vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Client Version: version.Info{Major:"1", Minor:"23", GitVersion:"v1.26", GitCommit:"641856db18352033a0d96dbc99153fa3b27298e5", GitTreeState:"clean", BuildDate:"2019-03-25T15:53:57Z", GoVersion:"go1.12.1", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"23", GitVersion:"v1.26+IKS", GitCommit:"e15454c2216a73b59e9a059fd2def4e6712a7cf0", GitTreeState:"clean", BuildDate:"2019-04-01T10:08:07Z", GoVersion:"go1.11.5", Compiler:"gc", Platform:"linux/amd64"}

The CLI versions match if you can see the same version in GitVersion for the client and the server. You can ignore the +IKS part of the version for the server.
2. If the oc CLI versions on your local machine and your cluster don't match, either update your cluster or [install a different CLI version on your local machine](https://cloud.ibm.com/docs/openshift?topic=openshift-cli-install).







 Checking and updating the Object Storage plug-in 

[Follow the steps to update the Object Storage plug-in](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_cos_installupdate_cos_plugin).





 Checking driver logs and the driver version installed 

To check the driver logs and see the driver version of your Object Storage installation perform the following steps:



1. List the pods in the kube-system namespace.
Client Version: version.Info{Major:"1", Minor:"23", GitVersion:"v1.26", GitCommit:"641856db18352033a0d96dbc99153fa3b27298e5", GitTreeState:"clean", BuildDate:"2019-03-25T15:53:57Z", GoVersion:"go1.12.1", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"23", GitVersion:"v1.26+IKS", GitCommit:"e15454c2216a73b59e9a059fd2def4e6712a7cf0", GitTreeState:"clean", BuildDate:"2019-04-01T10:08:07Z", GoVersion:"go1.11.5", Compiler:"gc", Platform:"linux/amd64"}

The CLI versions match if you can see the same version in GitVersion for the client and the server. You can ignore the +IKS part of the version for the server.
2. If the kubectl CLI versions on your local machine and your cluster don't match, either update your cluster or [install a different CLI version on your local machine](https://cloud.ibm.com/docs/containers?topic=containers-cli-install).







 Checking and updating the Object Storage plug-in 

[Follow the steps to update the Object Storage plug-in](https://cloud.ibm.com/docs/containers?topic=containers-storage_cos_installupdate_cos_plugin).





 Checking driver logs and the driver version installed 

To check the driver logs and see the driver version of your Object Storage installation perform the following steps:



1. List the pods in the kube-system namespace.
icr.io/continuous-delivery/pipeline/tekton/webhook

The private worker agent also uses these internal images:

icr.io/continuous-delivery/pipeline/pipeline-private-worker-util
icr.io/continuous-delivery/pipeline/tekton/kubectl-jq
icr.io/continuous-delivery/pipeline/tekton/ubi



 Support for previous Delivery Pipeline Private Worker images 

To take advantage of the current features and fixes, and to maintain full compliance, it is recommended that you keep your private worker images up to date.

For each subsequent release of a private worker image, the version number is updated.



* Agent changes result in a minor version increment, for example version 14.10 changes to version 14.11.
* A new Tekton framework change results in a major version increment, for example version 14.11 changes to version 15.0.



IBM Cloud® Continuous Delivery supports the n-1 major version of the current private worker image. For example, if the current image is version 14.x, previous version 13.x images are also allowed to run. After the major version of the pipeline worker image is incremented to 15.x, version 14.x images are allowed, but any version 13.x or earlier images are considered outdated.
Yes, you can increase the timeout for Red Hat OpenShift or Kubernetes resources. For more information, see [ibm_container_vpc_cluster](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/container_vpc_clustertimeouts) provides the following Timeouts configuration options.





 How can I rectify the 403 Error while validating the location in the account. Verify you have permission to the location in the global catalog settings? 

You can verify the location access to create or view the resource in the catalog settings for your account. For more information, see [Manage location settings in global catalog](https://cloud.ibm.com/docs/schematics?topic=schematics-access-ibm-cloud-catalog).





 Can I start or stop the Virtual Servers for VPC based on tags and through scheduler or cron job? 

Yes, you can use Cloud Functions to set the managed operations such as start, stop query based on tags and also through scheduler or cron job to trigger the Schematics action. For more information, see [VSI operations and schedule solution](https://github.com/Cloud-Schematics/vsi-operations-scheduler-solution) GitHub repository.





 Might I create a worker node in an existing worker node pool? 

Yes, you can create or add a worker node inside an existing worker node pool by using IBM container worker pool resource in a Kubernetes cluster through Schematics. Or Terraform by using IBM container worker pool zone attachment resource. For more information, see [ibm_container_worker_pool_zone_attachment](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/container_worker_pool_zone_attachment).





 Where can I view the list of public and private allowed IP addresses of us-south, us-east, eu-gb, and eu-de regions?
If one worker node goes down, app instances on available worker nodes continue to run. Kubernetes automatically reschedules pods from unavailable worker nodes to ensure performance and capacity for your app. To ensure that your pods are evenly distributed across worker nodes, implement [pod affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).



 Is my master highly available in a single zone cluster? 

If your cluster is created in a single zone city, the Kubernetes master of your classic cluster is highly available and includes replicas on separate physical hosts for your master API server, etcd, scheduler, and controller manager to protect against an outage such as during a master update. If your cluster resides in one of the multizone metro locations, the master is automatically deployed with three replicas and spread across the zones of the metro.





 How can I protect my workloads against a single zone failure? 

If your single zone cluster is created in one of the [multizone metro locations](https://cloud.ibm.com/docs/containers?topic=containers-regions-and-zoneszones-mz), you can change your single zone cluster to a [multizone cluster](https://cloud.ibm.com/docs/containers?topic=containers-ha_clustersmz-clusters). In a multizone cluster, your workloads are distributed across worker nodes in different zones. If one zone is not available, your workloads continue to run in the remaining zones. If you prefer single zone clusters for simplified management, or if your cluster must reside in a specific [single zone city](https://cloud.ibm.com/docs/containers?topic=containers-regions-and-zoneszones-sz) that does not support multizone capabilities, you can create [multiple clusters](https://cloud.ibm.com/docs/containers?topic=containers-ha_clustersmultiple-clusters-glb) and connect them with a global load balancer.







 Multizone cluster 

Create a multizone cluster to distribute your workloads across multiple worker nodes and zones, and protect against zone failures with hosts, networks, or apps.
To see what labels are already applied to a resource, use the kubectl get command with the --show-labels option.

To apply labels to worker nodes, [create your worker pool](https://cloud.ibm.com/docs/containers?topic=containers-add_workersadd_pool) with labels or [update an existing worker pool](https://cloud.ibm.com/docs/containers?topic=containers-add_workersworker_pool_labels).







 How can I keep my cluster in a supported state? 

Make sure that your cluster always runs a [supported Kubernetes version](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions). When a new Kubernetes minor version is released, an older version is shortly deprecated after and then becomes unsupported. For more information, see [Updating the master](https://cloud.ibm.com/docs/containers?topic=containers-updatemaster) and [worker nodes](https://cloud.ibm.com/docs/containers?topic=containers-updateworker_node).







 Making your resources highly available 

While no system is entirely failsafe, you can take steps to increase the high availability of your apps and services in IBM Cloud Kubernetes Service.

Review more information about making resources highly available.



* [Reduce potential points of failure](https://cloud.ibm.com/docs/containers?topic=containers-haha).
* [Create multizone clusters](https://cloud.ibm.com/docs/containers?topic=containers-ha_clustersha_clusters).
* [Plan highly available deployments](https://cloud.ibm.com/docs/containers?topic=containers-plan_deployhighly_available_apps) that use features such as replica sets and pod anti-affinity across multizones.
* [Run containers that are based on images in a cloud-based public registry](https://cloud.ibm.com/docs/containers?topic=containers-images).
* While creating Red Hat OpenShift or Kubernetes resources, can I tune 90 minutes time out to higher?

Yes, you can increase the timeout for Red Hat OpenShift or Kubernetes resources. For more information, see [ibm_container_vpc_cluster](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/container_vpc_clustertimeouts) provides the following Timeouts configuration options.
* How can I rectify the 403 Error while validating the location in the account. Verify you have permission to the location in the global catalog settings?

You can verify the location access to create or view the resource in the catalog settings for your account. For more information, see [Manage location settings in global catalog](https://cloud.ibm.com/docs/schematics?topic=schematics-access-ibm-cloud-catalog).
* Can I start or stop the Virtual Servers for VPC based on tags and through scheduler or cron job?

Yes, you can use Cloud Functions to set the managed operations such as start, stop query based on tags and also through scheduler or cron job to trigger the Schematics action. For more information, see [VSI operations and schedule solution](https://github.com/Cloud-Schematics/vsi-operations-scheduler-solution) GitHub repository.
* Might I create a worker node in an existing worker node pool?

Yes, you can create or add a worker node inside an existing worker node pool by using IBM container worker pool resource in a Kubernetes cluster through Schematics. Or Terraform by using IBM container worker pool zone attachment resource. For more information, see [ibm_container_worker_pool_zone_attachment](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/container_worker_pool_zone_attachment).
* Where can I view the list of public and private allowed IP addresses of us-south, us-east, eu-gb, and eu-de regions?
If you want the pods to be rebalanced across zones after the zone is back up, configure the [Kubernetes descheduler](https://github.com/kubernetes-sigs/descheduler). In multizone clusters, try to keep your worker node capacity at 50% per zone so that enough capacity remains to protect your cluster against a zonal failure.

What if I want to spread my app across regions?
: To protect your app from a region failure, create a second cluster in another region, [set up a global load balancer](https://cloud.ibm.com/docs/openshift?topic=openshift-ha_clustersmultiple-clusters-glb) to connect your clusters, and use a deployment YAML to deploy a duplicate replica set with [pod anti-affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/) for your app.

What if my apps need persistent storage?
: Use a cloud service such as [IBM Cloudant](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-getting-started-with-cloudant) or [IBM Cloud Object Storage](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-getting-started-cloud-object-storage).





 How can I scale my app? 

If you want to dynamically add and remove apps in response to workload usage, see [Scaling apps](https://cloud.ibm.com/docs/openshift?topic=openshift-update_appapp_scaling) for steps to enable horizontal pod autoscaling.







 Versioning and updating apps 

You put in a lot of effort preparing for the next version of your app. You can use IBM Cloud and Kubernetes update tools to roll out different versions of your app.



 How can I organize my deployments to make them easier to update and manage? 

Now that you have a good idea of what to include in your deployment, you might wonder how are you going to manage all these different YAML files?
* Service roles define the ability to perform actions on a service and are specific to every service such as performing API calls or accessing the UI. Service roles are: manager, writer, and reader. For more information about how these roles apply, refer to the specific service's documentation.







 How do I assign a user full access as an account administrator? 

To assign a user in your account full administrator access, go to Manage > Access (IAM) in the console, select the user's name, and assign the following access:



* An IAM policy with Administrator and Manager roles on All Identity and Access enabled services, which enable a user to create service instances and assign users access to all resources in the account.
* An IAM policy with Administrator role on All account management services, which enables a user to complete tasks like inviting and removing users, managing access groups, managing service IDs, managing private catalog products, and track billing and usage.
* The Super user permission set for classic infrastructure, which includes all of the available classic infrastructure permissions
* A trusted profile set as the alternative account owner has the highest level of classic infrastructure permissions and has both IAM policies that grant full access. For more information, see [Setting an alternative account owner](https://cloud.ibm.com/docs/account?topic=account-classic-infra-owner&interface=ui).







 Can every user in my account see all the other users? 

An account owner can view all users in the account and choose how users can view other users in the account on the Users page. An account owner can adjust the [user list visibility setting](https://cloud.ibm.com/docs/account?topic=account-iam-user-setting) on the Settings page by selecting one of the following options:



* Unrestricted view: All users in your account can view everyone else in the account.
* Restricted view: Limits the ability to view users on the Users page to only those who have been granted explicit access, along with those who have visibility of other users through a classic infrastructure user hierarchy relationship.







 Do I need to assign access to a user when I invite them to the account? 

No. You can invite users, and then assign access later.
VRVDR-46350 9.1 DSA-4431-1 CVE-2019-3855, CVE-2019-3856, CVE-2019-3857, CVE-2019-3858, CVE-2019-3859, CVE-2019-3860, CVE-2019-3861, CVE-2019-3862, CVE-2019-3863: Debian DSA-4431-1 : libssh2 - security update 









 1801y 



 Issues Resolved 



Issues resolved for 1801y

 Issue Number Priority Summary 

 VRVDR-46029 Major VRRP authentication either with simple text password or AH type does not work properly 
 VRVDR-45864 Critical Shell injection privilege escalation/sandbox escape in vyatta-techsupport remote copy 
 VRVDR-45748 Major Missing checks for zmsg_popstr returning a NULL pointer causing connsync to crash dataplane 
 VRVDR-45740 Minor 'generate tech-support archive' should not aggregate all existing archives 
 VRVDR-45720 Major vrrp gets stuck waiting for a packet when start_delay used with only a single router 
 VRVDR-45655 Critical "PANIC in rte_mbuf_raw_alloc" when performing VRRP failover 
 VRVDR-45059 Major null deref in sip_expire_session_request 
 VRVDR-41419 Major Static Analysis dataplane fixes 







 Security Vulnerabilities Resolved 



Security vulnerabilities resolved for 1801y

 Issue Number CVSS score Advisory Summary 

 VRVDR-46139 7.0 DSA-4428-1 CVE-2019-3842: Debian DSA-4428-1 : systemd - security update 
 VRVDR-46087 N/A DSA-4425-1 CVE-2019-5953: Debian DSA-4425-1 : wget - security update
Configuring Code Risk Analyzer to auto remediate vulnerabilities 

The Continuous Compliance (CC) pipeline uses the Code Risk Analyzer (CRA) to find the vulnerabilities in the compliance-check step. The CRA CLI can also remediate some of the vulnerabilities it identifies, this feature is called auto remediation.

Auto remediation is turned off by default. You can turn on auto remediation by setting the opt-in-cra-auto-remediation pipeline environment variable to true.

This feature is available in the CC pipeline only.

When the auto remediation feature is turned on, the CRA CLI attempts to update a vulnerable package to a nonvulnerable version. The top level and dependent packages are updated. The CRA CLI updates the minor and patch versions but does not update the major version of the package by default. You can force the CRA CLI to update the major version of the package by setting the pipeline environment variable opt-in-cra-auto-remediation-force to true. The opt-in-cra-auto-remediation-force variable is set to false by default.

Auto remediation creates a pull request with all the fixes against the default branch of the repo. If the pull request is accepable, you can manually review, approve, and merge it.

The auto remediation runs for each source repository in your pipeline that is returned by the list_repos method. To selectively enable a specific repo or repos for auto remediation, add a third pipeline environment variable that is named opt-in-cra-auto-remediation-enabled-repos. You must provide a comma-separated list of repo names in this variable.

Each CC pipeline run with auto remediation enabled creates a new pull request or updates an existing one, if fixes are available. The CRA CLI scans the commit that is deployed to production so unless the fixes that are identified and fixed by CRA CLI are approved, merged, and deployed to production, a new and potentially identical PR is generated at each CC pipeline run.

The following repositories are supported:



* Enterprise GitHub
* Service roles define the ability to perform actions on a service and are specific to every service such as performing API calls or accessing the UI. Service roles are: manager, writer, and reader. For more information about how these roles apply, refer to the specific service's documentation.



* How do I assign a user full access as an account administrator?

To assign a user in your account full administrator access, go to Manage > Access (IAM) in the console, select the user's name, and assign the following access:



* An IAM policy with Administrator and Manager roles on All Identity and Access enabled services, which enable a user to create service instances and assign users access to all resources in the account.
* An IAM policy with Administrator role on All account management services, which enables a user to complete tasks like inviting and removing users, managing access groups, managing service IDs, managing private catalog products, and track billing and usage.
* The Super user permission set for classic infrastructure, which includes all of the available classic infrastructure permissions
* A trusted profile set as the alternative account owner has the highest level of classic infrastructure permissions and has both IAM policies that grant full access. For more information, see [Setting an alternative account owner](https://cloud.ibm.com/docs/account?topic=account-classic-infra-owner&interface=ui).



* Can every user in my account see all the other users?

An account owner can view all users in the account and choose how users can view other users in the account on the Users page. An account owner can adjust the [user list visibility setting](https://cloud.ibm.com/docs/account?topic=account-iam-user-setting) on the Settings page by selecting one of the following options:



* Unrestricted view: All users in your account can view everyone else in the account.
* Restricted view: Limits the ability to view users on the Users page to only those who have been granted explicit access, along with those who have visibility of other users through a classic infrastructure user hierarchy relationship.



* Do I need to assign access to a user when I invite them to the account?

No. You can invite users, and then assign access later.
When you update the major or minor Kubernetes version of your cluster, IBM automatically makes necessary changes to the Fluentd ConfigMap, but does not change the image version of your Fluentd for logging add-on. You are responsible for checking the compatibility of the latest Kubernetes versions and your add-on images.

ibmcloud ks logging autoupdate disable --cluster CLUSTER [-q]

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster where you want to disable automatic updates for the Fluentd add-on.

-q
: Optional: Do not show the message of the day or update reminders.





 ibmcloud ks logging autoupdate enable 

Virtual Private Cloud

Classic infrastructure

Enable automatic updates for your Fluentd pods in a specific cluster. Fluentd pods are automatically updated when a new image version is available.

ibmcloud ks logging autoupdate enable --cluster CLUSTER [-q]

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster where you want to enable automatic updates for the Fluentd add-on.

-q
: Optional: Do not show the message of the day or update reminders.





 ibmcloud ks logging autoupdate get 

Virtual Private Cloud

Classic infrastructure

View whether your Fluentd pods are set to automatically update in a cluster.

ibmcloud ks logging autoupdate get --cluster CLUSTER [--output json] [-q]

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster where you want to check whether automatic updates for the Fluentd add-on are enabled.

--output json
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.





 ibmcloud ks logging config create 

Virtual Private Cloud

Classic infrastructure

Create a logging configuration. You can use this command to forward logs for containers, applications, worker nodes, Kubernetes clusters, and Ingress application load balancers to an external syslog server.
(https://cloud.ibm.com/docs/schematics?topic=schematics-general-faqsync-delresource-terraform)
* [How do I overcome the request exceeds the Cluster resource quota of '100' for the account in any region?](https://cloud.ibm.com/docs/schematics?topic=schematics-general-faqclusterquota-warn-faq)
* [While creating Red Hat OpenShift or Kubernetes resources, can I tune 90 minutes time out to higher?](https://cloud.ibm.com/docs/schematics?topic=schematics-general-faqresourcetimeout-warn-faq)
* [How can I rectify the 403 Error while validating the location in the account. Verify you have permission to the location in the global catalog settings?](https://cloud.ibm.com/docs/schematics?topic=schematics-general-faqglobal-setting-location)
* [Can I start or stop the Virtual Servers for VPC based on tags and through scheduler or cron job?](https://cloud.ibm.com/docs/schematics?topic=schematics-general-faqvm-tags-faq)
* [Might I create a worker node in an existing worker node pool?](https://cloud.ibm.com/docs/schematics?topic=schematics-general-faqworkernode-kubernetes-faq)
* [Where can I view the list of public and private allowed IP addresses of us-south, us-east, eu-gb, and eu-de regions?](https://cloud.ibm.com/docs/schematics?topic=schematics-general-faqprivateip-workspace-faq)
* [Can I manually add, or remove a resource from the service dashboard directly?]