vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Private Service Endpoint URL: https://c105.private.<REGION>.containers.cloud.ibm.com:<port>

 How to fix it 

If your cluster meets these conditions, delay updating to version 1.21 until you can [enable service endpoints and VRF](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint&interface=uivrf) for the account. If you are updating your VPC clusters or classic clusters that have only public service endpoints enabled, there is no issue updating to 1.21. If you have questions about this issue, please open a support ticket and reference this announcement.

Do not create classic clusters with only a private service endpoint enabled unless you have both VRF and the Service Endpoint enabled.
: Red Hat OpenShift [4.9.26_1535_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_changelog_49), [4.8.35_1553_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_changelog_48), [4.7.46_1560_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_changelog_47), [4.6.56_1579_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_changelog_46), [3.11.664_1628_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_changelog_311).





 7 April 2022 

Red Hat OpenShift on IBM Cloud clusters in Mexico City (MEX01) are deprecated and become unsupported later this year.
: To prevent any interruption of service, [redeploy your cluster workloads](https://cloud.ibm.com/docs/openshift?topic=openshift-update_appcopy_apps_cluster) to a [supported data center](https://cloud.ibm.com/docs/openshift?topic=openshift-regions-and-zoneszones-mz) and remove your MEX01 clusters by 31 October 2022. Clusters remaining in these data centers after 31 October 2022 will be removed. You cannot create clusters in this location after 07 May 2022. For more information about data center closures and recommended data centers, see [Data center consolidations](https://cloud.ibm.com/docs/get-support?topic=get-support-dc-closure).

Red Hat OpenShift on IBM Cloud default version update.
satellite.config-cluster.detach A Satellite or Red Hat OpenShift on IBM Cloud cluster is detached from Satellite Config and can no longer receive configuration. 
 satellite.config-clusters.detach One or more Satellite or Red Hat OpenShift on IBM Cloud clusters are detached from Satellite Config and can no longer receive configuration. 
 satellite.config-clusters.group One or more Satellite or Red Hat OpenShift on IBM Cloud clusters are added to a cluster group. 
 satellite.config-clusters.ungroup One or more Satellite or Red Hat OpenShift on IBM Cloud clusters are removed from a cluster group. 
 satellite.config-clustergroups.edit A Satellite or Red Hat OpenShift on IBM Cloud cluster sets the cluster group or cluster groups of which it is a member. 
 satellite.config-clustergroups.assign One or more Satellite or Red Hat OpenShift on IBM Cloud clusters are added to one or more cluster groups. 
 satellite.config-clustergroups.unassign: One or more Satellite or Red Hat OpenShift on IBM Cloud clusters are removed from one or more cluster groups. 
 satellite.config-configuration.create A Satellite configuration is created. 
 satellite.config-configuration.update A Satellite configuration is updated. 
 satellite.config-configuration.delete A Satellite configuration is removed. 
 satellite.config-configuration.addversion A version is added to a Satellite configuration. 
 satellite.config-configuration.removeversion A version is removed from a Satellite configuration. 
 satellite.config-subscription.create A Satellite subscription is created. 
 satellite.config-subscription.update A Satellite subscription is updated. 
 satellite.config-subscription.delete A Satellite subscription is removed. 
 satellite.config-subscription.setversion A Satellite subscription is set to a specific configuration version. 
 satellite.config-group.create A cluster group is created. 
 satellite.config-group.delete A cluster group is removed. 







 Events for Satellite storage 



Satellite storage actions that generate events.

 Action Description 

 satellite.storage-template.get A storage template is retrieved.
For example, in IBM Cloud Kubernetes Service, the instance is a cluster. By default, resources belong to the default resource group in your account. You can assign users an access role to a resource instance to grant permissions as described in the following scenarios.



* All IBM Cloud IAM services in your account, including all clusters in IBM Cloud Kubernetes Service and images in IBM Cloud Container Registry.
* All instances within a service, such as all the clusters in IBM Cloud Kubernetes Service.
* All instances within a region of a service, such as all the clusters in the US South region of IBM Cloud Kubernetes Service.
* To an individual instance, such as one cluster.



Kubernetes namespace
: As part of cluster resource instances in IBM Cloud IAM, you can assign users with service access roles to namespaces within your clusters. When you assign access to a namespace, the policy applies to all current and future instances of the namespace in all the clusters that you authorize. For example, say that you want a dev group of users to be able to deploy Kubernetes resources in a test namespace in all your clusters in AP North. If you assign the dev access group the Writer service access role for the Kubernetes namespace test in all clusters in the AP North region within the default resource group, the dev group can access the test namespace in any AP North cluster in the default resource group that currently has or eventually has a test namespace. If you scope a service access role to a namespace, you can't apply the policy to a resource group or assign a platform access role at the same time.

Resource group
: You can organize your account resources in customizable groupings so that you can quickly assign individual or groups of users access to more than one resource at a time. Resource groups can help operators and administrators filter resources to view their current usage, troubleshoot issues, and manage teams.
: A cluster can be created in only one resource group that you can't change afterward. If you create a cluster in the wrong resource group, you must delete the cluster and re-create it in the correct resource group.
All public traffic to the cluster APIserver is blocked. To use public CBR rules to control access to your cluster, update your cluster to enable public service endpoint.
* Due to a limitation with how Red Hat OpenShift on IBM Cloud fetches cluster details, the APIs for getting clusters and listing clusters are still accessible regardless of the CBR rules. This means clusters are still visible (read-only) in the console and CLI. When this limitation is addressed, you must add new rules to protect the APIs for getting clusters and listing clusters.
* For Red Hat OpenShift on IBM Cloud clusters on VPC with a Public Service Endpoint, if you add public CBR rules to your cluster, make sure to also add the public gateway IP addresses of your VPC subnets to your CBR rules. If you don't include the public gateway IPs, your Red Hat OpenShift Console pods won't work properly because those pods need to access the Oauth port of the cluster master with the public network.
* Due to a limitation that is currently being addressed, when you create a single private CBR rule that applies to the cluster API type and specifies a single, empty network zone, the rule does not block the private service endpoint completely. Instead, the cluster is treated as if there are no CBR rules and allows all traffic. Until this limitation is resolved, you must create a private CBR rule with at least one IP, for example, 1.1.1.1/32, or another IP that you control.
* Some Red Hat OpenShift on IBM Cloud clusters that were created before 8 October 2022 are not able to enforce public CBR rules for the cluster's APIserver. To check if your cluster supports these public cluster API type CBR rules, run the ibmcloud ks cluster get -c <CLUSTER-ID> command. If either of the Service Endpoint URLs starts with the https://cXXX (where XXX is any three digit number), then the cluster does support public CBR rules. If the Service Endpoint URLs starts with https://cX (where the number after the c is a single digit), then the cluster is not able to enforce public CBR rules for the cluster's APIserver.
: Added how to [add IBM Cloud tags to existing clusters](https://cloud.ibm.com/docs/containers?topic=containers-add_workerscluster_tags).

VPC security groups
: [Modify the security group rules](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-security-group)for VPC Gen 2 clusters to allow traffic requests that are routed to node ports on your worker nodes.





 3 February 2020 

Version change log
: Kubernetes worker node fix packs [1.16.5_1523](https://cloud.ibm.com/docs/containers?topic=containers-116_changelog1165_1523), [1.15.8_1530](https://cloud.ibm.com/docs/containers?topic=containers-115_changelog1158_1530), [1.14.10_1546](https://cloud.ibm.com/docs/containers?topic=containers-114_changelog11410_1546), and [1.13.12_1549](https://cloud.ibm.com/docs/containers?topic=containers-113_changelog11312_1549).

Expanded troubleshooting
: You can now find troubleshooting steps for IBM Cloud Kubernetes Service clusters in the following pages.



* [Clusters and masters](https://cloud.ibm.com/docs/containers?topic=containers-debug_clusters)
* [Worker nodes](https://cloud.ibm.com/docs/containers?topic=containers-debug_worker_nodes)
* [Cluster networking](https://cloud.ibm.com/docs/containers?topic=containers-coredns_lameduck)
* [Apps and integrations](https://cloud.ibm.com/docs/containers?topic=containers-debug_apps)
* [Load balancers](https://cloud.ibm.com/docs/containers?topic=containers-cs_loadbalancer_fails)
* [17 October 2019](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-oct1719)



* New! Cluster autoscaler
* New DevOps tutorial



* [14 October 2019](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-oct1419)



* CLI change log
* Calico MTU
* Creating DNS subdomains for VPC load balancers and private Ingress ALBs
* Let's Encrypt rate limits for Ingress
* Version change logs



* [3 October 2019](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-oct0319)



* Ingress ALB change log
* DevOps toolchain
* Security for VPC clusters



* [1 October 2019](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-oct0119)



* End of service of IBM Log Analysis and IBM Cloud Monitoring
* New! Gateway-enabled classic clusters
* Version change logs





* [September 2019](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-sept19)



* [27 September 2019](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-sept2719)



* IBM Cloud Object Storage supported in VPC clusters



* [24 September 2019](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-sept2419)



* CLI change log
* Ingress ALB change log
* Managing cluster network traffic for VPC clusters
* Customizing PVC settings for VPC Block Storage
: Kubernetes [1.23.5_1526](https://cloud.ibm.com/docs/containers?topic=containers-changelog_123), [1.22.8_1548](https://cloud.ibm.com/docs/containers?topic=containers-changelog_122), [1.21.11_1556](https://cloud.ibm.com/docs/containers?topic=containers-changelog_121), [1.20.15_1577](https://cloud.ibm.com/docs/containers?topic=containers-changelog_120).





 7 April 2022 

IBM Cloud Kubernetes Service clusters in Mexico City (MEX01) are deprecated and become unsupported later this year.
: To prevent any interruption of service, [redeploy your cluster workloads](https://cloud.ibm.com/docs/containers?topic=containers-update_appcopy_apps_cluster) to a [supported data center](https://cloud.ibm.com/docs/containers?topic=containers-regions-and-zoneszones-mz) and remove your MEX01 clusters by 31 October 2022. Clusters remaining in these data centers after 31 October 2022 will be removed. You cannot create clusters in this location after 07 May 2022. For more information about data center closures and recommended data centers, see [Data center consolidations](https://cloud.ibm.com/docs/get-support?topic=get-support-dc-closure).

Ingress ALB change log updates
: Updated the [Ingress ALB change log](https://cloud.ibm.com/docs/containers?topic=containers-cluster-add-ons-changelog) for versions 1.1.2_2084_iks, 1.1.1_2085_iks, and 0.49.3_2083_iks.

CLI change log update
: Version 3.0.0 of the Block Storage for VPC add-on is released. Update your clusters to use the latest version. For more information, see the [Block Storage for VPC add-on change log](https://cloud.ibm.com/docs/containers?topic=containers-vpc_bs_changelog).

End of service of VPC Gen 1
: Removed steps for using VPC Gen 1 compute. You can now [create new VPC clusters on Generation 2 compute only](https://cloud.ibm.com/docs/containers?topic=containers-cluster-create-vpc-gen2&interface=ui). Move any remaining workloads from VPC Gen 1 clusters to VPC Gen 2 clusters before 01 March 2021, when any remaining VPC Gen 1 worker nodes are automatically deleted.





 25 February 2021 

CLI change log
: Updated the IBM Cloud Kubernetes Service CLI plug-in change log page for the [release of version 1.0.231](https://cloud.ibm.com/docs/containers?topic=containers-cs_cli_changelog10).





 24 February 2021 

Default version
: Kubernetes 1.19 is now the default cluster version.





 23 February 2021 

VPE
: Worker node communication to the Kubernetes master is now established over the [VPC virtual private endpoint (VPE)](https://cloud.ibm.com/docs/containers?topic=containers-vpc-subnetsvpc_basics_vpe).





 22 February 2021 

Master versions
ibmcloud oc cluster create classic --name cloud_pak_cluster --version 4.11_openshift --zone dal10 --flavor b3c.4x16 --hardware dedicated --workers 3 --entitlement cloud_pak --public-vlan <public_VLAN_ID> --private-vlan <private_VLAN_ID> [--operating-system (REDHAT_7_64|REDHAT_8_64)]

For a complete list of available RHEL versions and which cluster versions they are compatible with, see [Available Red Hat OpenShift versions](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_versionsopenshift_versions_available).

ibmcloud oc cluster create classic --name my_cluster --zone dal10 --flavor b3c.4x16 --version 4.9.28_openshift --operating-system REDHAT_8_64

For a classic multizone cluster, after you created the cluster in a [multizone metro](https://cloud.ibm.com/docs/openshift?topic=openshift-regions-and-zoneszones-mz), [add zones](https://cloud.ibm.com/docs/openshift?topic=openshift-add_workersadd_zone):

ibmcloud oc zone add classic --zone <zone> --cluster <cluster_name_or_ID> --worker-pool <pool_name> --private-vlan <private_VLAN_ID> --public-vlan <public_VLAN_ID>





 Creating VPC clusters in the CLI 

Review the sample commands for creating classic clusters in the CLI. For more detailed steps and information about creating clusters, see [Creating VPC clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-cluster-create-vpc-gen2&interface=clicluster_create_vpc).
Deployment models 

Deployment models help you to understand your application deployment process across clusters.



  Push-based deployment 

The push-based deployment model deploys your application on a single cluster. It does not require any operator installation on your cluster.

For a push-based deployment, complete these steps:



1.  Log in to your Kubernetes or Red Hat OpenShift on IBM Cloud cluster.
2.  Apply the deployment files by using the native [kubectl](https://kubernetes.io/docs/reference/kubectl/kubectl/) tool.







  Pull-based deployment 

The pull-based deployment model is suitable for multi-cluster application deployments. This model uses IBM Cloud Satellite Config as the deployment tool for deploying across multiple clusters. For more information, see [Understanding Satellite Config](https://cloud.ibm.com/docs/satellite?topic=satellite-cluster-config).

For a pull-based deployment, complete these steps:



1.  Create or update the required Satellite config and their versions for the deployment files.
2.  Create or update the IBM Cloud Satellite subscriptions with Satellite config and the versions that need to be deployed.
3.  After the subscriptions are updated, the Razee agent that is installed on the clusters pulls the most recent deployments from Satellite config and deploys them across the clusters.
* [Creating a secret to store the KMS credentials](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_portworx_planpx_create_km_secret)



[Preparing your cluster for Portworx](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_portworx_preparingstorage_portworx_preparing)



* [Classic clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_portworx_preparingpx-create-classic-volumes)
* [VPC clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_portworx_preparingpx-create-vpc-volumes)
* [Satellite clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_portworx_preparingpx-create-satellite-volumes)



[Setting up the Portworx key-value store](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_portworx_kv_storestorage_portworx_kv_store)



* [Setting up a key-value store for Portworx metadata](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_portworx_kv_storeportworx_database)
* [Using the Portworx key-value database](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_portworx_kv_storeportworx-kvdb)



* [Optional: Setting up a Databases for etcd service instance](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_portworx_kv_storeportworx-kv-db)
A 200 response means that the BookInfo app is running properly with Istio.

curl -o /dev/null -s -w "%{http_code}n" http://${GATEWAY_URL}/productpage







 Viewing the BookInfo web page in a browser 

Run the following command based on your operating to view the BookInfo app in your browser.

Mac OS or Linux

open http://$GATEWAY_URL/productpage

Windows

start http://$GATEWAY_URL/productpage

Try refreshing the page several times. Different versions of the reviews section round-robin through red stars, black stars, and no stars.





 Exposing BookInfo by using an IBM-provided subdomain without TLS 

When you enable the BookInfo add-on in your cluster, the Istio gateway bookinfo-gateway is created for you. The gateway uses Istio virtual service and destination rules to configure a load balancer, istio-ingressgateway, that publicly exposes the BookInfo app. In the following steps, you create a subdomain for the istio-ingressgateway load balancer IP address in classic clusters or the hostname in VPC clusters through which you can publicly access BookInfo.



1. Register the IP address in classic clusters or the hostname in VPC clusters for the istio-ingressgateway load balancer by creating a DNS subdomain.



* Classic:

ibmcloud ks nlb-dns create classic --ip $INGRESS_IP --cluster <cluster_name_or_id>
* VPC:

ibmcloud ks nlb-dns create vpc-gen2 --lb-host $GATEWAY_URL --cluster <cluster_name_or_id>



2. Verify that the subdomain is created and copy the subdomain.

ibmcloud ks nlb-dns ls --cluster <cluster_name_or_id>



Example output for Classic clusters

Hostname IP(s) Health Monitor SSL Cert Status SSL Cert Secret Name
- ''
http:
- match:
- uri:
exact: /<service_path> Replace service_path with the path that your entrypoint microservice listens on. For example, in the BookInfo app, the path is defined as /productpage.
route:
- destination:
host: <service_name> Replace service_name with the name of your entrypoint microservice. For example, in the BookInfo app, productpage served as the entrypoint microservice that called the other app microservices.
port:
number: 80 If your microservice listens on a different port, replace 80 with the port.
Show more
4. Apply the virtual service rules in the namespace where your Istio-managed microservice is deployed.

kubectl apply -f my-virtual-service.yaml -n <namespace>
5. Get the EXTERNAL-IP address (classic clusters) or the hostname (VPC clusters) for the istio-ingressgateway public load balancer. If you [enabled an Istio load balancer in each zone of your cluster](https://cloud.ibm.com/docs/containers?topic=containers-istio-meshconfig-gateways), get the IP address or hostname of the load balancer service in each zone.

kubectl get svc -n istio-system

 Example output for classic clusters
istio-ingressgateway LoadBalancer 172.21.XXX.XXX 169.1.1.1 80:31380/TCP,443:31390/TCP,31400:31400/TCP,5011:31323/TCP,8060:32483/TCP,853:32628/TCP,15030:31601/TCP,15031:31915/TCP 22m

 Example output for VPC clusters:
Create a configuration file for a private Ingress controller.

apiVersion: operator.openshift.io/v1
kind: IngressController
metadata:
name: private-ingress-controller
namespace: openshift-ingress-operator
spec:
replicas: 2
domain: <domain>
endpointPublishingStrategy:
loadBalancer:
scope: Internal
type: LoadBalancerService
2. Create the IngressController resource in the openshift-ingress-operator project of your cluster. When you create the IngressController, a private Ingress controller is automatically created and deployed in the openshift-ingress project based on the IngressController settings that you set in the previous step. Additionally, an Ingress controller service is created to expose the Ingress controller with an IP address (classic clusters) or a VPC hostname (VPC clusters).

oc create -f private-ingress-controller.yaml -n openshift-ingress-operator
3. Run the oc get command and find the IP address or VPC hostname in the EXTERNAL IP field of the router-private-ingress-controller service.

oc get svc router-private-ingress-controller -n openshift-ingress

Example output for classic clusters.

NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
router-private-ingress-controller LoadBalancer 172.21.57.132 10.XX.XX.XX 80/TCP,443/TCP,1940/TCP 3m

Example output for VPC clusters:

NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
router-private-ingress-controller LoadBalancer 172.21.57.132 1234abcd-us-south.lb.appdomain.cloud 80/TCP,443/TCP,1940/TCP 3m
4. Register the service's external IP address or VPC hostname with the domain you previously chose.