vania-janet/multiturn-rag-retrieval-data huggingface dataset:
1.2.12 Red Hat OpenShift on IBM Cloud does not enable the [AlwaysPullImages](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/alwayspullimages) admission controller since it overrides a container's imagePullPolicy and may impact performance. 
 1.2.13 Red Hat OpenShift on IBM Cloud supports [pod security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scc) which are similar to Kubernetes pod security policies. 
 1.2.16 Red Hat OpenShift on IBM Cloud supports [pod security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scc) which are similar to Kubernetes pod security policies. 
 1.2.22 Red Hat OpenShift on IBM Cloud can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/openshift?topic=openshift-health-auditaudit-api-server). 
 1.2.23 Red Hat OpenShift on IBM Cloud can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/openshift?topic=openshift-health-auditaudit-api-server). 
 1.2.24 Red Hat OpenShift on IBM Cloud can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/openshift?topic=openshift-health-auditaudit-api-server). 
 1.2.25 Red Hat OpenShift on IBM Cloud can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/openshift?topic=openshift-health-auditaudit-api-server).
* [Adding the image pull secret](https://cloud.ibm.com/docs/openshift?topic=openshift-registryuse_imagePullSecret) to your deployment configuration or to the project service account.







 Understanding how to authorize your cluster to pull images from a private registry 

To pull images from a registry, your Red Hat OpenShift on IBM Cloud cluster uses a special type of Kubernetes secret, an imagePullSecret. This image pull secret stores the credentials to access a container registry.

The container registry can be:



* A private namespace in your own IBM Cloud Container Registry.
* A private namespace in IBM Cloud Container Registry that belongs to a different IBM Cloud account.
* Any other private registry such as Docker.



However, by default, your cluster is set up to pull images from only your account's namespaces in IBM Cloud Container Registry, and deploy containers from these images to the default Red Hat OpenShift project in your cluster. If you need to pull images in other projects of the cluster or from other container registries, then you must set up your own image pull secrets.



 Default image pull secret setup 

Generally, your Red Hat OpenShift on IBM Cloud cluster is set up to pull images from all IBM Cloud Container Registry icr.io domains from the default Red Hat OpenShift project only. Review the following FAQs to learn more about how to pull images in other Red Hat OpenShift projects or accounts, restrict pull access, or why your cluster might not have the default image pull secrets.

How is my cluster set up to pull images from the default Red Hat OpenShift project?
: When you create a cluster, the cluster has an IBM Cloud IAM service ID that is given an IAM Reader service access role policy to IBM Cloud Container Registry. The service ID credentials are impersonated in a non-expiring API key that is stored in image pull secrets in your cluster. The image pull secrets are added to the default Kubernetes namespace and the list of secrets in the default service account for this Red Hat OpenShift project.
Deployment values 

The following deployment values can be used to configure Red Hat® OpenShift® cluster instance on IBM Cloud®:



Table 1. Deployment values

 Value Description Is it required? Default value 

 api_key The API key for the IBM Cloud account where the Red Hat OpenShift cluster needs to be deployed. For more information on how to create an API key, see [Managing user API keys](https://cloud.ibm.com/docs/account?topic=account-userapikey). Yes None 
 cluster_prefix Prefix that is used to name the IBM Cloud resources that are provisioned to build the Red Hat OpenShift cluster. You cannot create more than one instance of the Red Hat OpenShift cluster with the same name. Make sure that the name is unique. Enter a prefix name, for example, my-openshift. The length of the prefix should be fewer than 13 characters. No hpcc-oc 
 enable_logdna Specify whether you would like to set up a logging configuration for the Red Hat OpenShift cluster. For more information, see [Forwarding cluster and app logs to IBM Log Analysis](https://cloud.ibm.com/docs/openshift?topic=openshift-healthopenshift_logging). No true 
 enable_monitoring Specify whether you would like to set up a monitoring configuration for the Red Hat OpenShift cluster. For more information, see [Monitoring cluster health](https://cloud.ibm.com/docs/openshift?topic=openshift-health-monitor). No true 
 kube_version The Red Hat OpenShift version that you want to set up in your cluster. Available versions: 4.9_openshift and 4.8_openshift. For more information, see [Version information and update actions](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_versions). No 4.9_openshift
: Master fix pack updates are available for Red Hat OpenShift [3.11.146_1526_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_changelog_311311146_1526).

Software-defined storage with Portworx
: You can now install Portworx on your Red Hat OpenShift cluster as a highly available data management platform for your containerized apps. For more information, see [Storing data software-defined storage (SDS) with Portworx](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_portworx_about).





 3 October 2019 

Ingress ALB change log
: Updated the ALB [nginx-ingress image to build 579 and ingress-auth image build to 341](https://cloud.ibm.com/docs/containers?topic=containers-cluster-add-ons-changelogkube_ingress_changelog).

DevOps toolchain
: You can now use the DevOps tab on the cluster details page to configure your DevOps toolchain. For more information, see [Setting up a continuous delivery pipeline for a cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-cicdcontinuous-delivery-pipeline).

Version change log
: Patch updates are available for Red Hat OpenShift [3.11.146_1525_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_changelog_311311146_1525).





 1 October 2019 

End of service of IBM Log Analysis and IBM Cloud Monitoring
: Removed steps for using IBM Log Analysis and IBM Cloud Monitoring to work with cluster logs and metrics.
1.2.13 Red Hat OpenShift on IBM Cloud supports [OpenShift security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scc) and [Kubernetes pod security admission](https://kubernetes.io/docs/concepts/security/pod-security-admission/) which are similar to the deprecated [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 1.2.16 Red Hat OpenShift on IBM Cloud supports [OpenShift security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scc) and [Kubernetes pod security admission](https://kubernetes.io/docs/concepts/security/pod-security-admission/) which are similar to the deprecated [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 1.2.22 Red Hat OpenShift on IBM Cloud can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/openshift?topic=openshift-health-audit). 
 1.2.23 Red Hat OpenShift on IBM Cloud can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/openshift?topic=openshift-health-audit). 
 1.2.24 Red Hat OpenShift on IBM Cloud can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/openshift?topic=openshift-health-audit). 
 1.2.25 Red Hat OpenShift on IBM Cloud can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/openshift?topic=openshift-health-audit).
Managing Red Hat OpenShift for VMware 

Review the following information to manage your Red Hat® OpenShift® for VMware® service after deployment.



 Rotating the Red Hat OpenShift certificates (required) 

Red Hat OpenShift for VMware uses kubelet client certificates that must be rotated periodically for security purposes. Red Hat OpenShift mainly automates the rotation process, but requires manual approval of certificate signing requests (CSRs). Therefore, it is important that you understand the Red Hat OpenShift certificate rotation schedule to avoid expired certificates.

The initial certificates that are created during installation expire 24 hours after they are created. IBM's automation process, which installs Red Hat OpenShift, handles the approval of the CSRs for this initial rotation, which is done by running a script on the bastion for the first 30 hours. The script is named /root/approve-csr.sh and its log file is named /root/approve-csr.log.

For the script to run successfully, the initial kubeadmin credentials must be the same until the initial certificate rotation is complete. Do not change the kubeadmin credentials for the first 24 hours. If the credentials are changed, you must monitor and approve the CSRs for the initial certificate rotation. For more information, see [Approving the CSRs for your machines](https://docs.openshift.com/container-platform/4.7/installing/installing_vsphere/installing-vsphere.htmlinstallation-approve-csrs_installing-vsphere).

Do not restart any of the Red Hat OpenShift cluster virtual machines (VMs) or the bastion VM until the first certificate rotation is done.

After the initial certificate rotation, certificates are renewed every 30 days. You must establish a process to approve the CSRs for every certificate rotation. According to Red Hat®, you can approve CSRs when they reach 80% of their expiration period, which is approximately 25 days into the lifespan of the CSRs.

If you do not approve CSRs in time and the certificates expire, you can recover from expired control plane certificates and get the Red Hat OpenShift cluster operational again.
5.2.4 Red Hat OpenShift on IBM Cloud can optionally [configure security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scc). 
 5.2.5 Red Hat OpenShift on IBM Cloud can optionally [configure security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scc). 
 5.2.6 Red Hat OpenShift on IBM Cloud can optionally [configure security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scc). 
 5.2.7 Red Hat OpenShift on IBM Cloud can optionally [configure security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scc). 
 5.2.8 Red Hat OpenShift on IBM Cloud can optionally [configure security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scc). 
 5.2.9 Red Hat OpenShift on IBM Cloud can optionally [configure security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scc). 
 5.3.2 Red Hat OpenShift on IBM Cloud has a set of [default Calico network policies defined](https://cloud.ibm.com/docs/openshift?topic=openshift-network_policiesdefault_policy) and [additional network policies can optionally be added](https://cloud.ibm.com/docs/openshift?topic=openshift-network_policiesadding_network_policies). 
 5.4.1 Red Hat OpenShift on IBM Cloud deploys some system components that could prefer using secrets as files over secrets as environment variables.
You can select from the following pre-defined user roles that determine the set of actions that the user can perform:



* Platform access roles: Determine the cluster and worker node management-related actions that a user can perform in Red Hat OpenShift on IBM Cloud. Platform access roles also assign users the basic-users and self-provisioners RBAC role. With these RBAC roles, you can create a Red Hat OpenShift project in the cluster, in which you can deploy apps and other Kubernetes resources. As the creator of the project, you are automatically assigned the admin RBAC role for the project so that you can fully control what you want to deploy and run in your project. However, these RBAC roles don't grant access to other Red Hat OpenShift projects. To view and access other Red Hat OpenShift projects, you must be assigned the appropriate service access role in IAM.
* Service access roles: Determine the [Kubernetes RBAC role](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) that is assigned to the user and the actions that a user can run against the Red Hat OpenShift API server. While the basic-users and self-provisioners RBAC role that is assigned with a platform access role lets you create and manage your own Red Hat OpenShift projects, you can't view, access, or work with other Red Hat OpenShift projects until you are assigned a service access role. For more information about the corresponding RBAC roles that are assigned to a user and associated permissions, see [IBM Cloud IAM service access roles](https://cloud.ibm.com/docs/openshift?topic=openshift-iam-service-access-roles).
* Classic infrastructure: Enables access to your classic IBM Cloud infrastructure resources. Example actions that are permitted by classic infrastructure roles are viewing the details of cluster worker node machines or editing networking and storage resources.
* VPC infrastructure: Enables access to VPC infrastructure resources. Example actions that are permitted by VPC infrastructure roles are creating a VPC, adding subnets, changing floating IP addresses, and creating VPC Block Storage instances.
From the Red Hat OpenShift web console menu bar, click your profile IAM#user.name@email.com > Copy Login Command. Display and copy the oc login token command into your command line to authenticate via the CLI.

Save your cluster master URL to access the Red Hat OpenShift console later. In future sessions, you can skip the cluster config step and copy the login command from the console instead.
9. Verify that the oc commands run properly with your cluster by checking the version.

oc version

Example output

Client Version: v4.11.0
Kubernetes Version: v1.26.6.2

If you can't perform operations that require Administrator permissions, such as listing all the worker nodes or pods in a cluster, download the TLS certificates and permission files for the cluster administrator by running the ibmcloud oc cluster config --cluster myvpc-cluster --admin command.







 Step 2: Deploy an app to your cluster 

Quickly deploy a new sample app that is available to requests from inside the cluster only.

The components that you deploy by completing this lesson are shown in the following diagram.

Zoom

![Deployment setup](https://cloud.ibm.com/docs-content/v1/content/bce0f0917a9eea684d1b4b704ac6343a1f65f446/openshift/images/cs-app-components1.svg)

Figure 1. Deployment setup



1. Create a Red Hat OpenShift project for your Hello World app.

oc new-project hello-world
2. Build the sample app [from the source code](https://github.com/IBM/container-service-getting-started-wt). With the Red Hat OpenShift new-app command, you can refer to a directory in a remote repository that contains the Dockerfile and app code to build your image. The command builds the image, stores the image in the local Docker registry, and creates the app deployment configurations (dc) and services (svc).
Install the IBM Cloud and Red Hat OpenShift on IBM Cloud client Command Line Interfaces (CLI) 

Use the following commands to download and install the CLIs you use to configure the connection between your Red Hat OpenShift on IBM Cloud cluster and your jump host.



1. Login to the jump host as root and install the IBM Cloud CLI ibmcloud.

curl -sL https://ibm.biz/idt-installer | bash
 For more information on IBM Cloud CLI, see [Getting started with the IBM Cloud CLI and Developer Tools](/docs/cli?topic=cli-getting-started){: external}.
2. Download and install the Red Hat OpenShift on IBM Cloud 3.11 CLI oc.

Click [here](http://mirror.openshift.com/pub/openshift-v3/clients) for the repository of all oc versions. If you are not sure which version to select, navigate to the [IBM Cloud console](https://cloud.ibm.com/kubernetes/clusters?platformType=openshift) and look at the Version details for the Red Hat OpenShift on IBM Cloud cluster you created. For example, 3.11.232, which matches the current version.

Download the appropriate version.

wget http://mirror.openshift.com/pub/openshift-v3/clients/3.11.232/linux/oc.tar.gz

Unpack the Red Hat OpenShift on IBM Cloud client.

tar -xf oc.tar.gz

Move it to the local executables directory.

mv oc /usr/local/bin
3. Download and install kubectl. For Red Hat OpenShift on IBM Cloud 3.11, release v1.11 of kubectl is required.

Download the appropriate version.

curl -LO https://dl.k8s.io/release/v1.11.10/bin/linux/amd64/kubectl

Set the executable attribute.

chmod +x ./kubectl
Prerequisites for installation 

Before you can start the build process to install the Red Hat® OpenShift® cluster, the following steps are required.



* Order new subnets for the Red Hat OpenShift environment.



* A private portable subnet for the Red Hat OpenShift cluster NSX ESG.
* A public portable subnet for the Red Hat OpenShift cluster NSX ESG.



* Download Red Hat OpenShift 4.7 - Access to a Red Hat® subscription to download the installer, pull secret and Red Hat Enterprise CoreOS OVA.
* Download RHEL 8.0 ISO - Access to a Red Hat subscription to download the Red Hat Enterprise Linux® 8.x ISO for the bastion host.
* IBM Cloud® environment details - Collect the following details for IBM Cloud for VMware® Solutions environment.



* VMware vCenter Server® instance details and passwords
* The additional private portable subnet information
* The additional public portable subnet information



* Download and install govc - govc is a VMware vSphere® CLI, an alternative to the GUI, and suited for automation tasks.





 Ordering new subnets for the Red Hat OpenShift environment 



1. Log in to the [IBM Cloud for VMware Solutions console](https://cloud.ibm.com/vmware).
2. Select Classic Infrastructure>Network>IP management>Subnets.
3. Click Order IP Subnets.



Review the following requirements.



* 8 Public portable addresses assigned to the Public VLAN collected in the previous step.
* 64 Private portable addresses assigned to the Private VLAN collected in the previous step.







 Downloading Red Hat OpenShift 4.7 

Access the [Red Hat OpenShift Infrastructure Providers page](https://cloud.redhat.com/openshift/install/vsphere/user-provisioned).



1. Download the installer.
2. Download the Pull Secret.
3. Download the Red Hat Enterprise Linux CoreOS (RHEL CoreOS) OVA image or download the OVA by using the following code.
Consumer connectivity to workload resources 

Consumers of the workloads and services that are deployed to your Satellite location might need access to one or more of the following resources:



* Applications and microservices that are deployed on your Red Hat OpenShift on IBM Cloud cluster
* Red Hat OpenShift on IBM Cloud Link cloud endpoints providing access to IBM Cloud services.



Configure your network infrastructure so that access to workloads and services that are not related to security or management functions is provided through an edge plane that runs outside of your Satellite location or some other facility that can control network flows to your Satellite hosts. Make sure that services and workloads related to security and management activities can be accessed only from the management plane that runs outside of your Satellite location.



 Edge plane with web application firewall 

The edge plane should be used to enhance boundary protection for the workloads and services that are deployed in the Satellite location and the Satellite control plane. The workload consumer connectivity to the edge plane is your responsibility and depends on the requirements for the workload consumers and the existing connectivity options for your network infrastructure.

We recommend that you use a Web Application Firewall (WAF) in your edge plane for any service or workload that uses the HTTP protocol (including REST APIs). A WAF filters and monitors consumer traffic and can prevent attacks that exploit the vulnerabilities of web applications and services.





 Exposing your Red Hat OpenShift on IBM Cloud workloads 

Red Hat OpenShift on IBM Cloud provides several options for enabling external access to applications deployed on a cluster:



* Ingress controller
* Load balancer service
* External IP
* NodePort



For more information, see [Exposing apps in Satellite clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-sat-expose-apps) and [Ingress traffic configuration](https://docs.openshift.com/container-platform/4.10/networking/configuring_ingress_cluster_traffic/overview-traffic.html).





 Related controls in IBM Cloud Framework for Financial Services 

The following IBM Cloud Framework for Financial Services controls are most related to this guidance.
Getting started with IBM Cloud Pak for Multicloud Management V1.3 

The IBM Cloud Pak for Multicloud Management, running on Red Hat OpenShift, provides consistent visibility, governance, and automation from on-premises to the edge. Enterprises gain capabilities such as multicluster management, event management, application management, and infrastructure management. Enterprises can use this Cloud Pak to help increase operational efficiency that is driven by intelligent data, analysis, and predictive golden signals, and gain built-in support for their compliance management. For more details, see the [documentation](https://www.ibm.com/support/knowledgecenter/SSFC4F/product_welcome_cloud_pak.html).



 What's inside this Cloud Pak 

In addition to the default features for managing multicloud environments, the IBM Cloud Pak for Multicloud Management includes the following installable modules that you can add to your cluster to manage applications and infrastructure, and to automate tasks:



* Monitoring Module for monitoring the performance and availability of cloud applications in hybrid cloud environments.
* Terraform & Service Automation Module for cluster security, operating efficiency, and appropriate service level delivery.
* CloudForms for controlling and managing cloud infrastructures.
* Red Hat Ansible Tower for running your automation tasks.







 Before you begin 



* Before you can install the Cloud Pak, you must purchase a license through [IBM Passport Advantage](https://www.ibm.com/software/passportadvantage/index.html). For part numbers, see [Passport Advantage part numbers](https://www.ibm.com/support/knowledgecenter/en/SSFC4F_1.3.0/about/part_numbers.html).
* You must have a supported version of OpenShift Container Platform installed by using IBM Cloud Kubernetes Service so that the managed OpenShift service is supported. For the list of supported versions, see [Supported OpenShift versions and platforms](https://www.ibm.com/support/knowledgecenter/en/SSFC4F_1.3.0/install/supported_os.html).