vania-janet/multiturn-rag-retrieval-data huggingface dataset:
For more information about the pod security admission controller, see [Configuring Pod Security admission](https://cloud.ibm.com/docs/openshift?topic=openshift-pod-security-admission).



 Update before master 

The following table shows the actions that you must take before you [update the cluster master](https://cloud.ibm.com/docs/openshift?topic=openshift-updatemaster).



Changes to make before you update the master to Red Hat OpenShift 4.11

 Type Description 

 Unsupported: Deprecated and removed Red Hat OpenShift features For more information, review the [Red Hat OpenShift version 4.11 deprecated and removed features](https://docs.openshift.com/container-platform/4.11/release_notes/ocp-4-11-release-notes.htmlocp-4-11-deprecated-removed-features). 
 Known Red Hat OpenShift issues For more information about possible required actions, review [Red Hat OpenShift version 4.11 known issues](https://docs.openshift.com/container-platform/4.11/release_notes/ocp-4-11-release-notes.htmlocp-4-11-known-issues). 
 LegacyServiceAccountTokenNoAutoGeneration feature gate is enabled For more information, review possible required actions in the LegacyServiceAccountTokenNoAutoGeneration is on by default section of the[Red Hat OpenShift version 4.11 notable technical changes](https://docs.openshift.com/container-platform/4.11/release_notes/ocp-4-11-release-notes.htmlocp-4-11-notable-technical-changes). 
 Red Hat OpenShift web console redirect changed Cluster server URL no longer redirects to the Red Hat OpenShift web console. You must add /console to the URL for the redirect. 







 Update after master 



Changes to make after you update the master to Red Hat OpenShift 4.11

 Type Description
"scope": "117458e26512b0308d93cf6852958e5e875294a982d2b4ea2e9f463b4551a846"
},
"assets": [
{
"hash": "cdd3ee20188d2f5bfb7f14bdb9c7fa99b22184ca195d9fa0a953dfbe9b1769cb",
"uri": "https://github.ibm.com/cocoa-test/e2e-hello-compliance-app-20220412084808399.git8c2a65373cb4fd27bccff646e8bdf63d02cae856",
"url": "https://s3.private.us-south.cloud-object-storage.appdomain.cloud/test/assets/cdd3ee20188d2f5bfb7f14bdb9c7fa99b22184ca195d9fa0a953dfbe9b1769cb/index.json"
}
],
"issues": [
"https://github.ibm.com/cocoa-test/e2e-compliance-incident-issues-20220412084808401/issues/1",
"https://github.ibm.com/cocoa-test/e2e-compliance-incident-issues-20220412084808401/issues/2",
"https://github.ibm.com/cocoa-test/e2e-compliance-incident-issues-20220412084808401/issues/3",
],
"attachments": [
{
"hash": "9a841ef856a5de813dbe440b102b9bff3ca1831630292cff7323c557704f386b",
Why does my cluster upgrade fail due to Pod Security upgrade prerequisites? 

 What’s happening 

When you upgrade your IBM Cloud Kubernetes Service from Kubernetes version 1.24 to version 1.25, the upgrade fails and you see an error message similar to the following example.

Version update cancelled. CAE009: Cannot complete cluster master operations because the cluster does not pass Pod Security upgrade prerequisites. Reason: [ClusterRoleBinding 'restricted-psp-user' does not have expected subjects]. For more information, see the troubleshooting docs: 'https://ibm.biz/master_pod_security_upgrade_iks_125'

 Why it’s happening 

The Kubernetes PodSecurityPolicy admission controller was removed in Kubernetes 1.25 and replaced with a new Pod Security Admission controller.

To safely upgrade IBM Cloud Kubernetes Service clusters from version 1.24 to version 1.25, the cluster PodSecurityPolicies (PSP) and associated role-based access control must satisfy the following prerequisites.



* No PSPs beyond the 5 IBM Cloud defined PSPs can exist.
* The IBM Cloud defined cluster role bindings that give all users and service accounts authority to use the IBM Cloud defined privileged and restricted PSPs must exist.



These prerequisites ensure that the cluster's version 1.24 PodSecurityPolicy configuration is equivalent to version 1.25 Pod Security Admission configuration and the upgrade and switch to Pod Security Admission does not break existing applications. Note these prerequisite do not preclude use of third party pod security providers.

Before you begin



* Review the [1.25 version information and update actions](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_125).
* Review the [Migrating from PSPs to Pod Security Admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission-migration) guide.



If you are not ready to migrate to Pod Security Admission, you can clear the status message by performing a cluster master refresh.

 How to fix it
For more information, see [Deprecated API Migration Guide - v1.25](https://kubernetes.io/docs/reference/using-api/deprecation-guide/v1-25). 
 Unsupported: Pod Security Policies [Pod Security Policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/) have been removed in Kubernetes version 1.25. See [Migrating from PSPs to Pod Security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission-migration) and the Kubernetes [Deprecated API Migration Guide](https://kubernetes.io/docs/reference/using-api/deprecation-guide/psp-v125) for more information. IBM Cloud Kubernetes Service version 1.25 now configures [Pod Security Admission](https://kubernetes.io/docs/concepts/security/pod-security-admission/) and no longer supports [Pod Security Policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 Unsupported: Pod kubectl.kubernetes.io/default-logs-container annotation Pods no longer support the kubectl.kubernetes.io/default-logs-container annotation. This annotation has been replaced by the kubectl.kubernetes.io/default-container annotation. If your pods rely on the unsupported annotation, update them to use the kubectl.kubernetes.io/default-container annotation instead. For more information, see [Well-Known Labels, Annotations and Taints](https://kubernetes.io/docs/reference/labels-annotations-taints/).
container-service[kubernetes-service/ks] 1.0.531 false
cra 1.3.7 false
doi 0.4.3 false
schematics[sch] 1.12.10 true
secrets-manager[sm] 2.0.1 true

 ibmcloud dev
3.1.0

 java
openjdk version "17.0.7" 2023-04-18
IBM Semeru Runtime Open Edition 17.0.7.0 (build 17.0.7+7)
Eclipse OpenJ9 VM 17.0.7.0 (build openj9-0.38.0, JRE 17 Linux amd64-64-Bit Compressed References 20230418_480 (JIT enabled, AOT enabled)
OpenJ9 - d57d05932
OMR - 855813495
JCL - 9d7a231edbc based on jdk-17.0.7+7)

 ant
Apache Ant(TM) version 1.10.13 compiled on January 4 2023

 mvn
Apache Maven 3.9.3 (21122926829f1ead511c958d89bd2f672198ae9f)
Maven home: /opt/IBM/maven
Java version: 17.0.7, vendor: IBM Corporation, runtime: /usr/local/jdk17
Default locale: en_US, platform encoding: ANSI_X3.4-1968
OS name: "linux", version: "6.3.8-200.fc38.aarch64", arch: "amd64", family: "unix"

 gradle

Welcome to Gradle 8.2!

Here are the highlights of this release:
- Kotlin DSL: new reference documentation, assignment syntax by default
- Kotlin DSL is now the default with Gradle init
- Improved suggestions to resolve errors in console output

For more details see https://docs.gradle.org/8.2/release-notes.html
(https://cloud.ibm.com/docs/openshift?topic=openshift-ts-app-image-pullts-app-image-pull)



* [Troubleshooting image pull secrets that use API keys](https://cloud.ibm.com/docs/openshift?topic=openshift-ts-app-image-pullimg-pull-api-key)



[Why don't my containers start?](https://cloud.ibm.com/docs/openshift?topic=openshift-ts-app-container-startts-app-container-start)



* [Fixing registry quota issues](https://cloud.ibm.com/docs/openshift?topic=openshift-ts-app-container-startregitry-quota)
* [Fixing IP address issues](https://cloud.ibm.com/docs/openshift?topic=openshift-ts-app-container-startcalico-ips)



* [Step 1: Releasing individual IP addresses](https://cloud.ibm.com/docs/openshift?topic=openshift-ts-app-container-startindividual-ips)
* [Step 2: Releasing IP address blocks](https://cloud.ibm.com/docs/openshift?topic=openshift-ts-app-container-startreleasing-individual-ips)





[Why do pods remain in pending state?](https://cloud.ibm.com/docs/openshift?topic=openshift-ts-app-pod-pendingts-app-pod-pending)

[Why are pods in a CrashLoopBackOff status?](https://cloud.ibm.com/docs/openshift?topic=openshift-ts-app-pod-crashloopts-app-pod-crashloop)

[Why do pods repeatedly fail to restart or are unexpectedly removed?]
kubectl get mutatingwebhookconfiguration <name> -o yaml > mutatingwebhook-backup.yaml

kubectl get validatingwebhookconfiguration <name> -o yaml > validatingwebhook-backup.yaml
5. Check the status of the related service and pods for the webhook.



1. Check the service Type, Selector, and Endpoint fields.

kubectl describe service -n <namespace> <service_name>
2. If the service type is ClusterIP, check that the Konnectivity pod is in a Running status so that the webhook can connect securely to the Kubernetes API in the cluster master. If the pod is not healthy, check the pod events, logs, worker node health, and other components to troubleshoot.



* Check the Konnectivity agent pods.

kubectl describe pods -n kube-system -l app=konnectivity-agent



3. If the service does not have an endpoint, check the health of the backing resources, such as a deployment or pod. If the resource is not healthy, check the pod events, logs, worker node health, and other components to troubleshoot. For more information, see [Debugging app deployments](https://cloud.ibm.com/docs/containers?topic=containers-debug_apps).

kubectl get all -n my-service-namespace -l <key=value>
4. If the service does not have any backing resources, or if troubleshooting the pods does not resolve the issue, remove the mutating or validating webhook configuration identified earlier.

kubectl delete validatingwebhookconfiguration NAME

kubectl delete mutatingwebhookconfiguration NAME



6. Retry the cluster master operation, such as updating the cluster.
7. If you still see the error, you might have worker node or network connectivity issues.
container-service/kubernetes-service 1.0.233 false
doi 0.3.1 false
schematics 1.5.1 false

 ibmcloud dev --version
ibmcloud dev version 2.6.0

 java -version
openjdk version "11.0.10" 2021-01-19
OpenJDK Runtime Environment AdoptOpenJDK (build 11.0.10+9)
Eclipse OpenJ9 VM AdoptOpenJDK (build openj9-0.24.0, JRE 11 Linux amd64-64-Bit Compressed References 20210120_910 (JIT enabled, AOT enabled)
OpenJ9 - 345e1b09e
OMR - 741e94ea8
JCL - 0a86953833 based on jdk-11.0.10+9)

 ant -version
Apache Ant(TM) version 1.10.9 compiled on September 27 2020

 mvn -version
Apache Maven 3.6.3 (cecedd343002696d0abb50b32b541b8a6ba2883f)
Maven home: /opt/IBM/maven
Java version: 11.0.10, vendor: AdoptOpenJDK, runtime: /usr/local/openjdk-11
Default locale: en_US, platform encoding: UTF-8
OS name: "linux", version: "4.19.121-linuxkit", arch: "amd64", family: "unix"

 gradle -version

Welcome to Gradle 6.8.3!

Here are the highlights of this release:
- Faster Kotlin DSL script compilation
- Vendor selection for Java toolchains
- Convenient execution of tasks in composite builds
- Consistent dependency resolution

For more details see https://docs.gradle.org/6.8.3/release-notes.html
For more information, see [FCM error response codes for downstream messages](https://firebase.google.com/docs/cloud-messaging/http-server-referror-codes).
* APNS or Safari devices:



* Unregistered - the device token is not active for the specified topic.
* BadDeviceToken - the specified device token is invalid.
* DeviceTokenNotForTopic - the device token doesn’t match the specified topic (bundle ID).



For more information on how to handle notification responses from apps, see [here](https://developer.apple.com/documentation/usernotifications/setting_up_a_remote_notification_server/handling_notification_responses_from_apns).
* Chrome or Firefox devices:



* NotFound - the subscription is expired and can’t be used.
* Gone - the subscription is no longer valid.



For more information, see [web push protocol](https://web.dev/push-notifications-web-push-protocol/).







 What is the difference between Event Notifications Topic Subscriptions and Event Notifications Tag Subsciptions to push devices? 



* Event Notifications Topic subscriptions:

For the topic subscriptions, start by creating a Topic and write conditions on that topic. This topic is responsible for routing the incoming notification that satisfies the topic conditions.

You can subscribe to multiple Event Notifications destinations like email, SMS, webhooks, slack, and Microsoft teams. Also, you can subscribe push type destinations like android, iOS, Firefox, chrome, and safari.

If the incoming notifications satisfy the condition written for Topic (T), it routes the notification to all the destinations subscribed or connected to Topic (T) irrespective of the type of destinations.

For example, ACME Bank wants to route maintenance event notifications to customers by using android and iOS devices. Acme Bank is following these steps:



1. Create a topic named ACME-Maintenance.
2. Write Advance condition $.notification-type == 'maintenance'.
3. Subscribe push android and push iOS destinations to the above topic.
cocoa inventory add 

Adds a value to the inventory repository. Creates a file with the name option, if it does not exist otherwise overwrites it.

Required Environment Variables:

GHE_ORG= Github Organization (required if --org option is not specified).
GHE_REPO= Github Repository (required if --repo option is not specified).

Required Environment Variables, if you are using GitHub:

GHE_TOKEN= Github Enterprise API Token(Optional if you are using --git-token-path)

Options for Git:

--git-token-path (Optional) Github Token's path
--git-api-url (Optional) Github API url



Table 1. Options for Git

 Option Description Value type Required or default value 

 artifact Artifact name. String Required 
 version The version of the application. String Required 
 repository-url The repository of the application. String Required 
 pipeline-run-id The id of the pipeline run. String Required 
 commit-sha The commit of the application repository from which the artifact is built String Required 
 name The name of the application the artifact belongs to String Required 
 build-number The number of the build. number Required 
 org The GitHub organization that owns the inventory repository. String 
 repo The name of the inventory repository. String 
 app-artifacts Arbitrary app content in JSON format String 
 type Type of the artifact String Required 
 sha256 The sha256 hash of the artifact String Required 
 provenance URL pointing to the artifact (for example, built image) String Required 
 signature The artifact's signature String Required 
 environment The name of the environment where the entry is added. String master 
 git-provider* The Git version control service provider. String* github 
 git-token-path Git token path to read the secret from String 
 git-api-url Git API URL String 



Running the command:
If restarting your pod does not resolve the issue, [reload your worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_worker_reload).
3. Verify that you use the latest IBM Cloud and IBM Cloud Kubernetes Service plug-in version.

ibmcloud update

ibmcloud plugin repo-plugins

ibmcloud plugin update







 Verifying that the storage driver and plug-in pods show a status of Running 

Follow the steps to check the status of your storage driver and plug-in pods and review any error messages.



1. List the pods in the kube-system project.

oc get pods -n kube-system
2. If the storage driver and plug-in pods don't show a Running status, get more details of the pod to find the root cause. Depending on the status of your pod, the following commands might fail.



1. Get the names of the containers that run in the driver pod.

kubectl describe pod <pod_name> -n kube-system
2. Export the logs from the driver pod to a logs.txt file on your local machine.

oc logs <pod_name> -n kube-system > logs.txt
3. Review the log file.

cat logs.txt



3. Check the latest logs for any error messages. [Review the File Storage for Classic troubleshooting documentation for steps to resolve common errors](https://cloud.ibm.com/docs/openshift?topic=openshift-sitemapsitemap_file_storage).







 Checking whether your PVC is successfully provisioned. 

Follow the steps to check the status of your PVC and review any error messages.



1. Check the status of your PVC. A PVC is successfully provisioned if the PVC shows a status of Bound.

oc get pvc



* If the PVC shows a status of Bound, the PVC is successfully provisioned.

Example output
App Configuration notices 

The following App Configuration notices are included in this document:



* [CC-BY-3.0](https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-en-noticesCC-BY-3.0)
* [CC-BY-SA-4.0](https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-en-noticesCC-BY-SA-4.0)
* [SIL OPEN FONT LICENSE 1.1](https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-en-noticessil-ofl-1.1)





 CREATIVE COMMONS ATTRIBUTION 3.0 

The Program includes some or all of the following works licensed under the Creative Commons. The URL to the license is https://creativecommons.org/licenses/by/3.0/legalcode.



* FLAPPY (No Copyright Found) (https://proxy.golang.org/golang.org/x/mobile/@v/v0.0.0-20190312151609-d3739f865fa6.zip)
* GO1.HTML [github.com/hashicorp/go.net] (No copyright found) (https://github.com/hashicorp/go.net/archive/v0.0.1.zi)
* GODOC.HTML (No Copyright Found) (https://proxy.golang.org/golang.org/x/tools/@v/v0.1.2.zip)
* POLY [google.golang.org/api] (No Copyright Found) (https://proxy.golang.org/google.golang.org/api/@v/v0.13.0.zip)
* ABOUTIVY.HTML (No Copyright Found) (https://reneefrench.blogspot.com)







 CREATIVE COMMONS ATTRIBUTION SHARE ALIKE 4.0 GENERIC 

The Program includes some or all of the following works licensed under the Creative Commons.
For more information, see the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/).

livenessProbe:
httpGet:
path: /
port: 9080
initialDelaySeconds: 300
periodSeconds: 15
readinessProbe:
httpGet:
path: /
port: 9080
initialDelaySeconds: 45
periodSeconds: 5





 Pod Disruption Budget 

To increase your app's availability, you can control how your app reacts to [disruptions](https://kubernetes.io/docs/concepts/workloads/pods/disruptions/) based on the type of availability that you want with a PodDisruptionBudget object.

A pod disruption budget can help you plan how your app behaves during voluntary disruptions, such as when you initiate a direct restart by updating the app deployment, or involuntary disruptions, such as a kernel panic. minAvailable : You can specify the number or percentage of pods that must still be available after a disruption occurs.

maxUnavailable
: You can specify the number or percentage of pods that can be unavailable after a disruption occurs. The example uses maxUnavailable: 1.

selector
: Fill in the label to select the set of pods that the PodDisruptionBudget applies to. Note that if you used this same label in other pod deployments, the pod applies to those as well.

For more information, see the [Kubernetes documentation](https://kubernetes.io/docs/tasks/run-application/configure-pdb/).

apiVersion: policy/v1beta1
kind: PodDisruptionBudget
metadata:
name: wasliberty
spec:
maxUnavailable: 1
selector:
matchLabels:
app: wasliberty





 Exposing the app service 

You can create a service that exposes your app.
major: "1"
minor: "25"
platform: linux/amd64
kustomizeVersion: v4.5.7

 buildctl --version
buildctl github.com/moby/buildkit v0.11.5 252ae63bcf2a9b62777add4838df5a257b86e991

 helm version --client
version.BuildInfo{Version:"v3.11.2", GitCommit:"912ebc1cd10d38d340f048efaf0abda047c3468e", GitTreeState:"clean", GoVersion:"go1.18.10"}

 ibmcloud -version
ibmcloud version 2.15.0+79fb346-2023-02-21T22:06:52+00:00

 ibmcloud plugin list
Listing installed plug-ins...

Plugin Name Version Status Private endpoints supported
cloud-functions[wsk/functions/fn] 1.0.66 false
cloud-internet-services[cis] 1.14.11 true
code-engine[ce] 1.43.0 true
container-registry[cr] 1.0.6 true
container-service[kubernetes-service/ks] 1.0.498 false
cra 1.2.1 false
doi 0.4.2 false
schematics[sch] 1.12.8 true
secrets-manager 0.1.25 true

 ibmcloud dev --version
ibmcloud dev version 2.17.1

 java -version
openjdk version "17.0.6" 2023-01-17
IBM Semeru Runtime Open Edition 17.0.6.0 (build 17.0.6+10)
Eclipse OpenJ9 VM 17.0.6.0 (build openj9-0.36.0, JRE 17 Linux amd64-64-Bit Compressed References 20230117_397 (JIT enabled, AOT enabled)
[Pods in the openshift-markeplace namespace are in ImagePullBackOff](https://cloud.ibm.com/docs/openshift?topic=openshift-ts-openshift-marketplacets-openshift-marketplace)





 Cluster autoscaler 

[Debugging the cluster autoscaler](https://cloud.ibm.com/docs/openshift?topic=openshift-debug_cluster_autoscalerdebug_cluster_autoscaler)



* [Step 1: Check the version](https://cloud.ibm.com/docs/openshift?topic=openshift-debug_cluster_autoscalerca-debug-version)
* [Step 2: Check the configuration](https://cloud.ibm.com/docs/openshift?topic=openshift-debug_cluster_autoscalerca-debug-config)
* [Step 3: Review the cluster autoscaler status](https://cloud.ibm.com/docs/openshift?topic=openshift-debug_cluster_autoscalerca-debug-status)
* [Step 4: Check the cluster autoscaler pod](https://cloud.ibm.com/docs/openshift?topic=openshift-debug_cluster_autoscalerca-debug-pod)
* [Step 5: Search the pod logs](https://cloud.ibm.com/docs/openshift?topic=openshift-debug_cluster_autoscalerca-debug-pod-logs)
* [Step 5: Restart the pod](https://cloud.ibm.com/docs/openshift?topic=openshift-debug_cluster_autoscalerca-debug-pod-restart)
* [Step 6: Disable and reenable](https://cloud.ibm.com/docs/openshift?topic=openshift-debug_cluster_autoscalerca-debug-disable)
Why does PVC or pod creation fail due to not finding the Kubernetes secret? 

Virtual Private Cloud

Classic infrastructure

This troubleshooting topic applies only to Red Hat OpenShift clusters that run version 3.11.

  What’s happening 

When you create your PVC or deploy a pod that mounts the PVC, the creation or deployment fails.

Example error message for a PVC creation failure.

can't get credentials: can't get secret tsecret-key: secrets "secret-key" not found

Example error message for a pod creation failure.

persistentvolumeclaim "pvc-3" not found (repeated 3 times)

  Why it’s happening 

The Kubernetes secret that you created is not referenced correctly in your deployment yaml or is not set to the ibm/ibmc-s3fs type.

  How to fix it 

This task requires [Writer or Manager IBM Cloud IAM service access role](https://cloud.ibm.com/docs/openshift?topic=openshift-userschecking-perms) for all projects.



1.  List the secrets in your cluster and review the secret type. The secret must show ibm/ibmc-s3fs as the Type.

oc get secrets --all-namespaces
2.  If your secret does not show ibm/ibmc-s3fs as the Type, [re-create your secret](https://cloud.ibm.com/docs/openshift?topic=openshift-storage-cos-understandcreate_cos_secret).
3.  Check your YAML configuration file for your PVC and pod to verify that you used the correct secret.