vania-janet/multiturn-rag-retrieval-data huggingface dataset:
(https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-v2-troubleshootingibp-v2-troubleshooting-status-error)
* [How do I disable the network policies in my namespace?](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-v2-troubleshootingibp-v2-troubleshooting-disable-network-policies)
* [How do I delete a peer pod?](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-v2-troubleshootingibp-troubleshooting-delete-peer)
* [How can I recover a contract after a failed upgrade of the smart contract container?](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-v2-troubleshootingibp-troubleshooting-contract-fail)



Issues on IBM Cloud



* [My Kubernetes cluster on IBM Cloud expired. What does this mean?](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-v2-troubleshootingibp-v2-troubleshooting-cluster-expired)
* [After I deploy a node, I'm seeing a message in my Kubernetes cluster on IBM Cloud reporting that the pod has unbound immediate persistent volume claims. Is this an error?](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-v2-troubleshootingibp-v2-troubleshooting-unbound-persistent-volume-claim)
* [After I deploy a node, I'm seeing a message in my Kubernetes cluster on IBM Cloud reporting that the pod has hit a crash loop backoff. Is this an error?]
The public network interface for worker nodes is protected by [predefined Calico network policy settings](https://cloud.ibm.com/docs/containers?topic=containers-network_policiesdefault_policy) that are configured on every worker node during cluster creation. By default, all outbound network traffic is allowed for all worker nodes. Inbound network traffic is blocked except for a few ports. These ports are opened so that IBM can monitor network traffic and automatically install security updates for the Kubernetes master, and so that connections can be established to NodePort, LoadBalancer, and Ingress services. For more information about these policies, including how to modify them, see [Network policies](https://cloud.ibm.com/docs/containers?topic=containers-network_policiesnetwork_policies).



 Choosing a deployment pattern for classic clusters 

To make an app publicly available to the internet in a classic cluster, choose a load balancing deployment pattern that uses public NodePort, LoadBalancer, or Ingress services. The following table describes each possible deployment pattern, why you might use it, and how to set it up. For basic information about the networking services that these deployment patterns use, see [Understanding Kubernetes service types](https://cloud.ibm.com/docs/containers?topic=containers-cs_network_planningexternal).

NodePort
: Load-balancing method: Port on a worker node that exposes the app on the worker's public IP address
: Use case: Test public access to one app or provide access for only a short amount of time.
: Implementation: [Create a public NodePort service](https://cloud.ibm.com/docs/containers?topic=containers-nodeportnodeport_config).

NLB v1.0 (+ subdomain)
: Load-balancing method: Basic load balancing that exposes the app with an IP address or a subdomain.
: Use case: Quickly expose one app to the public with an IP address or a subdomain that supports SSL termination.
: Implementation: 1.
For instructions, see [Installing and configuring cloud-init on Linux](https://www.ibm.com/support/knowledgecenter/en/SSXK2N_1.4.4/com.ibm.powervc.standard.help.doc/powervc_install_cloudinit_hmc.html).
* Can I use my own AIX, IBM i, or Linux image?

Yes. This function is known as bring your own image. For more information, see [Deploying a custom image within a Power Systems Virtual Server](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-deploy-custom-image).
* What versions of stock images are available?

For each major version (example: Technology Level) of the operating system (OS) that is enabled through the offering, Power Systems Virtual Server provides a single stock image. PowerVS typically provides stock images for the last three major versions of the supported OS. Any update to the OS stock image is planned only when the image level is certified for PowerVM™ environment.
* When are stock images removed from the catalog?

Any unsupported and older stock images are periodically removed from the offering. You will be notified three weeks before the images are removed.
* What happens to VMs deployed using stock images that are being removed?

VMs deployed by using stock images that are being removed can continue to operate without any issues. You are recommended to follow operating system vendor’s guidelines to update the OS as needed.
* What formats should I use when uploading a custom image?

Currently, you can import a custom image in the following formats: .ova, .ova.gz, .tar, .tar.gz and .tgz.
* What are the available storage types in the storage area network (SAN)?

All regions use Tier 1 or Tier 3 storage types. The Tier 1 storage type is best for customers who require higher throughput. Customers who do not require exceptionally high throughput and are looking to minimize costs want to select Tier 3. A VM cannot have disks from both storage types while provisioning.
* [Adding a zone to a worker pool in a classic cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-add_workersadd_zone)
* [Adding a zone to a worker pool in a VPC cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-add_workersvpc_add_zone)



* For Satellite clusters:

ibmcloud oc zone add satellite --zone <zone_name> --cluster <cluster_name_or_ID> --worker-pool <worker_pool>



4. Migrate your workload to the new RHEL 8 worker pool. For more information about restricting your workload to the new worker pool, see [Deploying apps to specific worker nodes by using labels](https://cloud.ibm.com/docs/openshift?topic=openshift-deploy_appnode_affinity).

If you have software-defined storage (SDS) solutions like OpenShift Data Foundation or Portworx, update your storage configurations to include the new worker nodes and verify your workloads before removing your RHEL 7 worker nodes.

Your RHEL 8 worker nodes have the os label set by default, which can be used to [create an affinity rule](https://cloud.ibm.com/docs/openshift?topic=openshift-deploy_appnode_affinity) to reschedule your workload in your RHEL 8 worker pool.

For more information about rescheduling workloads, see [Safely Drain a Node](https://kubernetes.io/docs/tasks/administer-cluster/safely-drain-node/) in the Kubernetes docs or [Understanding how to evacuate pods on nodes](https://docs.openshift.com/container-platform/4.9/nodes/nodes/nodes-nodes-working.html) in the Red Hat OpenShift docs.
5.
: You can use the IBM Cloud Object Storage CSI driver template to create persistent storage for stateful apps that run in Satellite clusters. For more information, see the [IBM Cloud Object Storage CSI driver template documentation](https://cloud.ibm.com/docs/satellite?topic=satellite-storage-ibm-object-storage-plugin).





 26 October 2022 

Create Satellite storage configurations from the console
: You can now create and deploy Satellite storage configurations from the [location console](https://cloud.ibm.com/satellite/locations). For more information about storage templates, see [Understanding storage](https://cloud.ibm.com/docs/satellite?topic=satellite-storage-template-ov).





 7 October 2022 

Subscription identity sync
: After you create a subscription, you might need to [sync subscription identity](https://cloud.ibm.com/docs/satellite?topic=satellite-sat-sync-sub-identity) for your rollout to be successful.

Apply updates your worker nodes in place
: You can apply updates to your worker nodes without detaching them. You can update your worker nodes individually or perform rolling by using a ConfigMap to define update parameters for all worker nodes in a cluster. See [Apply version updates to worker node hosts without detaching them](https://cloud.ibm.com/docs/satellite?topic=satellite-host-update-workershost-update-workers-inplace).





 3 October 2022 

CLI change log
: Updated the CLI plug-in change log page for the [release of version 1.0.454](https://cloud.ibm.com/docs/satellite?topic=satellite-satellite-cli-changelog).







 September 2022 



 23 September 2022 

Added support for remote workers
: You can now assign workload hosts to a location from a single provider or from multiple providers. See [Setting up a Satellite location with remote workers](https://cloud.ibm.com/docs/satellite?topic=satellite-sat-multi-infra).





 21 September 2022 

CLI change log
IBM Cloud keeps all your Istio components up-to-date by automatically rolling out patch updates to the most recent version of Istio that is supported by IBM Cloud Kubernetes Service. To update your Istio components to the next minor version of Istio that is supported by IBM Cloud Kubernetes Service, such as from version 1.9 to 1.10, you must manually update your add-on. You can only manually update Istio one version at a time.

You can only manually update the Istio add-on one version at a time. If you want to update the Istio add-on by two or more versions, you can repeat the manual update process or you can [uninstall and remove](https://cloud.ibm.com/docs/containers?topic=containers-istioistio_uninstall_addon) the add-on and then [reinstall](https://cloud.ibm.com/docs/containers?topic=containers-istioistio_install) it with a later version.

When you update the Istio control components in the istio-system namespace to the latest minor version, you might experience disruptive changes. Review the following changes that occur during a minor version update.



* As updates are rolled out to control plane pods, the pods are re-created. The Istio control plane is not fully available until after the update completes.
* The Istio data plane continues to function during the update. However, some traffic to apps in the service mesh might be interrupted for a short period of time.
* The external IP address for the istio-ingressgateway load balancer does not change during or after the update.



You can't revert your managed Istio add-on to a previous version. If you want to revert to an earlier minor version, you must uninstall your add-on and then reinstall the add-on by specifying the earlier version.



1. Review the current version of your Istio add-on.

kubectl get iop managed-istio -n ibm-operators -o jsonpath='{.metadata.annotations.version}'
2.
VRVDR-40857 Critical Vhost-bridge does not come up for tagged VLAN with interface names of a certain length 
 VRVDR-40803 Minor VIF interfaces are not present in “show vrrp” output after a reboot 
 VRVDR-40644 Major IKEv1: QUICK_MODE re-transmits are not handled correctly 







 Security Vulnerabilities Resolved 



Security vulnerabilities resolved for 1801f

 Issue Number CVSS score Advisory Summary 

 VRVDR- 41512 9.8 DSA-4172-1 CVE-2018-6797, CVE-2018-6798, CVE-2018-6913: Debian DSA-4172-1: perl – security update 
 VRVDR- 41331 6.5 DSA-4158-1 CVE-2018-0739: Debian DSA-4158-1: openssl1.0 – security update 
 VRVDR- 41330 6.5 DSA-4157-1 CVE-2017-3738, CVE-2018-0739: Debian DSA-4157-1: openssl – security update 
 VRVDR- 41215 6.1 CVE-2018-1059 CVE-2018-1059 – DPDK vhost out of bound host memory access from VM guests 









 1801e 

Released March 28, 2018.



 Issues Resolved 



Issues resolved for 1801e

 Issue Number Priority Summary 

 VRVDR-39985 Minor TCP DF packets larger than GRE tunnel MTU are dropped with no ICMP fragmentation needed returned 
 VRVDR-41088 Critical Extended (4 byte) ASN not represented internally as unsigned type 
 VRVDR-40988 Critical Vhost not starting when used with certain number of interfaces 
 VRVDR-40927 Critical DNAT: SDP in SIP 200 OK not translated when it follows a 183 response 
 VRVDR-40920 Major With 127.0.0.1 as listen-address snmpd does not start 
 VRVDR-40920 Critical ARP doesn’t work over bonded SR-IOV interface
The peer admin identity is generated when the peer organization MSP is created and it is associated with the peer node during node deployment. If you are unsure, open the peer tile, and in the left column, view the name of the admin identity under Associated identity for peer. That is the identity that must be in your wallet and is required when you propose a smart contract definition.







 Limitations 



 Can I continue to use the Fabric SDK to deploy my smart contracts? 

If your client applications are using the Fabric v1.4 SDK to deploy smart contracts, those functions will no longer work when the peers are running on a channel with the Fabric 2.0 application capability enabled. In this case, you can only use the Fabric v1.4 or v2.x SDKs with the IBM Blockchain Platform to submit transactions or queries against smart contracts. The SDKs cannot be used to submit administrative transactions such as installing a smart contract, proposing a smart contract definition, approving it, or committing it to a channel. Instead, customers can use the console UI, the [Fabric CLI](https://hyperledger-fabric.readthedocs.io/en/release-2.2/commands/peerlifecycle.html), or [Ansible playbooks](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ansible-build) to perform these administrative tasks.





 What happens to my existing smart contracts? 

Although support for Fabric 2.0 networks was added to the platform, you can still run your existing smart contracts on your peers that run a v1.4 image on a channel with an application capability level of 1.4 or lower. Should you later decide to upgrade your peer to a v2.x image and update your channel application capability level to 2.0, you may need to update your existing smart contract. However, after you upgrade your peer image to v2.x and channel application capability v2.x, there is no longer a way to update the original smart contract.
Installing the IBM Cloud Object Storage plug-in on VPC and classic clusters 

Install the IBM Cloud Object Storage plug-in with a Helm chart to set up pre-defined storage classes for IBM Cloud Object Storage. You can use these storage classes to create a PVC to provision IBM Cloud Object Storage for your apps.

If you are migrating from RHEL 7 to RHEL 8, you must uninstall and then reinstall the plug-in version 2.2.6 or later. If you are upgrading from a chart version before 2.2.5, you must uninstall and reinstall the plug-in and then re-create your PVCs and pods or the upgrade will fail.

Prerequisites
: The IBM Cloud Object Storage plug-in requires at least 0.2 vCPU and 128 MB of memory.

Before you begin: [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)

To install the ibmc Helm plug-in and the ibm-object-storage-plugin:



1. Make sure that your worker node applies the latest patch for your minor version to run your worker node with the latest security settings. The patch version also ensures that the root password on the worker node is renewed.

If you did not apply updates or reload your worker node within the last 90 days, your root password on the worker node expires and the installation of the storage plug-in might fail.



1. List the current patch version of your worker nodes.

ibmcloud ks worker ls --cluster <cluster_name_or_ID>

Example output

OK
ID Public IP Private IP Machine Type State Status Zone Version
kube-dal10-crb1a23b456789ac1b20b2nc1e12b345ab-w26 169.xx.xxx.xxx 10.xxx.xx.xxx b3c.4x16.encrypted normal Ready dal10 1.26_1523
Installing the IBM Cloud Object Storage plug-in on VPC and classic clusters 

Install the IBM Cloud Object Storage plug-in with a Helm chart to set up pre-defined storage classes for IBM Cloud Object Storage. You can use these storage classes to create a PVC to provision IBM Cloud Object Storage for your apps.

If you are migrating from RHEL 7 to RHEL 8, you must uninstall and then reinstall the plug-in version 2.2.6 or later. If you are upgrading from a chart version before 2.2.5, you must uninstall and reinstall the plug-in and then re-create your PVCs and pods or the upgrade will fail.

Prerequisites
: The IBM Cloud Object Storage plug-in requires at least 0.2 vCPU and 128 MB of memory.

Before you begin: [Access your Red Hat OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-access_cluster).

To install the ibmc Helm plug-in and the ibm-object-storage-plugin:



1. Make sure that your worker node applies the latest patch for your minor version to run your worker node with the latest security settings. The patch version also ensures that the root password on the worker node is renewed.

If you did not apply updates or reload your worker node within the last 90 days, your root password on the worker node expires and the installation of the storage plug-in might fail.



1. List the current patch version of your worker nodes.

ibmcloud oc worker ls --cluster <cluster_name_or_ID>

Example output

OK
ID Public IP Private IP Machine Type State Status Zone Version
kube-dal10-crb1a23b456789ac1b20b2nc1e12b345ab-w26 169.xx.xxx.xxx 10.xxx.xx.xxx b3c.4x16.encrypted normal Ready dal10 1.26_1523

If your worker node does not apply the latest patch version, you see an asterisk () in the Version column of your CLI output.
You can use this approach regardless of whether or not your service instance includes recovery crypto units. In this case, the workstation key files serve as a backup copy of your master key value. To complete the initialization in this approach, you also need to use the IBM Cloud TKE CLI plug-in.



 Understanding master key parts 

In this approach, the master key is composed of several master key parts that you need to use the TKE CLI plug-in to create. For security considerations, each key part can be owned by a different person called [master key custodian](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-manage-accessuko-roles). Key parts are stored in workstation files and are protected by password. The master key custodian needs to make sure that the key files are properly saved and no one else knows the password.

The TKE CLI plug-in provides a series of commands to complete the initialization, including creating signature keys and master key parts, adding administrators, and loading the master key. For detailed steps, see [Initializing service instances by using key part files](https://test.cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm).







 What's next 

When you plan your security policy for storing your signature keys and master key parts, take the [Security considerations for initializing a service instance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialization-security-policy) into account.
For more information, see [Best practices for organizing resources and assigning access](https://cloud.ibm.com/docs/account?topic=account-account_setup).

When you define your resource groups, do not add sensitive information in the name.





 Naming 

If you add PII or other sensitive information in the name or the description of a service instance, you might be disclosing sensitive data to others in the same account.

When you define your logging instances names, do not add sensitive information in the name or in the description.





 Service plan 

The service plan that you choose for a logging instance determines the number of days that data is available for search. For more information, see [Service plans](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-service_plans).

Choose your plan based on the number of days that you need to be able to search data online through the web UI.

The HIPAA plan has a maximum of 25 users. If you need to grant permissions to more than 25 users, [open a support ticket](https://cloud.ibm.com/docs/get-support).





 Tags 

A tag is a label that you assign to a resource for easy filtering of resources in your resource list.



* You can use tags to organize your resources and easily find them later.
* You can also use tags to help you with identifying specific team usage or cost allocation when you view your [exported usage report](https://cloud.ibm.com/docs/billing-usage?topic=billing-usage-viewingusageexport-csv).



Tags are case-sensitive, and the maximum length of a tag is 128 characters.



* The characters that are permitted to name tags are A-Z, 0-9, spaces, underscore, hyphen, period, and colon.
* Colons turn the tag into a string where you can isolate two logical parts, like a key:value pair. You can't use a colon in a tag without creating this pairing.
* A comma separates tags and can't be used within the tag name itself.
You can also initialize your service instance by using master key parts that you create and store in files on your local workstation. You can use this approach regardless of whether or not your service instance includes recovery crypto units. In this case, the workstation key files serve as a backup copy of your master key value. To complete the initialization in this approach, you also need to use the IBM Cloud TKE CLI plug-in.



 Understanding master key parts 

In this approach, the master key is composed of several master key parts that you need to use the TKE CLI plug-in to create. For security considerations, each key part can be owned by a different person called [master key custodian](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-accessroles). Key parts are stored in workstation files and are protected by password. The master key custodian needs to make sure that the key files are properly saved and no one else knows the password.

The TKE CLI plug-in provides a series of commands to complete the initialization, including creating signature keys and master key parts, adding administrators, and loading the master key. For detailed steps, see [Initializing service instances by using key part files](https://test.cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm).







 What's next 

When you plan your security policy for storing your signature keys and master key parts, take the [Security considerations for initalizing a service instance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialization-security-policy) into account.
Why can't a user in my account access all instances of a service? 

If a user in your account can't access all instances of a service, you might need to update the type of access they're assigned.

 What’s happening 

You defined a policy that assigns access to a specific service for a user in your account, but they can't access all instances of the service.

 Why it’s happening 

You might need to update the access policy. The issue can be caused by the following reasons:



* The user is not included the correct access group.
* The user is not assigned the correct role.
* The access management tag that's defined in the policy isn't correct. The tag in your policy must be the same tag that is attached to the instances of the service.
* The resource has a context-based restriction that excludes the user.



 How to fix it 

Check the user's level of access.



1. Go to Manage > Access (IAM) in the IBM Cloud console, and select the user from the list on the Users page.
2. To view IAM access policies that are assigned to you, select Access and view the Access policies table.
3. To determine what access you have through the access groups you are assigned, select Access and view the Access groups table. Check the access policies for each of the access groups.



To view what actions are mapped to each role, click the numbers listed next to each role.

To check the name of the access management tag that's attached to the service, complete the following steps:



1. Click the Navigation menu icon ![Navigation Menu icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/icon_hamburger.svg) > Resource List.
2. Locate the service in the table, and see the Tags column.



To help you quickly identify which tags are access management tags, the name is preceded by IAM in the label, for example, IAM | devtools:project1.