vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Action Started: 2020-08-30T16:17:56+0000
Action Completed: 2020-08-30T16:21:13+0000
4. Download the updated Kubernetes configuration data and certificates in your cluster's kubeconfig file.

ibmcloud ks cluster config -c CLUSTER --admin --network
5. Update any tooling that relies on the previous certificates.



* If you use IBM® Blockchain, you must [re-establish connectivity between the Blockchain management console and your cluster](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-manage-consoleibp-console-refresh).
* If you use the certificate from your cluster's kubeconfig file in your own service such as Travis or Jenkins, or if you use calicoctl to manage Calico network policies, update your services and automation to use the new certificates.



6. Verify that the timestamps on your new certificates are later than the timestamp that you found in step 3. To check the date on your certificates, you can use a tool such as [KeyCDN](https://tools.keycdn.com/ssl).
7. [Reload your classic worker nodes](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_worker_reload) or [replace your VPC worker nodes](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clicli_worker_replace) to pick up the certificates that are signed by the new CA.
8. Rotate the old certificates with the new certificates. The old CA certificates in your cluster are removed.

ibmcloud ks cluster ca rotate -c CLUSTER
9. Check the status of the CA certificate rotation.

ibmcloud ks cluster ca status -c CLUSTER

Example output

Status: CA certificate rotation complete.
Action Started: 2020-08-30T16:37:56+0000
Change log for master fix pack 1.21.14_1574, released 26 July 2022 

The following table shows the changes that are in the master fix pack 1.21.14_1574. Master patch updates are applied automatically.



Changes since version 1.21.14_1564

 Component Previous Current Description 

 Cluster health image v1.3.8 v1.3.9 Updated Go dependencies and to use Go version 1.18.4. Fixed minor typographical error in the add-on daemonset not available health status. 
 Gateway-enabled cluster controller 1680 1792 Updated to use Go version 1.17.11. Updated image for [CVE-2022-2097](https://nvd.nist.gov/vuln/detail/CVE-2022-2097) and [CVE-2022-29458](https://nvd.nist.gov/vuln/detail/CVE-2022-29458). 
 GPU device plug-in and installer 2b0b6d1 d8f1be0 Updated Go dependencies and to use Go version 1.18.3. 
 IBM Calico extension 980 997 Updated to use Go version 1.17.11. Updated universal base image (UBI) to version 8.6-854 to resolve CVEs. 
 IBM Cloud Controller Manager v1.21.13-5 v1.21.14-3 Updated Go dependencies. Updated to support the Kubernetes 1.21.14 release. 
 IBM Cloud File Storage for Classic plug-in and monitor 410 412 Updated to use Go version 1.18.3. Updated universal base image (UBI) to version 8.6-854 to resolve CVEs. Improved Kubernetes resource watch configuration. 
 IBM Cloud RBAC Operator 8c96932 0a187a4 Updated universal base image (UBI) to resolve CVEs. 
 Key Management Service provider v2.5.6 v2.5.7 Updated Go dependencies and to use Go version 1.18.4.
Change log for master fix pack 1.17.17_1551, released 19 January 2021 

The following table shows the changes that are in the master fix pack patch update 1.17.17_1551. Master patch updates are applied automatically.



Changes since version 1.17.16_1550

 Component Previous Current Description 

 Cluster health image v1.1.13 v1.1.16 Updated image to implement additional IBM security controls. 
 Gateway-enabled cluster controller 1184 1195 Updated image for [CVE-2020-1971](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1971). 
 GPU device plug-in and installer adcae42 4d3b934f Updated image for [CVE-2021-3114](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3114), [CVE-2021-3115](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3115), [CVE-2020-27350](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27350), [CVE-2020-29361](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29361), [CVE-2020-29362]
Note that DNS resolvers that retry lookups using TCP, such as Dig, are not impacted. DNS clients that don't require UDP DNS messages to exceed 512 bytes are not impacted.

 How to fix it 

Update your cluster master and worker nodes.



1. [Update your cluster master](https://cloud.ibm.com/docs/openshift?topic=openshift-updatemaster).

ibmcloud oc cluster master update --cluster <clusterID> --version <4.6.38_openshift|4.7.19_openshift>
2. After you update your master, run the cluster get command to get the cluster state and version and verify that the state is deployed.

ibmcloud oc cluster get --cluster <clusterID>
3. [Update your worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-updatemaster).
4. Get the details of the openshift-dns configmap and review the bufsize by running the following command.

oc get ConfigMap -n openshift-dns dns-default -o yaml
5. If the bufsize is still 1232, get the name of the DNS Operator pod.

oc get pods -n openshift-dns-operator

Example output

NAME READY STATUS RESTARTS AGE
dns-operator-111aa1aaab-xxxx1 2/2 Running 0 5h49m
6. Delete the DNS Operator pod.

oc delete pod <dns_operator_pod> -n openshift-dns-operator
7. Wait for the DNS pod to restart. Run get pods with the --watch option to to verify that the pod is deployed.

oc get pods -n openshift-dns --watch
8. Verify that the DNS Operator pod is running.

oc get pods -n openshift-dns-operator
9.
Kubernetes 1.24.14 1.24.15 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.24.15). 







 Change log for master fix pack 1.24.15_1573, released 27 June 2023 

The following table shows the changes that are in the master fix pack 1.24.15_1573. Master patch updates are applied automatically.



Changes since version 1.24.14_1568

 Component Previous Current Description 

 Calico v3.24.5 v3.24.6 See the [Calico release notes](https://docs.tigera.io/calico/3.24/release-notes/v3.24.6). 
 Cluster health image v1.3.20 v1.3.21 Updated Go dependencies and to Go version 1.19.10. 
 etcd v3.5.8 v3.5.9 See the [etcd release notes](https://github.com/etcd-io/etcd/releases/v3.5.9). 
 Gateway-enabled cluster controller 2106 2322 Updated image to resolve [CVE-2023-2650](https://nvd.nist.gov/vuln/detail/CVE-2023-2650). 
 GPU device plug-in and installer 28d80a0 202b284 Updated to Go version 1.19.9 
 IBM Cloud Controller Manager v1.24.13-6 v1.24.15-1 Updated to support the Kubernetes 1.24.15 release. Updated Go dependencies and to Go version 1.19.10. Updated calicoctl and vpcctl. 
 IBM Cloud File Storage for Classic plug-in and monitor 431 433 Updated Go to version 1.20.4. Updated UBI base image. 
 Key Management Service provider v2.6.6 v2.6.7 Updated Go dependencies and to Go version 1.19.10.
From the [Kubernetes clusters console](https://cloud.ibm.com/kubernetes/clusters), select the cluster that you want to enable encryption for.
3. From the Overview tab, in the Summary > Key management service section, click Enable. If you already enabled the KMS provider, click Update.
4. Select the Key management service instance and Root key that you want to use for the encryption.

During the enablement, you might not be able to access the Kubernetes master such as to update YAML configurations for deployments.
5. Click Enable (or Update).
6. Verify that the KMS enablement process is finished. From the Summary > Master status section, you can check the progress. Example output when the enablement is in progress.

Master status KMS feature enablement in progress.

Example output when the master is ready.

Master status Ready

After the KMS provider is enabled in the cluster, all cluster secrets are automatically encrypted.
7. Optional: [Verify that your secrets are encrypted](https://cloud.ibm.com/docs/containers?topic=containers-encryptionverify_kms).



Do not delete root keys in your KMS instance, even if you rotate to use a new key. If you delete a root key that a cluster uses, the cluster becomes unusable, loses all its data, and can't be recovered. When you rotate a root key, you can't reuse a previous root key for the same cluster. Similarly, if you disable a root key, operations that rely on reading secrets fail. Unlike deleting a root key, however, you can reenable a disabled key to make your cluster usable again.





 Rotating the root key for your cluster
Apply the MTU changes to your cluster master by refreshing the master API server. It might take several minutes for the master to refresh.

ibmcloud ks cluster master refresh --cluster <cluster_name_or_ID>
4. Verify that the master refresh is completed. When the refresh is complete, the Master Status changes to Ready.

ibmcloud ks cluster get --cluster <cluster_name_or_ID>
5. In the data section of the output, verify that the veth_mtu field shows the new MTU value for Calico that you specified in step 2.

kubectl get cm -n kube-system calico-config -o yaml

Example output

apiVersion: v1
data:
...
etcd_ca: /calico-secrets/etcd-ca
etcd_cert: /calico-secrets/etcd-cert
etcd_endpoints: https://172.20.0.1:2041
etcd_key: /calico-secrets/etcd-key
typha_service_name: none
veth_mtu: "8980"
kind: ConfigMap
...
6. Apply the MTU changes to your worker nodes by [rebooting all worker nodes in your cluster](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_worker_reboot).









 Disabling the port map plug-in 

The portmap plug-in for the Calico container network interface (CNI) enables you to use a hostPort to expose your app pods on a specific port on the worker node. Prevent iptables performance issues by removing the port map plug-in from your cluster's Calico CNI configuration.

When you have many services in your cluster, such as more than 500 services, or many ports on services, such as more than 50 ports per service for 10 or more services, many iptables rules are generated for the Calico and Kubernetes network policies for these services.
[Assign the newly attached hosts to your Satellite resource](https://cloud.ibm.com/docs/satellite?topic=satellite-assigning-hostshost-assign-manual). These hosts automatically receive the update when you assign them.
4. After the new hosts are successfully assigned to your Satellite resource, [remove and delete the old hosts that you previously noted](https://cloud.ibm.com/docs/satellite?topic=satellite-host-remove).







 Updating worker node hosts in the Red Hat OpenShift on IBM Cloud console 

You can update worker node hosts by using the Red Hat OpenShift on IBM Cloud console.



1. Log in to the IBM Cloud console and click OpenShift > Clusters.
2. Click the cluster where the hosts that you want to update are assigned and navigate to the Worker nodes page.
3. Select each host that you want to update. After you select the hosts, an Update option appears.
4. Click Update. In the dialog box that appears, click Update again. A message appears that the update started successfully.
5. Wait while the hosts update. The update process for each host is complete when the Status of the host returns to Normal and the new version is listed in the Version column.







 Determining if the worker node version update is a major, minor, or patch update 

The process to update a worker node is the same for all types of updates. However, you can find information on whether the update is a major, minor, or patch update.

To determine the type of update that is available, compare your current worker node versions to the latest worker node fix pack version in the [Red Hat OpenShift version change log](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_versions). Major updates are indicated by the first digit in the version label (4.x.x), minor updates are indicated by the second digit (x.7.x) and patch updates are indicated by the trailing digits (x.x.23_1528_openshift).
10 February 2020 

New! Kubernetes version 1.17
: You can now create clusters that run Kubernetes version 1.17. To update an existing cluster, see the [Version 1.17 preparation actions](https://cloud.ibm.com/docs/containers?topic=containers-cs_versionsk8s_version_archive).

Deprecated: Kubernetes version 1.14
: With the release of version 1.17, clusters that run version 1.14 are deprecated. Consider [updating to at least version 1.15](https://cloud.ibm.com/docs/containers?topic=containers-cs_versionsk8s_version_archive) today.

VPC cluster creation troubleshooting
: Added [troubleshooting steps](https://cloud.ibm.com/docs/containers?topic=containers-ts_no_vpc) for when no VPCs are listed when you try to create a VPC cluster in the console.

Knative change logs
: Check out the changes that are in version 0.12.1 of the managed Knative add-on. If you installed the Knative add-on before, you must uninstall and reinstall the add-on to apply these changes in your cluster.





 6 February 2020 

Cluster autoscaler
: Added a [debugging guide for the cluster autoscaler](https://cloud.ibm.com/docs/containers?topic=containers-debug_cluster_autoscaler).

Tags
: Added how to [add IBM Cloud tags to existing clusters](https://cloud.ibm.com/docs/containers?topic=containers-add_workerscluster_tags).

VPC security groups
: [Modify the security group rules](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-security-group)for VPC Gen 2 clusters to allow traffic requests that are routed to node ports on your worker nodes.





 3 February 2020 

Version change log
To get started, try out the [Red Hat OpenShift on IBM Cloud tutorial](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_tutorial).





 Does the service come with a managed Kubernetes master and worker nodes? 

Every cluster in IBM Cloud Kubernetes Service is controlled by a dedicated Kubernetes master that is managed by IBM in an IBM-owned IBM Cloud infrastructure account. The Kubernetes master, including all the master components, compute, networking, and storage resources, is continuously monitored by IBM Site Reliability Engineers (SREs). The SREs apply the latest security standards, detect and remediate malicious activities, and work to ensure reliability and availability of IBM Cloud Kubernetes Service. Add-ons, such as Fluentd for logging, that are installed automatically when you provision the cluster are automatically updated by IBM. However, you can choose to disable automatic updates for some add-ons and manually update them separately from the master and worker nodes. For more information, see [Updating cluster add-ons](https://cloud.ibm.com/docs/containers?topic=containers-updateaddons).

Periodically, Kubernetes releases [major, minor, or patch updates](https://cloud.ibm.com/docs/containers?topic=containers-cs_versionsupdate_types). These updates can affect the Kubernetes API server version or other components in your Kubernetes master. IBM automatically updates the patch version, but you must update the master major and minor versions. For more information, see [Updating the master](https://cloud.ibm.com/docs/containers?topic=containers-updatemaster).

Worker nodes in standard clusters are provisioned in to your IBM Cloud infrastructure account. The worker nodes are dedicated to your account and you are responsible to request timely updates to the worker nodes to ensure that the worker node OS and IBM Cloud Kubernetes Service components apply the latest security updates and patches.
* Master fix packs 4.8.57_1600_openshift, 4.9.59_1587_openshift, 4.10.56_1565_openshift, 4.11.35_1552_openshift, and 4.12.11_1538_openshift.



* [26 April 2023](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift-relnotesopenshift-apr2623)



* Cluster autoscaler add-on version 1.1.0_1060.



* [24 April 2023](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift-relnotesopenshift-apr2423)



* Worker node fix packs 4.8.57_1600_openshift, 4.9.59_1587_openshift, 4.10.57_1565_openshift, 4.11.37_1553_openshift, and 4.12.13_1539_openshift.



* [11 April 2023](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift-relnotesopenshift-apr1123)



* CLI version 1.0.510.
* Worker node fix packs 4.8.57_1598_openshift, 4.9.59_1585_openshift, 4.10.55_1563_openshift, 4.11.34_1550_openshift, and 4.12.10_1536_openshift.



* [5 April 2023](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift-relnotesopenshift-apr0523)



* Cluster autoscaler add-on versions 1.0.6_1010, 1.0.7_1021, and 1.0.8_1016.
* Block Storage for VPC add-on versions 5.0.10_1869 and 5.1.6_1872.
You can continue to monitor the health of the master until the master reaches a normal state. If the master remains in this state for more than 1 day, [open an IBM Cloud support case](https://cloud.ibm.com/docs/containers?topic=containers-get-help). IBM Support might identify other issues in your cluster that you must fix before the master can be updated. 







 Understanding the impact of a master outage 

The [Red Hat OpenShift master](https://cloud.ibm.com/docs/openshift?topic=openshift-service-architecture) is the main component that keeps your cluster up and running. The master stores cluster resources and their configurations in the etcd database that serves as the single point of truth for your cluster. The Red Hat OpenShift API server is the main entry point for all cluster management requests from the worker nodes to the master, or when you want to interact with your cluster resources.

If a master failure occurs, your workloads continue to run on the worker nodes, but you can't use oc commands to work with your cluster resources or view the cluster health until the Red Hat OpenShift API server in the master is back up. If a pod goes down during the master outage, the pod can't be rescheduled until the worker node can reach the Red Hat OpenShift API server again.

During a master outage, you can still run ibmcloud oc commands against the IBM Cloud Kubernetes Service API to work with your infrastructure resources, such as worker nodes or VLANs. If you change the current cluster configuration by adding or removing worker nodes to the cluster, your changes don't happen until the master is back up.

Do not restart or reboot a worker node during a master outage. This action removes the pods from your worker node. Because the Kubernetes API server is unavailable, the pods can't be rescheduled onto other worker nodes in the cluster.
For more information, see [Worker node resource reserves](https://cloud.ibm.com/docs/containers?topic=containers-planning_worker_nodesresource_limit_node). 







 Change log for master fix pack 1.12.6_1546, released 26 March 2019 

The following table shows the changes that are in the master fix pack 1.12.6_1546.



Changes since version 1.12.6_1544

 Component Previous Current Description 

 IBM Cloud File Storage for Classic plug-in 345 346 Updated image for [CVE-2019-9741](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9741). 
 Key Management Service provider 166 167 Fixes intermittent context deadline exceeded and timeout errors for managing Kubernetes secrets. In addition, fixes updates to the key management service that might leave existing Kubernetes secrets unencrypted. Update includes fix for [CVE-2019-9741](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9741). 
 Load balancer and load balancer monitor for IBM Cloud Provider 143 146 Updated image for [CVE-2019-9741](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9741). 







 Change log for 1.12.6_1544, released 20 March 2019 

The following table shows the changes that are in the patch 1.12.6_1544.



Changes since version 1.12.6_1541

 Component Previous Current Description 

 Cluster DNS configuration N/A N/A Fixed a bug that might cause cluster master operations, such as refresh or update, to fail when the unused cluster DNS must be scaled down. 
 Cluster master HA proxy configuration N/A N/A Updated configuration to better handle intermittent connection failures to the cluster master.
The following table shows the changes that are in the master fix pack patch update 1.17.16_1550. Master patch updates are applied automatically.



Changes since version 1.17.15_1548

 Component Previous Current Description 

 IBM Calico extension 544 556 Updated image to include the ip command. 
 IBM Cloud Controller Manager v1.17.15-1 v1.17.16-1 Updated to support the Kubernetes 1.17.16 release. 
 IBM Cloud File Storage for Classic plug-in N/A N/A Updated to run with a privileged security context. 
 Kubernetes v1.17.15 v1.17.16 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.17.16). 
 Operator Lifecycle Manager 0.14.1-IKS-1 0.14.1-IKS-2 Updated image for [CVE-2020-1971](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1971) and [CVE-2020-28928](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28928). 







 Change log for worker node fix pack 1.17.15_1549, released 21 December 2020 

The following table shows the changes that are in the worker node fix pack 1.17.15_1549. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.17.15_1548

 Component Previous Current Description
Cluster autoscaler add-on change log 

View information for patch updates to the cluster autoscaler add-on in your IBM Cloud Kubernetes Service clusters.

Patch updates
: Patch updates are delivered automatically by IBM and don't contain any feature updates or changes in the supported add-on and cluster versions.

Release updates
: Release updates contain new features for the cluster autoscaler or changes in the supported add-on or cluster versions. You must manually apply release updates to your cluster autoscaler add-on. To update your cluster autoscaler add-on, see [Updating the cluster autoscaler add-on](https://cloud.ibm.com/docs/containers?topic=containers-cluster-scaling-install-addoncluster-scaling-update-addon).

Refer to the following tables for a summary of changes for each version of the [cluster autoscaler add-on](https://cloud.ibm.com/docs/containers?topic=containers-cluster-scaling-classic-vpc).

To view a list of add-ons and the supported cluster versions, run the following command or see the [Supported cluster add-ons table](https://cloud.ibm.com/docs/containers?topic=containers-supported-cluster-addon-versions).

ibmcloud ks cluster addon versions



 Version 1.1.0 (Beta) 

Version 1.1.0 is a Satellite Beta release. Patches might be slower on this version.



 Change log for patch update 1.1.0_1066, released 15 May 2023 



* Image tags: 1.21.0 110-9, 1.22.0 110-9, 1.23.0 110-9, 1.24.0 110-9, 1.25.0 110-9
* Resolves issues while reading secrets.







 Change log for patch update 1.1.0_1060, released 26 April 2023 



* Image tags: 1.19.1 110-8, 1.20.0 110-8, 1.21.0 110-8, 1.22.0 110-8, 1.23.0 110-8.
(https://cloud.ibm.com/docs-content/v1/content/c8335d66af691d19e837116fd633481c477061eb/satellite/images/icon-checkmark-filled.svg) 
 Update a subscription to a configuration of Kubernetes resources that are managed by Satellite Config. editSubscription [subscription update](https://cloud.ibm.com/docs/satellite?topic=satellite-satellite-cli-referencecli-config-subscription-update) ![Feature available.](https://cloud.ibm.com/docs-content/v1/content/c8335d66af691d19e837116fd633481c477061eb/satellite/images/icon-checkmark-filled.svg) ![Feature available.](https://cloud.ibm.com/docs-content/v1/content/c8335d66af691d19e837116fd633481c477061eb/satellite/images/icon-checkmark-filled.svg) 
 Set the configuration version of Kubernetes resources for a subscription in Satellite Config. setSubscription [subscription update --version](https://cloud.ibm.com/docs/satellite?topic=satellite-satellite-cli-referencecli-config-subscription-update) ![Feature available.](https://cloud.ibm.com/docs-content/v1/content/c8335d66af691d19e837116fd633481c477061eb/satellite/images/icon-checkmark-filled.svg) ![Feature available.](https://cloud.ibm.com/docs-content/v1/content/c8335d66af691d19e837116fd633481c477061eb/satellite/images/icon-checkmark-filled.svg)