vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Release notes for Security and Compliance Center 



 12 July 2023 

IBM Cloud Kubernetes Service Benchmark profile version 1.0.0
: Version 1.0.0 of the IBM Cloud Kubernetes Service Benchmark profile is now available. This profile introduces the new assessment format wp-rule. For more information, see the [Change log](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-iks-profile). To view results by using this profile, you must have a connected instance of Workload Protection. For help getting started, see [Connecting Workload Protection](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-setup-workload-protection).

New rule operators
: You can now use the operators strings allowed, strings_required, string_contains, and string_not_contains to create custom rules. For more information about the new operators or help getting started with custom rules, see [Defining custom rules](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-rules-define).





 8 July 2023 

Security and Compliance Center is now an instance-based, regional offering
: You now have full control over the region that is used when Security and Compliance Center processes your data. To process data in different regions, you can create multiple instances of the service in a single account. As part of this architecture change, any Identity and Access Management (IAM) access policies or context-based restrictions that are scoped to “All Account Management Services” will no longer apply to Security and Compliance Center. Users who have access to “All Identity and Access Enabled Services” will now have access to Security and Compliance Center. Additionally, if you are working with private catalogs, Security and Compliance Center must be added to the private catalog as an approved service in order for members of your organization to create an instance.

If users have a quota on the number of resources for their account that has already been met, instances of the service will not be able to be created.





 1 July 2023 

Support removed for the collector-based architecture
: Updated the [ALB ingress-auth image to build 345](https://cloud.ibm.com/docs/containers?topic=containers-cluster-add-ons-changelogkube_ingress_changelog).





 5 November 2019 

New! Adding classic infrastructure servers to gateway-enabled classic clusters (Beta)
: If you have non-containerized workloads on a classic IBM Cloud infrastructure virtual server or bare metal server, you can connect those workloads to the workloads in your gateway-enabled classic cluster by adding the server instance to your cluster network.





 4 November 2019 

New! Kubernetes version 1.16
: You can now create clusters that run Kubernetes version 1.16. To update an existing cluster, see the [Version 1.16 preparation actions](https://cloud.ibm.com/docs/containers?topic=containers-cs_versionsk8s_version_archive).

Deprecated: Kubernetes version 1.13
: With the release of version 1.16, clusters that run version 1.13 are deprecated. Consider [updating to 1.14](https://cloud.ibm.com/docs/containers?topic=containers-cs_versionsk8s_version_archive) today.

Unsupported: Kubernetes version 1.12
: With the release of version 1.16, clusters that run version 1.12 are unsupported. To continue receiving important security updates and support, you must [update the cluster to a supported version](https://cloud.ibm.com/docs/containers?topic=containers-cs_versionsprep-up) immediately.





 1 November 2019 

New! Keep your own key (KYOK) support (beta)
: You can now [enable several key management service (KMS) providers](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkms), so that you can use your own root key to encrypt the secrets in your cluster.







 October 2019 



 28 October 2019 

Version change logs
: Upgraded to [Tekton Pipelines v0.14.1](https://github.com/tektoncd/pipeline/releases/tag/v0.14.1).





 30 April 2020 

Delivery Pipeline
: Upgraded to [Tekton Pipelines v0.11.2](https://github.com/tektoncd/pipeline/releases/tag/v0.11.2).





 28 February 2020 

Delivery Pipeline
: Upgraded to [Tekton Pipelines v0.10.1](https://github.com/tektoncd/pipeline/releases/tag/v0.10.1).





 31 October 2019 

Delivery Pipeline
: Upgraded to [Tekton Pipelines v0.7.0](https://github.com/tektoncd/pipeline/releases/tag/v0.7.0).





 30 October 2019 

Git Repos and Issue Tracking
: Upgraded to [GitLab 12.2.7](https://about.gitlab.com/releases/2019/10/02/security-release-gitlab-12-dot-3-dot-3-released/).





 10 October 2019 

Delivery Pipeline now has Tekton option.
: Tekton Pipelines is an open source project that you can use to configure and run continuous integration/continuous delivery (CI/CD) pipelines within a Kubernetes cluster. Pipelines are defined as Tekton resources in YAML, typically stored in a Git repository.
: Read the [announcement](https://www.ibm.com/cloud/blog/announcements/build-and-deliver-using-tekton-enabled-pipelines).





 2 October 2019 

New DevOps tab in your IBM Cloud Kubernetes Service cluster details.
: Find all toolchains whose delivery pipelines deployed to that cluster
: Easily create a new DevOps toolchain
IBM Cloud Controller Manager v1.26.1-16 v1.26.3-1 Updated to support the Kubernetes 1.26.3 release. 
 IBM Cloud File Storage for Classic plug-in and monitor 427 429 Updated universal base image (UBI) to resolve CVEs. Updated Go to version 1.19.6 and updated dependencies. 
 Key Management Service provider v2.6.3 v2.6.4 Updated Go to version 1.19.7 and updated dependencies. 
 Kubernetes v1.26.1 v1.26.3 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.26.3). 
 Kubernetes Dashboard metrics scraper v1.0.8 v1.0.9 See the [Kubernetes Dashboard metrics scraper release notes](https://github.com/kubernetes-sigs/dashboard-metrics-scraper/releases/tag/v1.0.9). 
 Load balancer and load balancer monitor for IBM Cloud Provider 2383 2420 Updated the image to resolve CVEs. 







 Change log for worker node fix pack 1.26.3_1529, released 27 March 2023 

The following table shows the changes that are in the worker node fix pack 1.26.3_1529. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.26.1_1525

 Component Previous Current Description
helm upgrade --set scanInterval=2m --set workerpools[0].default.max=5,workerpools[0].autoscale.min=3,workerpools[0].default.enabled=true ibm-iks-cluster-autoscaler iks-charts/ibm-iks-cluster-autoscaler -i --recreate-pods --namespace kube-system

To reset the Helm chart to the default values:

helm upgrade --reset-values ibm-iks-cluster-autoscaler iks-charts/ibm-iks-cluster-autoscaler --recreate-pods
2. Verify your changes. Review the Helm chart values again.

helm get values ibm-iks-cluster-autoscaler -a
3. Verify that the installation is successful. Check that the cluster autoscaler pod is in a Running state.

kubectl get pods --namespace=kube-system | grep ibm-iks-cluster-autoscaler

Example output

ibm-iks-cluster-autoscaler-8497bfc968-dbn7w 1/1 Running 0 9m
4. Check that the cluster autoscaler service is created.

kubectl get service --namespace=kube-system | grep ibm-iks-cluster-autoscaler

Example output

ibm-iks-cluster-autoscaler ClusterIP 172.21.xxx.xx <none> 8085/TCP 9m
5. Verify that the config map is correct by checking that the workerPoolsConfig.json field is updated and that the workerPoolsConfigStatus field shows a SUCCESS message.

kubectl get cm iks-ca-configmap -n kube-system -o yaml

Example output where the autoscale worker pool is enabled for autoscaling:

apiVersion: v1
data:
workerPoolsConfig.json:
Kubernetes Metrics Server v0.3.3 v0.3.4 See the [Kubernetes Metrics Server release notes)](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.3.4). 
 Load balancer and load balancer monitor for IBM Cloud Provider 148 153 Fixed issues with version 2.0 network load balancers (NLBs) that might cause all network traffic to drop or to be sent only to pods on one worker node. 
 OpenVPN server 2.4.6-r3-IKS-115 2.4.6-r3-IKS-121 Updated images for [CVE-2019-1547)](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1547) and [CVE-2019-1563)](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1563). 
 containerd v1.2.9 v1.2.10 See the [containerd release notes)](https://github.com/containerd/containerd/releases/tag/v1.2.10). Update resolves [CVE-2019-16884)](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16884) and [CVE-2019-16276)](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16276). 
 Kubernetes v1.15.3 v1.15.4 See the [Kubernetes release notes)](https://github.com/kubernetes/kubernetes/releases/tag/v1.15.4).
For more information about Kubernetes project version 1.23, see the [Kubernetes change log](https://kubernetes.io/releases/notes/.)



 Release timeline 

The following table includes the expected release timeline for version 1.23 of IBM Cloud® Kubernetes Service. You can use this information for planning purposes, such as to estimate the general time that the version might become unsupported.

Dates that are marked with a dagger (†) are tentative and subject to change.



Release timeline for IBM Cloud Kubernetes Service version 1.23

 Version Supported? IBM Cloud Kubernetes Service <br>release date IBM Cloud Kubernetes Service <br>unsupported date 

 1.23 Yes 09 Feb 2022 08 May 2023 † 







 Preparing to update 

This information summarizes updates that are likely to have and impact on deployed apps when you update a cluster to version 1.23. For a complete list of changes, review the [community Kubernetes change log](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.23.md) and [IBM version change log](https://cloud.ibm.com/docs/containers?topic=containers-changelog_123) for version 1.23. You can also review the [Kubernetes helpful warnings](https://kubernetes.io/blog/2020/09/03/warnings/).

Kubernetes version 1.23 becomes unsupported on 08 May 2023. Update your cluster to at least [version 1.24](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_124) as soon as possible.



 Update before master 

The following table shows the actions that you must take before you update the Kubernetes master.



Changes to make after you update the master to Kubernetes 1.23

 Type Description 

 Unsupported: CoreDNS wildcard queries via Kubernetes plugin CoreDNS no longer supports wildcard DNS queries via the Kubernetes plugin.
Check with your container image vendor to verify that your container images can run on an Ubuntu kernel.

Continuous monitoring by Site Reliability Engineers (SREs)
: The image that is installed on your worker nodes is continuously monitored by IBM Site Reliability Engineers (SREs) to detect vulnerabilities and security compliance issues. To address vulnerabilities, SREs create security patches and fix packs for your worker nodes. Make sure to apply these patches when they are available to ensure a secure environment for your worker nodes and the apps that you run on them.

CIS Kubernetes worker node benchmark
: To configure IBM Cloud Kubernetes Service, IBM engineers follow relevant cybersecurity practices from the Kubernetes worker node benchmark that is published by the [Center of Internet Security (CIS)](https://www.cisecurity.org/benchmark/kubernetes/). You can review the compliance of worker nodes against [CIS Kubernetes benchmark](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmarkcis-worker-test) standards.

Compute isolation
: Worker nodes are dedicated to a cluster and don't host workloads of other clusters. When you create a standard classic cluster, you can choose to provision your worker nodes as [physical machines (bare metal) or as virtual machines](https://cloud.ibm.com/docs/containers?topic=containers-planning_worker_nodesplanning_worker_nodes) that run on shared or dedicated physical hardware. Worker nodes in a VPC cluster can be provisioned as virtual machines on shared infrastructure only.

Option to deploy bare metal on classic
: If you create a standard classic cluster, you can choose to provision your worker nodes on bare metal physical servers (instead of virtual server instances). With bare metal machines, you have additional control over the compute host, such as the memory or CPU. This setup eliminates the virtual machine hypervisor that allocates physical resources to virtual machines that run on the host. Instead, all a bare metal machine's resources are dedicated exclusively to the worker, so you don't need to worry about "noisy neighbors" sharing resources or slowing down performance.
The CLI versions match if you can see the same version in GitVersion for the client and the server. You can ignore the +IKS part of the version for the server.
2. If the kubectl CLI versions on your local machine and your cluster don't match, either update your cluster or [install a different CLI version on your local machine](https://cloud.ibm.com/docs/containers?topic=containers-cli-install).







 Checking and updating the Block Storage for Classic driver 



1. For Block Storage for VPC, [verify that you have the latest version of the Block Storage for VPC add-on](https://cloud.ibm.com/docs/containers?topic=containers-vpc-blockvpc-addon-update).
2. For Block Storage for Classic on classic clusters, make sure that you installed the latest Helm chart version for the plug-in.



1. Update your Helm chart repositories.

helm repo update
2. List the Helm charts in the repository.

helm search repo iks-charts | grep block-storage-plugin

Example output

iks-charts-stage/ibmcloud-block-storage-plugin 1.5.0 A Helm chart for installing ibmcloud block storage plugin
iks-charts/ibmcloud-block-storage-plugin 1.5.0 A Helm chart for installing ibmcloud block storage plugin
3. List the installed Helm charts in your cluster and compare the version that you installed with the version that is available.

helm list --all-namespaces
4. If a more recent version is available, install this version. For instructions, see [Updating the IBM Cloud Block Storage plug-in](https://cloud.ibm.com/docs/containers?topic=containers-block_storageupdate_block).
Key Management Service provider 166 167 Fixes intermittent context deadline exceeded and timeout errors for managing Kubernetes secrets. In addition, fixes updates to the key management service that might leave existing Kubernetes secrets unencrypted. Update includes fix for [CVE-2019-9741](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9741). 
 Load balancer and load balancer monitor for IBM Cloud Provider 143 146 Updated image for [CVE-2019-9741](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9741). 







 Change log for 1.11.8_1550, released 20 March 2019 

The following table shows the changes that are in the patch 1.11.8_1550.



Changes since version 1.11.8_1547

 Component Previous Current Description 

 Cluster master HA proxy configuration N/A N/A Updated configuration to better handle intermittent connection failures to the cluster master. 
 GPU device plug-in and installer e32d51c 9ff3fda Updated the GPU drivers to [418.43](https://www.nvidia.com/object/unix.html). Update includes fix for [CVE-2019-9741](https://ubuntu.com/security/CVE-2019-9741.html). 
 IBM Cloud File Storage for Classic plug-in 344 345 Added support for [private cloud service endpoints](https://cloud.ibm.com/docs/containers?topic=containers-cs_network_clusterset-up-private-se). 
 Kernel 4.4.0-141 4.4.0-143 Updated worker node images with kernel update for [CVE-2019-6133](https://ubuntu.com/security/CVE-2019-6133.html).
[Kubernetes](https://kubernetes.io/) is a container orchestrator to manage the lifecycle of containerized apps in a cluster of worker nodes. Your apps might need many other resources to run, such as volumes, networks, and secrets which will help you connect to other cloud services, and secure keys. Kubernetes helps you to add these resources to your app. The key paradigm of Kubernetes is its declarative model. The user provides the desired state and Kubernetes attempts to conform to, and then maintains the described state.

This [self-paced workshop](https://ibm.github.io/kube101/) can help you to get your first hands-on experience with Kubernetes. Additionally, check out the Kubernetes [concepts](https://kubernetes.io/docs/concepts/) documentation page to learn more about the concepts of Kubernetes.







 What IBM's doing for you 

By using Kubernetes clusters with IBM Cloud Kubernetes Service, you get the following benefits:



* Multiple data centers where you can deploy your clusters.
* Support for ingress and load balancer networking options.
* Dynamic persistent volume support.
* Highly available, IBM-managed Kubernetes masters.









 Sizing clusters 

As you design your cluster architecture, you want to balance costs against availability, reliability, complexity, and recovery. Kubernetes clusters in IBM Cloud Kubernetes Service provide architectural options based on the needs of your apps. With a bit of planning, you can get the most out of your cloud resources without over-architecting or over-spending. Even if you over or underestimate, you can easily scale up or down your cluster, by changing either the number or size of worker nodes.

To run a production app in the cloud by using Kubernetes, consider the following items:



1. Do you expect traffic from a specific geographic location? If yes, select the location that is physically closest to you for best performance.
2. How many replicas of your cluster do you want for higher availability?
IBM Cloud Provider v1.10.5-118 v1.10.7-146 Updated to support Kubernetes 1.10.7 release. In addition, changed the cloud provider configuration to better handle updates for load balancer services with externalTrafficPolicy set to local. 
 IBM Cloud File Storage for Classic plug-in 334 338 Updated incubator version to 1.8. File storage is provisioned to the specific zone that you select. You can't update an existing (static) PV instance's labels, unless you are using a multizone cluster and need to add the region and zone labels. <br>Removed the default NFS version from the mount options in the IBM-provided file storage classes. The host's operating system now negotiates the NFS version with the IBM Cloud infrastructure NFS server. To manually set a specific NFS version, or to change the NFS version of your PV that was negotiated by the host's operating system, see [Changing the default NFS version](https://cloud.ibm.com/docs/containers?topic=containers-file_storagenfs_version_class). 
 Kubernetes v1.10.5 v1.10.7 See the Kubernetes [release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.10.7). 
 Kubernetes Heapster configuration N/A N/A Increased resource limits for the heapster-nanny container. 







 Change log for worker node fix pack 1.10.5_1519, released 23 August 2018 

The following table shows the changes that are in the worker node fix pack 1.10.5_1519.



Table 1. Changes since version 1.10.5_1518

 Component Previous Current Description 

 systemd 229 230 Updated systemd to fix cgroup leak. 
 Kernel 4.4.0-127 4.4.0-133 Updated worker node images with kernel update for [CVE-2018-3620,CVE-2018-3646](https://ubuntu.com/security/notices/USN-3741-1).
IBM Cloud File Storage for Classic plug-in and monitor Master 357 358 Image updated for [CVE-2019-5188](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5188). 
 IBM Cloud Provider Master v1.15.8-230 v1.15.10-252 Updated to support the Kubernetes 1.15.10 release. 
 Kubernetes Both v1.15.8 v1.15.10 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.15.10). The master update resolves CVE-2019-11254 and CVE-2020-8552 (see the [IBM security bulletin](https://www.ibm.com/support/pages/node/6203780)), and the worker node update resolves CVE-2020-8551 (see the [IBM security bulletin](https://www.ibm.com/support/pages/node/6204874)). 
 OpenVPN server Master N/A N/A OpenVPN server is now restarted during [cluster master refresh](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_apiserver_refresh).
* kubernetes.workload.name
* kubernetes.workload.type



New Kubernetes dashboards
: A number of new Kubernetes dashboards are available in beta.





 29 April 2021 

Secure updates to scan results page
: The layout of the scan results page has been reorganize to clearly distinguish policy evaluation from vulnerability matching and better summarize the information.





 26 April 2021 

Extended label set
: An extended label set is available for PromQL queries.

Microsoft Teams integration
: You can use Microsoft Teams as a notification channel.

Capture files
: S3 compatible storage can be used for capture files.

Webhook channel integration
: The following updates have been made to webhook integration:



* TLS verification can be skipped.
* The ability to add custom headers to append to the alert format.



Secure support for Inline Scanner
: V2.4.0 is supported with the following changes:



* Security fixes.
* Addition of HTTP_PROXY and HTTPS_PROXY environment variables to retrieve the malware database inline behind a proxy.
* Addition of support for the .dockercfg repository authorization method.
* Use of HTTP1.1 by default.
* Fix for when a Docker UID is not 1000.







 31 March 2021 

CLI support
: New CLI added that you can use to access information in IBM Cloud Monitoring. [Learn more about the CLI](https://cloud.ibm.com/docs/monitoring?topic=sysdig-monitor-cli-plugin-sysdig-monitor-cli).

API support
: New API added that can be used to manage the IBM Cloud Monitoring service. [Learn more about the API](https://cloud.ibm.com/apidocs/monitor).





 24 March 2021 

Secure beta support for image scanning reports
: V3 of the image scanning reports is available in beta. Functional changes include:



* Allowing scheduling of reports and sending them through notification channels.
* Allowing a preview of the report structure in the UI.
* Adding an advanced query builder.
Load balancer and load balancer monitor for IBM Cloud Provider 143 146 Updated image for [CVE-2019-9741](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9741). 







 Change log for 1.13.4_1513, released 20 March 2019 

The following table shows the changes that are in the patch 1.13.4_1513.



Table 1. Changes since version 1.13.4_1510

 Component Previous Current Description 

 Cluster DNS configuration N/A N/A Fixed a bug that might cause cluster master operations, such as refresh or update, to fail when the unused cluster DNS must be scaled down. 
 Cluster master HA proxy configuration N/A N/A Updated configuration to better handle intermittent connection failures to the cluster master. 
 CoreDNS configuration N/A N/A Updated the CoreDNS configuration to support [multiple Corefiles](https://coredns.io/2017/07/23/corefile-explained/) after updating the cluster Kubernetes version from 1.12. 
 containerd 1.2.4 1.2.5 See the [containerd release notes](https://github.com/containerd/containerd/releases/tag/v1.2.5). Update includes improved fix for [CVE-2019-5736](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5736). For more information, see the [IBM security bulletin](https://www.ibm.com/support/pages/node/871600). 
 GPU device plug-in and installer e32d51c 9ff3fda Updated the GPU drivers to [418.43](https://www.nvidia.com/object/unix.html). Update includes fix for [CVE-2019-9741](https://ubuntu.com/security/CVE-2019-9741.html).