vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Because the Calico IPAM detects no available IP addresses, it does not assign IP addresses to new pods in the cluster, and pods can't start.

 How to fix it 



 Fixing registry quota issues 

Virtual Private Cloud

Classic infrastructure

To fix registry quota issues, [free up storage in IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_quotaregistry_quota_freeup).





 Fixing IP address issues 

Virtual Private Cloud

Classic infrastructure

To fix IP address issues, release individual and blocks of IP addresses that were not cleanly removed from the Calico IPAM records so that they can be reused by pods in your cluster.

Your cluster must run a [supported version](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_versions). If your cluster runs a deprecated or unsupported version, first [update your cluster](https://cloud.ibm.com/docs/containers?topic=containers-update).



 Step 1: Releasing individual IP addresses 

First, check for and release individual IP addresses that were not cleanly removed from the Calico IPAM records so that they can be reused by pods in your cluster.



1. Follow the steps in [Installing and configuring the Calico CLI](https://cloud.ibm.com/docs/openshift?topic=openshift-network_policiescli_install) to download version 3.18 or later of the calicoctl client, use the correct Calico configuration for your cluster, and verify that the Calico configuration is working correctly for your targeted cluster. Note that even if your cluster runs an older version of Calico, you can still use calicoctl version 3.18 to run the commands in the following steps.
2. Check for any IP addresses that are incorrectly detected as in use by the Calico IPAM.

calicoctl ipam check
3. In the output, look for the section that contains the line Scanning for IPs that are allocated but not actually in use....
* Cause: A job that creates a storage bucket for Minio and then is deleted after it completes, is not being deleted properly.
* Solution: Complete the following steps to check whether an incomplete create-bucket job for Minio exists. If so, delete the incomplete job so that the job can be recreated and can then run successfully.



1. Check for the Minio job by using the following command:

oc get jobs | grep 'wd-minio-discovery-create-bucket'
2. If an existing job is listed in the response, delete the job by using the following command:

oc delete job $(oc get jobs -oname | grep 'wd-minio-discovery-create-bucket')
3. Verify that all of the Minio pods start successfully by using the following command:

oc get pods -l release=wd-minio -o wide









 A No space left on device message is displayed in the log 

If the a wd-ibm-elasticsearch-es-server-client pod restarts repeatedly and then reports the Crashloopbackoff state with the message No space left on device written to the log for the pod, then the issue might be a lack of memory on the pod. Follow the steps to [troubleshoot out of memory issues](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-troubleshootts-oom) or contact IBM Support.





 A java.lang.OutOfMemoryError: Java heap space message is displayed in the log 

When indexing a large set of documents that have multiple enrichments applied to them, the worker node can run out of space. To address the issue, first determine which pod is out of memory by completing the following steps:

If the document status cannot be promoted to Processing, check the status of the inlet, outlet, and converter pods.



1. Run the following command:

oc get pod -l 'tenant=wd,run in (inlet,outlet,converter)'
2. If any of the pods are not showing a Running status, restart the failing pod by using the following command:
* pod-security.kubernetes.io/warn-version



To label a namespace to enforce the privileged profile and generate warnings and audit events for violations of the baseline profile, use the following labels.



* pod-security.kubernetes.io/enforce: privileged
* pod-security.kubernetes.io/enforce-version: latest
* pod-security.kubernetes.io/audit: baseline
* pod-security.kubernetes.io/audit-version: latest
* pod-security.kubernetes.io/warn: baseline
* pod-security.kubernetes.io/warn-version: latest







 Default Pod Security Admission plug-in configuration 

IBM Cloud Kubernetes Service uses the following PodSecurityConfiguration by default.

apiVersion: pod-security.admission.config.k8s.io/v1
kind: PodSecurityConfiguration
defaults:
enforce: "privileged"
enforce-version: "latest"
audit: "privileged"
audit-version: "latest"
warn: "privileged"
warn-version: "latest"
exemptions:
usernames: []
runtimeClasses: []
namespaces: []





 Customizing the Pod Security Admission plug-in configuration 

The cluster-wide Pod Security Admission plug-in configuration sets enforce, audit, and warn behavior for all namespaces that don't have pod security labels or exemptions.

For Kubernetes 1.24 clusters the apiVersion must be pod-security.admission.config.k8s.io/v1beta. For 1.25 and later pod-security.admission.config.k8s.io/v1 is preferred, but the v1beta API version can still be used.



1. Create a YAML file containing a PodSecurityConfiguration resource. You can use the default configuration to start.

apiVersion: pod-security.admission.config.k8s.io/v1
kind: PodSecurityConfiguration
defaults:
enforce: "privileged"
* pod-security.kubernetes.io/audit-version
* pod-security.kubernetes.io/warn
* pod-security.kubernetes.io/warn-version



To label a namespace to enforce the privileged profile and generate warnings and audit events for violations of the baseline profile, use the following labels.



* pod-security.kubernetes.io/enforce: privileged
* pod-security.kubernetes.io/enforce-version: latest
* pod-security.kubernetes.io/audit: baseline
* pod-security.kubernetes.io/audit-version: latest
* pod-security.kubernetes.io/warn: baseline
* pod-security.kubernetes.io/warn-version: latest







 Default Pod Security Admission plug-in configuration 

Red Hat OpenShift on IBM Cloud uses the following PodSecurityConfiguration by default.

apiVersion: pod-security.admission.config.k8s.io/v1
kind: PodSecurityConfiguration
defaults:
enforce: "privileged"
enforce-version: "latest"
audit: "privileged"
audit-version: "latest"
warn: "privileged"
warn-version: "latest"
exemptions:
usernames: []
runtimeClasses: []
namespaces: []





 Customizing the Pod Security Admission plug-in configuration 

The cluster-wide Pod Security Admission plug-in configuration sets enforce, audit, and warn behavior for all namespaces that don't have pod security labels or exemptions.



1. Create a YAML file containing a PodSecurityConfiguration resource. You can use the default configuration to start.

apiVersion: pod-security.admission.config.k8s.io/v1
kind: PodSecurityConfiguration
defaults:
enforce: "privileged"
enforce-version: "latest"
audit: "privileged"
audit-version: "latest"
warn: "privileged"
warn-version: "latest"
exemptions:
interactive_category: 'Accept',
icon: 'http://www.iconsdb.com/icons/preview/purple/message-2-xxl.png',
delay_while_idle: true,
sync: true,
visibility: 'PUBLIC',
payload: { "alert" : "20% Off for you" },
priority: 'DEFAULT',
sound: 'sound.mp3',
time_to_live: 1.0,
lights: lightsModel,
android_title: 'Title for Android',
style: styleModel,
type: 'DEFAULT',
};

// NotificationBodyMessage
const notificationBodyMessageModel = {
en_data: notificationFcmBodyMessageDataModel,
};
Show more



1. Changes to Send notification method



// Replace the below section

var settings = PushMessageBuilder.Settings
.fcm(fcm)
.build();

var notificationExample = Notification.message(message)
.target(target)
.settings(settings)
.build();

myPushNotifications.send(notificationExample, function(error, response, body) {
console.log("Error: " + error);
console.log("Response: " + JSON.stringify(response));
console.log("Body: " + body);
});

// with this

const params = {
instanceId: instanceId,
ceIbmenseverity: notificationSeverity,
ceId: notificationID,
ceSource: notificationsSource,
ceIbmensourceid: sourceId,
ceType: typeValue,
ceTime: date,
ceIbmenpushto: JSON.stringify(notificationFcmDevicesModel),
ceIbmenfcmbody: JSON.stringify(notificationFcmBodyModel),
Pod security admission provides the ability to enforce, warn, and generate audit events for pods that violate the security profiles. In OpenShift 4.11, the default configuration enforces the privileged profile, while also generating warnings and audit events based on the restricted profile. This behavior can be controlled at the namespace level through the use of predefined pod security labels on namespaces. When the Pod security profiles are enforced, you might see warnings such as the following example.

Warning: would violate PodSecurity "restricted:latest": host namespaces (hostNetwork=true, hostPID=true), privileged (container "container-00" must not set securityContext.privileged=true), allowPrivilegeEscalation != false (container "container-00" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "container-00" must set securityContext.capabilities.drop=["ALL"]), restricted volume types (volume "host" uses restricted volume type "hostPath"), runAsNonRoot != true (pod or container "container-00" must set securityContext.runAsNonRoot=true), runAsUser=0 (container "container-00" must not set runAsUser=0), seccompProfile (pod or container "container-00" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

In this example, the pod is still created and can run as long the service account is authorized to a SecurityContextConstraint profile. The warning indicates that changes to the securityContext profile of the pod and container are required for the pod to run under the specified pod security profile, such as setting the allowPrivilegeEscalation=false option or that a pod security profile that allows those capabilities must be used.

Red Hat OpenShift also includes a controller that applies namespace labels based on the SCC permissions of the service accounts in a given namespace. Both pod security admission and SCCs are applied. You can use primarily SCCs and use the pod security admission synchronization controller to adjust the pod security label on the namespace.
System.out.println("Error while unsubscribing from tag "+ message);
}
});

// with this

push.unsubscribe("tagName", new ENPushResponseListener<String>() {

@Override
public void onSuccess(String s) {
System.out.println("Successfully unsubscribed from tag . "+ tag);
}

@Override
public void onFailure(ENPushException ex) {
String message = ex.getMessage();
System.out.println("Error while unsubscribing from "+ message);
}
});
Show more



8. Optionally, if you are using Notification options, make the following changes:
9. Changes to the Notification actions listener

// Replace the below section

notificationListener = new MFPPushNotificationListener() {
@Override
public void onReceive(final MFPSimplePushNotification message) {
if (message.actionName.equals("Accept Button")){
System.out.print("Clicked Accept Action");
} else if (message.actionName.equals("Decline Button")){
System.out.print("Clicked Decline Action");
} else if (message.actionName.equals("View Button")){
System.out.print("Clicked View Action");
}
}
};

// with this

notificationListener = new ENPushNotificationListener() {
@Override
public void onReceive(final ENSimplePushNotification message) {
if (message.getActionName().equals("Accept Button")){
System.out.print("Clicked Accept Action");
} else if (message.getActionName().equals("Decline Button")){
System.out.print("Clicked Decline Action");
"assignedto": "alexandra.szanto@ibm.com",
"backoutplan": "rollback",
"priority": "critical",
"purpose": "bugfix",
"description": "test description",
"environment": "crn:v1:bluemix:public::ch-ctu-2::::",
"impact": "bug",
"system": "devopsinsights",
"outageduration": "0 00:00:00",
"plannedstart": "2020-10-05 14:48:00",
"plannedend": "2020-10-05 14:49:00",
"deploymentready": "yes",
}

Required Environment Variables for ServiceNow v1 or v2:

SERVICENOW_TOKEN= ServiceNow API Token
SERVICENOW_URL= ServiceNow API URL

Required Environment Variables for ServiceNow v3:

IAM_ACCESS_TOKEN= Access token obtained from the IAM service corresponding to pnp-ibmcloud-api-key.
SERVICENOW_URL= ServiceNow API URL

Running the command:

cocoa change-request create --file=test.json

Or

$ cocoa change-request create --assigned-to=<your-ibm-email> --system=<servicenow-configuration-item> --impact=<impact description> --outage-duration='0 00:00:00' --priority=<the-priority> --environment=<involved-environment> --purpose=<purpose-explanation> --description=<description-of-the-change> --backout-plan=<description-of-a-backout-plan> --planned-start='2020-05-13 13:00:12' --planned-end='2020-05-13 13:10:12' --deployment-ready=<yes/no> --type=<change-type>





 cocoa change-request change-state-to-implement 

Changes the state of a Change Request to implement through the ServiceNow API.
event-notifications.00006I INFO No devices found for platform: push_chrome Valid platforms are [push_chrome, push_firefox, push_android, push_ios, push_safari] 
 event-notifications.00007I INFO An SMS is dispatched to the following numbers: [<LIST-OF-TELEPHONE-NUMBERS]. 
 event-notifications.00008I INFO An email is sent to each of the following destinataries: [<LIST-OF-EMAIL-ADDRESSES>] 
 event-notifications.00009I INFO A webhook is successfully served. Response from the webhook: OK with the status code: 200 
 event-notifications.00010I INFO A notification event with ID <NOTIFICATION_ID is sent to the following subscriptions.<LIST-OF_SUBSCRIPTIONS> 
 event-notifications.00011I INFO A notification event with ID <NOTIFICATION_ID is sent to the following destinations.<LIST-OF_DESTINATIONS> 
 event-notifications.00012I INFO Notification processed successfully for total: 1 devices and platform push_chrome 
 event-notifications.00013I INFO Notification dispatched successfully to total devices <COUNT> and platform push_android. 
 event-notifications.00014I INFO The slack destination is successfully served. Response from the slack API:. 
 event-notifications.00015I INFO The notification is delievered to the deviceID:<DEVICE_ID> on the platform: <PLATFORM_NAME> and the destination ID:<DESTINATION_ID>. 
 event-notifications.00015I INFO The user has opened the notification on the deviceID:<DEVICE_ID> and the platform: <PLATFORM_NAME> and the destination ID:<DESTINATION_ID>. 
 event-notifications.00016I INFO The Microsoft Teams destination is successfully served. Response from the microsoft teams API: OK with the status code: 200 
 event-notifications.00001W WARN A notification event from source<Source_ID> is rejected because no topic is configured for the source. . The topic to filter the event is missing. 
 event-notifications.00002W WARN A notification event from the source <Source_ID> is invalid as it is not filtered by any topic.
npm notice created a lockfile as package-lock.json. You should commit this file.
npm WARN enoent ENOENT: no such file or directory, open '/package.json'
npm WARN !invalid2 No description
npm WARN !invalid2 No repository field.
npm WARN !invalid2 No README data
npm WARN !invalid2 No license field.

up to date in 0.27s
found 0 vulnerabilities

INFO[0010] Taking snapshot of full filesystem...
INFO[0010] COPY server.js .
INFO[0010] Taking snapshot of files...
INFO[0010] EXPOSE 8080
INFO[0010] cmd: EXPOSE
INFO[0010] Adding exposed port: 8080/tcp
INFO[0010] CMD [ "node", "server.js" ]

mybuildrun-v2mb8-pod-tlzdx/step-image-digest-exporter-hcvmf:
2021/02/23 14:11:43 warning: unsuccessful cred copy: ".docker" from "/tekton/creds" to "/tekton/home": unable to open destination: open /tekton/home/.docker/config.json: permission denied
{"severity":"INFO","timestamp":"2021-02-23T14:12:05.65581098Z","caller":"logging/config.go:115","message":"Successfully created the logger.","logging.googleapis.com/labels":{},"logging.googleapis.com/sourceLocation":{"file":"github.com/tektoncd/pipeline/vendor/knative.dev/pkg/logging/config.go","line":"115","function":"github.com/tektoncd/pipeline/vendor/knative.dev/pkg/logging.newLoggerFromConfig"}}
After the device is subscribed to a particular tag, the device can receive notifications that are sent for that tag.

Add the following code snippet to your iOS mobile application to subscribe to a list of tags.

// Subscribe to the given tag
enPush.subscribeToTags(tagName: "<tag_name>") { response, statusCode, error in
/...../
});





 Retrieve subscribed tags 

The retrieveSubscriptionsWithCompletionHandler API returns the list of tags to which the device is subscribed. Use the following code snippets in the mobile application to get the subscription list.

// Get a list of tags that to which the device is subscribed.
enPush.retrieveSubscriptionsWithCompletionHandler { response, statusCode, error in
/...../
}





 Unsubscribe from tags 

The unsubscribeFromTags API removes the device subscription from the list tags. Use the following code snippets to allow your devices to get unsubscribe from a tag.

// unsubscibe from the given tag ,that to which the device is subscribed.
enPush.unsubscribeFromTags(tagName: "<tag_name>") { response, statusCode, error in
/...../
}





 Receiving push notifications on iOS devices 

To receive push notifications on iOS devices, add the following Swift method to the appDelegate.swift of your application:

func application(_ application: UIApplication, didReceiveRemoteNotification userInfo: [AnyHashable : Any], fetchCompletionHandler completionHandler: @escaping (UIBackgroundFetchResult) -> Void) {

//UserInfo dictionary will contain data sent from the server
}







 Notification options 

The following notification options are supported.



 Interactive notifications 



1. To enable interactive push notifications, the notification action parameters must be passed in as part of the notification object.
You can define the admission control mode you want to use for pod security in each namespace. Kubernetes defines a set of labels that you can set to define which of the predefined Pod Security Standard profiles you want to use for a namespace. The label you select defines what action the control plane takes if a potential violation is detected.

By default, Red Hat OpenShift on IBM Cloud adds the privileged Pod Security labels to the following namespaces. These namespaces are labeled to enforce, audit, and warn by using the privileged profile.



* kube-system
* ibm-system
* ibm-operators
* calico-system
* tigera-operator



Do not remove or change the labels for these namespaces or any of the openshift-* namespaces.

A namespace can be labeled to set the pod security profile for any or all the Pod Security Admission modes.

For example, you can label a namespace to enforce the privileged profile in addition to using warn or audit by using the baseline profile.

This label allows administrators and application developers to dry-run applications by looking for only warnings and audit records against the baseline profile without rejecting pods. Then, you can make necessary changes to your workloads before changing the enforce mode to baseline.

The Pod Security Admission namespace labels are of the form pod-security.kubernetes.io/<MODE>: <LEVEL> and pod-security.kubernetes.io/<MODE>-version: <VERSION>.



* pod-security.kubernetes.io/enforce
* pod-security.kubernetes.io/enforce-version
* pod-security.kubernetes.io/audit
* pod-security.kubernetes.io/audit-version
* pod-security.kubernetes.io/warn
* pod-security.kubernetes.io/warn-version



To label a namespace to enforce the privileged profile and generate warnings and audit events for violations of the baseline profile, use the following labels.



* pod-security.kubernetes.io/enforce: privileged
* pod-security.kubernetes.io/enforce-version: latest
globalDefault: <false>
description: "Use this class for XYZ service pods only."



Understanding the YAML file components

 Components Description 

 name Required: The name of the priority class that you want to create. 
 value Required: Enter an integer less than or equal to 1 billion (1000000000). The higher the value, the higher the priority. Values are relative to the values of other priority classes in the cluster. Reserve very high numbers for system critical pods that you don't want to be preempted (removed).<br><br>For example, the [default cluster-critical priority classes](https://cloud.ibm.com/docs/openshift?topic=openshift-pod_prioritydefault_priority_class) range in value from 900000000-2000001000, so enter a value less than these numbers for new priority classes so that nothing is prioritized higher than these pods. 
 globalDefault Optional: Set the field to true to make this priority class the global default that is applied to every pod that is scheduled without a priorityClassName value. Only one priority class in your cluster can be set as the global default. If there is no global default, pods with no priorityClassName specified have a priority of zero (0).<br><br>The [default priority classes](https://cloud.ibm.com/docs/openshift?topic=openshift-pod_prioritydefault_priority_class) don't set a globalDefault. If you created other priority classes in your cluster, you can check to make sure that they don't set a globalDefault by running oc describe priorityclass <name>. 
 description Optional: Tell users why to use this priority class. Enclose the string in quotations (""). 



4. Create the priority class in your cluster.

oc apply -f filepath/priorityclass.yaml
5. Verify that the priority class is created.

oc get priorityclasses



Great! You created a priority class.
move or create the staging_latest label to another label (to the same commit)
$ cocoa inventory label move --org='Github-ID' --repo='compliance-inventory-repo' --to-label="some-label" "label-to-move"





 cocoa inventory promote 

Promotes entries from the inventory from one environment to another. The source environment can be either a branch or a tag.

Required Environment Variables:

GHE_ORG= Github Organization (required if --org option is not specified).
GHE_REPO= Github Repository (required if --repo option is not specified).
PIPELINE_RUN_ID= Can be used instead of --pipeline-run-id (either the option or the variable is required).

Required Environment Variables, if you are using GitHub:

GHE_TOKEN= Github Enterprise API Token (Optional if you are using --git-token-path)

Options for Git:

--git-token-path (Optional) Github Token's path
--git-api-url (Optional) Github API url

If you are using github, use --git-token-path field to set your GitHub Token and --git-api-url field to set the # GitHub Enterprise API URL instead of GHE_TOKEN and GH_URL environment variables. If both of them are provided --git-token-path and --git-api-url take precedence.

Running the command:

$ cocoa inventory promote --org='Github-ID' --repo='compliance-inventory-repo' --source='master' --target='prod' --priority='Critical' --assigned-to='employee@ibm.com' --description='desc' --purpose='purpose' --impact='impact' --customer-impact='impact' --backout-plan='rollback'







 cocoa incident commands 



 cocoa incident add