vania-janet/multiturn-rag-retrieval-data huggingface dataset:
During the update, you can request resources that require Calico, such as pods that are subject to Calico policies, but the resources remain pending until the update is complete.<br><br><br><br> * Before the update, you must delete any NetworkPolicy resources that are scoped to namespaces that no longer exist. When you delete a namespace, Kubernetes cleans up all resources that are associated with that namespace. However, resources that you created for Calico by using the calicoctl CLI, such as NetworkPolicy resources that you scoped to that namespace, are not cleaned up and remain in your cluster even after the namespace is deleted. To find and delete any of these policies, list all NetworkPolicy resources by running calicoctl get NetworkPolicy -A -o wide. In the output, check if the namespace for each policy still exists in your cluster. You can list existing namespaces by running kubectl get namespaces. If any policy is scoped to a non-existent namespace, delete the policy by running calicoctl delete networkpolicy <policy_name> -n <namespace>.<br> * As part of the update to KDD and going forward, access to the etcd port in the cluster master is blocked. If you use the etcd port, such as in firewall rules or Calico policies that allow worker nodes to access etcd, update these resources to use the apiserver port instead. To get the apiserver port, run ibmcloud ks cluster get -c <cluster_name_or_ID> and look for the node port that is listed for the Master URL.<br> * Complete the steps in [Releasing individual IP addresses](https://cloud.ibm.com/docs/containers?topic=containers-ts-app-container-startindividual-ips) to ensure that any pod IP addresses that are incorrectly detected as in use by the Calico IP address manager (IPAM) are released.<br><br><br> 
 Unsupported: CoreDNS federations plug-in CoreDNS version 1.7 and later no longer support the federations plug-in.
Setting up Tekton continuous integration pipelines with DevSecOps 

Complete these steps to set up the Tekton continuous integration pipelines with compliance. Recommended configuration options guide you through the steps to create your toolchain.



 Before you begin 



* [Create a Kubernetes cluster](https://cloud.ibm.com/docs/containers?topic=containers-getting-started) on IBM Cloud Kubernetes Service to deploy your application.
* [Install the IBM Cloud CLI](https://cloud.ibm.com/docs/containers?topic=containers-getting-started) on your operating system to interact with IBM Cloud resources.
* [Create an image signing key](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops-image-signing) with proper encoding to sign your application docker images.
* [Create toolchain secrets](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-toolchains-secrets) to access different integrations and secure them.
* Optional. [Configure Cloud Object Storage](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-cos-config) as the compliance evidence locker to durably store pipeline run evidence.
* [Validate recommended IAM permissions](https://cloud.ibm.com/docs/devsecops?topic=devsecops-iam-permissions) are assigned to corresponding integrations.







 Guided setup overview for the CI toolchain 

View the following video tutorial to get an overview of the setup process:

The progress indicator in Figure 1 guides you through the toolchain configuration. If you need to return to a previous step, you can use the progress indicator to navigate to a previous step.

Zoom

!
As a result, pods might go into a Pending state until enough capacity is available. If you want to change the default behavior to make Kubernetes scheduler or Red Hat OpenShift controller distribute pods across zones in a best effort distribution, use the preferredDuringSchedulingIgnoredDuringExecution[pod affinity policy](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).

You can create a multizone cluster in one of the supported [classic](https://cloud.ibm.com/docs/containers?topic=containers-regions-and-zoneszones-mz) or [VPC](https://cloud.ibm.com/docs/containers?topic=containers-regions-and-zoneszones-vpc) multizone locations only.



 Why do I need worker nodes in three zones? 

Distributing your workload across three zones ensures high availability for your app in case a zone becomes unavailable. You must have your worker nodes spread evenly across all three availability zones to meet the [IBM Cloud service level agreement (SLA)](https://cloud.ibm.com/docs/overview?topic=overview-slas) for HA configuration. This setup also makes your cluster more cost-efficient. Why is that, you ask? Here is an example.

Let's say you need a worker node with six cores to handle the workload for your app. To make your cluster more available, you have the following options:



* Duplicate your resources in another zone: This option leaves you with two worker nodes, each with six cores in each zone for a total of 12 cores.
* Distribute resources across three zones: With this option, you deploy two cores per zone, which leaves you with a total capacity of six cores. To handle your workload, two zones must be up at a time. If one zone is unavailable, the other zone can fully handle your workload. If two zones are unavailable, the two remaining cores are up to handle your parts of your workload, and you could temporarily add another worker node to that zone.







 How is my IBM Cloud Kubernetes Service master set up?
For information about how to retrieve the service access key, see [Getting the access key through the IBM Cloud UI](https://cloud.ibm.com/docs/monitoring?topic=monitoring-access_keyaccess_key_ibm_cloud_ui). This value is required if you want to replace the service access key, and optional if you want to replace the IBM Cloud Monitoring service instance. If you don't provide the service access key when replacing the IBM Cloud Monitoring service instance, the service access key that was last added is retrieved automatically.





 ibmcloud ob monitoring config show 

Virtual Private Cloud

Classic infrastructure

Show the details of a Monitoring configuration.

To show the details of monitoring configurations that you manually set up without using the IBM Cloud Kubernetes Service observability plug-in, you must first make this configuration available to the plug-in by using the [ibmcloud ob monitoring agent discover](https://cloud.ibm.com/docs/containers?topic=containers-observability_climonitoring_agent_discover) command.

ibmcloud ob monitoring config show --cluster CLUSTER --instance MONITORING_INSTANCE

Minimum required permissions:



* Viewer platform access role and Reader service access role for the ibm-observe Kubernetes namespaces in IBM Cloud Kubernetes Service.
* Viewer platform access role for IBM Log Analysis



Command options:

--cluster CLUSTER
: The name or ID of the cluster for which you want to list existing Monitoring configurations. To retrieve your cluster name or ID, run ibmcloud ks clusters. This value is required.

--instance LOGGING_INSTANCE
: The ID or name of the IBM Cloud Monitoring service instance for which you want to show the monitoring configuration. To retrieve the name, run ibmcloud resource service-instances. This value is required.
: If you want to replace the IBM Log Analysis service instance that you use in your Log Analysis configuration, enter the ID or name of the new IBM Log Analysis service instance that you want to use. This value is required if you want to replace the IBM Log Analysis service instance. If you want to replace the ingestion key, don't include this command option.

--logdna-ingestion-key INGESTION_KEY
: The Log Analysis ingestion key that you want to use for your configuration. For information about how to retrieve the ingestion key, see [Get the ingestion key through the IBM Cloud UI](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-ingestion_key). This value is required if you want to replace the ingestion key, and optional if you want to replace the IBM Log Analysis service instance. If you don't provide the ingestion key when replacing the IBM Log Analysis service instance, the ingestion key that was last added is retrieved automatically.





 ibmcloud ob logging config show 

Virtual Private Cloud

Classic infrastructure

Show the details of a Log Analysis configuration.

To show the details of logging configurations that you manually set up without using the Red Hat OpenShift on IBM Cloud observability plug-in, you must first make this configuration available to the plug-in by using the [ibmcloud ob logging agent discover](https://cloud.ibm.com/docs/openshift?topic=openshift-observability_clilogging_agent_discover) command.

ibmcloud ob logging config show --cluster CLUSTER --instance LOGGING_INSTANCE

Minimum required permissions:



* Administrator platform access role and Manager service access role for the ibm-observe Kubernetes namespaces in IBM Cloud Kubernetes Service.
* Viewer platform access role for IBM Log Analysis



Command options:

--cluster CLUSTER
: The name or ID of the cluster for which you want to list existing Log Analysis configurations. To retrieve your cluster name or ID, run ibmcloud oc clusters. This value is required.

--instance LOGGING_INSTANCE
[Brocade Vyatta Network OS Remote Access IPsec VPN Configuration Guide, 5.2R1](https://public.dhe.ibm.com/cloud/bluemix/network/vra/vyatta-network-os-5.2r1-ra-ipsec-vpn.pdf) This guide describes how to configure Remote Access VPN on the Brocade Vyatta Network OS (referred to as a virtual router, vRouter, or router in the guide). 
 [Brocade Vyatta Network OS OpenVPN Configuration Guide, 5.2R1](https://public.dhe.ibm.com/cloud/bluemix/network/vra/vyatta-network-os-5.2r1-openvpn.pdf) This guide describes how to configure OpenVPN on the Brocade Vyatta Network OS (referred to as a virtual router, vRouter, or router in the guide). 
 [Brocade Vyatta Network OS Tunnels Configuration Guide, 5.2R1](https://public.dhe.ibm.com/cloud/bluemix/network/vra/vyatta-network-os-5.2r1-tunnels.pdf) This guide describes how to configure tunneling on Brocade products that run on the Brocade Vyatta Network OS (referred to as a virtual router, vRouter, or router in the guide). 
 [Brocade Vyatta Network OS IPsec Site-to-Site VPN Configuration Guide, 5.2R1](https://public.dhe.ibm.com/cloud/bluemix/network/vra/vyatta-network-os-5.2r1-ipsec-vpn.pdf) This guide describes how to configure site-to-site IPsec VPNs on Brocade products that run on the Brocade Vyatta Network OS (referred to as a virtual router, vRouter, or router in the guide).
: If you want to replace the IBM Cloud Monitoring service instance that you use in your Monitoring configuration, enter the ID or name of the new IBM Cloud Monitoring service instance that you want to use. This value is required if you want to replace the IBM Cloud Monitoring service instance. If you want to replace the service access key, don't include this command option.

--sysdig-access-key ACCESS_KEY
: The Monitoring service access key that you want to use for your configuration. For information about how to retrieve the service access key, see [Getting the access key through the IBM Cloud UI](https://cloud.ibm.com/docs/monitoring?topic=monitoring-access_keyaccess_key_ibm_cloud_ui). This value is required if you want to replace the service access key, and optional if you want to replace the IBM Cloud Monitoring service instance. If you don't provide the service access key when replacing the IBM Cloud Monitoring service instance, the service access key that was last added is retrieved automatically.





 ibmcloud ob monitoring config show 

Virtual Private Cloud

Classic infrastructure

Show the details of a Monitoring configuration.

To show the details of monitoring configurations that you manually set up without using the Red Hat OpenShift on IBM Cloud observability plug-in, you must first make this configuration available to the plug-in by using the [ibmcloud ob monitoring agent discover](https://cloud.ibm.com/docs/openshift?topic=openshift-observability_climonitoring_agent_discover) command.

ibmcloud ob monitoring config show --cluster CLUSTER --instance MONITORING_INSTANCE

Minimum required permissions:



* Administrator platform access role and Manager service access role for the ibm-observe Kubernetes namespaces in IBM Cloud Kubernetes Service.
* Viewer platform access role for IBM Log Analysis



Command options:

--cluster CLUSTER
: The name or ID of the cluster for which you want to list existing Monitoring configurations. To retrieve your cluster name or ID, run ibmcloud oc clusters. This value is required.

--instance LOGGING_INSTANCE
If you want to use a different IBM Cloud Monitoring service instance to send metrics to, use the [ibmcloud ob monitoring config replace](https://cloud.ibm.com/docs/containers?topic=containers-observability_climonitoring_config_replace) command.
* If you created a Monitoring configuration in your cluster without using the IBM Cloud Kubernetes Service observability plug-in, you can use the [ibmcloud ob monitoring agent discover](https://cloud.ibm.com/docs/containers?topic=containers-observability_climonitoring_agent_discover) command to make the configuration visible to the plug-in. Then, you can use the observability plug-in commands and functionality in the IBM Cloud console to manage the configuration.



Before you begin:



* Verify that you are assigned the Editor platform access role and Manager server access role for IBM Cloud Monitoring.
* Verify that you are assigned the Administrator platform access role and the Manager service access role for all Kubernetes namespaces in IBM Cloud Kubernetes Service to create the monitoring configuration. To view a monitoring configuration or launch the Monitoring dashboard after the monitoring configuration is created, users must be assigned the Viewer platform access role and Reader service access role for the ibm-observe Kubernetes namespace in IBM Cloud Kubernetes Service.
* If you want to use the CLI to set up the monitoring configuration:



* [Install the IBM Cloud Kubernetes Service observability CLI plug-in (ibmcloud ob)](https://cloud.ibm.com/docs/containers?topic=containers-cli-install).
* [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)





To set up a monitoring configuration for your cluster:



1. Create an [IBM Cloud Monitoring service instance](https://cloud.ibm.com/docs/monitoring?topic=monitoring-provision) and note the name of the instance.
[Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/667adc0b8a7fdb0b349b1158d8e128640b5bc72b/workload-protection//images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/667adc0b8a7fdb0b349b1158d8e128640b5bc72b/workload-protection//images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/667adc0b8a7fdb0b349b1158d8e128640b5bc72b/workload-protection//images/checkmark-icon.svg) 







 IAM actions 

The following table identifies the IAM actions that are assigned to the platform and service roles for the IBM Cloud Security and Compliance Center Workload Protection service:



Table 3. IAM actions assigned to platform and service roles

 Role type Role IAM actions 

 Platform administrator sysdig-secure.launch.admin <br>sysdig-secure.launch.user <br>sysdig-secure.launch.viewer 
 Service manager sysdig-secure.launch.admin <br>sysdig-secure.launch.user <br>sysdig-secure.launch.viewer 
 Service writer sysdig-secure.launch.user <br>sysdig-secure.launch.viewer 
 Service reader sysdig-secure.launch.viewer 







 How do I know which access policies are set for me? 

You can see which access policies are set for you in the [IBM Cloud UI](https://cloud.ibm.com/) console.



1. Go to [Access IAM users](https://cloud.ibm.com/iam/users).
2. Click your name in the user table.
3. Click the Access policies tab to see your access policies.
[Check mark icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/checkmark-icon.svg) ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/checkmark-icon.svg) ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/checkmark-icon.svg) 



The manager service role maps directly to the logging admin role.





 IAM actions 

The following table identifies the IAM actions that are assigned to the platform and service roles for the IBM Log Analysis service:



Table 3. IAM actions assigned to platform and service roles

 Role type Role IAM actions 

 Platform administrator logdna.dashboard.view <br>logdna.dashboard.manage 
 Service manager logdna.dashboard.view <br>logdna.dashboard.manage 
 Service writer logdna.dashboard.view <br>logdna.dashboard.member 
 Service reader logdna.dashboard.view <br>logdna.dashboard.read 







 How do I know which access policies are set for me? 

You can see which access policies are set for you in the [IBM Cloud UI](https://cloud.ibm.com/) console.



1. Go to [Access IAM users](https://cloud.ibm.com/iam/users).
2. Click your name in the user table.
3. Click the Access policies tab to see your access policies.
4.
* Verify that you are assigned the Administrator platform access role and the Manager service access role for all Kubernetes namespaces in IBM Cloud Kubernetes Service to create the logging configuration. To view a logging configuration or launch the Log Analysis dashboard after the logging configuration is created, users must be assigned the Administrator platform access role and the Manager service access for the ibm-observe Kubernetes namespace in IBM Cloud Kubernetes Service.
* If you want to use the CLI to set up the logging configuration:



* [Install the Red Hat OpenShift on IBM Cloud observability CLI plug-in (ibmcloud ob)](https://cloud.ibm.com/docs/containers?topic=containers-cli-install).
* [Access your Red Hat OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-access_cluster).





To set up a logging configuration for your cluster,



1. Create an [IBM Log Analysis service instance](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-provision) and note the name of the instance. The service instance must belong to the same IBM Cloud account where you created your cluster, but can be in a different resource group and IBM Cloud region than your cluster.
2. Set up a logging configuration for your cluster. When you create the logging configuration, an Red Hat OpenShift project ibm-observe is created and a Log Analysis agent is deployed as a daemon set to all worker nodes in your cluster. This agent collects logs with the extension .log and extensionless files that are stored in the /var/log directory of your pod from all projects, including kube-system. The agent then forwards the logs to the IBM Log Analysis service.



* From the console



1. From the [Red Hat OpenShift clusters console](https://cloud.ibm.com/kubernetes/clusters?platformType=openshift), select the cluster for which you want to create a Log Analysis configuration.
2. On the cluster Overview page, click Connect.
3.
Tip: To see the details for a specific revision, include the revision number.

kubectl rollout history deployment/<deployment_name> --revision=<number>
2. Roll back to the previous version, or specify a revision. To roll back to the previous version, use the following command.

kubectl rollout undo deployment/<depoyment_name> --to-revision=<number>









 Setting up continuous integration and delivery 

With IBM Cloud and other open source tools, you can set up continuous integration and delivery (CI/CD), version control, tool chains, and more to help automate app development and deployment.

To see a list of supported integrations and steps for setting up a continuous delivery pipeline, see [Setting up continuous integration and delivery](https://cloud.ibm.com/docs/containers?topic=containers-cicd).





 Copying deployments to another cluster 

When you use a [version control system such as Git](https://cloud.ibm.com/docs/containers?topic=containers-plan_deploydeploy_organize), configuration management projects such as [kustomize](https://cloud.ibm.com/docs/containers?topic=containers-appkustomize), or continuous delivery tools such as [Razee](https://razee.io/) in your cluster, you can deploy your app configuration files quickly from cluster to cluster. Sometimes you have only a few deployments that you tested in a cluster and prefer to copy these deployments and redeploy in another cluster. For example, you might use a free, classic infrastructure Kubernetes cluster for a proof of concept that you did not manage in Git. Now, you are ready to take this proof of concept and deploy it to a standard cluster that runs Red Hat OpenShift or on VPC infrastructure.

Before you begin, you need two clusters and the Manager[service access role](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-perms) for all namespaces in both clusters so that you can copy all the resources from one cluster and deploy them to another.



1.
restricted-psp-user All ClusterRoleBinding Enables cluster administrators, authenticated users, service accounts, and nodes to use ibm-restricted-psp pod security policy. 



You can modify these RBAC roles to remove or add administrators, users, services, or nodes to the policy. These modifications don't prevent cluster administrators, service accounts, and nodes from using the privileged pod security policy in the kube-system, ibm-system, and ibm-operators namespaces. Do not modify these system namespaces, which are privileged namespaces.

Before you begin



* [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)
* Understand working with RBAC roles. For more information, see [Authorizing users with custom Kubernetes RBAC roles](https://cloud.ibm.com/docs/containers?topic=containers-usersrbac) or the [Kubernetes documentation](https://kubernetes.io/docs/reference/access-authn-authz/rbac/api-overview).
* Ensure you have the [Manager IBM Cloud IAM service access role](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-perms) for all namespaces.



When you modify the default configuration, you can prevent important cluster actions, such as pod deployments or cluster updates. Test your changes in a non-production cluster that other teams don't rely on.



 Modifying the RBAC resources 



1. Get the name of the RBAC cluster role binding. The following steps use the privileged-psp-user RBAC as an example, but you can take similar steps for the restricted-psp-user RBAC or custom pod security policies.

kubectl get clusterrolebinding
2. Download the cluster role binding as a .yaml file that you can edit locally.

kubectl get clusterrolebinding privileged-psp-user -o yaml > privileged-psp-user.yaml