vania-janet/multiturn-rag-retrieval-data huggingface dataset:
kube-c85ra07w091uv4nid9ug-vpcoc-default-00000352 10.241.64.4 bx2.4x16 normal Ready us-east-2 4.8.29_1544_openshift
2. Replace the worker node.

ibmcloud oc worker replace -c CLUSTER --worker kube- --update

Example output

The replacement worker node is created in the same zone with the same flavor, but gets new public or private IP addresses. During the replacement, all pods might be rescheduled onto other worker nodes and data is deleted if not stored outside the pod. To avoid downtime, ensure that you have enough worker nodes to handle your workload while the selected worker nodes are being replaced.
Replace worker node kube-c85ra07w091uv4nid9ug-cluster-default-00000288? [y/N]> y
Deleting worker node kube-c85ra07w091uv4nid9ug-cluster-default-00000288 and creating a new worker node in cluster
3. Wait for the replacement node to be provisioned and then list your worker nodes. Note that this process might take 20 minutes or more.

oc get nodes

Example output

NAME STATUS ROLES AGE VERSION
10.241.0.4 Ready master,worker 22d v1.21.6+bb8d50a
10.241.128.4 Ready master,worker 22d v1.21.6+bb8d50a
10.241.64.4 Ready master,worker 22d v1.21.6+bb8d50a







 Step 6: Clean up the resources from the old node 

Major

Minor



1. Navigate to the openshift-storage project.

oc project openshift-storage
2. Remove the failed OSD from the cluster. You can specify multiple failed OSDs if required:
* How many connection requests can I make from one account to VPCs in other IBM Cloud accounts?

Each gateway is only permitted to have ten outstanding requests for a cross-account connection.
* I connected a VPC to one transit gateway. Can I connect that VPC to a second transit gateway?

You can connect a VPC to multiple local transit gateways and a single global gateway.
* I connected a classic connection to one transit gateway. Can I connect the classic connection to a second transit gateway?

You can connect a classic connection to multiple local transit gateways and a single global transit gateway.
* Can I connect a direct link to both a VPC and a transit gateway simultaneously?

No, you must choose to connect to a direct resource (VPC or classic infrastructure), or bind your direct link to one or more local transit gateways, or one global gateway. Your on-premises network can then access IBM Cloud resources connected through the transit gateways.
* I can only provision a transit gateway in a certain set of locations on the provisioning page. Does that mean that the VPC I want to connect must be located in one of those locations?

By enabling global routing, you can connect VPCs located in different [MZRs](https://cloud.ibm.com/docs/overview?topic=overview-locationsmzr-table), regardless of the set of locations that you can provision your transit gateway in.
* What are the service limits that I must keep in mind while using IBM Cloud Transit Gateway?

For more information, see [Service limits](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-helpful-tipsservice-limits).
* Classic access VPCs cannot be attached to a transit gateway. How can I connect and access classic resources in those VPCs?

Although [classic-access VPCs](https://cloud.ibm.com/docs/vpc?topic=vpc-setting-up-access-to-classic-infrastructure) cannot be attached to a transit gateway, access to classic resources and classic-access VPC resources can be achieved by adding the classic infrastructure connection to a transit gateway.
You can add more worker nodes to your cluster by [resizing an existing worker pool](https://cloud.ibm.com/docs/openshift?topic=openshift-add_workersresize_pool) or by [adding a new worker pool](https://cloud.ibm.com/docs/openshift?topic=openshift-add_workersadd_pool). When you add more worker nodes, app instances can be distributed across multiple worker nodes. If one worker node goes down, app instances on available worker nodes continue to run. Red Hat OpenShift automatically reschedules pods from unavailable worker nodes to ensure performance and capacity for your app. To ensure that your pods are evenly distributed across worker nodes, implement [pod affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).



 Is my master highly available in a single zone cluster? 

If your cluster is created in a single zone city, the Kubernetes master of your classic cluster is highly available and includes replicas on separate physical hosts for your master API server, etcd, scheduler, and controller manager to protect against an outage such as during a master update. If your cluster resides in one of the multizone metro locations, the master is automatically deployed with three replicas and spread across the zones of the metro.





 How can I protect my workloads against a single zone failure? 

If your single zone cluster is created in one of the [multizone metro locations](https://cloud.ibm.com/docs/openshift?topic=openshift-regions-and-zoneszones-mz), you can change your single zone cluster to a [multizone cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-ha_clustersmz-clusters). In a multizone cluster, your workloads are distributed across worker nodes in different zones. If one zone is not available, your workloads continue to run in the remaining zones.
To enable VRF, see [Enabling VRF](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpointvrf). To check whether a VRF is already enabled, use the ibmcloud account show command. If you can't or don't want to enable VRF, enable [VLAN spanning](https://cloud.ibm.com/docs/vlans?topic=vlans-vlan-spanningvlan-spanning). To perform this action, you need the Network > Manage Network VLAN Spanning[infrastructure permission](https://cloud.ibm.com/docs/containers?topic=containers-access-credsinfra_access), or you can request the account owner to enable it. To check whether VLAN spanning is already enabled, use the ibmcloud ks vlan spanning get --region <region>[command](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_vlan_spanning_get).





 Can I convert my single zone cluster to a multizone cluster? 

To convert a single zone cluster to a multizone cluster, your cluster must be set up in one of the supported [classic](https://cloud.ibm.com/docs/containers?topic=containers-regions-and-zoneszones-mz) or [VPC](https://cloud.ibm.com/docs/containers?topic=containers-regions-and-zoneszones-vpc) multizone locations. VPC clusters can be set up only in multizone metro locations, and as such can always be converted from a single zone cluster to a multizone cluster. Classic clusters that are set up in a single zone data center can't be converted to a multizone cluster. To convert a single zone cluster to a multizone cluster, see [Adding worker nodes by adding a zone to a worker pool](https://cloud.ibm.com/docs/containers?topic=containers-add_workersadd_zone).





 Do my apps automatically spread across zones? 

It depends on how you set up the app.
Changes overview 

Services MUST have semantic service versioning and MAY support date-based API versioning.



 Semantic service versioning 

Services MAY have a major, minor, and patch version, following the industry conventions on [semantic versioning](https://semver.org/):

> Given a version number MAJOR.MINOR.PATCH, increment the:
>
> MAJOR version when you make incompatible API changes, MINOR version when you add functionality in a backwards-compatible manner, and PATCH version when you make backwards-compatible bug fixes.

If surfaced, this version SHOULD be exposed in the Server response header.



 Major version 

The major version of a service MUST be represented in its URL path, [as detailed](https://cloud.ibm.com/docs/api-handbook?topic=api-handbook-urisversion) in the URI section. A service MAY support multiple major versions concurrently.

Incrementing of the major version MUST NOT occur frequently, and SHOULD occur only as a part of a significant reconception of a service. A new major version of a service MAY support an entirely separate resource scope

[1]that does not support resources created or managed with prior versions.





 Minor and patch versions 

The minor and patch version MUST NOT be client-selectable at runtime for a service deployment.







 Date-based API versioning 

If client-selectable versions of API behavior are needed, services MAY support the version query parameter, accepting a date-based API version in the format YYYY-MM-DD. The version query parameter MUST NOT have any alternative use.



 Supported version dates 

Each major version of a service MUST support a single range of contiguous API version dates.

A non-deprecated major version of a service MUST support up to (but not beyond) the current date (from 00:00 UTC of that date).

From an API client developer's perspective, any date in the supported range is equally valid. From a service developer's point of view, version dates provided by the client SHOULD be canonicalized to a small number of "inflection" dates — version dates at which the behavior of the service actually changes.
VRVDR-43110 N/A DSA-4265-1 Debian DSA-4265-1 : xml-security-c -security update 
 VRVDR-43057 N/A DSA-4260-1 CVE-2018-14679, CVE-2018-14680, CVE-2018-14681, CVE-2018-14682: Debian DSA-4260-1 : libmspack -security update 
 VRVDR-43026 9.8 DSA-4259-1 Debian DSA-4259-1 : ruby2.3 -security updateVRVDR-42994N/ADSA-4257-1CVE-2018-10906: Debian DSA-4257-1 :fuse -security update 









 1801q 



 Issues Resolved 



Issues resolved for 1801q

 Issue Number Priority Summary 

 VRVDR-43531 Major Boot on 1801p results in kernel panic within roughly 40 seconds 
 VRVDR-43104 Critical Fake Gratuitous ARP over DHCP network when IPsec is enabled 
 VRVDR-41531 Major IPsec continues to attempt to use VFP interface after unbinding it 
 VRVDR-43157 Minor When tunnel bounces SNMP trap is not properly generated. 
 VRVDR-43114 Critical Upon reboot, a router in an HA pair with a higher priority than its peer does not honor its own “preempt false” configuration and becomes the master immediately following the boot 
 VRVDR-42826 Minor With remote-id “0.0.0.0” peer negotiation fails due to pre-shared-key mismatch 
 VRVDR-42774 Critical X710 (i40e) driver sending flow control frames at a very high rate 
 VRVDR-42635 Minor BGP redistribute route-map policy change does not take effect 
 VRVDR-42620 Minor Vyatta-ike-sa-daemon throws error “Command failed: establishing CHILD_SA passthrough-peer” while tunnel appears to be up 
 VRVDR-42483 Minor TACACS authentication failing
Satellite Host <br><br> * Provide an interface to initiate change management activities.<br> * Monitor the health of hosts and report back status with actions that you must complete, such as reloading a host operating system.<br> * Disable the ability to SSH into hosts after you attach the hosts to a location, to enhance security.<br> * Make major, minor, and fix pack version updates of the container platform available for you to apply.<br> * Make minor, and fix pack version updates of the operating system software available for you to apply.<br><br><br> <br><br> * [Review the status of your hosts](https://cloud.ibm.com/docs/satellite?topic=satellite-monitorhost-health) and take any actions required to resolve host infrastructure issues, such as operating system reloads or updates.<br> * Before you update or [delete](https://cloud.ibm.com/docs/satellite?topic=satellite-host-remove) any hosts, make sure that you have [enough additional hosts](https://cloud.ibm.com/docs/satellite?topic=satellite-location-sizing) in the cluster or location control plane to continue running any components that you must run. Save any backup information that you want to keep about the hosts before you update or delete.<br> * To reuse a host after removal from a cluster, you must remove the host from the location. Then, perform a complete operating system reload in your infrastructure provider, reattach the host to your location, and reassign the host to a cluster.<br> * Apply available updates to your [worker node](https://cloud.ibm.com/docs/satellite?topic=satellite-host-update-workers) or [control plane hosts](https://cloud.ibm.com/docs/satellite?topic=satellite-host-update-location). If the version update fails, you must remove your host, reload and troubleshoot any issues with the host, and reattach the host until the update is applied.<br><br><br>
VRVDR-51066 Blocker 1908g performance hit with vCSR vnf scenario in Small, Medium and Large Platforms 
 VRVDR-51008 Major When the /var/log partition exists journal files from previous installs are retained but not rotated 
 VRVDR-50939 Blocker BFD session retained in admin down state when interface is disabled 
 VRVDR-50754 Critical Cannot perform H2O Update Capsule update due to missing efivar tool 
 VRVDR-50705 Critical show history & tech support output incorrectly show order of CLI commands executed 
 VRVDR-50665 Critical Permit local user fallback following TACACS+ failure on read-only filesystem 
 VRVDR-50621 Critical Duplicate entries added to dp_event_register() 
 VRVDR-50614 Critical ADI V150 with 100M physical WAN port doesn't show drops with 100M QOS shaper applied 
 VRVDR-50569 Blocker SIAD BFD inter-op issue with Cisco 7609S 
 VRVDR-50560 Critical "show vpn ike secrets" allows operator and members outside the secrets group to display secrets 
 VRVDR-50306 Critical ADI Spirent probe RFC2544 test failure due to small packet loss w/ 100m speed and 50m QoS shaper 
 VRVDR-50279 Major RX error incrementing on the bond1 interface, but no errors on physical interface 
 VRVDR-50237 Critical QoS not working when applied in certain order 
 VRVDR-49656 Minor PTP: IDT servo is built without optimization 
 VRVDR-49442 Major SNMP related syslog messages at wrong log level 
 VRVDR-49326 Major At system login user level operator "show queuing" command does not work 
 VRVDR-49231 Critical PPPoE Client - Not re-establishing dropped connection automatically 
 VRVDR-48466 Critical DNS nslookup query within a routing instance vrf is broken 
 VRVDR-48337 Critical NCS fails to load vyatta-system-image YANG 
 VRVDR-48203 Minor Split IDT servo into separate shared libraries
VRVDR-47485 Major VRRP snmp MIB stops working when any configuration changes made to SNMP 
 VRVDR-47381 Major When a vrrp vif is disabled the next change may prevent the interface from being displayed in 'show interfaces' 
 VRVDR-47229 Blocker netplugd crash on configuration change 
 VRVDR-46417 Major Dataplane is sending GRE packets sourced from non-exist VRRP VIP when router is BACKUP 
 VRVDR-45396 Critical Shunt policy installation race 
 VRVDR-42108 Minor After 25s ssh login delay 'systemctl --user status' fails with "Failed to connect to bus: No such file or directory" 







 Security Vulnerabilities Resolved 



Security vulnerabilities resolved for 1801zb

 Issue Number CVSS score Advisory Summary 

 VRVDR-47707 7.8 DSA-4484-1 CVE-2019-13272: Debian DSA-4484-1: linux security update 
 VRVDR-37993 5.0 N/A CVE-2013-5211: Network Time Protocol (NTP) Mode 6 Scanner 









 1801za 



 Issues Resolved 



Issues resolved for 1801za

 Issue Number Priority Summary 

 VRVDR-47387 Major NAT statistics displaying unrealistic usage values 
 VRVDR-47345 Minor Syslog rate-limiting does not take effect when configured 
 VRVDR-47290 Minor SNMP agent memory cleanup issue on interface scans for ipAddrTable GET/GETNEXT fetch requests 
 VRVDR-47224 Minor OSPF debug logs are incorrectly showing when logging level is set to info 
 VRVDR-47222 Minor GUI not responding after RO users login 
 VRVDR-47179 Major “Update config-sync” overwrites IPsec pre-shared secret key with masked value of asterisks if run by different user than the one used for config-sync itself 
 VRVDR-47066 Major Configuration change to a site-to-site or DMVPN may cause IKE negotiation to fail with INVAL_ID for IKEv1 or TS_UNACCEPT for IKEv2
Each gateway is only permitted to have ten outstanding requests for a cross-account connection.





 I connected a VPC to one transit gateway. Can I connect that VPC to a second transit gateway? 

You can connect a VPC to multiple local transit gateways and a single global gateway.





 I connected a classic connection to one transit gateway. Can I connect the classic connection to a second transit gateway? 

You can connect a classic connection to multiple local transit gateways and a single global transit gateway.





 Can I connect a direct link to both a VPC and a transit gateway simultaneously? 

No, you must choose to connect to a direct resource (VPC or classic infrastructure), or bind your direct link to one or more local transit gateways, or one global gateway. Your on-premises network can then access IBM Cloud resources connected through the transit gateways.





 I can only provision a transit gateway in a certain set of locations on the provisioning page. Does that mean that the VPC I want to connect must be located in one of those locations? 

By enabling global routing, you can connect VPCs located in different [MZRs](https://cloud.ibm.com/docs/overview?topic=overview-locationsmzr-table), regardless of the set of locations that you can provision your transit gateway in.





 What are the service limits that I must keep in mind while using IBM Cloud Transit Gateway? 

For more information, see [Service limits](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-helpful-tipsservice-limits).





 Classic access VPCs cannot be attached to a transit gateway. How can I connect and access classic resources in those VPCs? 

Although [classic-access VPCs](https://cloud.ibm.com/docs/vpc?topic=vpc-setting-up-access-to-classic-infrastructure) cannot be attached to a transit gateway, access to classic resources and classic-access VPC resources can be achieved by adding the classic infrastructure connection to a transit gateway.
The status includes a timestamp of how long the master has been in the same state, such as Ready (1 month ago). The Master State reflects the lifecycle of possible operations that can be performed on the master, such as deploying, updating, and deleting. Each state is described in the following table.



Master states

 Master state Description 

 deployed The master is successfully deployed. Check the status to verify that the master is Ready or to see if an update is available. 
 deploying The master is currently deploying. Wait for the state to become deployed before working with your cluster, such as adding worker nodes. 
 deploy_failed The master failed to deploy. IBM Support is notified and works to resolve the issue. Check the Master Status field for more information, or wait for the state to become deployed. 
 deleting The master is currently deleting because you deleted the cluster. You can't undo a deletion. After the cluster is deleted, you can no longer check the master state because the cluster is completely removed. 
 delete_failed The master failed to delete. IBM Support is notified and works to resolve the issue. You can't resolve the issue by trying to delete the cluster again. Instead, check the Master Status field for more information, or wait for the cluster to delete. You can also [open an IBM Cloud support case](https://cloud.ibm.com/docs/containers?topic=containers-get-help). 
 scaled_down The master resources have been scaled down to zero replicas. This is a temporary state that occurs while etcd is being restored after a backup. You cannot interact with your cluster while it is in this state. Wait for the etcd restoration to complete and the master state to return to deployed. 
 updating The master is updating its Kubernetes version. The update might be a patch update that is automatically applied, or a minor or major version that you applied by updating the cluster. During the update, your highly available master can continue processing requests, and your app workloads and worker nodes continue to run.
VRVDR- 41797 7.8 DSA-4196-1 CVE-2018-1087, CVE-2018-8897: Debian DSA-4196-1: linux security update 









 1801g 

Released May 4, 2018.



 Issues Resolved 



Issues resolved for 1801g

 Issue Number Priority Summary 

 VRVDR-41620 Major vTI interface traffic stops sending traffic after new vIF is added 
 VRVDR-40965 Major Bonding does not recover after a data plane crash 









 1801f 

Released April 23, 2018



 Issues Resolved 



Issues resolved for 1801f

 Issue Number Priority Summary 

 VRVDR-41537 Minor Ping is not working over IPsec tunnel on 1801d 
 VRVDR-41283 Minor Configd stops processing static routes during boot if the configuration has disabled static routes 
 VRVDR-41266 Major Static route leaking to VRF does not transit traffic across mGRE tunnel after reboot 
 VRVDR-41255 Major When slave goes down it takes over 60s for master link state to reflect that 
 VRVDR-41252 Major With unbound VTI in zone-policy, drop rule is bypassed depending on commit order of zone rules 
 VRVDR-41221 Critical Upgrading vRouters from 1801b to 1801c to 1801d with 10% failure rate 
 VRVDR-40967 Major Disabling IPv6 forwarding prevents routing of VTI sourced IPv4 packets 
 VRVDR-40858 Major VTI interface showing MTU 1428 causing TCP PMTU issues 
 VRVDR-40857 Critical Vhost-bridge does not come up for tagged VLAN with interface names of a certain length 
 VRVDR-40803 Minor VIF interfaces are not present in “show vrrp” output after a reboot 
 VRVDR-40644 Major IKEv1: QUICK_MODE re-transmits are not handled correctly 







 Security Vulnerabilities Resolved 



Security vulnerabilities resolved for 1801f

 Issue Number CVSS score Advisory Summary
To see the IBM Cloud IAM token for a CLI session, you can run ibmcloud iam oauth-tokens. IBM Cloud IAM tokens can also be used to [make calls directly to the IBM Cloud Kubernetes Service API](https://cloud.ibm.com/docs/containers?topic=containers-cs_api_installcs_api).





 How do I limit which commands a user can run? 

After you set up access to the portfolio for users in your account, you can then control which infrastructure actions the users can perform by assigning the appropriate [platform access role](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-perms). By assigning IBM Cloud IAM roles to users, they are limited in which commands they can run against a cluster. For example, because the API key owner has all the required infrastructure roles, all infrastructure-related commands can be run in a cluster. But, depending on the IBM Cloud IAM role that is assigned to a user, the user can run only some of those infrastructure-related commands.

For example, if you want to create a cluster in a new region, make sure that the first cluster is created by a user with the Super User infrastructure role, such as the account owner. After verification, you can invite individual users or users in IBM Cloud IAM access groups to that region by setting platform access policies for them in that region. A user with a Viewer platform access role isn't authorized to add a worker node. Therefore, the worker-add action fails, even though the API key has the correct infrastructure permissions. If you change the user's platform access role to Operator, the user is authorized to add a worker node. The worker-add action succeeds because the user is authorized and the API key is set correctly. You don't need to edit the user's IBM Cloud infrastructure permissions.

To audit the actions that users in your account run, you can use [Activity Tracker](https://cloud.ibm.com/docs/containers?topic=containers-at_events) to view all cluster-related events.





 What if I don't want to assign the API key owner or credentials owner the Super User infrastructure role?