vania-janet/multiturn-rag-retrieval-data huggingface dataset:
(https://cloud.ibm.com/docs/containers?topic=containers-ts-kubectl-exec-timeoutts-kubectl-exec-timeout)



* [Links to additional information](https://cloud.ibm.com/docs/containers?topic=containers-ts-kubectl-exec-timeoutadditional-link-info)



[Why does my cluster master status say it is approaching its resource limit?](https://cloud.ibm.com/docs/containers?topic=containers-master_resource_limitmaster_resource_limit)

[Debugging the metrics-server](https://cloud.ibm.com/docs/containers?topic=containers-debug_metrics_serverdebug_metrics_server)

[Why does the Kubernetes dashboard terminate with an out of memory error?](https://cloud.ibm.com/docs/containers?topic=containers-ts-kube-dashboord-oomts-kube-dashboord-oom)



* [Changing the resource auto refresh time interval from the Kubernetes dashboard](https://cloud.ibm.com/docs/containers?topic=containers-ts-kube-dashboord-oomts-dashboard-auto-refresh)
* [Changing the resource auto refresh time interval from the command line](https://cloud.ibm.com/docs/containers?topic=containers-ts-kube-dashboord-oomts-dashboard-auto-refresh-cli)



[Why can't I create a new admin certificate?](https://cloud.ibm.com/docs/containers?topic=containers-ts_admin-certts_admin-cert)





 Worker nodes 

[Debugging worker nodes](https://cloud.ibm.com/docs/containers?topic=containers-debug_worker_nodesdebug_worker_nodes)
* file.bytes.out
* file.mount
* file.name







 14 August 2019 

New Kubernetes groupings
: Groupings for Kubernetes have been modified.

Enhanced event notification
: The ability to customize the subject and body of an alert notification with variables has been extended.

Units for metrics
: Introduction of a common metrics format to ease comparison.

Display instance name
: The instance name is now visible when creating and editing the instance name.

Kubernetes dashboard updates
: Kubernetes cluster and node capacity dashboards now have actual CPU and memory usage compared to requests, limits, and capacity that can be allocated.

In addition the Kubernetes health dashboard has been updated with metric aggregation across all containers running on the node.





 11 July 2019 

Enhanced dashboard menu
: Addition of a menu where you can add new dashboards and search for existing ones.

Customize alert notification template
: Added the ability to customize messages sent with alert notifications.

Prometheus remote scraping
: Added the ability to collect Prometheus metrics from remote endpoints.

Additional enhancements
: The following additional enhancements were added.



* Kafka integration support for authentication and SSL/TLS.
* Addition of new Kubernetes metrics for pod counts.







 1 December 2018 

Introducing IBM Cloud Monitoring
: IBM Cloud® Monitoring is a cloud-native, and container-intelligence management system that you can include as part of your IBM Cloud architecture. Use it to gain operational visibility into the performance and health of your applications, services, and platforms. It offers administrators, DevOps teams and developers full stack telemetry with advanced features to monitor and troubleshoot, define alerts, and design custom dashboards. In architectures that are focused on container and microservices, you can use Secure to protect, monitor, and enhance forensic analysis of your pipeline and runtime components. [Learn more](https://cloud.ibm.com/docs/monitoring?topic=monitoring-getting-started)
Kubernetes Dashboard metrics scraper v1.0.6 v1.0.7 See the [Kubernetes Dashboard metrics scraper release notes](https://github.com/kubernetes-sigs/dashboard-metrics-scraper/releases/tag/v1.0.7). 
 Kubernetes DNS autoscaler 1.8.3 1.8.4 See the [Kubernetes DNS autoscaler release notes](https://github.com/kubernetes-sigs/cluster-proportional-autoscaler/releases/tag/1.8.4). 
 Load balancer and load balancer monitor for IBM Cloud Provider 1328 1510 Updated image for [CVE-2020-27780](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27780). 
 Operator Lifecycle Manager 0.16.1-IKS-10 0.16.1-IKS-12 Updated image for [CVE-2021-36159](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36159). 







 Change log for worker node fix pack 1.20.9_1549, released 16 August 2021 

The following table shows the changes that are in the worker node fix pack patch update 1.20.9_1549. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.20.9_1548

 Component Previous Current Description 

 Ubuntu 18.04 packages 4.15.0-151 4.15.0-153 N/A 
 HA proxy 68e6b3 9c98dc Updated image with fixes for [CVE-2021-27218](https://nvd.nist.gov/vuln/detail/CVE-2021-27218). 







 Change log for worker node fix pack 1.20.9_1548, released 02 August 2021
Kubernetes v1.19.13 v1.19.14 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.19.14). 
 Kubernetes Dashboard metrics scraper v1.0.6 v1.0.7 See the [Kubernetes Dashboard metrics scraper release notes](https://github.com/kubernetes-sigs/dashboard-metrics-scraper/releases/tag/v1.0.7). 
 Kubernetes DNS autoscaler 1.8.3 1.8.4 See the [Kubernetes DNS autoscaler release notes](https://github.com/kubernetes-sigs/cluster-proportional-autoscaler/releases/tag/1.8.4). 
 Load balancer and load balancer monitor for IBM Cloud Provider 1328 1510 Updated image for [CVE-2020-27780](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27780). 
 Operator Lifecycle Manager 0.16.1-IKS-10 0.16.1-IKS-12 Updated image for [CVE-2021-36159](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36159). 







 Change log for worker node fix pack 1.19.13_1556, released 16 August 2021 

The following table shows the changes that are in the worker node fix pack patch update 1.19.13_1556. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.19.13_1555

 Component Previous Current Description 

 Ubuntu 18.04 packages 4.15.0-151 4.15.0-153 N/A
* [node file](https://raw.githubusercontent.com/IBM-Cloud/kube-samples/master/cis-kube-benchmark/cis-1.5/ibm/node.yaml)



2. Create the ConfigMap by using the --from-file option to specify the ibm directory where your downloaded the configuration files.

kubectl create cm kube-bench-node -n ibm-kube-bench-test --from-file ibm



3. Create a job to run the benchmark test based on the configurations that you previously created.

kubectl apply -n ibm-kube-bench-test -f https://raw.githubusercontent.com/IBM-Cloud/kube-samples/master/cis-kube-benchmark/cis-1.5/ibm/job-node.yaml
4. Check that the job completed.

kubectl get pods -n ibm-kube-bench-test -l job-name=kube-bench-node

Example output

NAME READY STATUS RESTARTS AGE
kube-bench-node-hlvhc 0/1 Completed 0 23s
5. Review the CIS Kubernetes benchmark results for your worker nodes by checking the pod logs.

kubectl logs -n ibm-kube-bench-test -l job-name=kube-bench-node --tail=-1

Example output

== Summary ==
20 checks PASS
2 checks FAIL
1 checks WARN
0 checks INFO
6. Optional: When you are done reviewing results, delete the resources that you created.

kubectl delete ns ibm-kube-bench-test
* [config file](https://raw.githubusercontent.com/IBM-Cloud/kube-samples/master/cis-kube-benchmark/cis-1.5/ibm/config.yaml)
* [node file](https://raw.githubusercontent.com/IBM-Cloud/kube-samples/master/cis-kube-benchmark/cis-1.5/ibm/node.yaml)



2. Create the ConfigMap by using the --from-file option to specify the ibm directory where your downloaded the configuration files.

oc create cm kube-bench-node -n ibm-kube-bench-test --from-file ibm



3. Create a job to run the benchmark test based on the configurations that you previously created.

oc apply -n ibm-kube-bench-test -f https://raw.githubusercontent.com/IBM-Cloud/kube-samples/master/cis-kube-benchmark/cis-1.5/ibm/job-node.yaml
4. Check that the job completed.

oc get pods -n ibm-kube-bench-test -l job-name=kube-bench-node

Example output

NAME READY STATUS RESTARTS AGE
kube-bench-node-hlvhc 0/1 Completed 0 23s
5. Review the CIS Kubernetes benchmark results for your worker nodes by checking the pod logs.

oc logs -n ibm-kube-bench-test -l job-name=kube-bench-node --tail=-1

Example output

== Summary ==
20 checks PASS
2 checks FAIL
1 checks WARN
0 checks INFO
6. Optional: When you are done reviewing results, delete the resources that you created.

oc delete ns ibm-kube-bench-test
See [Multizone-capable Storage](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-v2-deploy-iksibp-console-storage-multizone) for more information.





 Kubernetes version upgrade 

IBM Blockchain Platform requires Kubernetes v1.15 - v1.18. If your existing Kubernetes cluster is running v1.14 or lower, you need to upgrade your cluster before you can update your existing blockchain components to this latest release.







 20 May 2020 

CA, peer, and ordering node patch 1.4.6-2

Miscellaneous bug fixes and security patches.



 Support for Intermediate Certificate Authorities (CAs) 

You now have the option to configure an intermediate CA using the console or APIs to override the default CA settings. See the tutorial on [Creating an intermediate Certificate Authority](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-ica) to learn more.





 Updated connection profile 

The generated connection profile that client applications use to connect to the network has been streamlined and is now downloadable from the Organizations tab. See [Downloading a connection profile](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-organizationsibp-console-organizations-connx-profile) to learn how.







 16 April 2020 

CA, peer, and ordering node patch 1.4.6-1



 Support for AWS HSM 

If you plan to use AWS HSM, you must include the immutable and AltId parameters in your BCCSP configuration. See [Fabric documentation](https://hyperledger-fabric.readthedocs.io/en/release-2.2/hsm.htmlexample) for details.

Miscellaneous bug fixes







 24 March 2020 

IBM is in the process of migrating existing IBM Blockchain Platform consoles to v2.1.3, therefore, the new features described in this list may not yet be available in your console. Unsure what version you are currently using?
5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller. Not Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-benchmark-remediations-123) Shared 







 5.6 General policies 



Section 5.6 General policies benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 5.6.1 Create administrative boundaries between resources using namespaces. Not Scored 1 Pass Shared 
 5.6.2 Ensure that the seccomp profile is set to docker/default in your pod definitions. Not Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-benchmark-remediations-123) Shared 
 5.6.3 Apply security context to your pods and containers. Not Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-benchmark-remediations-123) Shared 
 5.6.4 The default namespace should not be used. Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-benchmark-remediations-123) Shared 









 IBM remediations and explanations 

Review information from IBM on the CIS Benchmark results.



Explanation and remediation

 Section Remediation/Explanation 

 1.2.1 IBM Cloud Kubernetes Service utilizes RBAC for cluster protection, but allows anonymous discovery, which is considered reasonable per [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/). 
 1.2.10 IBM Cloud Kubernetes Service does not enable the [EventRateLimit](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/eventratelimit) admission controller since it is a Kubernetes alpha feature.
5.5 Extensible admission control 



Section 5.5 Extensible admission control benchmark results

 Section Recommendation Scored? Level Result Responsibility 

 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller. Not Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-125cis-benchmark-remediations-125) Shared 







 5.6 General policies 



Section 5.6 General policies benchmark results

 Section Recommendation Scored? Level Result Responsibility 

 5.6.1 Create administrative boundaries between resources using namespaces. Not Scored 1 Pass Shared 
 5.6.2 Ensure that the seccomp profile is set to docker/default in your pod definitions. Not Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-125cis-benchmark-remediations-125) Shared 
 5.6.3 Apply security context to your pods and containers. Not Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-125cis-benchmark-remediations-125) Shared 
 5.6.4 The default namespace should not be used. Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-125cis-benchmark-remediations-125) Shared 









 IBM remediations and explanations 

Review information from IBM on the CIS Benchmark results.



Explanation and remediation

 Section Remediation/Explanation 

 1.2.1 IBM Cloud Kubernetes Service utilizes RBAC for cluster protection, but allows anonymous discovery, which is considered reasonable per [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/).
Kubernetes Dashboard v2.2.0 v2.3.1 See the [Kubernetes Dashboard release notes](https://github.com/kubernetes/dashboard/releases/tag/v2.3.1). 
 Kubernetes Dashboard metrics scraper v1.0.6 v1.0.7 See the [Kubernetes Dashboard metrics scraper release notes](https://github.com/kubernetes-sigs/dashboard-metrics-scraper/releases/tag/v1.0.7). 
 Kubernetes DNS autoscaler 1.8.3 1.8.4 See the [Kubernetes DNS autoscaler release notes](https://github.com/kubernetes-sigs/cluster-proportional-autoscaler/releases/tag/1.8.4). 
 Load balancer and load balancer monitor for IBM Cloud Provider 1328 1510 Updated image for [CVE-2020-27780](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27780). 
 Operator Lifecycle Manager 0.16.1-IKS-10 0.16.1-IKS-12 Updated image for [CVE-2021-36159](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36159). 







 Change log for worker node fix pack 1.21.3_1527, released 16 August 2021 

The following table shows the changes that are in the worker node fix pack patch update 1.21.3_1527. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.21.3_1526

 Component Previous Current Description 

 Ubuntu 18.04 packages 4.15.0-151 4.15.0-153 N/A
1.26 version information and update actions 

Review information about version 1.26 of IBM Cloud® Kubernetes Service, released 01 February 2023.

Looking for general information on updating IBM Cloud® Kubernetes Service clusters, or information on a different version? See [Kubernetes version information and update actions](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions).

Zoom

![This badge indicates Kubernetes version 1.26 certification for IBM Cloud Kubernetes Service](https://cloud.ibm.com/docs-content/v1/content/4d497aff9e27b92fbbc2ee4e343a9ec4549cb1d7/containers/images/certified-kubernetes-color.svg)

Figure 1. Kubernetes version 1.26 certification badge

IBM Cloud Kubernetes Service is a Certified Kubernetes product for version 1.26 under the CNCF Kubernetes Software Conformance Certification program. _Kubernetes® is a registered trademark of The Linux Foundation in the United States and other countries, and is used pursuant to a license from The Linux Foundation.

For more information about Kubernetes project version 1.26, see the [Kubernetes change log](https://kubernetes.io/releases/notes/.)



 Release timeline 

The following table includes the expected release timeline for version 1.26 of IBM Cloud® Kubernetes Service. You can use this information for planning purposes, such as to estimate the general time that the version might become unsupported.

Dates that are marked with a dagger (†) are tentative and subject to change.



Release timeline for IBM Cloud Kubernetes Service version 1.26

 Version Supported? IBM Cloud Kubernetes Service <br>release date IBM Cloud Kubernetes Service <br>unsupported date 

 1.26 Yes 01 February 2023 24 April 2024† 







 Preparing to update 

This information summarizes updates that are likely to have and impact on deployed apps when you update a cluster to version 1.26.
1.24 version information and update actions 

Review information about version 1.24 of IBM Cloud® Kubernetes Service, released 09 June 2022.

Looking for general information on updating IBM Cloud® Kubernetes Service clusters, or information on a different version? See [Kubernetes version information and update actions](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions).

Zoom

![This badge indicates Kubernetes version 1.24 certification for IBM Cloud Kubernetes Service](https://cloud.ibm.com/docs-content/v1/content/4d497aff9e27b92fbbc2ee4e343a9ec4549cb1d7/containers/images/certified-kubernetes-color.svg)

Figure 1. Kubernetes version 1.24 certification badge

IBM Cloud Kubernetes Service is a Certified Kubernetes product for version 1.24 under the CNCF Kubernetes Software Conformance Certification program. Kubernetes® is a registered trademark of The Linux Foundation in the United States and other countries, and is used pursuant to a license from The Linux Foundation.

For more information about Kubernetes project version 1.24, see the [Kubernetes change log](https://kubernetes.io/releases/notes/.)



 Release timeline 

The following table includes the expected release timeline for version 1.24 of IBM Cloud® Kubernetes Service. You can use this information for planning purposes, such as to estimate the general time that the version might become unsupported.

Dates that are marked with a dagger (†) are tentative and subject to change.



Release timeline for IBM Cloud Kubernetes Service version 1.24

 Version Supported? IBM Cloud Kubernetes Service <br>release date IBM Cloud Kubernetes Service <br>unsupported date 

 1.24 Yes 09 Jun 2022 06 Sept 2023 † 







 Preparing to update 

This information summarizes updates that are likely to have and impact on deployed apps when you update a cluster to version 1.24.
* Updates: You can run one Kubernetes API version at a time only. All apps that run in a cluster must comply with the current Kubernetes API version independent of the team that owns the app. When you want to update a cluster, you must ensure that all teams are ready to switch to a new Kubernetes API version and that apps are updated accordingly. This also means that individual teams have less control over the Kubernetes API version they want to run.
* Changes in cluster setup: If you want to change the cluster setup or reschedule workloads onto new worker nodes, you must roll out this change across tenants. This roll out requires more reconciliation and testing than in a single-tenant cluster.
* Communication process: When you manage multiple tenants, consider setting up a communication process so that tenants know where to go when an issue with the cluster exists, or when they need more resources for their services. This communication process also includes informing your tenants about all changes in the cluster setup or planned updates.



Although single-tenant and multi-tenant clusters come with roughly the same costs, single-tenant clusters provide a higher level of isolation than the namespaces in a multi-tenant cluster. For better workload isolation, use single-tenant clusters.

[Kubernetes network policies](https://cloud.ibm.com/docs/containers?topic=containers-network_policiesisolate_services) protect pods from internal network traffic. For example, if most or all pods don't require access to specific pods or services, and you want to ensure that pods by default can't access those pods or services, you can create a Kubernetes network policy to block ingress traffic to those pods or services. Kubernetes network policies can also help you enforce workload isolation between namespaces by controlling how pods and services in different namespaces can communicate.

How can I control pod permissions?
: By default, every cluster enables the [Kubernetes pod security policy admission controller](https://kubernetes.io/docs/concepts/security/pod-security-policy/) that you can use to define what requirements a pod must meet to get deployed in a namespace.
* [4 Worker node security configuration](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-121cis-section-4-121)



* [4.1 Worker node configuration files](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-121cis-benchmark-41-121)
* [4.2 Kubelet](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-121cis-benchmark-42-121)



* [5 Kubernetes policies](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-121cis-section-5-121)



* [5.1 RBAC and service accounts](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-121cis-benchmark-51-121)
* [5.2 Pod Security Policies](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-121cis-benchmark-52-121)
* [5.3 Network policies and CNI](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-121cis-benchmark-53-121)
* [5.4 Secrets management](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-121cis-benchmark-54-121)
* [5.5 Extensible admission control](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-121cis-benchmark-55-121)
* [5.6 General policies](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-121cis-benchmark-56-121)



* [IBM remediations and explanations](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-121cis-benchmark-remediations-121)
IBM Cloud Provider v1.14.1-71 v1.14.2-100 Updated to support the Kubernetes 1.14.2 release. 
 Kubernetes v1.14.1 v1.14.2 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.14.2). 
 Kubernetes Metrics Server v0.3.1 v0.3.3 See the [Kubernetes Metrics Server release notes](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.3.3).
5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller. Not Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-122cis-benchmark-remediations-122) Shared 







 5.6 General policies 



Section 5.6 General policies benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 5.6.1 Create administrative boundaries between resources using namespaces. Not Scored 1 Pass Shared 
 5.6.2 Ensure that the seccomp profile is set to docker/default in your pod definitions. Not Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-122cis-benchmark-remediations-122) Shared 
 5.6.3 Apply security context to your pods and containers. Not Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-122cis-benchmark-remediations-122) Shared 
 5.6.4 The default namespace should not be used. Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-122cis-benchmark-remediations-122) Shared 







 IBM remediations and explanations 

Review information from IBM on the CIS Benchmark results.



Explanation and remediation

 Section Remediation/Explanation 

 1.2.1 IBM Cloud Kubernetes Service utilizes RBAC for cluster protection, but allows anonymous discovery, which is considered reasonable per [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/). 
 1.2.10 IBM Cloud Kubernetes Service does not enable the [EventRateLimit](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/eventratelimit) admission controller since it is a Kubernetes alpha feature.