vania-janet/multiturn-rag-retrieval-data huggingface dataset:
1.22 version information and update actions 

Kubernetes version 1.22 becomes unsupported on 14 September 2022. Update your cluster to at least [version 1.23](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_123) as soon as possible.

Review information about version 1.22 of IBM Cloud® Kubernetes Service, released 29 Sept 2021.

Looking for general information on updating IBM Cloud® Kubernetes Service clusters, or information on a different version? See [Kubernetes version information and update actions](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions).

Zoom

![This badge indicates Kubernetes version 1.22 certification for IBM Cloud Kubernetes Service](https://cloud.ibm.com/docs-content/v1/content/4d497aff9e27b92fbbc2ee4e343a9ec4549cb1d7/containers/images/certified-kubernetes-color.svg)

Figure 1. Kubernetes version 1.22 certification badge

IBM Cloud Kubernetes Service is a Certified Kubernetes product for version 1.22 under the CNCF Kubernetes Software Conformance Certification program. Kubernetes® is a registered trademark of The Linux Foundation in the United States and other countries, and is used pursuant to a license from The Linux Foundation.

For more information about Kubernetes project version 1.22, see the [Kubernetes change log](https://v1-22.docs.kubernetes.io/releases/notes/).



 Release timeline 

The following table includes the expected release timeline for version 1.22 of IBM Cloud® Kubernetes Service. You can use this information for planning purposes, such as to estimate the general time that the version might become unsupported.

Dates that are marked with a dagger (†) are tentative and subject to change.



Release timeline for IBM Cloud Kubernetes Service version 1.22

 Version Supported?
Change log: CIS IBM Foundations Benchmark profile 

In this change log, you can learn about the latest changes, improvements, and updates for the CIS IBM Foundations Benchmark profile. The change log lists changes that were made, ordered by the version number.



  Profile versioning 

When specifications or controls are edited, removed from, or added to a profile in a way that is not compatible with the current version, a new version is released. To take advantage of the changes in a new version, update your attachments to use the newest profile version.

This profile is consistently updated and is not an exhaustive list of all the controls that might be required for every organization. Be sure to validate the available controls to determine where you might need to supplement your workloads with other security measures.



  Active versions 

The following table shows the service behavior changes for each version date. Switching to a later version date activates all changes that are introduced in earlier versions.



Table. Active versions of the CIS IBM Foundations Benchmark profile

 Version number   Release date 

 Version 1.0.0    2023-05-17   









  Version 1.0.0 

Now available
:   Released in the new architecture today, 17 May 2023, the CIS IBM Foundations Benchmark profile is a collection of controls designed to validate the configuration of your IBM Cloud resources in accordance with the CIS defined standards.
Cluster master HA proxy 1.9.6-alpine 1.9.7-alpine See the [HAProxy release notes](https://www.haproxy.org/download/1.9/src/CHANGELOG). Update resolves [CVE-2019-6706](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6706). 
 GPU device plug-in and installer 9ff3fda 55c1f66 Updated image for [CVE-2019-1543](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1543). 
 IBM Cloud Provider v1.12.7-180 v1.12.8-210 Updated to support the Kubernetes 1.12.8 release. Also, fixed the update process for version 2.0 network load balancer that have only one available worker node for the load balancer pods. 
 Kubernetes v1.12.7 v1.12.8 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.12.8). 
 Kubernetes configuration N/A N/A The Kubernetes API server audit policy configuration is updated to not log the /openapi/v2* read-only URL. In addition, the Kubernetes controller manager configuration increased the validity duration of signed kubelet certificates from 1 to 3 years. 
 OpenVPN client configuration N/A N/A The OpenVPN client vpn-* pod in the kube-system namespace now sets dnsPolicy to Default to prevent the pod from failing when cluster DNS is down.
Key Management Service provider 221 237 Updated image for [CVE-2019-16276](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16276). 
 Kubernetes v1.15.4 v1.15.5 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.15.5). Update resolves [CVE-2019-11253](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11253) (see [IBM security bulletin](https://www.ibm.com/support/pages/node/1098759)){: external} and [CVE-2019-16276](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16276). 
 Kubernetes Metrics Server v0.3.4 v0.3.6 See the [Kubernetes Metrics Server release notes](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.3.6). The update also includes the following configuration changes to improve reliability and availability.<br><br><br><br> * Added [Kubernetes liveness and readiness probes](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/).<br> * Added [Kubernetes pod affinity rule](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/) to prefer scheduling to the same worker node as the OpenVPN client vpn pod in the kube-system namespace.<br> * Increased metrics resolution timeout from 30 to 45 seconds.<br><br><br>
Not Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-remediations-120) Shared 
 5.6.4 The default namespace should not be used. Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-remediations-120) Shared 









 IBM remediations and explanations 

Review information from IBM on the CIS Benchmark results.



Explanation and remediation

 Section Remediation/Explanation 

 1.2.1 IBM Cloud Kubernetes Service utilizes RBAC for cluster protection, but allows anonymous discovery, which is considered reasonable per [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/). 
 1.2.10 IBM Cloud Kubernetes Service does not enable the [EventRateLimit](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/eventratelimit) admission controller since it is a Kubernetes alpha feature. 
 1.2.12 IBM Cloud Kubernetes Service does not enable the [AlwaysPullImages](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/alwayspullimages) admission controller since it overrides a container's imagePullPolicy and may impact performance. 
 1.2.21 IBM Cloud Kubernetes Service enables profiling for cluster administrator troubleshooting purposes. 
 1.2.22 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server). 
 1.2.23 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server).
Additionally, the http2-max-streams-per-connection option is set to 1000 to mitigate network disruption impacts on the kubelet connection to the API server. 
 Kubernetes Dashboard Master v2.0.0 v2.0.1 See the [Kubernetes Dashboard release notes](https://github.com/kubernetes/dashboard/releases/tag/v2.0.1). 
 Load balancer and load balancer monitor for IBM Cloud Provider Master 211 223 Improved startup performance of version 2.0 private network load balancers (NLBs). 
 Ubuntu 18.04 packages Worker 4.15.0-101-generic 4.15.0-106-generic Updated worker node images with kernel and package updates for [CVE-2018-8740](https://nvd.nist.gov/vuln/detail/CVE-2018-8740), [CVE-2019-17023](https://nvd.nist.gov/vuln/detail/CVE-2019-17023), [CVE-2020-0543](https://nvd.nist.gov/vuln/detail/CVE-2020-0543), [CVE-2020-12049](https://nvd.nist.gov/vuln/detail/CVE-2020-12049), [CVE-2020-12399](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12399), [CVE-2020-13434](https://nvd.nist.gov/vuln/detail/CVE-2020-13434), [CVE-2020-13630](https://nvd.nist.gov/vuln/detail/CVE-2020-13630), and [CVE-2020-13632](https://nvd.nist.gov/vuln/detail/CVE-2020-13632).
For more information, see the [Cluster autoscaler add-on change log](https://cloud.ibm.com/docs/openshift?topic=openshift-ca_changelog).





 12 January 2021 

Ingress resources
: Added example Ingress resource definitions that are compatible with Kubernetes version 1.19.

Kubernetes benchmarks
: Added how to [run the CIS Kubernetes benchmark tests on your own worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmarkcis-worker-test).

Removal of data center support
: Updated the documentation to reflect that Melbourne (mel01) is no longer available as an option to create IBM Cloud resources in.





 6 January 2021 

Master versions
: Master fix pack update change log documentation is available.
: [4.5.24_1525_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-changelog_archive4524_1525), [4.4.31_1529_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-changelog_archive4431_1529), [4.3.40_1550_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-changelog_archive4340_1550), and [3.11.346_1577_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_changelog_311311346_1577).







 December 2020 



 21 December 2020 

Gateway firewalls and Calico policies
Kubernetes configuration Master N/A N/A The Kubernetes API server audit policy configuration is updated to include auditing the apiextensions.k8s.io API group and the persistentvolumeclaims and persistentvolumes resources. Additionally, the http2-max-streams-per-connection option is set to 1000 to mitigate network disruption impacts on the kubelet connection to the API server. 
 Kubernetes Dashboard Master v2.0.0 v2.0.1 See the [Kubernetes Dashboard release notes](https://github.com/kubernetes/dashboard/releases/tag/v2.0.1). 
 Ubuntu 18.04 packages Worker 4.15.0-101-generic 4.15.0-106-generic Updated worker node images with kernel and package updates for [CVE-2018-8740](https://nvd.nist.gov/vuln/detail/CVE-2018-8740), [CVE-2019-17023](https://nvd.nist.gov/vuln/detail/CVE-2019-17023), [CVE-2020-0543](https://nvd.nist.gov/vuln/detail/CVE-2020-0543), [CVE-2020-12049](https://nvd.nist.gov/vuln/detail/CVE-2020-12049), [CVE-2020-12399](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12399), [CVE-2020-13434](https://nvd.nist.gov/vuln/detail/CVE-2020-13434), [CVE-2020-13630](https://nvd.nist.gov/vuln/detail/CVE-2020-13630), and [CVE-2020-13632](https://nvd.nist.gov/vuln/detail/CVE-2020-13632).
Key Management Service provider 277 v1.0.0 Updated the IBM Key Protect Go client. 
 Kubernetes Dashboard v2.0.0-rc5 v2.0.0-rc7 See the [Kubernetes Dashboard release notes](https://github.com/kubernetes/dashboard/releases/tag/v2.0.0-rc7). Added a readiness probe to the Kubernetes Dashboard configuration. 
 Kubernetes Dashboard metrics scraper v1.0.3 v1.0.4 See the [Kubernetes Dashboard metrics scraper release notes](https://github.com/kubernetes-sigs/dashboard-metrics-scraper/releases/tag/v1.0.4). 
 OpenVPN client N/A N/A Fixed problem that might cause the vpn-config secret in the kube-system namespace to be deleted during cluster master operations. 
 Operator Lifecycle Manager Catalog v1.5.11 v1.6.1 See the [Operator Lifecycle Manager Catalog release notes](https://github.com/operator-framework/operator-registry/releases/tag/v1.6.1). 







 Change log for worker node fix pack 1.17.4_1521, released 13 April 2020 

The following table shows the changes that are in the worker node fix pack 1.17.4_1521. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.17.4_1520

 Component Previous Current Description 

 HA proxy 1.8.23 1.8.25 See the [HA proxy change logs](https://www.haproxy.org/download/1.8/src/CHANGELOG). The update addresses [CVE-2020-11100](https://nvd.nist.gov/vuln/detail/CVE-2020-11100).
IBM Cloud RBAC operator Master N/A 08ce50e New!: Added a control plane operator to synchronize [IBM Cloud Identity and Access Management (IAM) service access roles](https://cloud.ibm.com/docs/containers?topic=containers-iam-service-access-roles) with Kubernetes role-based access control (RBAC) roles. 
 Kubernetes Both v1.18.3 v1.18.4 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.18.4). The master update resolves CVE-2020-8558 (see the [IBM security bulletin](https://www.ibm.com/support/pages/node/6249905)). 
 Kubernetes configuration Master N/A N/A The Kubernetes API server audit policy configuration is updated to include auditing the apiextensions.k8s.io API group and the persistentvolumeclaims and persistentvolumes resources. Additionally, the http2-max-streams-per-connection option is set to 1000 to mitigate network disruption impacts on the kubelet connection to the API server. 
 Kubernetes Dashboard Master v2.0.0 v2.0.1 See the [Kubernetes Dashboard release notes](https://github.com/kubernetes/dashboard/releases/tag/v2.0.1). 
 Load balancer and load balancer monitor for IBM Cloud Provider Master 211 223 Improved startup performance of version 2.0 private network load balancers (NLBs).
Review this [release note](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions) for details.

ibmcloud ks worker update --cluster CLUSTER --worker WORKER_ID [-f] [-q]

Minimum required permissions
: Operator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster where you list available worker nodes.

-w, --worker WORKER
: Specify a worker node ID. To reload multiple worker nodes, use multiple options, such as -w worker1_id -w worker2_id.

-f
: Optional: Force the command to run with no user prompts.

-q
: Optional: Do not show the message of the day or update reminders.



 Example worker update command 

ibmcloud ks worker update --cluster my_cluster -w kube-dal10-cr18a61a63a6a94b658596aa93d087aaa9-w1 -w kube-dal10-cr18a61a63a6a94b658596aa93d087aaa9-w2









 worker-pool commands 

View and modify worker pools for a cluster.



 ibmcloud ks worker-pool create classic 

Classic infrastructure

You can create a worker pool in your cluster. When you add a worker pool, it is not assigned a zone by default. You specify the number of workers that you want in each zone and the flavors for the workers. The worker pool is given the default Kubernetes versions. To finish creating the workers, [add a zone or zones](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_zone_add) to your pool.
You might use these webhooks with Helm charts or admission controller projects such as Portieris. 
 IBM Cloud Provider v1.11.3-100 v1.11.3-127 Added the service.kubernetes.io/ibm-load-balancer-cloud-provider-vlan annotation to specify the VLAN that the load balancer service deploys to. To see available VLANs in your cluster, run ibmcloud ks vlan ls --zone <zone>. 
 TPM-enabled kernel N/A N/A Bare metal worker nodes with TPM chips for Trusted Compute use the default Ubuntu kernel until trust is enabled. If you [enable trust](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-cli) on an existing cluster, you need to [reload](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_worker_reload) any existing bare metal worker nodes with TPM chips. To check if a bare metal worker node has a TPM chip, review the Trustable field after running the ibmcloud ks flavors --zone[command](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_machine_types). 







 Change log for master fix pack 1.11.3_1531, released 1 November 2018 

The following table shows the changes that are in the master fix pack 1.11.3_1531.



Changes since version 1.11.3_1527

 Component Previous Current Description 

 Cluster master N/A N/A Updated the cluster master configuration to increase high availability (HA). Clusters now have three Kubernetes master replicas that are set up with a highly available (HA) configuration, with each master deployed on separate physical hosts. 
 Cluster master HA proxy N/A 1.8.12-alpine Added an ibm-master-proxy-* pod for client-side load balancing on all worker nodes, so that each worker node client can route requests to an available HA master replica.
For more information, see [Create Pod that uses the container runtime default seccomp profile](https://kubernetes.io/docs/tutorials/security/seccomp/create-pod-that-uses-the-container-runtime-default-seccomp-profile). 
 Unsupported: Select Kubernetes API server metrics removed The following Kubernetes API service metrics were removed: priority_level_seat_count_watermarks, priority_level_request_count_watermarks and read_vs_write_request_count_watermarks. If you rely on these removed metrics, update accordingly. 
 Unsupported: Select Kubernetes API server metrics replaced The following Kubernetes API service metrics were replaced: priority_level_seat_count_samples is replaced by priority_level_seat_utilization, priority_level_request_count_samples is replaced by priority_level_request_utilization and read_vs_write_request_count_samples is replaced by read_vs_write_current_requests. If you rely on these replaced metrics, update accordingly. 
 Service account tokens are not automatically generated The LegacyServiceAccountTokenNoAutoGeneration feature gate has been enabled. As a result, secrets containing service account tokens are no longer automatically generated. Use the TokenRequest API to acquire service account tokens. Or if a non-expiring service account token is required, follow the [Service account token Secrets guide](https://kubernetes.io/docs/concepts/configuration/secret/service-account-token-secrets) to create one. During an upgrade to IKS version 1.25, existing service account token secrets remain in the cluster and continue to function as expected. 
 Application updates required for natPortRange changes. Updates might be required if your app makes a lot of egress network connections from pod-network pods out to something external to the cluster. For example, if your app or has either 30,000+ of egress connections open on a single worker node at once, or opens over 30,000 egress connections on a single worker node within a few minutes of each other.
: Updated information for various service binding, logging, and nlb operations in the [user access](https://cloud.ibm.com/docs/containers?topic=containers-access_reference) and [CLI reference](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-cli) pages.





 7 May 2019 

Cluster DNS provider
: [Explained the benefits of CoreDNS](https://cloud.ibm.com/docs/containers?topic=containers-cluster_dns) now that clusters that run Kubernetes 1.14 and later support only CoreDNS.

Edge nodes
: Added private load balancer support for [edge nodes](https://cloud.ibm.com/docs/containers?topic=containers-edge).

Free clusters
: Clarified where free clusters are supported.

New! Integrations
: Added and restructure information about [IBM Cloud services and third-party integrations](https://cloud.ibm.com/docs/containers?topic=containers-ibm-3rd-party-integrations), [popular integrations](https://cloud.ibm.com/docs/containers?topic=containers-supported_integrations), and [partnerships](https://cloud.ibm.com/docs/containers?topic=containers-service-partners).

New! Kubernetes version 1.14
: Create or update your clusters to [Kubernetes 1.14](https://cloud.ibm.com/docs/containers?topic=containers-cs_versionsk8s_version_archive).

Deprecated Kubernetes version 1.11
: [Update any clusters](https://cloud.ibm.com/docs/containers?topic=containers-update) that run [Kubernetes 1.11](https://cloud.ibm.com/docs/containers?topic=containers-cs_versionsk8s_version_archive) before they become unsupported.

Permissions
: Added an FAQ, [What access policies do I give my cluster users?]
Update any [DNS egress network policies](https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/dns/nodelocaldnsnetwork-policy-and-dns-connectivity) that are impacted by zone-aware DNS, such as policies that rely on pod or namespace selectors for DNS egress. Run the following command to get a list of your network policies.

kubectl get networkpolicy --all-namespaces -o yaml
2. Label the coredns ConfigMap in the kube-system namespace with ibm-cloud.kubernetes.io/deploy-zone-aware-dns=true.

kubectl label cm -n kube-system coredns --overwrite "ibm-cloud.kubernetes.io/deploy-zone-aware-dns=true"
3. [Refresh the cluster master](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_apiserver_refresh) to deploy the zone-aware DNS resources.

ibmcloud ks cluster master refresh -c <cluster_name_or_ID>
4. Watch for the refresh operation to complete by [reviewing the Master Health in the cluster details](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_cluster_get).

ibmcloud ks cluster get -c <cluster_name_or_ID>
5. If you [customized stub domains and upstream DNS servers for CoreDNS](https://cloud.ibm.com/docs/containers?topic=containers-cluster_dnsdns_customize), you must also [customize the NodeLocal DNS cache](https://cloud.ibm.com/docs/containers?topic=containers-cluster_dnsdns_nodelocal_customize) with these stub domains and upstream DNS servers.
6. Set an environment variable for the zones of the cluster.
Updated image for [CVE-2021-22946](https://nvd.nist.gov/vuln/detail/CVE-2021-22946). 
 Konnectivity agent v0.0.24_262_iks v0.0.24_268_iks Update to use Go version 1.16.9. 
 Konnectivity server v0.0.24_262_iks v0.0.24_268_iks Update to use Go version 1.16.9. 
 Kubernetes v1.22.2 v1.22.3 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.22.3). Changed the duration of the Kubernetes API server certificate from 825 days to 365 days. Changed the duration of the cluster CA certificate from 30 to 10 years. 
 Load balancer and load balancer monitor for IBM Cloud Provider 1547 1590 Updated to use Go version 1.16.9. 







 Change log for worker node fix pack 1.22.2_1528, released 10 November 2021 

The following table shows the changes that are in the worker node fix pack patch update 1.22.2_1528. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.22.2_1527

 Component Previous Current Description