vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Kubernetes Dashboard metrics scraper v1.0.7 v1.0.8 See the [Kubernetes Dashboard metrics scraper release notes](https://github.com/kubernetes-sigs/dashboard-metrics-scraper/releases/tag/v1.0.8). 
 Kubernetes NodeLocal DNS cache 1.22.5 1.22.6 See the [Kubernetes NodeLocal DNS cache release notes](https://github.com/kubernetes/dns/releases/tag/1.22.6). 
 Load balancer and load balancer monitor for IBM Cloud Provider 2058 2110 Updated Go dependencies and to Go version 1.17.13. 
 Portieris admission controller v0.12.5 v0.12.6 See the [Portieris admission controller release notes](https://github.com/IBM/portieris/releases/tag/v0.12.6). 







 Change log for worker node fix pack 1.24.4_1535, released 29 August 2022 

The following table shows the changes that are in the worker node fix pack 1.24.4_1535. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.24.3_1533

 Component Previous Current Description 

 Ubuntu 18.04 packages N/A N/A Worker node kernel & package updates for [CVE-2019-5815](https://nvd.nist.gov/vuln/detail/CVE-2019-5815), [CVE-2021-30560](https://nvd.nist.gov/vuln/detail/CVE-2021-30560), [CVE-2022-31676](https://nvd.nist.gov/vuln/detail/CVE-2022-31676), [CVE-2022-37434](https://nvd.nist.gov/vuln/detail/CVE-2022-37434).
5.5 Extensible admission control 



Section 5.5 Extensible admission control benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller. Not Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-121cis-benchmark-remediations-121) Shared 







 5.6 General policies 



Section 5.6 General policies benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 5.6.1 Create administrative boundaries between resources using namespaces. Not Scored 1 Pass Shared 
 5.6.2 Ensure that the seccomp profile is set to docker/default in your pod definitions. Not Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-121cis-benchmark-remediations-121) Shared 
 5.6.3 Apply security context to your pods and containers. Not Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-121cis-benchmark-remediations-121) Shared 
 5.6.4 The default namespace should not be used. Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-121cis-benchmark-remediations-121) Shared 









 IBM remediations and explanations 

Review information from IBM on the CIS Benchmark results.



Explanation and remediation

 Section Remediation/Explanation 

 1.2.1 IBM Cloud Kubernetes Service utilizes RBAC for cluster protection, but allows anonymous discovery, which is considered reasonable per [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/).
5.5 Extensible admission control 



Section 5.5 Extensible admission control benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller. Not Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-119cis-benchmark-remediations-119) Shared 







 5.6 General policies 



Section 5.6 General policies benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 5.6.1 Create administrative boundaries between resources using namespaces. Not Scored 1 Pass Shared 
 5.6.2 Ensure that the seccomp profile is set to docker/default in your pod definitions. Not Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-119cis-benchmark-remediations-119) Shared 
 5.6.3 Apply security context to your pods and containers. Not Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-119cis-benchmark-remediations-119) Shared 
 5.6.4 The default namespace should not be used. Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-119cis-benchmark-remediations-119) Shared 









 IBM remediations and explanations 

Review information from IBM on the CIS Benchmark results.



Explanation and remediation

 Section Remediation/Explanation 

 1.2.1 IBM Cloud Kubernetes Service utilizes RBAC for cluster protection, but allows anonymous discovery, which is considered reasonable per [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/).
: Updated the [nginx-ingress image build to 628](https://cloud.ibm.com/docs/containers?topic=containers-cluster-add-ons-changelogkube_ingress_changelog).





 14 May 2020 

Kubernetes version 1.18
: [Kubernetes 1.18 release](https://cloud.ibm.com/docs/containers?topic=containers-cs_versionsk8s_version_archive) is certified.





 11 May 2020 

New! Kubernetes version 1.18
: You can now create clusters that run Kubernetes version 1.18. To update an existing cluster, see the [Version 1.18 preparation actions](https://cloud.ibm.com/docs/containers?topic=containers-cs_versionsk8s_version_archive).

Deprecated: Kubernetes version 1.15
: With the release of version 1.18, clusters that run version 1.15 are deprecated. Consider [updating to at least version 1.16](https://cloud.ibm.com/docs/containers?topic=containers-cs_versionsk8s_version_archive) today.

NodeLocal DNS cache
: [NodeLocal DNS cache](https://cloud.ibm.com/docs/containers?topic=containers-cluster_dnsdns_cache) is generally available for clusters that run Kubernetes 1.18, but still not enabled by default.

Zone-aware DNS beta
: For multizone clusters that run Kubernetes 1.18, you can set up [zone-aware DNS](https://cloud.ibm.com/docs/containers?topic=containers-cluster_dnsdns_zone_aware) to improve DNS performance and availability.

Version change logs
: Change log documentation is available for Kubernetes version [1.18.2_1512](https://cloud.ibm.com/docs/containers?topic=containers-118_changelog1182_1512).
Kubernetes Dashboard metrics scraper v1.0.6 v1.0.7 See the [Kubernetes Dashboard metrics scraper release notes](https://github.com/kubernetes-sigs/dashboard-metrics-scraper/releases/tag/v1.0.7). 
 Load balancer and load balancer monitor for IBM Cloud Provider 1328 1510 Updated image for [CVE-2020-27780](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27780). 
 Operator Lifecycle Manager 0.14.1-IKS-8 0.14.1-IKS-11 Updated image for [CVE-2021-36159](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36159). 







 Change log for worker node fix pack 1.18.20_1561, released 16 August 2021 

The following table shows the changes that are in the worker node fix pack patch update 1.18.20_1561. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.18.20_1560

 Component Previous Current Description 

 Ubuntu 18.04 packages 4.15.0-151 4.15.0-153 N/A 
 HA proxy 68e6b3 9c98dc Updated image with fixes for [CVE-2021-27218](https://nvd.nist.gov/vuln/detail/CVE-2021-27218). 







 Change log for worker node fix pack 1.18.20_1560, released 02 August 2021 

The following table shows the changes that are in the worker node fix pack patch update 1.18.20_1560. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.18.29_1558

 Component Previous Current Description
1.19 version information and update actions 

Kubernetes version 1.19 is unsupported.

Review information about version 1.19 of IBM Cloud® Kubernetes Service, released 13 Oct 2020.

Looking for general information on updating IBM Cloud® Kubernetes Service clusters, or information on a different version? See [Kubernetes version information and update actions](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions).

Zoom

![This badge indicates Kubernetes version 1.19 certification for IBM Cloud Kubernetes Service](https://cloud.ibm.com/docs-content/v1/content/4d497aff9e27b92fbbc2ee4e343a9ec4549cb1d7/containers/images/certified-kubernetes-color.svg)

Figure 1. Kubernetes version 1.19 certification badge

IBM Cloud Kubernetes Service is a Certified Kubernetes product for version 1.19 under the CNCF Kubernetes Software Conformance Certification program. Kubernetes® is a registered trademark of The Linux Foundation in the United States and other countries, and is used pursuant to a license from The Linux Foundation.



 Release timeline 

The following table includes the expected release timeline for version 1.19 of IBM Cloud® Kubernetes Service. You can use this information for planning purposes, such as to estimate the general time that the version might become unsupported.

Dates that are marked with a dagger (†) are tentative and subject to change.



Release timeline for IBM Cloud Kubernetes Service version 1.19

 Version Supported? IBM Cloud Kubernetes Service <br>release date IBM Cloud Kubernetes Service <br>unsupported date 

 1.19 Deprecated 13 Oct 2020 14 Mar 2022 † 







 Preparing to update 

This information summarizes updates that are likely to have and impact on deployed apps when you update a cluster to version 1.19.
Dates that are marked with a dagger (†) are tentative and subject to change.



Release timeline for IBM Cloud Kubernetes Service version 1.27

 Version Supported? IBM Cloud Kubernetes Service <br>release date IBM Cloud Kubernetes Service <br>unsupported date 

 1.27 Yes 24 May 2023 14 August 2024† 







 Preparing to update 

This information summarizes updates that are likely to have and impact on deployed apps when you update a cluster to version 1.27. For a complete list of changes, review the [community Kubernetes change log](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md) and [IBM version change log](https://cloud.ibm.com/docs/containers?topic=containers-changelog_127) for version 1.27. You can also review the [Kubernetes helpful warnings](https://kubernetes.io/blog/2020/09/03/warnings/).

[Portworx](https://cloud.ibm.com/docs/containers?topic=containers-storage_portworx_about) does not yet support version 1.27. Do not upgrade your cluster to version 1.27 if your apps use Portworx.



 Update before master 

The following table shows the actions that you must take before you update the Kubernetes master.



Changes to make before you update the master to Kubernetes 1.27

 Type Description 

 Unsupported: Beta version of the CSIStorageCapacity API Migrate manifests and API clients to use the storage.k8s.io/v1 API version, available since Kubernetes version 1.24. For more information, see [Deprecated API Migration Guide - v1.27](https://kubernetes.io/docs/reference/using-api/deprecation-guide/v1-27).
The CLI versions match if you can see the same version in GitVersion for the client and the server. You can ignore the +IKS part of the version for the server.
2. If the kubectl CLI versions on your local machine and your cluster don't match, either update your cluster or [install a different CLI version on your local machine](https://cloud.ibm.com/docs/containers?topic=containers-cli-install).







 Updating Helm charts 



1. Find the [latest Helm chart version](https://github.com/IBM/charts/tree/master/community/portworx).
2. List the installed Helm charts in your cluster and compare the version that you installed with the latest version.

helm list --all-namespaces
3. If a more recent version is available, install the new version. For instructions, see [Updating Portworx in your cluster](https://cloud.ibm.com/docs/containers?topic=containers-storage_portworx_update).
Kubernetes Both v1.17.2 v1.17.3 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.17.3). The master update resolves CVE-2019-11254 and CVE-2020-8552 (see the [IBM security bulletin](https://www.ibm.com/support/pages/node/6203780)), and the worker node update resolves CVE-2020-8551 (see the [IBM security bulletin](https://www.ibm.com/support/pages/node/6204874)). 
 Kubernetes Dashboard Master v2.0.0-rc3 v2.0.0-rc5 See the [Kubernetes Dashboard release notes](https://github.com/kubernetes/dashboard/releases/tag/v2.0.0-rc5). 
 Operator Lifecycle Manager Catalog Master v1.5.8 v1.5.9 See the [Operator Lifecycle Manager Catalog release notes](https://github.com/operator-framework/operator-registry/releases/tag/v1.5.9).
After you run ibmcloud ks cluster config for the first time after the update, kubectl commands might fail for a few seconds while RBAC synchronizes for the first time. Afterward, kubectl commands perform as expected. If you use automation to access the cluster with kubectl commands, add retry logic for kubectl commands after a kubeconfig file is successfully retrieved. 
 Unsupported: Select kubelet metrics The following kubelet metrics that were available via the /metrics and /metrics/resource endpoints are unsupported and removed. If you use any of these removed and deprecated kubelet metrics, change to use the available replacement metric.<br><br><br><br> * From kubelet_running_container_count to kubelet_running_containers<br> * From kubelet_running_pod_count to kubelet_running_pods<br> * From node_cpu_usage_seconds to node_cpu_usage_seconds_total<br> * From container_cpu_usage_seconds to container_cpu_usage_seconds_total.<br><br><br> 
 Unsupported: Select kube-proxy metrics The following kube-proxy metric label names for kubernetes_build_info, available via the /metrics endpoint, are changed. If you rely on these changed metrics, update accordingly.<br><br><br><br> * From gitVersion to git_version<br> * From gitCommit to git_commit<br> * From gitTreeState to git_tree_state<br> * From buildDate to build_date<br> * From goVersion to go_version<br><br><br> 







 Update after worker nodes 

The following table shows the actions that you must take after you update your worker nodes.



Changes to make after you update the worker nodes to Kubernetes 1.19

 Type Description 

 Deprecated: Beta worker node labels The following beta worker node labels are deprecated and replaced.
kubectl autoscale deployment <deployment_name> --cpu-percent=<percentage> --min=<min_value> --max=<max_value>



Table 2. Understanding your command options

 Options Description 

 --cpu-percent The average CPU utilization that is maintained by the Horizontal Pod Autoscaler, which is specified as a percentage. 
 --min The minimum number of deployed pods that are used to maintain the specified CPU utilization percentage. 
 --max The maximum number of deployed pods that are used to maintain the specified CPU utilization percentage. 









 Managing rolling deployments to update your apps 

You can manage the rollout of your app changes in an automated and controlled fashion for workloads with a pod template such as deployments. If your rollout isn't going according to plan, you can roll back your deployment to the previous revision.

Want to prevent downtime during your rolling update? Be sure to specify a [readiness probe in your deployment](https://cloud.ibm.com/docs/containers?topic=containers-appprobe) so that the rollout proceeds to the next app pod after the most recently updated pod is ready.

Before you begin



* [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)
* Create a [deployment](https://cloud.ibm.com/docs/containers?topic=containers-deploy_appapp_cli).
* Make sure that you have a [service access role](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-perms) that grants the appropriate Kubernetes RBAC role so that you can work with Kubernetes resources in the namespace.



To manage rolling updates to your apps,



1. To make sure that your deployments are marked as ready only when the container is running and ready to service requests, add [liveness and readiness probes to your deployment](https://cloud.ibm.com/docs/containers?topic=containers-appprobe).
Use this page as a visual reference for how ibmcloud ks commands are organized, or to quickly find a specific command.

Kubernetes Service 1.19, 1.20, 1.21, and 1.22 unsupported date change
: The [Kubernetes version information and update actions](https://cloud.ibm.com/docs/containers?topic=containers-cs_versionscs_versions_available) page has been updated with the new unsupported dates.

Worker node fix pack update.
: Kubernetes [1.22.4_1536](https://cloud.ibm.com/docs/containers?topic=containers-changelog_1221224_1536), [1.21.7_1546](https://cloud.ibm.com/docs/containers?topic=containers-changelog_1211217_1546), [1.20.13_1567](https://cloud.ibm.com/docs/containers?topic=containers-changelog_12012013_1567), and [1.19.16_1574](https://cloud.ibm.com/docs/containers?topic=containers-changelog_11911916_1574).





 17 January 2022 

IBM Cloud Object Storage plug-in
: Version 2.1.8 of the IBM Cloud Object Storage plug-in is released. For more information, see the [IBM Cloud Object Storage plug-in change log](https://cloud.ibm.com/docs/containers?topic=containers-cos_plugin_changelog).





 13 January 2022 

Istio add-on
: [Version 1.12.1](https://cloud.ibm.com/docs/containers?topic=containers-istio-changelog1121) and [Version 1.10.6](https://cloud.ibm.com/docs/containers?topic=containers-istio-changelog1106) of the Istio managed add-on are released.





 06 January 2022 

Block Storage for VPC add-on.
prometheus :9253
}
ip6.arpa:53 {
errors
cache 30
reload
loop
bind 169.254.20.10 172.21.0.10
forward . __PILLAR__CLUSTER__DNS__ {
force_tcp
}
prometheus :9253
}
.:53 {
errors
cache 30
reload
loop
bind 169.254.20.10 172.21.0.10
forward . __PILLAR__UPSTREAM__SERVERS__ {
force_tcp
}
prometheus :9253
}
<MyCorefile>: 
 Add custom corefile content ...
3. After a few minutes, the NodeLocal DNS cache pods pick up the ConfigMap changes.







 Editing the node-local-dns-config ConfigMap to extend with stub domains or upstream servers 

Edit the node-local-dns-config ConfigMap to extend the NodeLocal DNS cache configuration such as by customizing stub domains or upstream DNS servers. For more information, see the [Kubernetes documentation](https://kubernetes.io/docs/tasks/administer-cluster/dns-custom-nameservers/kube-dns).

Before you begin: [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)



1. Verify that the NodeLocal DNS cache daemon set is available.

kubectl get ds -n kube-system node-local-dns

Example output

NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR AGE
node-local-dns 4 4 4 4 4 ibm-cloud.kubernetes.io/node-local-dns-enabled=true 82d
2. Confirm that the NodeLocal DNS cache has a ConfigMap.
* [1.4 Scheduler](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-125cis-benchmark-14-125)



* [2 Etcd node configuration](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-125cis-section-2-125)
* [3 Control plane configuration](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-125cis-section-3-125)



* [3.1 Authentication and authorization](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-125cis-benchmark-31-125)
* [3.2 Logging](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-125cis-benchmark-32-125)



* [4 Worker node security configuration](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-125cis-section-4-125)



* [4.1 Worker node configuration files](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-125cis-benchmark-41-125)
* [4.2 Kubelet](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-125cis-benchmark-42-125)



* [5 Kubernetes policies](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-125cis-section-5-125)



* [5.1 RBAC and service accounts](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-125cis-benchmark-51-125)
* [5.2 Pod Security Policies](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-125cis-benchmark-52-125)
Max pods N/A N/A Increased the limit of maximum number of pods for worker nodes with more than 11 CPU cores to be 10 pods per core, up to a maximum of 250 pods per worker node. 







 Change log for 1.14.3_1523, released 17 June 2019 

The following table shows the changes that are in the patch 1.14.3_1523.



Table 1. Changes since version 1.14.2_1521

 Component Previous Current Description 

 GPU device plug-in and installer 32257d3 5d34347 Updated image for [CVE-2019-8457](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8457). Updated the GPU drivers to [430.14](https://www.nvidia.com/Download/driverResults.aspx/147582/). 
 IBM Cloud File Storage for Classic plug-in 346 347 Updated so that the IAM API key can be either encrypted or unencrypted. 
 IBM Cloud Provider v1.14.2-100 v1.14.3-113 Updated to support the Kubernetes 1.14.3 release. 
 Kubernetes v1.14.2 v1.14.3 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.14.3). 
 Kubernetes feature gates configuration N/A N/A Added the SupportNodePidsLimit=true configuration to reserve process IDs (PIDs) for use by the operating system and Kubernetes components. Added the CustomCPUCFSQuotaPeriod=true configuration to mitigate CPU throttling problems. 
 Public service endpoint for Kubernetes master N/A N/A Fixed an issue to [enable the public cloud service endpoint](https://cloud.ibm.com/docs/containers?topic=containers-cs_network_clusterset-up-public-se).
Kubernetes v1.19.6 v1.19.7 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.19.7). Updated to implement additional IBM security controls. 
 Kubernetes Dashboard v2.0.4 v2.0.5 See the [Kubernetes Dashboard release notes](https://github.com/kubernetes/dashboard/releases/tag/v2.0.5). 
 Kubernetes Dashboard metrics scraper v1.0.4 v1.0.6 See the [Kubernetes Dashboard metrics scraper release notes](https://github.com/kubernetes-sigs/dashboard-metrics-scraper/releases/tag/v1.0.6). 
 Load balancer and load balancer monitor for IBM Cloud Provider 1004 1078 Updated image for [CVE-2020-1971](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1971). 
 Operator Lifecycle Manager Catalog v1.14.0 v1.15.3 See the [Operator Lifecycle Manager Catalog release notes](https://github.com/operator-framework/operator-registry/releases/tag/v1.15.3). 
 Operator Lifecycle Manager 0.16.1 0.16.1-IKS-3 Updated image for [CVE-2020-1971](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1971). 







 Change log for worker node fix pack 1.19.7_1532, released 18 January 2021 

The following table shows the changes that are in the worker node fix pack 1.19.7_1532. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.19.5_1530

 Component Previous Current Description