vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Kubernetes v1.18.14 v1.18.15 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.18.15). Updated to implement additional IBM security controls. 
 Kubernetes Dashboard v2.0.4 v2.0.5 See the [Kubernetes Dashboard release notes](https://github.com/kubernetes/dashboard/releases/tag/v2.0.5). 
 Kubernetes Dashboard metrics scraper v1.0.4 v1.0.6 See the [Kubernetes Dashboard metrics scraper release notes](https://github.com/kubernetes-sigs/dashboard-metrics-scraper/releases/tag/v1.0.6). 
 Load balancer and load balancer monitor for IBM Cloud Provider 1004 1078 Updated image for [CVE-2020-1971](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1971). 
 Operator Lifecycle Manager Catalog v1.6.1 v1.15.3 See the [Operator Lifecycle Manager Catalog release notes](https://github.com/operator-framework/operator-registry/releases/tag/v1.15.3). 







 Change log for worker node fix pack 1.18.15_1538, released 18 January 2021 

The following table shows the changes that are in the worker node fix pack 1.18.15_1538. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.18.13_1536

 Component Previous Current Description 

 Kubernetes v1.18.13 v1.18.15 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.18.15).
Kernel 4.4.0-133 4.4.0-137 Updated worker node images with kernel update for [CVE-2018-14633, CVE-2018-17182](https://changelogs.ubuntu.com/changelogs/pool/main/l/linux/linux_4.4.0-137.163/changelog). 
 Inactive session timeout N/A N/A Set the inactive session timeout to 5 minutes for compliance reasons. 







 Change log for 1.10.8_1524, released 2 October 2018 

The following table shows the changes that are in patch 1.10.8_1524.



Table 1. Changes since version 1.10.7_1520

 Component Previous Current Description 

 Key Management Service Provider N/A N/A Added the ability to use the Kubernetes [key management service (KMS) provider](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkeyprotect) in the cluster, to support IBM® Key Protect for IBM Cloud®. When you [enable Key Protect or a key management service (KMS) provider in your cluster](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkeyprotect), all your Kubernetes secrets are encrypted. 
 Kubernetes v1.10.7 v1.10.8 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.10.8). 
 Kubernetes DNS autoscaler 1.1.2-r2 1.2.0 See the [Kubernetes DNS autoscaler release notes](https://github.com/kubernetes-sigs/cluster-proportional-autoscaler/releases/tag/1.2.0). 
 IBM Cloud Provider v1.10.7-146 v1.10.8-172 Updated to support Kubernetes 1.10.8 release. Also, updated the documentation link in load balancer error messages.
For more information about supported versions and update actions that you must take to move from one version to another, see [Kubernetes version information](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions)





 Which worker node operating systems does the service support? 

For a list of supported worker node operated systems by cluster version, see [Kubernetes version information](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions).





 Where is the service available? 

IBM Cloud Kubernetes Service is available worldwide. You can create clusters in every supported IBM Cloud Kubernetes Service region.

For more information about supported regions, see [Locations](https://cloud.ibm.com/docs/containers?topic=containers-regions-and-zonesregions-and-zones).





 Is the service highly available? 

Yes. By default, IBM Cloud Kubernetes Service sets up many components such as the cluster master with replicas, anti-affinity, and other options to increase the high availability (HA) of the service. You can increase the redundancy and failure toleration of your cluster worker nodes, storage, networking, and workloads by configuring them in a highly available architecture. For an overview of the default setup and your options to increase HA, see [High availability for IBM Cloud Kubernetes Service](https://cloud.ibm.com/docs/containers?topic=containers-ha).

For the latest HA service level agreement terms, refer to the [IBM Cloud terms of service](https://cloud.ibm.com/docs/overview?topic=overview-slas). Generally, the SLA availability terms require that when you configure your infrastructure resources in an HA architecture, you must distribute them evenly across three different availability zones. For example, to receive full HA coverage under the SLA terms, you must [set up a multizone cluster](https://cloud.ibm.com/docs/containers?topic=containers-ha_clustersmz-clusters) with a total of at least 6 worker nodes, two worker nodes per zone that are evenly spread across three zones.
* [3 Control plane configuration](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-119cis-section-3-119)



* [3.1 Authentication and authorization](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-119cis-benchmark-31-119)
* [3.2 Logging](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-119cis-benchmark-32-119)



* [4 Worker node security configuration](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-119cis-section-4-119)



* [4.1 Worker node configuration files](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-119cis-benchmark-41-119)
* [4.2 Kubelet](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-119cis-benchmark-42-119)



* [5 Kubernetes policies](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-119cis-section-5-119)



* [5.1 RBAC and service accounts](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-119cis-benchmark-51-119)
* [5.2 Pod Security Policies](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-119cis-benchmark-52-119)
* [5.3 Network policies and CNI](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-119cis-benchmark-53-119)
* [5.4 Secrets management](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-119cis-benchmark-54-119)
Key Management Service provider v2.3.12 v2.3.13 Updated Go dependencies and golangci-lint 
 Konnectivity agent v0.0.26_282_iks v0.0.27_309_iks See the [Konnectivity release notes](https://github.com/kubernetes-sigs/apiserver-network-proxy/releases/tag/v0.0.27). Updated universal base image (UBI) to the 8.5-218 version to resolve CVEs. Updated to use Go version 1.17.5. 
 Konnectivity server v0.0.26_282_iks v0.0.27_309_iks See the [Konnectivity release notes](https://github.com/kubernetes-sigs/apiserver-network-proxy/releases/tag/v0.0.27). Updated universal base image (UBI) to the 8.5-218 version to resolve CVEs. Updated to use Go version 1.17.5. 
 Kubernetes 1.21.7 1.21.9 Changed the duration of the Kubernetes API server certificate from 825 days to 365 days. Changed the duration of the cluster CA certificate from 30 years to 10 years. Changed the duration of worker node certificates from 3 years to 2 years. See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.21.9). 
 Kubernetes configuration N/A N/A Updated the [feature gate configuration](https://cloud.ibm.com/docs/containers?topic=containers-service-settingsfeature-gates) 
 Kubernetes Metrics Server v0.4.4 v0.4.5 Metrics server now dynamically reloads NannyConfiguration updates. See the [Kubernetes Metrics Server release notes](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.4.5).
* Adds satellite as a supported provider to the output of the ibmcloud ks cluster ls command.
* General refactoring and improvements.







 Version 1.0.231 

Version 1.0.231 of the CLI was released on 25 February 2021.



* Updates the Go version to 1.15.8.
* Updates the help text in various languages.







 Version 1.0.223 

Version 1.0.223 of the CLI was released on 8 February 2021.



* Adds the [ibmcloud ks worker-pool label set](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_worker_pool_label_set) and [ibmcloud ks worker-pool label rm](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_worker_pool_label_rm) commands to set and remove custom Kubernetes labels for all worker nodes in a worker pool.







 Version 1.0.208 

Version 1.0.208 of the CLI was released on 18 December 2020.



* Updates the help text in various languages.







 Version 1.0.206 

Version 1.0.206 of the CLI was released on 10 December 2020.



* Adds the ibmcloud ks ingress lb get, ibmcloud ks ingress lb proxy-protocol disable, and ibmcloud ks ingress lb proxy-protocol disable[beta commands](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_ingress_lb_proxy-protocol_enable) to manage the configuration of load balancers that expose Ingress ALBs in your cluster. For example, you can enable the NGINX PROXY protocol so that client connection information is passed in request headers to ALBs.
* Adds the optional --endpoint option to the ibmcloud ks cluster config command to specify a type of endpoint for the cluster context, such as the cluster's private cloud service endpoint.
* Updates the help text in various languages.
* Updates the Go version to 1.15.6.
0:6400000 
 resourcesRequestsCPU The minimum amount of worker node CPU that the ibm-iks-cluster-autoscaler pod starts with. 200m 
 resourcesRequestsMemory The minimum amount of worker node memory that the ibm-iks-cluster-autoscaler pod starts with. 200Mi 
 retryAttempts The maximum number of attempts to retry after failing to connect to the service API. Use this parameter and the maxRetryGap parameter to adjust the retry window for the cluster autoscaler. 64 
 logLevel The log level for the autoscaler. Logging levels are info, debug, warning, error info 
 scaleDownDelayAfterAdd The amount of time after scale up that scale down evaluation resumes. The default value for scaleDownDelayAfterAdd is 10 minutes. 10m 
 scaleDownDelayAfterDelete The amount of time after node deletion that scale down evaluation resumes. The default value for scaleDownDelayAfterDelete is the same as the scan-interval which is 1m 1m 
 scaleDownDelayAfterFailure The amount of time in minutes that the autoscaler must wait after a failure. 3m 
 kubeClientBurst Allowed burst for the Kubernetes client. 300 
 kubeClientQPS The QPS value for Kubernetes client. How many queries are accepted once the burst has been exhausted. 5.0 
 maxEmptyBulkDelete The maximum number of empty nodes that can be deleted by the autoscaler at the same time. 10 
 maxGracefulTerminationSec The maximum number of seconds the autoscaler waits for pod to end when it scales down a node. 600 
 maxTotalUnreadyPercentage The maximum percentage of unready nodes in the cluster. After this value is exceeded, the autoscaler stops operations. 45 
 okTotalUnreadyCount Number of allowed unready nodes, irrespective of the maxTotalUnreadyPercentage value. 3
Kubernetes version information 

Review this page for general information about IBM Cloud® Kubernetes Service versions and updating to newer versions.

For more information about the Kubernetes project versions, see the [Kubernetes change logs](https://github.com/kubernetes/kubernetes/tree/master/CHANGELOG).



 Available IBM Cloud® Kubernetes Service versions 

IBM Cloud Kubernetes Service concurrently supports multiple versions of Kubernetes. When a latest version (n) is released, versions up to 2 behind (n-2) are supported. Versions more than 2 behind the latest (n-3) are first deprecated and then unsupported. To continue receiving important security patch updates, make sure that your clusters always run a supported Kubernetes version. Deprecated clusters might not receive security updates. For more information, see [Release lifecycle](https://cloud.ibm.com/docs/containers?topic=containers-cs_versionsrelease_lifecycle).

Review the supported versions of IBM Cloud Kubernetes Service. In the CLI, you can run ibmcloud ks versions.

Dates that are marked with a dagger (†) are tentative and subject to change.

Ubuntu 18 is deprecated and becomes unsupported soon. For migration actions, see [Migrating to a new Ubuntu version](https://cloud.ibm.com/docs/containers?topic=containers-ubuntu-migrate).

Latest: 1.27



* Release date: 24 May 2023
* End of support: 14 August 2024†
* Supported operating systems: UBUNTU_20_64, UBUNTU_18_S390X, UBUNTU_18_64
* [Version information and update actions](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_127)
* [Change log](https://cloud.ibm.com/docs/containers?topic=containers-changelog_127)



Default: 1.26



* Release date: 01 February 2023
Red Hat OpenShift on IBM Cloud version 4.9 compliance operator benchmark 



 1 Control plane components 



 1.1 Master node configuration files 

Master node configuration is not stored as a set of files, therefore rules in section 1.1 are out of the scope of automated check by the Compliance Operator.





 1.2 API server 



Section 1.2 API server benchmark results

 Section Recommendation Manual/Automated Level Result 

 1.2.1 Ensure that anonymous requests are authorized. Manual 1 Pass 
 1.2.2 Ensure that the --basic-auth-file option is not set. Automated 1 Pass 
 1.2.3 Ensure that the --token-auth-file parameter is not set. Automated 1 Pass 
 1.2.4 Use https for kubelet connections. Automated 1 [FAIL](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_49_coco-benchmark-49-remdiations) 
 1.2.5 Ensure that the kubelet uses certificates to authenticate. Automated 1 Pass 
 1.2.6 Verify that the kubelet certificate authority is set as appropriate. Automated 1 Pass 
 1.2.7 Ensure that the --authorization-mode option is not set to AlwaysAllow. Automated 1 Pass 
 1.2.8 Verify that the Node authorizer is enabled. Automated 1 Pass 
 1.2.9 Verify that RBAC is enabled. Automated 1 Pass 
 1.2.10 Ensure that the APIPriorityAndFairness feature gate is enabled. Manual 1 Pass 
 1.2.11 Ensure that the admission control plug-in AlwaysAdmit is not set. Automated 1 Pass 
 1.2.12 Ensure that the admission control plug-in AlwaysPullImages is not set. Manual 1 Pass 
 1.2.13 Ensure that the admission control plug-in SecurityContextDeny is not set. Manual 1 Pass 
 1.2.14 Ensure that the admission control plug-in ServiceAccount is set. Automated 1 Pass 
 1.2.15 Ensure that the admission control plug-in NamespaceLifecycle is set.
Max pods N/A N/A Increased the limit of maximum number of pods for worker nodes with more than 11 CPU cores to be 10 pods per core, up to a maximum of 250 pods per worker node. 







 Change log for 1.13.7_1526, released 17 June 2019 

The following table shows the changes that are in the patch 1.13.7_1526.



Table 1. Changes since version 1.13.6_1524

 Component Previous Current Description 

 GPU device plug-in and installer 32257d3 5d34347 Updated image for [CVE-2019-8457](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8457). Updated the GPU drivers to [430.14](https://www.nvidia.com/Download/driverResults.aspx/147582/). 
 IBM Cloud File Storage for Classic plug-in 346 347 Updated so that the IAM API key can be either encrypted or unencrypted. 
 IBM Cloud Provider v1.13.6-139 v1.13.7-162 Updated to support the Kubernetes 1.13.7 release. 
 Kubernetes v1.13.6 v1.13.7 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.13.7). 
 Public service endpoint for Kubernetes master N/A N/A Fixed an issue to [enable the public cloud service endpoint](https://cloud.ibm.com/docs/containers?topic=containers-cs_network_clusterset-up-public-se). 
 Ubuntu 16.04 kernel 4.4.0-148-generic 4.4.0-150-generic Updated worker node images with kernel and package updates for [CVE-2019-10906](https://ubuntu.com/security/CVE-2019-10906).
: Choose between [IBM Cloud Classic or VPC infrastructure providers](https://cloud.ibm.com/docs/containers?topic=containers-infrastructure_providers).
: Provision a dedicated and secured Kubernetes master, worker nodes, virtual networks, and storage by using the resources provided by IBM Cloud infrastructure.
: Fully managed Kubernetes master that is continuously monitored and updated by IBM to keep your cluster available.
: Option to provision worker nodes as bare metal servers for compute-intensive workloads such as data, GPU, and AI.
: Store persistent data, share data between Kubernetes pods, and restore data when needed with the integrated and secure volume service.
: Benefit from full support for all native Kubernetes APIs.

Multizone clusters to increase high availability
: Easily manage worker nodes of the same flavor (CPU, memory, virtual or physical) with worker pools.
: Guard against zone failure by spreading nodes evenly across select multizones and by using anti-affinity pod deployments for your apps.
: Decrease your costs by using multizone clusters instead of duplicating the resources in a separate cluster.
: Benefit from automatic load balancing across apps with the multizone load balancer (MZLB) that is set up automatically for you in each zone of the cluster.

Highly available masters
: Reduce cluster downtime such as during master updates with highly available masters that are provisioned automatically when you create a cluster.
: Spread your masters across zones in a [multizone cluster](https://cloud.ibm.com/docs/containers?topic=containers-ha_clustersmz-clusters) to protect your cluster from zonal failures.

Image security compliance with Vulnerability Advisor
: Set up your own repo in our secured Docker private image registry where images are stored and shared by all users in the organization.
: Benefit from automatic scanning of images in your private IBM Cloud registry.
: Review recommendations specific to the operating system used in the image to fix potential vulnerabilities.

Continuous monitoring of the cluster health
: Use the cluster dashboard to quickly see and manage the health of your cluster, worker nodes, and container deployments.
: Find detailed consumption metrics by using IBM Cloud® Monitoring and quickly expand your cluster to meet work loads.
In addition, the Kubernetes DNS autoscaler configuration was updated to include worker nodes that can't be scheduled in scaling calculations. 
 Kubernetes NodeLocal DNS cache 1.15.13 1.15.14 See the [Kubernetes NodeLocal DNS cache release notes](https://github.com/kubernetes/dns/releases/tag/1.15.14). 
 Load balancer and load balancer monitor for IBM Cloud Provider 223 234 Updated to use Go version 1.15.2. 
 Operator Lifecycle Manager Catalog v1.6.1 v1.14.0 See the [Operator Lifecycle Manager Catalog release notes](https://github.com/operator-framework/operator-registry/releases/tag/v1.14.0). 
 Operator Lifecycle Manager 0.14.1-IKS-1 0.16.1 See the [Operator Lifecycle Manager release notes](https://github.com/operator-framework/operator-lifecycle-manager/releases/tag/0.16.1).
Version 1.0.9 



 Change log for patch update 1.0.9_44, released 22 June 2023 



* Adds support for cluster version 1.27.
* Adds the scaleDownUnreadyEnabled, maxNodesPerScaleup, maxNodegroupBinpackingDuration, kubeClientBurst, and kubeClientQPS parameters.
* Updates the storage-secret-sidecar image to v1.2.24.
* Updates Golang to 1.19.10 for iks-cluster-autoscaler1.22-1.26 and Golang version 1.20.5 for iks-cluster-autoscaler 1.27.
* Image tags: 1.22.0 109-0, 1.23.0 109-0, 1.24.0 109-0, 1.25.0 109-0, 1.26.1 109-0, 1.27.2 109-0.









 Version 1.0.8 



 Change log for patch update 1.0.8_56, released 6 July 2023 



* Image tags: 1.20.0 108-3, 1.21.0 108-3, 1.22.0 108-3, 1.23.0 108-3, 1.24.0 108-3, 1.25.0 108-3, 1.26.0 108-3.
* Updates the storage-secret-sidecar image to v1.2.21.
* Updates the golang version to 1.19.8.







 Change log for patch update 1.0.8_1078, released 15 May 2023 



* Image tags: 1.20.0 108-2, 1.21.0 108-2, 1.22.0 108-2, 1.23.0 108-2, 1.24.0 108-2, 1.25.0 108-2, 1.26.0 108-2.
* Updates storage-secret-sidecar image to v1.2.21.
* Golang updated to 1.19.8.







 Change log for patch update 1.0.8_1016, released 5 April 2023
Red Hat OpenShift on IBM Cloud version 4.10 compliance operator benchmark 



 1 Control plane components 



 1.1 Master node configuration files 

Master node configuration is not stored as a set of files, therefore rules in section 1.1 is out of the scope of automated check by the compliance operator.





 1.2 API server 



Section 1.2 API server benchmark results

 Section Recommendation Manual/Automated Level Result 

 1.2.1 Ensure that anonymous requests are authorized. Manual 1 Pass 
 1.2.2 Ensure that the --basic-auth-file option is not set. Automated 1 Pass 
 1.2.3 Ensure that the --token-auth-file parameter is not set. Automated 1 Pass 
 1.2.4 Use https for kubelet connections. Automated 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_410_coco-benchmark-410-remdiations) 
 1.2.5 Ensure that the kubelet uses certificates to authenticate. Automated 1 Pass 
 1.2.6 Verify that the kubelet certificate authority is set as appropriate. Automated 1 Pass 
 1.2.7 Ensure that the --authorization-mode option is not set to AlwaysAllow. Automated 1 Pass 
 1.2.8 Verify that the Node authorizer is enabled. Automated 1 Pass 
 1.2.9 Verify that RBAC is enabled. Automated 1 Pass 
 1.2.10 Ensure that the APIPriorityAndFairness feature gate is enabled. Manual 1 Pass 
 1.2.11 Ensure that the admission control plug-in AlwaysAdmit is not set. Automated 1 Pass 
 1.2.12 Ensure that the admission control plug-in AlwaysPullImages is not set. Manual 1 Pass 
 1.2.13 Ensure that the admission control plug-in SecurityContextDeny is not set. Manual 1 Pass 
 1.2.14 Ensure that the admission control plug-in ServiceAccount is set. Automated 1 Pass 
 1.2.15 Ensure that the admission control plug-in NamespaceLifecycle is set.
Red Hat OpenShift on IBM Cloud version 4.11 compliance operator benchmark 



 1 Control plane components 



 1.1 Master node configuration files 

Master node configuration is not stored as a set of files, therefore rules in section 1.1 is out of the scope of automated check by the compliance operator.





 1.2 API server 



Section 1.2 API server benchmark results

 Section Recommendation Manual/Automated Level Result 

 1.2.1 Ensure that anonymous requests are authorized. Manual 1 Pass 
 1.2.2 Ensure that the --basic-auth-file option is not set. Automated 1 Pass 
 1.2.3 Ensure that the --token-auth-file parameter is not set. Automated 1 Pass 
 1.2.4 Use https for kubelet connections. Automated 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_411_coco-benchmark-411-remdiations) 
 1.2.5 Ensure that the kubelet uses certificates to authenticate. Automated 1 Pass 
 1.2.6 Verify that the kubelet certificate authority is set as appropriate. Automated 1 Pass 
 1.2.7 Ensure that the --authorization-mode option is not set to AlwaysAllow. Automated 1 Pass 
 1.2.8 Verify that the Node authorizer is enabled. Automated 1 Pass 
 1.2.9 Verify that RBAC is enabled. Automated 1 Pass 
 1.2.10 Ensure that the APIPriorityAndFairness feature gate is enabled. Manual 1 Pass 
 1.2.11 Ensure that the admission control plug-in AlwaysAdmit is not set. Automated 1 Pass 
 1.2.12 Ensure that the admission control plug-in AlwaysPullImages is not set. Manual 1 Pass 
 1.2.13 Ensure that the admission control plug-in SecurityContextDeny is not set. Manual 1 Pass 
 1.2.14 Ensure that the admission control plug-in ServiceAccount is set. Automated 1 Pass 
 1.2.15 Ensure that the admission control plug-in NamespaceLifecycle is set.