vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Monitoring a Kubernetes cluster 

Use this tutorial to learn how to configure an IBM Cloud® Kubernetes Service cluster to forward metrics to the IBM Cloud® Monitoring service. You can monitor clusters in IBM Cloud, on-prem, and in other clouds.

To configure a cluster to forward metrics, you must install a monitoring agent onto each worker node in your Kubernetes cluster by using a [DaemonSet](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/). The monitoring agent uses an access key (token) to authenticate with the IBM Cloud Monitoring instance. The monitoring agent acts as a data collector. It automatically collects metrics such as worker node CPU and worker node memory usage, HTTP traffic into and out of your containers, and data about several infrastructure components. In addition, the agent can collect custom application metrics by using either a Prometheus-compatible scraper or a StatsD facade.

Zoom

![Components overview on the IBM Cloud](https://cloud.ibm.com/docs-content/v1/content/220cdcbf6f4421bd7fee83fd1028048dba3f16c8/monitoring/infrastructure/images/kube.png)

Figure 1. Components overview on the IBM Cloud

For example, to configure your Kubernetes cluster to forward metrics to your IBM Cloud Monitoring instance, you can deploy the agent by using Helm or a script:



* [Helm](https://cloud.ibm.com/docs/monitoring?topic=monitoring-agent-deploy-kube-helm)
* [Script](https://cloud.ibm.com/docs/monitoring?topic=monitoring-agent_Kube)



The Monitoring agent automatically collects the following types of system metrics per host:



* System hosts metrics provide information about CPU, memory, and storage usage metrics, that you can use to analyze the performance and resource utilization of all your processes.
* File and File System metrics provide information about files and file system that you can use to analyze file interactions that occur in your system.
* Fail: The service does not comply with the benchmark recommendation by default. Refer to the remediation section for an explanation and possible actions that you can take to comply with the benchmark recommendation.



* Responsibility



* IBM: IBM is responsible for configuring the setting that the benchmark recommends.
* Shared: You and IBM share responsibility for configuring the setting that the benchmark recommends.









 What parts of the benchmark am I responsible for? 

Because Red Hat OpenShift on IBM Cloud is a managed offering, IBM already configures many security settings for you. For example, IBM manages and automatically applies updates to your cluster master. For your worker nodes, IBM provides security and version updates, but you must apply the updates. You are also responsible for your workload applications and data. For more information, see [Your responsibilities while using Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-responsibilities_iks).





 What if some part of the service fails to comply with a recommendation? 

First, check the explanation of the failure for any remediation steps.

Then, determine whether the failure is acceptable according to your security requirements. For example, some recommendations might be more in-depth configuration requirements than your particular processes or standards require. Also, some recommendations are not scored, and don't impact the overall benchmark score.

Next, decide whether the component falls within your responsibility. If so, you might need to change how you configure that component. For example, you might configure security context constraints for all your app deployments. For components that are not directly within your responsibility, assess whether you can use another IBM Cloud service to meet the recommendation.





 What else can I do to increase the security and compliance of my cluster? 

See [Security for Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-security).







 Running the worker node CIS Kubernetes benchmark 

To review the results of the CIS Kubernetes benchmark for Section 4: Worker node security configuration, you can run the test yourself.
The open source project, Kubernetes, combines running a containerized infrastructure with production workloads, open source contributions, and Docker container management tools. The Kubernetes infrastructure provides an isolated and secure app platform for managing containers that is portable, extensible, and self-healing in case of a failover. For more information, see [What is Kubernetes?](https://www.ibm.com/topics/kubernetes).

Learn more about the key concepts of Kubernetes as illustrated in the following image.

Zoom

![Example deployment and namespaces](https://cloud.ibm.com/docs-content/v1/content/bce0f0917a9eea684d1b4b704ac6343a1f65f446/openshift/images/k8-namespace.svg)

Figure 2. A description of key concepts for Kubernetes

Account
: Your account refers to your IBM Cloud account.

Cluster, worker pool, and worker node
: A Kubernetes cluster consists of a master and one or more compute hosts that are called worker nodes. Worker nodes are organized into worker pools of the same flavor, or profile of CPU, memory, operating system, attached disks, and other properties. The worker nodes correspond to the Kubernetes Node resource, and are managed by a Kubernetes master that centrally controls and monitors all Kubernetes resources in the cluster. So when you deploy the resources for a containerized app, the Kubernetes master decides which worker node to deploy those resources on, accounting for the deployment requirements and available capacity in the cluster. Kubernetes resources include services, deployments, and pods. For more information, see [Service architecture](https://cloud.ibm.com/docs/containers?topic=containers-service-arch).

Namespace
: Kubernetes namespaces are a way to divide your cluster resources into separate areas that you can deploy apps and restrict access to, such as if you want to share the cluster with multiple teams.
You can install Portworx with a Helm chart and provision storage for your apps by using Kubernetes persistent volumes. For more information about how to set up Portworx in your cluster, see [Setting up software-defined storage (SDS) with Portworx](https://cloud.ibm.com/docs/containers?topic=containers-storage_portworx_about). Yes Yes 







 Database services 



Table 7. Database services

 Service Description Classic VPC 

 IBM Blockchain Platform v2 Deploy and manage your own IBM Blockchain Platform on IBM Cloud Kubernetes Service. With IBM Blockchain Platform v2, you can host IBM Blockchain networks or create organizations that can join other IBM Blockchain v2 networks. For more information about how to set up IBM Blockchain in IBM Cloud Kubernetes Service, see [About IBM Blockchain Platform](https://cloud.ibm.com/docs/blockchain?topic=blockchain-get-started-ibp). Yes 
 Cloud databases You can choose between various IBM Cloud database services, such as IBM® Compose for MongoDB for IBM Cloud® or IBM® Cloudant® for IBM Cloud® to deploy highly available and scalable database solutions in your cluster. For a list of available cloud databases, see the [IBM Cloud catalog](https://cloud.ibm.com/catalog?category=databases). Yes Yes
If you include this option, you must also include the --kms-instance option. Before you can use KMS encryption, you must create a KMS instance and set up the required service authorization in IAM. See [Managing encryption](https://cloud.ibm.com/docs/containers?topic=containers-encryptionworker-encryption) for the worker nodes in your cluster.

--secondary-storage STORAGE
: Optional. The storage option for the flavor. For example, 900gb.5iops-tier. When you add a secondary disk, that disk is used for the container runtime, while the primary disk is used for the operating system. To view the storage options for a flavor, run the ibmcloud ks flavor get --flavor FLAVOR --zone ZONE --provider vpc-gen2 command. To view a list of VPC worker node flavors, see [VPC flavors](https://cloud.ibm.com/docs/containers?topic=containers-vpc-flavors&interface=ui)
5. Verify that the creation of the cluster was requested. It can take a few minutes for the worker node machines to be ordered, and for the cluster to be set up and provisioned in your account.

ibmcloud ks cluster ls

When the provisioning of your Kubernetes master is completed, the state of your cluster changes to normal. After the Kubernetes master is ready, your worker nodes are set up.

NAME ID State Created Workers Zone Version Resource Group Name Provider
mycluster aaf97a8843a29941b49a598f516da72101 normal 20170201162433 3 Dallas 1.26.6_1526 Default vpc-gen2

Is your cluster not in a normal state? Check out the [Debugging clusters](https://cloud.ibm.com/docs/containers?topic=containers-debug_clusters) guide for help.
Kubernetes 

The IBM Blockchain Platform allows you to provision blockchain components into your Kubernetes cluster. Kubernetes is an open-source system for automating deployment, scaling, and management of containerized applications.

Kubernetes provides a container-centric management environment. It orchestrates computing, networking, and storage infrastructure on behalf of user workloads. This provides much of the simplicity of Platform as a Service (PaaS) with the flexibility of Infrastructure as a Service (IaaS), and enables portability across infrastructure providers.

The following diagram explains the architecture of Kubernetes. For more explanation about nodes, containers, and pod, see the [Key Kubernetes objects](https://cloud.ibm.com/docs/blockchain/reference?topic=blockchain-k8s-overviewk8s-overview-key-obj) section below.

Zoom

![Kubernetes architecture diagram](https://cloud.ibm.com/docs-content/v1/content/c5288bed34c3820e3a5251d820ee91adcd2591a3/blockchain/images/k8s-archi-diagram.svg)

Figure 1. Kubernetes architecture diagram



 Key Kubernetes objects 



* Cluster

A set of machines, called nodes, that run containerized applications managed by Kubernetes. A cluster has several worker nodes and at least one master node.
* Node

A node is a worker machine in Kubernetes. A node may be a VM or physical machine, depending on the cluster. Each node contains the services necessary to run pods and is managed by the master components. The services on a node include the container runtime, kubelet and kube-proxy. For more information, see the [Kubernetes Node section](https://kubernetes.io/docs/concepts/architecture/nodes/) in the Kubernetes documentation.
* Container

A lightweight and portable executable image that contains software and all of its dependencies.
Kubernetes 

The IBM Blockchain Platform allows you to provision blockchain components into your Kubernetes cluster. Kubernetes is an open-source system for automating deployment, scaling, and management of containerized applications.

Kubernetes provides a container-centric management environment. It orchestrates computing, networking, and storage infrastructure on behalf of user workloads. This provides much of the simplicity of Platform as a Service (PaaS) with the flexibility of Infrastructure as a Service (IaaS), and enables portability across infrastructure providers.

The following diagram explains the architecture of Kubernetes. For more explanation about nodes, containers, and pod, see the [Key Kubernetes objects](https://cloud.ibm.com/docs/blockchain?topic=blockchain-k8s-overviewk8s-overview-key-obj) section below.

Zoom

![Kubernetes architecture diagram](https://cloud.ibm.com/docs-content/v1/content/c5288bed34c3820e3a5251d820ee91adcd2591a3/blockchain/images/k8s-archi-diagram.svg)

Figure 1. Kubernetes architecture diagram



 Key Kubernetes objects 



* Cluster

A set of machines, called nodes, that run containerized applications managed by Kubernetes. A cluster has several worker nodes and at least one master node.
* Node

A node is a worker machine in Kubernetes. A node may be a VM or physical machine, depending on the cluster. Each node contains the services necessary to run pods and is managed by the master components. The services on a node include the container runtime, kubelet and kube-proxy. For more information, see the [Kubernetes Node section](https://kubernetes.io/docs/concepts/architecture/nodes/) in the Kubernetes documentation.
* Container

A lightweight and portable executable image that contains software and all of its dependencies.
The open source project, Kubernetes, combines running a containerized infrastructure with production workloads, open source contributions, and Docker container management tools. The Kubernetes infrastructure provides an isolated and secure app platform for managing containers that is portable, extensible, and self-healing in case of a failover. For more information, see [What is Kubernetes?](https://www.ibm.com/topics/kubernetes).

Learn more about the key concepts of Kubernetes as illustrated in the following image.

Zoom

![Example deployment and namespaces](https://cloud.ibm.com/docs-content/v1/content/4d497aff9e27b92fbbc2ee4e343a9ec4549cb1d7/containers/images/k8-namespace.svg)

Figure 2. A description of key concepts for Kubernetes

Account
: Your account refers to your IBM Cloud account.

Cluster, worker pool, and worker node
: A Kubernetes cluster consists of a master and one or more compute hosts that are called worker nodes. Worker nodes are organized into worker pools of the same flavor, or profile of CPU, memory, operating system, attached disks, and other properties. The worker nodes correspond to the Kubernetes Node resource, and are managed by a Kubernetes master that centrally controls and monitors all Kubernetes resources in the cluster. So when you deploy the resources for a containerized app, the Kubernetes master decides which worker node to deploy those resources on, accounting for the deployment requirements and available capacity in the cluster. Kubernetes resources include services, deployments, and pods. For more information, see [Service architecture](https://cloud.ibm.com/docs/containers?topic=containers-service-arch).

Namespace
: Kubernetes namespaces are a way to divide your cluster resources into separate areas that you can deploy apps and restrict access to, such as if you want to share the cluster with multiple teams.
: The Kubernetes network proxy is a daemon that runs on every worker node and that forwards or load balances TCP and UDP network traffic for services that run in the cluster.

kube-dashboard
: The Kubernetes dashboard is a web-based GUI that allows users to manage and troubleshoot the cluster and applications that run in the cluster.

heapster
: Heapster is a cluster-wide aggregator of monitoring and event data. The Heapster pod discovers all nodes in the cluster and queries usage information from each node's kubelet. You can find utilization graphs in the Kubernetes dashboard.

Ingress ALB
: Ingress is a Kubernetes service that you can use to balance network traffic workloads in your cluster by forwarding public or private requests to multiple apps in your cluster. To expose your apps over the public or private network, you must create an Ingress resource to register your apps with the Ingress application load balancer (ALB). Multiple apps can then be accessed by using a single URL or IP address.

Storage provider
: Every cluster is set up with a plug-in to provision file storage. You can choose to install other add-ons, such as block storage.





 ibm-system namespace 

Logging and metrics
: You can use the IBM® Log Analysis and IBM Cloud® Monitoring services to expand your collection and retention capabilities when working with logs and metrics. Load balancer
: A load balancer is a Kubernetes service that can be used to balance network traffic workloads in your cluster by forwarding public or private requests to an app.





 default namespace 

App pods and services
: In the default namespace or in namespaces that you create, you can deploy apps in pods and services to communicate with those pods.







 VPC cluster 

The following diagram and table describe the default components that are set up in an IBM Cloud Kubernetes Service VPC cluster architecture.

The following architectural overviews are specific to the VPC infrastructure provider.
The Kubernetes master configures the resources and deploys containers into pods on the worker nodes with available capacity.
: Define update strategies for your app, including the number of pods that you want to add during a rolling update and the number of pods that can be unavailable at a time. When you perform a rolling update, the deployment checks whether the update is working and stops the rollout when failures are detected.
: A deployment is just one type of workload controller that you can use to manage pods. For help choosing among your options, see [What type of Kubernetes objects can I make for my app?](https://cloud.ibm.com/docs/containers?topic=containers-plan_deployobject). For more information about deployments, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/).

Pod
: Every containerized app that is deployed into a cluster is deployed, run, and managed by a Kubernetes resource called a pod. Pods represent small deployable units in a Kubernetes cluster and are used to group the containers that must be treated as a single unit. Usually, each container is deployed in its own pod. However, an app might require a container and other helper containers to be deployed into one pod so that those containers can be addressed by using the same private IP address. For more information, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/pods/).

App
: An app might refer to a complete app or a component of an app. You might deploy components of an app in separate pods or separate worker nodes. For more information, see [Planning app deployments](https://cloud.ibm.com/docs/containers?topic=containers-plan_deploy) and [Developing Kubernetes-native apps](https://cloud.ibm.com/docs/containers?topic=containers-app).
: An app might refer to a complete app or a component of an app. You might deploy components of an app in separate pods or separate worker nodes. For more information, see [Planning app deployments](https://cloud.ibm.com/docs/containers?topic=containers-plan_deploy) and [Developing Kubernetes-native apps](https://cloud.ibm.com/docs/containers?topic=containers-app).

To dive deeper into Kubernetes, see the [Kubernetes documentation](https://kubernetes.io/docs/home/?path=users&persona=app-developer<=vel=foundational).





 What are containers? 

Containers provide a standard way to package your application's code, configurations, and dependencies into a single unit that can run as a resource-isolated process on a compute server. To run your app in Kubernetes on IBM Cloud Kubernetes Service, you must first containerize your app by creating a container image that you store in a container registry.





 What compute host infrastructure does the service offer? 

You can create clusters on Classic or IBM Cloud® Virtual Private Cloud infrastructure. You can also bring your own hosts by using Satellite.

For more information, see [Supported infrastructure providers](https://cloud.ibm.com/docs/containers?topic=containers-infrastructure_providers).





 Related resources 

Review how you can learn about Kubernetes concepts and the terminology.



* Learn how Kubernetes and IBM Cloud Kubernetes Service work together by completing this [course](https://cognitiveclass.ai/courses/kubernetes-course).
Each node contains the services necessary to run pods and is managed by the master components. The services on a node include the container runtime, kubelet and kube-proxy. For more information, see the [Kubernetes Node section](https://kubernetes.io/docs/concepts/architecture/nodes/) in the Kubernetes documentation.
* Container

A lightweight and portable executable image that contains software and all of its dependencies. Containers decouple applications from underlying host infrastructure to make deployment easier in different cloud or OS environments, and for easier scaling.
* Pod

The smallest and simplest Kubernetes object. A Pod represents a set of running containers on your cluster. A Pod is typically set up to run a single primary container. It can also run optional sidecar containers that add supplementary features like logging. Pods are commonly managed by a Deployment. For more information, see the [Kubernetes Pod section](https://kubernetes.io/docs/concepts/workloads/pods/pod/) in the Kubernetes documentation.







 IBM Cloud Kubernetes Service 

IBM Cloud Kubernetes Service delivers powerful tools by combining Docker containers, the Kubernetes technology, an intuitive user experience, and built-in security and isolation to automate the deployment, operation, scaling, and monitoring of containerized apps in a cluster of compute hosts. You can use the IBM Cloud Kubernetes Service to deploy clusters using open source Kubernetes and the OpenShift Container Platform.

For more information about IBM Cloud Kubernetes Service, see the following topics in IBM Cloud Kubernetes Service documentation:



* [Understanding the IBM Cloud Kubernetes Service](https://cloud.ibm.com/docs/containers?topic=containers-iks-overviewservice-concepts)
* [Why IBM Cloud Kubernetes Service](https://cloud.ibm.com/docs/containers?topic=containers-cs_ovcs_ov)
* [Defining your Kubernetes strategy](https://cloud.ibm.com/docs/containers?topic=containers-strategystrategy)
[Tekton](https://www.ibm.com/cloud/blog/tekton-a-modern-approach-to-continuous-delivery) is an open source, vendor-neutral, Kubernetes-native framework that you can use to build, test, and deploy apps. Tekton provides a set of shared components for building [continuous integration](https://www.ibm.com/garage/method/practices/code/practice_continuous_integration/) and [continuous delivery](https://www.ibm.com/garage/method/practices/deliver/practice_continuous_delivery/) systems. As an open source project, Tekton is managed by the [Continuous Delivery Foundation](https://cd.foundation/). The goal is to modernize continuous delivery by providing industry specifications for pipelines, workflows, and other building blocks. With Tekton, you can build, test, and deploy across cloud providers or on-premises systems by abstracting the underlying implementation details. Tekton pipelines are built into [Continuous Delivery](https://www.ibm.com/cloud/blog/announcements/build-and-deliver-using-tekton-enabled-pipelines). For more information about the IBM Cloud® Kubernetes Service, see [IBM Cloud® Kubernetes Service](https://www.ibm.com/garage/method/practices/run/tool_ibm_container).

The template that is used in this tutorial works with the Standard plan for Kubernetes.



 Before you begin 

Before you start this tutorial, make sure that you have the following resources in place:



* An [IBM Cloud account](https://cloud.ibm.com/registration). Depending on your IBM Cloud account type, access to certain resources might be limited. Depending on your account plan limits, certain capabilities that are required by some of the deployment strategies might not be available.