vania-janet/multiturn-rag-retrieval-data huggingface dataset:
This process is also referred to as no root squash. An effective way of updating all your worker nodes is to use a daemon set, which runs a specified pod on every worker node in your cluster. In this case, the pod that is controlled by the daemon set updates each of your worker nodes to enable root permission on the volume mount path.

The deployment is configured to allow the daemon set pod to run in privileged mode, which is necessary to access the host file system. Running a pod in privileged mode does create a security risk, so use this option with caution.

While the daemon set is running, new worker nodes that are added to the cluster are automatically updated.

Before you begin:



* [Create persistent storage](https://cloud.ibm.com/docs/containers?topic=containers-file_storageadd_file).
* [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)



Steps:



1. Copy the norootsquash daemon set [deployment YAML file](https://github.com/IBM-Cloud/kube-samples/tree/master/daemonset-sample)
2. Create the norootsquash daemon set deployment.

kubectl apply -f norootsquash.yaml
3. Get the name of the pod that your storage volume is mounted to. This pod is not the same as the norootsquash pods.

kubectl get pods
4. Log in to the pod.

kubectl exec -it mypod /bin/bash
5. Verify that the permissions to the mount path are root.

root@mypod:/ ls -al /mnt/myvol/
total 8
drwxr-xr-x 2 root root 4096 Feb 7 20:49 .
drwxr-xr-x 1 root root 4096 Feb 20 18:19 .
: No. [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/) (PSPs) are originally based on Red Hat OpenShift SCCs. However, Red Hat OpenShift supports only SCCs, not PSPs.

The default Red Hat OpenShift SCCs are stricter than the default PSPs in community Kubernetes clusters. As such, app deployments that run in community Kubernetes clusters might need to be modified to run in Red Hat OpenShift.



 Customizing security context constraints 

To create, edit, list, delete, and otherwise manage security context constraints, see the [Red Hat OpenShift docs](https://docs.openshift.com/container-platform/4.11/authentication/managing-security-context-constraints.html). You can also authorize users or groups to the default security context constraints by using role-based access control such as clusterroles, clusterrolebindings, roles, and rolebindings. You can also use the oc adm policy subcommands, such as oc adm policy add-scc-to-user, to manage these settings. The oc version is the same as that of the cluster being managed.

Guidelines for assigning access to SCCs:



* Authorize specific service accounts to the SCC that is to be used by pods running under that service account.
* If a service account needs access to multiple SCCs, consider creating additional service accounts so that all pods running under a service account are expected to use the same SCC.
* Do not authorize all users or all service accounts to use any SCC other than the restricted (4.10 and earlier) or restricted-v2 (4.11 and later) SCCs.
* Do not change SCC authorization for service accounts in the openshift- namespaces. Red Hat OpenShift components are designed to run under specific SCCs and might not operate properly under a different SCC.







 Default Red Hat OpenShift security context constraints 

Red Hat OpenShift on IBM Cloud clusters come with the following security context constraints by default.
You can write one with just a few lines as follows.

apiVersion: v1
kind: Pod
metadata:
name: nginx
spec:
containers:
- name: nginx
image: nginx
ports:
- containerPort: 80

But you don't want to stop there. If the node that your pod runs on goes down, then your pod goes down with it and isn't rescheduled. Instead, use a [deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) to support pod rescheduling, replica sets, and rolling updates. A basic deployment is almost as easy to make as a pod. Instead of defining the container in the spec by itself, however, you specify replicas and a template in the deployment spec. The template has its own spec for the containers within it, such as follows.

apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx-deployment
spec:
replicas: 3
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
spec:
containers:
- name: nginx
image: nginx
ports:
- containerPort: 80
Show more

You can keep adding features, such as pod anti-affinity or resource limits, all in the same YAML file.

For a more detailed explanation of different features that you can add to your deployment, see [Making your app deployment YAML file](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_appsapp_yaml).





 What type of Kubernetes objects can I make for my app? 

When you prepare your app YAML file, you have many options to increase the app's availability, performance, and security. For example, instead of a single pod, you can use a Kubernetes controller object to manage your workload, such as a replica set, job, or daemon set.
* [ibmcloud ks cluster master pod-security unset](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clicluster-master-pod-security-unset)
* ibmcloud ks cluster master pod-security policy: View and modify the deprecated Pod Security policy configuration in supported clusters.



* [ibmcloud ks cluster master pod-security policy disable](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clicluster-master-pod-security-policy-disable)
* [ibmcloud ks cluster master pod-security policy enable](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clicluster-master-pod-security-policy-enable)
* [ibmcloud ks cluster master pod-security policy get](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clicluster-master-pod-security-policy-get)





* cluster master private-service-endpoint: Manage the private service endpoint of a cluster.



* ibmcloud ks cluster master private-service-endpoint allowlist: Manage the private service endpoint allowlist.



* [ibmcloud ks cluster master private-service-endpoint allowlist add](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_master_pse_allowlist_add)
* [ibmcloud ks cluster master private-service-endpoint allowlist disable](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_master_pse_allowlist_disable)
* [ibmcloud ks cluster master private-service-endpoint allowlist enable](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_master_pse_allowlist_enable)
Then, you also [tainted those edge nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-edgeedge_workloads) to prevent any other workloads from running on edge nodes. However, you didn't add an edge node affinity rule and toleration to your app deployment. Your app pods can't be scheduled on the same tainted nodes as the service pods, and no traffic reaches the back-end service for your app.
* Custom taints: You used custom taints on several nodes so that only app pods with that taint toleration can deploy to those nodes. You added affinity rules and tolerations to the deployments of your app and load balancer service so that their pods deploy to only those nodes. However, ibm-cloud-provider-ipkeepalived pods that are automatically created in the ibm-system namespace ensure that the load balancer and the app pods are always scheduled onto the same worker node. These keepalived pods don't have the tolerations for the custom taints that you used. They can't be scheduled on the same tainted nodes that your app pods are running on, and no traffic reaches the back-end service for your app.



 How to fix it 

Resolve the issue by choosing one of the following options:

Edge node taints: To ensure that your load balancer and app pods deploy to tainted edge nodes, [add edge node affinity rules and tolerations to your app deployment](https://cloud.ibm.com/docs/openshift?topic=openshift-loadbalancerlb_edge_nodes). Load balancer pods have these affinity rules and tolerations by default.

Custom taints: Remove custom taints that the keepalived pods don't have tolerations for. Instead, you can [label worker nodes as edge nodes, and then taint those edge nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-edge).

If you complete one of the previous options but the keepalived pods are still not scheduled, you can get more information about the keepalived pods:



1. Get the keepalived pods.
You can write one with just a few lines as follows.

apiVersion: v1
kind: Pod
metadata:
name: nginx
spec:
containers:
- name: nginx
image: nginx
ports:
- containerPort: 80

But you don't want to stop there. If the node that your pod runs on goes down, then your pod goes down with it and isn't rescheduled. Instead, use a [deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) to support pod rescheduling, replica sets, and rolling updates. A basic deployment is almost as easy to make as a pod. Instead of defining the container in the spec by itself, however, you specify replicas and a template in the deployment spec. The template has its own spec for the containers within it, such as follows.

apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx-deployment
spec:
replicas: 3
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
spec:
containers:
- name: nginx
image: nginx
ports:
- containerPort: 80
Show more

You can keep adding features, such as pod anti-affinity or resource limits, all in the same YAML file.

For a more detailed explanation of different features that you can add to your deployment, see [Making your app deployment YAML file](https://cloud.ibm.com/docs/containers?topic=containers-appapp_yaml).





 What type of Kubernetes objects can I make for my app? 

When you prepare your app YAML file, you have many options to increase the app's availability, performance, and security. For example, instead of a single pod, you can use a Kubernetes controller object to manage your workload, such as a replica set, job, or daemon set.
Not Scored 2 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-47cis-benchmark-remediations-47) Shared 
 5.6.4 The default namespace should not be used. Scored 2 Pass Shared 









 IBM remediations and explanations 

Review information from IBM on the CIS Benchmark results.



Explanation and remediation

 Section Remediation/Explanation 

 1.2.1 Red Hat OpenShift on IBM Cloud utilizes RBAC for cluster protection, but allows anonymous discovery, which is considered reasonable per [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/). 
 1.2.10 Red Hat OpenShift on IBM Cloud does not enable the [EventRateLimit](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/eventratelimit) admission controller since it is a Kubernetes alpha feature. 
 1.2.12 Red Hat OpenShift on IBM Cloud does not enable the [AlwaysPullImages](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/alwayspullimages) admission controller since it overrides a container's imagePullPolicy and may impact performance. 
 1.2.13 Red Hat OpenShift on IBM Cloud supports [pod security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scc) which are similar to Kubernetes pod security policies. 
 1.2.16 Red Hat OpenShift on IBM Cloud supports [pod security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scc) which are similar to Kubernetes pod security policies.
Not Scored 2 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-48cis-benchmark-remediations-48) Shared 
 5.6.4 The default namespace should not be used. Scored 2 Pass Shared 









 IBM remediations and explanations 

Review information from IBM on the CIS Benchmark results.



Explanation and remediation

 Section Remediation/Explanation 

 1.2.1 Red Hat OpenShift on IBM Cloud utilizes RBAC for cluster protection, but allows anonymous discovery, which is considered reasonable per [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/). 
 1.2.10 Red Hat OpenShift on IBM Cloud does not enable the [EventRateLimit](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/eventratelimit) admission controller since it is a Kubernetes alpha feature. 
 1.2.12 Red Hat OpenShift on IBM Cloud does not enable the [AlwaysPullImages](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/alwayspullimages) admission controller since it overrides a container's imagePullPolicy and may impact performance. 
 1.2.13 Red Hat OpenShift on IBM Cloud supports [pod security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scc) which are similar to Kubernetes pod security policies. 
 1.2.16 Red Hat OpenShift on IBM Cloud supports [pod security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scc) which are similar to Kubernetes pod security policies.
Supported browsers 

For a list of supported browsers, see [Required Browsers for IBM Cloud®](https://cloud.ibm.com/docs/overview?topic=overview-prereqs-platformbrowsers-platform).

For Safari, clear the options Prevent cross-site tracking and Block all cookies under Safari > Preferences > Privacy.

If you encounter problems when you use these browsers, disable your browser plug-ins.
They are only relevant in older pods, such as sjc01.pod01, and sng01.pod01. By default, all ports are configured into a redundant bond, even if not all ports are active, allowing for a seamless redundancy upgrade in the future. However, this default bonding can prevent PXE booting in some locations. The option causes ports to not be configured within a bond by default, regardless of the number of active interfaces. Modern data centers do not have a conflict with PXE booting and our default bonding configuration. Avoid use of this feature unless instructed by IBM Sales or Support.

For more information about network performance on IBM Cloud® Bare Metal Servers, check out this [blog post](https://www.ibm.com/cloud/blog/how-fast-is-the-network-on-ibm-cloud-part-1-bare-metal-servers).



 25 Gbps port speed 

The 25 Gbps port speed option is compatible with only the following 2U (12 drive) Cascade Lake processor servers:



* Intel Xeon 4210
* Intel Xeon 5218
* Intel Xeon 6248
* Intel Xeon 6250
* Intel Xeon 8260



Select pods in only the following data centers support the 25 Gbps port speed option:



Table 1. 25 Gbps network data centers

 Location Data center 

 Dallas DAL10, DAL12, DAL13 
 Frankfurt FRA02, FRA04, FRA05 
 London LON06 
 Tokyo TOK02, TOK04, TOK05 
 Toronto TOR04 
 Washington DC WDC04, WDC06, WDC07 



25 Gbps port speeds are available with the following operating systems:



* CentOS 8.2
* ESXi for Bare Metal Servers
* RHEL 8.2
* RHEL 8.2 for SAP
* Windows server 2016, 2019



For more information about 25 Gbps port speeds, check out this [blog post](https://www.ibm.com/cloud/blog/announcements/newly-released-25gbe-standard-on-ibm-cloud-bare-metal-servers).
Delete your PSPs and any associated Roles, ClusterRoles, RoleBindings, and ClusterRoleBindings. Make sure that the components you delete do not grant any other unrelated permissions that you might need elsewhere. Do not delete the following PSPs: ibm-privileged-psp, ibm-anyuid-psp, ibm-anyuid-hostpath-psp, ibm-anyuid-hostaccess-psp and ibm-restricted-psp. Do not delete the following ClusterRoles and ClusterRoleBindings: privileged-psp-user and restricted-psp-user.



If you need to re-enable PSPs in your 1.24 cluster, run ibmcloud ks cluster master pod-security policy enable --cluster <cluster>. This command updates the cluster master to use the PSP configuration.





 Step 7: Optional. Upgrade your cluster 

[Upgrade your cluster to version 1.25](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_125&interface=ui) to use Pod Security admission. Or, keep your cluster at version 1.24 with Pod Security admission enabled until you are ready to upgrade.







 References 

Review the following information before you migrate from Pod Security Policies to Pod Security Admission. Do not follow the migration guide as-is as some actions are not appropriate for IBM Cloud Kubernetes Service clusters.



* [Pod Security Admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission)
* [Migrate from PodSecurityPolicy to the Built-In PodSecurity Admission Controller](https://kubernetes.io/docs/tasks/configure-pod-container/migrate-from-psp/)
* [PSP to PSA tool](https://github.com/kubernetes-sigs/pspmigrator)
* [Why does my cluster upgrade fail due to Pod Security upgrade prerequisites?](https://cloud.ibm.com/docs/containers?topic=containers-ts-app-pod-security).
You can also specify the --service-subnet option to specify a custom subnet CIDR to provide private IP addresses for services. This option can be used only if you also enable Red Hat CoreOS with the --coreos-enabled flag. The subnet must be at least /24 or larger. The default value is 172.20.0.0/16.





 Defining the pod network interface when creating your location 

During location creation

When you create your location in the CLI, you can define the --pod-network-interface to set the pod network interface. The available methods are can-reach and interface.



* To provide a direct URL or IP address, specify can-reach=<url> or can-reach=<ip_address>. If the network interface can reach the provided URL or IP address, this option is used. For example, use can-reach=www.exampleurl.com for specifying a URL and can-reach=172.19.0.0 for specifying an IP address.
* To choose an interface with a Regex string, specify interface=<regex_string>; for example, interface=eth..



For more information, see the [ibmcloud sat location create](https://cloud.ibm.com/docs/satellite?topic=satellite-satellite-cli-referencelocation-create) command reference.





 Defining the pod network interface when creating your cluster 

During cluster creation

When you create your cluster in the CLI, you can define the --pod-network-interface to set the pod network interface. The available methods are can-reach and interface.



* To provide a direct URL or IP address, specify can-reach=<url> or can-reach=<ip_address>. If the network interface can reach the provided URL or IP address, this option is used. For example, use can-reach=www.exampleurl.com for specifying a URL and can-reach=172.19.0.0 for specifying an IP address.
* To choose an interface with a Regex string, specify interface=<regex_string>; for example, interface=eth..
The Kubernetes scheduler finds an available worker node, but the worker node has only enough resources to support the high and medium priority pods. The low-priority pod is not scheduled and it remains in pending.
3. Two pods with high and medium priority are pending scheduling. A third pod with low priority exists on an available worker node. However, the worker node does not have enough resources to schedule any of the pending pods. The Kubernetes scheduler preempts, or removes, the low-priority pod, which returns the pod to a pending state. Then, the Kubernetes scheduler tries to schedule the high priority pod. However, the worker node does not have enough resources to schedule the high priority pod, and instead, the Kubernetes scheduler schedules the medium priority pod.



For more information, see the Kubernetes documentation about [pod priority and preemption](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/).

Can I disable the pod priority admission controller?
: No. If you don't want to use pod priority, don't set a globalDefault or include a priority class in your pod deployments. Every pod defaults to zero, except the cluster-critical pods that IBM deploys with the [default priority classes](https://cloud.ibm.com/docs/containers?topic=containers-pod_prioritydefault_priority_class). Because pod priority is relative, this basic setup ensures that the cluster-critical pods are prioritized for resources, and schedules any other pods by following the existing scheduling policies that you have in place.

How do resource quotas affect pod priority?
: You can use pod priority in combination with resource quotas, including [quota scopes](https://kubernetes.io/docs/concepts/policy/resource-quotas/quota-scopes). With quota scopes, you can set up your resource quotas to account for pod priority. Higher priority pods get to consume system resources that are limited by the resource quota before lower priority pods.



 Understanding default priority classes
: Encryption: The masking of data to prevent visibility when data is accessed by an unauthorized user.



 Non-persistent storage 

Virtual Private Cloud

Classic infrastructure

Satellite

You can use non-persistent storage options if your data is not required to be persistently stored or if you want to unit-test your app components. The following image shows available non-persistent data storage options in Red Hat OpenShift on IBM Cloud.

Zoom

![Non-persistent data storage options](https://cloud.ibm.com/docs-content/v1/content/bce0f0917a9eea684d1b4b704ac6343a1f65f446/openshift/images/cs_storage_nonpersistent.svg)

Figure 1. Non-persistent data storage options



Figure 1. Non-persistent storage options

 Characteristics Inside the container On the worker node's primary or secondary disk 

 Multizone capable No No 
 Data types All All 
 Capacity Limited to the worker node's available secondary disk. To limit the amount of secondary storage that is consumed by your pod, use resource requests and limits for [ephemeral storage](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/local-ephemeral-storage). Limited to the worker node's available space on the primary (hostPath) or secondary disk (emptyDir). To limit the amount of secondary storage that is consumed by your pod, use resource requests and limits for [ephemeral storage](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/local-ephemeral-storage). 
 Data access pattern Read and write operations of any frequency Read and write operations of any frequency 
 Access Via the container's local file system Via [Kubernetes hostPath](https://kubernetes.io/docs/concepts/storage/volumes/hostpath) for access to worker node primary storage.