vania-janet/multiturn-rag-retrieval-data huggingface dataset:
: Added a troubleshooting topic for [build errors due to image pull authentication](https://cloud.ibm.com/docs/openshift?topic=openshift-ts-app-build-img-pull).

Installing SGX drivers
: Added a topic for [installing SGX drivers and platform software on SGX-capable worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-add_workersinstall-sgx).

Sizing workloads
: Enhanced the topic with a [How do I monitor resource usage and capacity in my cluster?](https://cloud.ibm.com/docs/openshift?topic=openshift-strategysizing_manage) FAQ.
: sticky-cookie-services annotation.
: Added the secure and httponly parameters to the [sticky-cookie-services annotation](https://cloud.ibm.com/docs/containers?topic=containers-comm-ingress-annotationssession-affinity-cookies).

Enabling TLS for Ingress, Red Hat OpenShift version 4.3 only
: If you use a custom domain and want to enable TLS for Ingress, you must [add a TLS section to each Ingress resource](https://cloud.ibm.com/docs/openshift?topic=openshift-secrets&interface=ui) instead of specifying the certificate in the configuration file for the custom Ingress controller.

Version change logs
: Master and worker node patch updates are available.
: Red Hat OpenShift [3.11.170_1544_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_changelog_311311170_1544).





 12 March 2020 

Feature gates
: Added the [feature gates for Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-service-settingsfeature-gates) that differ from community Red Hat OpenShift distributions.





 9 March 2020
OpenVPN server 2.4.6-r3-IKS-462 2.5.4-r0-IKS-555 Update base image to alpine 3.15 to address CVEs, no longer set the --compress config option, updated scripts. 
 OpenVPN Operator image v1.3.9 v1.4.0 Updated OpenVPN to version 2.5.4-r0. Remove deprecated compression config option from VPN server. Set cipher explicitly to default value to avoid warning message in logs. 
 Red Hat OpenShift on IBM Cloud Metrics Server v4.6.0-20211201 v4.6.0-20220107 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.6.0%2B20220107). 
 Red Hat OpenShift on IBM Cloud toolkit 4.6.0+20211201 4.6.0+20220107 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.6.0%2B20220107). 







 Change log for worker node fix pack 4.6.53_1569_openshift, released 18 January 2022 

The following table shows the changes that are in the worker node fix pack 4.6.53_1569_openshift. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 4.6.52_1568_openshift

 Component Previous Current Description
Create security groups to define inbound and outbound traffic that's allowed for virtual server instances. For more information, see [Using security groups](https://cloud.ibm.com/docs/vpc?topic=vpc-using-security-groups) and [Overview of network security options](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-network-policy).
6. Configure ACLs for your subnets that do not contain virtual servers or Red Hat OpenShift on IBM Cloud clusters (for example, subnets that contain a VPN Gateway or VPEs). For more information, see [Set up network ACLs](https://cloud.ibm.com/docs/vpc?topic=vpc-using-acls).

Even though we recommend security groups where possible, there are subnets without virtual servers or Red Hat OpenShift on IBM Cloud clusters that require ACLs. In our example, we're referring to the subnets that contain virtual private endpoints (VPEs) only or VPN for VPC.

For more information, see:



* [Configuring ACLs and security groups for use with VPN](https://cloud.ibm.com/docs/vpc?topic=vpc-acls-security-groups-vpn)



7. [Order Transit Gateway](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-ordering-transit-gateway).

For additional consideration, see the following resources:



* [Interconnect two or more VPCs in the same MZR](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-aboutuse-case-1-interconnect-two-or-more-vpcs-in-the-same-mzr)
* [Planning for Transit Gateway](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-helpful-tips)
Section 5.5 Extensible admission control benchmark results

 Section Recommendation Manual/Automated Level Result 

 5.5.1 Configure image provenance by using image controller configuration parameters. Manual 2 Not checked 







 5.7 General policies 



Section 5.7 General policies benchmark results

 Section Recommendation Manual/Automated Level Result 

 5.7.1 Create administrative boundaries between resources by using namespaces. Manual 1 Not checked 
 5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitions. Manual 2 Not checked 
 5.7.3 Apply security context to your pods and containers. Manual 2 Not checked 
 5.7.4 Do not use the default namespace. Automated 2 Not checked 









 IBM Remediations and explanations 



Remediations and explanations

 Section Recommendation/Explanation 

 1.2.23 Red Hat OpenShift on IBM Cloud can optionally enable Kubernetes API server auditing. 
 1.2.33 Red Hat OpenShift on IBM Cloud can optionally enable a Kubernetes Key Management Service (KMS) provider. 
 1.2.34 Red Hat OpenShift on IBM Cloud can optionally enable a Kubernetes Key Management Service (KMS) provider. 
 2.7 Red Hat OpenShift on IBM Cloud configures a unique Certificate Authority for etcd. 
 5.2.8 Red Hat OpenShift on IBM Cloud installs custom SCCs. 
 5.3.2 Red Hat OpenShift on IBM Cloud has a set of default Calico network policies defined and additional network policies can optionally be added.
Section 5.5 Extensible admission control benchmark results

 Section Recommendation Manual/Automated Level Result 

 5.5.1 Configure image provenance by using image controller configuration parameters. Manual 2 Not checked 







 5.7 General policies 



Section 5.7 General policies benchmark results

 Section Recommendation Manual/Automated Level Result 

 5.7.1 Create administrative boundaries between resources by using namespaces. Manual 1 Not checked 
 5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitions. Manual 2 Not checked 
 5.7.3 Apply security context to your pods and containers. Manual 2 Not checked 
 5.7.4 Do not use the default namespace. Automated 2 Not checked 









 IBM Remediations and explanations 



Remediations and explanations

 Section Recommendation/Explanation 

 1.2.4 Red Hat OpenShift on IBM Cloud configures the IBM Cloud IAM identity provider by default. 
 1.2.19 Test will properly ignore Red Hat OpenShift version 4.11 and later clusters when [https://github.com/ComplianceAsCode/compliance-operator/issues/77](https://github.com/ComplianceAsCode/compliance-operator/issues/77) is fixed. 
 1.2.23 Red Hat OpenShift on IBM Cloud can optionally enable Kubernetes API server auditing. 
 1.2.33 Red Hat OpenShift on IBM Cloud can optionally enable a Kubernetes Key Management Service (KMS) provider. 
 1.2.34 Red Hat OpenShift on IBM Cloud can optionally enable a Kubernetes Key Management Service (KMS) provider. 
 2.7 Red Hat OpenShift on IBM Cloud configures a unique certificate authority for etcd. 
 5.2.8 Red Hat OpenShift on IBM Cloud installs custom SCCs. 
 5.3.1 Review the [issue in GitHub](https://github.com/ComplianceAsCode/content/issues/9047).
Section 5.5 Extensible admission control benchmark results

 Section Recommendation Manual/Automated Level Result 

 5.5.1 Configure image provenance by using image controller configuration parameters. Manual 2 Not checked 







 5.7 General policies 



Section 5.7 General policies benchmark results

 Section Recommendation Manual/Automated Level Result 

 5.7.1 Create administrative boundaries between resources by using namespaces. Manual 1 Not checked 
 5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitions. Manual 2 Not checked 
 5.7.3 Apply security context to your pods and containers. Manual 2 Not checked 
 5.7.4 Do not use the default namespace. Automated 2 Not checked 









 IBM Remediations and explanations 

Review information from IBM Cloud on the CIS Benchmark results.



Remediations and explanations

 Section Recommendation/Explanation 

 1.2.4 Red Hat OpenShift on IBM Cloud configures the IBM Cloud IAM identity provider by default. 
 1.2.19 Test will properly ignore Red Hat OpenShift version 4.11 and later clusters when [https://github.com/ComplianceAsCode/compliance-operator/issues/77](https://github.com/ComplianceAsCode/compliance-operator/issues/77) is fixed. 
 1.2.23 Red Hat OpenShift on IBM Cloud can optionally enable Kubernetes API server auditing. 
 1.2.33 Red Hat OpenShift on IBM Cloud can optionally enable a Kubernetes Key Management Service (KMS) provider. 
 1.2.34 Red Hat OpenShift on IBM Cloud can optionally enable a Kubernetes Key Management Service (KMS) provider. 
 2.7 Red Hat OpenShift on IBM Cloud configures a unique certificate authority for etcd. 
 5.2.8 Red Hat OpenShift on IBM Cloud installs custom SCCs. 
 5.3.1 Review the [issue in GitHub](https://github.com/ComplianceAsCode/content/issues/9047).
Section 5.5 Extensible admission control benchmark results

 Section Recommendation Manual/Automated Level Result 

 5.5.1 Configure image provenance by using image controller configuration parameters. Manual 2 Not checked 







 5.7 General policies 



Section 5.7 General policies benchmark results

 Section Recommendation Manual/Automated Level Result 

 5.7.1 Create administrative boundaries between resources by using namespaces. Manual 1 Not checked 
 5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitions. Manual 2 Not checked 
 5.7.3 Apply security context to your pods and containers. Manual 2 Not checked 
 5.7.4 Do not use the default namespace. Automated 2 Not checked 









 IBM Remediations and explanations 

Review information from IBM Cloud about the CIS Benchmark results.



Remediations and explanations

 Section Recommendation/Explanation 

 1.2.4 Red Hat OpenShift on IBM Cloud configures the IBM Cloud IAM identity provider by default. 
 1.2.19 Test will properly ignore Red Hat OpenShift version 4.11 and later clusters when [https://github.com/ComplianceAsCode/compliance-operator/issues/77](https://github.com/ComplianceAsCode/compliance-operator/issues/77) is fixed. 
 1.2.23 Red Hat OpenShift on IBM Cloud can optionally enable Kubernetes API server auditing. 
 1.2.33 Red Hat OpenShift on IBM Cloud can optionally enable a Kubernetes Key Management Service (KMS) provider. 
 1.2.34 Red Hat OpenShift on IBM Cloud can optionally enable a Kubernetes Key Management Service (KMS) provider. 
 2.7 Red Hat OpenShift on IBM Cloud configures a unique certificate authority for etcd. 
 5.2.8 Red Hat OpenShift on IBM Cloud installs custom SCCs. 
 5.3.1 Review the [issue in GitHub](https://github.com/ComplianceAsCode/content/issues/9047).
Accessing the cluster master with admission controllers and webhooks 

Admission controllers intercept authorized API requests from various Kubernetes resources before the requests reach the API server that runs in your Red Hat OpenShift on IBM Cloud cluster master. Mutating admission webhooks might modify the request, and validating admission webhooks check the request. If either webhook rejects a request, the entire request fails. Advanced features, whether built-in or added on, often require admission controllers as a security precaution and to control what requests are sent to the API server. For more information, see [Using Admission Controllers](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/) and [Dynamic Admission Control](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/) in the Kubernetes documentation.



 Can I create my own admission controllers? 

Yes, see the [Kubernetes](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/) and [Red Hat OpenShift](https://docs.openshift.com/container-platform/4.11/architecture/admission-plug-ins.html) documentation for more information.

As noted in the Kubernetes documentation, you can use admission controllers for operations that are otherwise handled by the control plane. As such, take great caution when you configure a custom admission controller. You are responsible for any changes that happen in your cluster because of a custom admission controller.





 What are the best practices for using webhooks? 

Keep in mind the following best practices and considerations when you configure a webhook.



* Create [replica pods](https://cloud.ibm.com/docs/containers?topic=containers-appreplicaset) for the webhook so that if one pod goes down, the webhook can still process requests from your resources. Spread the replica pods across zones, if possible.
: Updated the CLI plug-in change log page for the [release of version 1.0.353](https://cloud.ibm.com/docs/satellite?topic=satellite-satellite-cli-changelog).







 November 2021 

Review the release notes for November 2021.



 29 November 2021 

Red Hat OpenShift Data Foundation
: Updated deployment parameters for Red Hat OpenShift Data Foundation. The container-private-endpoint parameter is no longer required.

Activity Tracker
: New Activity Tracker events are available for Satellite storage. For more information, see [Auditing events](https://cloud.ibm.com/docs/satellite?topic=satellite-at_events).





 16 November 2021 

New! Sao Paulo location
: You can now manage Satellite locations from the Sao Paulo (sao, br-sao) [IBM Cloud region](https://cloud.ibm.com/docs/satellite?topic=satellite-sat-regions).





 11 November 2021 

New location error message is added.
: For more information see [R0052: Ingress certificate generation issues](https://cloud.ibm.com/docs/satellite?topic=satellite-ts-locations-debugR0052).





 10 November 2021 

Troubleshooting a certificate expired error for the Red Hat OpenShift console
: For more information see [Why can't I access the Red Hat OpenShift web console?](https://cloud.ibm.com/docs/satellite?topic=satellite-ts-sat-ocp-console).





 9 November 2021 

Azure Disk CSI driver template
: Previously, when you created a storage configuration by using the Azure Disk storage template, you passed your Azure configuration parameters as one base64 encoded string. Now, each of the Azure configuration parameters is exposed as a command-line option. For more information, see [Azure Disk CSI driver](https://cloud.ibm.com/docs/satellite?topic=satellite-storage-azuredisk-csi-driver).





 8 November 2021 

Troubleshooting a degraded Ingress operator
: v1 API: [https://containers.cloud.ibm.com/global/swagger-global-api/](https://containers.cloud.ibm.com/global/swagger-global-api//)
: v2 API: [https://containers.cloud.ibm.com/global/swagger-global-api/](https://containers.cloud.ibm.com/global/swagger-global-api//).

API architectural style
: v1 API: Representational state transfer (REST) that focuses on resources that you interact with through HTTP methods such as GET, POST, PUT, PATCH, and DELETE.
: v2 API: Remote procedure calls (RPC) that focus on actions through only GET and POST HTTP methods.

Supported container platforms
: v1 API: Use the Red Hat OpenShift on IBM Cloud API to manage your IBM Cloud infrastructure resources, such as worker nodes, for both community Kubernetes and Red Hat OpenShift clusters.
: v2 API: Use the Red Hat OpenShift on IBM Cloud v2 API to manage your IBM Cloud infrastructure resources, such as worker nodes, for both community Kubernetes and Red Hat OpenShift VPC clusters.

Red Hat OpenShift API
: v1 API: To use the Red Hat OpenShift API to manage Red Hat OpenShift and Kubernetes resources within the cluster, such as pods or namespaces, you must log in by exchanging an IBM Cloud API key for a Red Hat OpenShift access token. See [Using an API key to log in to clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-access_clusteraccess_api_key).
: v2 API: Same as v1; see [Using an API key to log in to clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-access_clusteraccess_api_key).

Supported APIs by infrastructure type
: v1 API: classic
: v2 API: vpc and classic



* The vpc provider is designed to support multiple VPC subproviders.
* [Accessing clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-access_cluster) on the public or private service endpoints, or by using an IBM Cloud IAM API key such as for automation purposes.



Other managed services
: To use Satellite with other [managed services](https://cloud.ibm.com/docs/satellite?topic=satellite-managed-services), you must set up service to service access through IAM, with Satellite as your target service and the managed service as the source service.



 Platform and service roles for Red Hat OpenShift clusters 

If you create Red Hat OpenShift on IBM Cloud clusters to use in your Red Hat OpenShift locations, you manage access to these clusters in IAM for the Red Hat OpenShift service, not for Red Hat OpenShift. Review the following information to manage IAM access to Red Hat OpenShift clusters.



* [Reference documentation](https://cloud.ibm.com/docs/openshift?topic=openshift-access_reference) for user access permissions including [platform](https://cloud.ibm.com/docs/openshift?topic=openshift-access_reference) and [service](https://cloud.ibm.com/docs/openshift?topic=openshift-access_reference) roles.
* [Assigning access to clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-users), such as setting up the API key for underlying infrastructure permissions and granting users access with IBM Cloud IAM.
* [Accessing clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-access_cluster) on the public or private service endpoints, or by using an IBM Cloud IAM API key such as for automation purposes.









 Common use cases and roles in IBM Cloud 

Wondering which access roles to assign to your Satellite access groups and users? Use the examples in following table to determine which roles and scope to assign.



Types of roles you might assign to meet different use cases.

 Use case Example roles and scope
Create a custom IBM Cloud IAM policy for your cluster service ID that grants access to Red Hat OpenShift on IBM Cloud.

ibmcloud iam service-policy-create <cluster_service_ID> --service-name containers-kubernetes --roles <service_access_role> --service-instance <cluster_ID>



Table 1. Understanding this command's components

 Parameter Description 

 <cluster_service_ID> Required. Enter the service ID that you previously created for your Red Hat OpenShift cluster. 
 --service-name containers-kubernetes Required. Enter containers-kubernetes so that the IAM policy is for Red Hat OpenShift on IBM Cloud clusters. 
 --roles <service_access_role> Required. Enter the access role that you want the service ID to have to your Red Hat OpenShift cluster. [Platform access roles](https://cloud.ibm.com/docs/openshift?topic=openshift-iam-platform-access-roles) permit cluster management activities such as creating worker nodes. [Service access roles](https://cloud.ibm.com/docs/openshift?topic=openshift-iam-service-access-roles) correspond to RBAC roles that permit Red Hat OpenShift management activities within the cluster, such as for Kubernetes resources like pods and namespaces. For multiple roles, include a comma-separated list. Possible values are Administrator, Operator, Editor, and Viewer (platform access roles); and Reader, Writer, and Manager (service access roles). 
 --service-instance <cluster_ID> To restrict the policy to a particular cluster, enter the cluster's ID. To get your cluster ID, run ibmcloud oc clusters. If you don't include the service instance, the access policy grants the service ID access to all your clusters, Kubernetes and Red Hat OpenShift. You can also scope the access policy to a region (--region) or resource group (--resource-group-name). 



3. Create an API key for the service ID.
IBM Cloud Controller Manager v1.22.8-7 v1.22.10-1 Updated to support the Kubernetes 1.22.10 release. 
 IBM Cloud File Storage for Classic plug-in and monitor 408 410 Updated universal base image (UBI) to version 8.6-751 to resolve CVEs. 
 IBM Cloud RBAC Operator 8c8c82b 8c96932 Updated Go to version 1.18.1 
 Key Management Service provider v2.5.4 v2.5.5 Updated Go to version 1.17.10 and updated the golang dependencies. 
 Load balancer and load balancer monitor for IBM Cloud Provider 1916 1998 Updated Go to version 1.17.10 and updated dependencies. 
 OpenVPN Operator image v1.4.3 v1.4.5 Updated base image to v1.21.0 for CVE remediation. 
 Red Hat OpenShift on IBM Cloud. 4.9.28 4.9.33 See the [Red Hat OpenShift on IBM Cloud release notes](https://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.htmlocp-4-9-33). 
 Red Hat OpenShift on IBM Cloud Control Plane Operator v4.9.0-20220412 v4.9.0-20220509 See the [Red Hat OpenShift toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.9.0+20220509). 
 Red Hat OpenShift Metrics Server v4.9.0-20220412 v4.9.0-20220509 See the [Red Hat OpenShift toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.9.0+20220509).
IBM engineers begin testing and hardening the community version in preparation to release a supported Red Hat OpenShift on IBM Cloud version.
2. Supported version lifecycle:

Development release
: Release is under development and might be available as a Beta to select customers. IBM provides best effort support for the release.

General availability
: Release is generally available (GA). IBM provides full support for the release. IBM provides a tentative target date for the release to be unsupported. Release will become the default version used during cluster creation once there are minimal restrictions and a reasonable adoption rate for the release.

Maintenance
: Release has entered maintenance support as defined by Red Hat support. IBM provides maintenance support for OpenShift based on Red Hat policy. IBM provides full support otherwise.

Extended support
: Release has entered extended support as defined by Red Hat. IBM provides extended support for OpenShift based on Red Hat policy. IBM provides full support otherwise.
3. Deprecated version: The version is deprecated. IBM provides an updated unsupported target date for the release. An unsupported countdown to this date will be provided at least 45 days before the release becomes unsupported. IBM provides minimal support for the release in alignment with Red Hat support. This support phase is generally the final phase before the release becomes unsupported and overrides the maintenance and extended support phases should there be any overlap. Security patch updates might not be provided. During the deprecation period, the version is still supported and your cluster is still functional, but might require updating to a supported release to fix security vulnerabilities. For example, by adding or reloading worker nodes.
4. Unsupported version: The version is unsupported. IBM only provides support to upgrade to a supported release. The version is unsupported. Unsupported clusters are not provided with security and patch updates and are not supported by IBM Cloud Support. Although your cluster and apps might continue to run for a time, you can no longer create, reload, or take other corrective actions on your cluster master or worker nodes when an issue occurs.