choose must be within one of the following ranges.



* 172.16.0.0 - 172.17.255.255
* 172.21.0.0 - 172.31.255.255
* 192.168.0.0 - 192.168.254.255
* 198.18.0.0 - 198.19.255.255



: Note that the pod and service subnets can't overlap. The service subnet is in the 172.20.0.0/16 range by default. This value can't be set to the value of the related location's pod-subnet or service-subnet.

--service-subnet SUBNET
: Optional. Specify a custom subnet CIDR to provide private IP addresses for services. This option can be used only if you also enable Red Hat CoreOS with the --coreos-enabled option. All services that are deployed to the cluster are assigned a private IP address in the 172.20.0.0/16 range by default.
Delete the pod.

oc deleted pod <pod_name>
3. Re-create the pod.

oc apply -f pod.yaml



4. Wait for the pod to deploy. The pod is fully deployed when the status changes to Running.

oc get pods
5. Log in to your pod.

oc exec -it <pod_name> sh
6. Verify that the File Storage for Classic was mounted with the NFS version that you specified earlier.

mount | grep "nfs" | awk -F" |," '{ print $5, $8 }'

Example output

nfs vers=3.0









 Backing up and restoring data 

File Storage for Classic is provisioned into the same location as the worker nodes in your cluster. The storage is hosted on clustered servers by IBM to provide availability in case a server goes down. However, File Storage for Classic is not backed up automatically and might be inaccessible if the entire location fails. To protect your data from being lost or damaged, you can set up periodic backups that you can use to restore your data when needed.

Review the following backup and restore options for your File Storage for Classic.



 Setting up periodic snapshots 

You can [set up periodic snapshots for your File Storage for Classic](https://cloud.ibm.com/docs/FileStorage?topic=FileStorage-snapshots), which is a read-only image that captures the state of the instance at a point in time. To store the snapshot, you must request snapshot space on your File Storage for Classic. Snapshots are stored on the existing storage instance within the same zone. You can restore data from a snapshot if a user accidentally removes important data from the volume.

Complete the following steps to create a snapshot for your volume.



1. [Access your Red Hat OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-access_cluster).
2. Log in to the ibmcloud sl CLI.

ibmcloud sl init
3.
If these requirements are not met, your cluster cannot upgrade unless you take additional migration steps.



* All pods run under the ibm-privileged-psp PSP.
* The privileged-psp-user cluster role binding uses the default configuration.
* The restricted-psp-user cluster role binding uses the default configuration.
* Only the following PSPs provided by IBM Cloud are present, and no additional PSPs are configured.



* ibm-privileged-psp
* ibm-anyuid-psp
* ibm-anyuid-hostpath-psp
* ibm-anyuid-hostaccess-psp
* ibm-restricted-psp





If your cluster meets these requirements, your pods use a PSP that allows privileged pods. However, meeting these requirements does not mean that all your pods are privileged.

If you created your own PSPs, installed applications that create PSPs, or changed the cluster role bindings to restrict use of the ibm-privileged-psp, you must modify your setup to meet the listed requirements before you can upgrade your cluster. If you use third-party security policy admission controllers, your cluster can still meet these requirements as long as all controllers function properly within the PSP configuration.

Complete the following steps to confirm that the cluster PSP configuration satisfies the requirements. If all requirements are satisfied, you can upgrade your cluster to version 1.25.



 Step 1: Check that all pods run under the ibm-privileged-psp PSP 

Complete the following steps ensure that all pods run under the ibm-privileged-psp PSP.

One difference between Pod Security Admission and PodSecurityPolicies is that Pod Security Admission is validating while the PodSecurityPolicies can be mutating. This makes it important that pods use the ibm-privileged-psp, which is not a mutating PSP, before you upgrade. Because both Pod Security Admission and the ibm-privileged-psp are validating, pods work the same under either one.

For example, if a pod is currently running under ibm-restricted-psp, it might set the fsGroup and supplementalGroups to 1 in the pod securityContext section, based on the MustRunAs range in the PSP.
For example, when working with corpora and words in a custom language model, you do not need to set the X-Watson-Learning-Opt-Out request header. Your training data is never used to improve the service's base models.
* The service does log data when a custom model is used with a recognition request. You can opt out of request logging at the account level or by setting the X-Watson-Learning-Opt-Out request header to true.



For more information, see [Request logging](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-data-securitydata-security-request-logging).
See the Kubernetes [Deprecated API migration guide](https://kubernetes.io/docs/reference/using-api/deprecation-guide/psp-v125) for more information. Customers have the option to replace Pod Security Policies with [Pod security admission](https://kubernetes.io/docs/concepts/security/pod-security-admission/) or a [third party admission webhook](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/). For more information, see [Migrating from PSPs to Pod Security Admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission-migration).



Changes to make after you update the master to Kubernetes 1.25

 Type Description 

 Unsupported: Beta version of the CronJob API Migrate manifests and API clients to use the batch/v1 API version, available since Kubernetes version 1.21. For more information, see [Deprecated API Migration Guide - v1.25](https://kubernetes.io/docs/reference/using-api/deprecation-guide/v1-25). 
 Unsupported: Beta version of the EndpointSlice API Migrate manifests and API clients to use the discovery.k8s.io/v1 API version, available since Kubernetes version 1.21. For more information, see [Deprecated API Migration Guide - v1.25](https://kubernetes.io/docs/reference/using-api/deprecation-guide/v1-25). 
 Unsupported: Beta version of the Event API Migrate manifests and API clients to use the events.k8s.io/v1 API version, available since Kubernetes version 1.19. For more information, see [Deprecated API Migration Guide - v1.25](https://kubernetes.io/docs/reference/using-api/deprecation-guide/v1-25).
: You can use pod priority in combination with resource quotas, including [quota scopes](https://kubernetes.io/docs/concepts/policy/resource-quotas/quota-scopes). With quota scopes, you can set up your resource quotas to account for pod priority. Higher priority pods get to consume system resources that are limited by the resource quota before lower priority pods.



 Understanding default priority classes 

Your IBM Cloud® Kubernetes Service clusters come with some priority classes by default.

Do not modify the default classes, which are used to properly manage your cluster. You can use these classes in your app deployments, or [create your own priority classes](https://cloud.ibm.com/docs/containers?topic=containers-pod_prioritycreate_priority_class).

The following table describes the priority classes that are in your cluster by default and why they are used.



Default priority classes that you must not modify

 Name Set by Priority Value Purpose 

 system-node-critical Kubernetes 2000001000 Select pods that are deployed into the kube-system namespace when you create the cluster use this priority class to protect critical functionality for worker nodes, such as for networking, storage, logging, monitoring, and metrics pods. 
 system-cluster-critical Kubernetes 2000000000 Select pods that are deployed into the kube-system namespace when you create the cluster use this priority class to protect critical functionality for clusters, such as for networking, storage, logging, monitoring, and metrics pods. 
 ibm-app-cluster-critical IBM 900000000 Select pods that are deployed into the ibm-system namespace when you create the cluster use this priority class to protect critical functionality for apps, such as the load balancer pods. 



You can check which pods use the priority classes by running the following command.

kubectl get pods --all-namespaces -o custom-columns=NAME:.metadata.name,PRIORITY:.spec.priorityClassName





 Creating a priority class 

To set pod priority, you need to use a priority class.

Before you begin:



* [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.]
If you changed the istio-global-logging-level or istio-global-proxy-accessLogFile settings, you must restart your data plane pods to apply the changes to them.



1. Get the list of all data plane pods that are not in the istio-system namespace.

istioctl version --short=false | grep "data plane version" | grep -v istio-system

Example output

data plane version: version.ProxyInfo{ID:"test-6f86fc4677-vsbsf.default", IstioVersion:"1.18.0"}
data plane version: version.ProxyInfo{ID:"rerun-xfs-f8958bb94-j6n89.default", IstioVersion:"1.18.0"}
data plane version: version.ProxyInfo{ID:"test2-5cbc75859c-jh6bx.default", IstioVersion:"1.18.0"}
data plane version: version.ProxyInfo{ID:"minio-test-78b5d4597d-hkpvt.default", IstioVersion:"1.18.0"}
data plane version: version.ProxyInfo{ID:"sb-887f89d7d-7s8ts.default", IstioVersion:"1.18.0"}
data plane version: version.ProxyInfo{ID:"gid-deployment-5dc86db4c4-kdshs.default", IstioVersion:"1.18.0"}
2. Restart each pod by deleting it. In the output of the previous step, the pod name and namespace are listed in each entry as data plane version: version.ProxyInfo{ID:"<pod_name>.<namespace>", IstioVersion:"1.18.0"}.

kubectl delete pod <pod_name> -n <namespace>





Want to change a ConfigMap setting?
kubectl delete pod test



6. Continue to the next section to check for unused IP address blocks.







 Step 2: Releasing IP address blocks 

Next, check for and clean up entire blocks of IP addresses that are assigned to a worker node but are not used by that worker node.

Occasionally, when a worker node is assigned a second or third block of IP addresses, entire blocks of IP addresses that the worker node previously used might later be completely unused. Additionally, when you remove or replace a worker node, the cleanup of the IP address block by the Calico IPAM might fail due to the lack of a worker node for the calico-kube-controllers to temporarily run on, or due to problems with the CNI plug-in or containerd runtime when the worker node is removed or replaced.

Ensuring that IP blocks are free is especially important for all classic clusters that run Kubernetes version 1.19 or later and all VPC clusters. In these clusters, the strictAffinity Calico setting is set to true, which forces a worker node to use IP addresses that are from its assigned IP blocks only, as opposed to using IP addresses from blocks that are assigned to other worker nodes. Over time, the blocks that are assigned to nodes but that are unused can accumulate until no more IP address blocks can be assigned to worker nodes.



1. Follow the steps to [release individual IP addresses](https://cloud.ibm.com/docs/containers?topic=containers-ts-app-container-startindividual-ips).
2. Choose whether to lock the data store for the Calico IPAM records.



* If you lock the data store, existing pods continue to run, but any pods that are created remain in the ContainerCreating state and can't start until you unlock the data store. This data store lock ensures that pods can't be created after you check for unused blocks, but before you release the blocks.
* If you don't lock the data store, you must immediately verify that no new pods used IP addresses from a released block that you deleted.



calicoctl datastore migrate lock
3. List the Calico IPAM records.
5.2.3 IBM Cloud Kubernetes Service can optionally configure [Pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 5.2.4 IBM Cloud Kubernetes Service can optionally configure [Pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 5.2.5 IBM Cloud Kubernetes Service can optionally configure [Pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 5.2.6 IBM Cloud Kubernetes Service can optionally configure [Pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 5.2.7 IBM Cloud Kubernetes Service can optionally configure [Pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/).
If no pod is returned in your CLI output, you don't have a pod that uses the PVC.

oc get pods --all-namespaces -o=jsonpath='{range .items[]}{"n"}{.metadata.name}{":t"}{range .spec.volumes[]}{.persistentVolumeClaim.claimName}{" "}{end}{end}' | grep "<pvc_name>"

Example output

blockdepl-12345-prz7b: claim1-block-bronze
4. Remove the pod that uses the PVC. If the pod is part of a deployment, remove the deployment.

oc delete pod <pod_name>
5. Verify that the pod is removed.

oc get pods
6. Remove the PVC.

oc delete pvc <pvc_name>
7. Review the status of your PV. Use the name of the PV that you retrieved earlier as VOLUME. When you remove the PVC, the PV that is bound to the PVC is released. Depending on how you provisioned your storage, your PV goes into a Deleting state if the PV is deleted automatically, or into a Released state, if you must manually delete the PV. Note: For PVs that are automatically deleted, the status might briefly say Released before it is deleted. Rerun the command after a few minutes to see whether the PV is removed.

oc get pv <pv_name>
8. If your PV is not deleted, manually remove the PV.

oc delete pv <pv_name>
9. Verify that the PV is removed.

oc get pv
10. List the physical storage instance that your PV pointed to and note the id of the physical storage instance.

ibmcloud sl file volume-list --columns id --columns notes | grep <pv_name>

Example output for File Storage for Classic.

id notes
5.2.5 IBM Cloud Kubernetes Service can optionally configure [pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 5.2.6 IBM Cloud Kubernetes Service can optionally configure [pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 5.2.7 IBM Cloud Kubernetes Service can optionally configure [pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 5.2.8 IBM Cloud Kubernetes Service can optionally configure [pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 5.2.9 IBM Cloud Kubernetes Service can optionally configure [pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/).
5.2.5 IBM Cloud Kubernetes Service can optionally configure [Pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 5.2.6 IBM Cloud Kubernetes Service can optionally configure [Pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 5.2.7 IBM Cloud Kubernetes Service can optionally configure [Pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 5.2.8 IBM Cloud Kubernetes Service can optionally configure [Pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 5.2.9 IBM Cloud Kubernetes Service can optionally configure [Pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/).