vania-janet/multiturn-rag-retrieval-data huggingface dataset:
<br><br> * The number of backups per smart card: x<br> * The number of administrators (1 to 8): y<br> * The number of master key parts (2 or 3): z<br> * Store an administrator signature key and a master key part on the same EP11 smart card<br> * The number of master key parts equals to the number of administrators (y = z)<br><br><br> 1 (CA card) + x (CA card backups) + z (administrator signature key and master key part EP11 cards)+ z * x (administrator signature key and master key part EP11 card backups) = (1+x) * (1+z) 



A backup certificate authority smart card can be created by using the Smart Card Utility Program. Select CA Smart Card > Backup CA smart card from the menu, and follow the prompts.

The contents of an EP11 smart card can be copied to another EP11 smart card that was created in the same smart card zone by using the Trusted Key Entry application. On the Smart card tab, click Copy smart card, and follow the prompts.

For greater security, you can generate administrator signature keys on more EP11 smart cards and set the signature thresholds in your crypto units to a value greater than one. You can install up to eight administrators in your crypto units and specify that up to eight signatures are required for some administrative commands.

To find out details on how to procure and set up smart cards and other Management Utilities components, see [Setting up smart cards and the Management Utilities](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-prepare-management-utilities).





 How can I procure smart cards and smart card readers? 

To procure smart cards and smart card readers, follow the procedure in [Order smart cards and smart card readers](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-prepare-management-utilitiesorder-smart-card-and-reader).





 How many crypto units shall I set up in my service instance? 

You need to set up at least two crypto units for high availability.
ibmcloud oc cluster master satellite-service-endpoint allowlist add --cluster CLUSTER --subnet SUBNET [--subnet SUBNET ...] [-q]

Minimum required permissions: IBM Cloud IAM Editor platform access role for Satellite.

Command options:

-c, --cluster CLUSTER
: Required. The name or ID of the cluster.

--subnet SUBNET
: Required: The subnet in CIDR format. Specify more than one subnet by using multiple repeated entries.

-q
: Optional: Do not show the message of the day or update reminders.

Example:

ibmcloud oc cluster master satellite-service-endpoint allowlist add --cluster my-cluster --subnet 1.1.1.1/16 --subnet SUBNET 1.1.1.1/32 [-q]





 ibmcloud oc cluster master satellite-service-endpoint allowlist disable 

Satellite

Disable the allowlist for a Satellite cluster. When the allowlist is disabled, authorized requests to the cluster master that originate from any subnet are permitted through the Satellite service endpoint. This command can be used only with Satellite clusters that are CoreOS-enabled.

ibmcloud oc cluster master satellite-service-endpoint allowlist disable --cluster CLUSTER [-f] [-q]

Minimum required permissions: IBM Cloud IAM Administrator platform access role for Satellite.

Command options:

-c, --cluster CLUSTER
: Required. The name or ID of the cluster.

--subnet SUBNET
: Required: The subnet in CIDR format. Specify more than one subnet by using multiple repeated entries.

-f
: Optional: Force the command to run with no user prompts.

-q
: Optional: Do not show the message of the day or update reminders.

Example:

ibmcloud oc cluster master satellite-service-endpoint allowlist disable --cluster my-cluster





 ibmcloud oc cluster master satellite-service-endpoint allowlist enable 

Satellite

Enable the allowlist for a Satellite cluster.
To make your master publicly or privately accessible to cluster users, you can enable the public and private cloud service endpoints. VRF is required in your IBM Cloud account, and you must enable your account to use service endpoints. To enable VRF and service endpoints, run ibmcloud account update --service-endpoint-enable true.



* Communication between worker nodes and master is established over both the private network through the private cloud service endpoint and the public network through the public cloud service endpoint. By routing half of the worker-to-master traffic over the public endpoint and half over the private endpoint, your master-to-worker communication is protected from potential outages of the public or private network.
* The master is publicly accessible to authorized cluster users through the public cloud service endpoint. The master is privately accessible through the private cloud service endpoint if authorized cluster users are in your IBM Cloud private network or are connected to the private network through a VPN connection or IBM Cloud Direct Link. Note that you must [expose the master endpoint through a private load balancer](https://cloud.ibm.com/docs/openshift?topic=openshift-access_clusteraccess_private_se) so that users can access the master through a VPN or IBM Cloud Direct Link connection.
* You can optionally secure access to your private cloud service endpoint by creating a subnet allowlist. Only authorized requests to your cluster master that originate from subnets in the allowlist are permitted through the cluster's private cloud service endpoint. For more information, see [Creating an allowlist for the private cloud service endpoint](https://cloud.ibm.com/docs/containers?topic=containers-access_clusterprivate-se-allowlist).









 Worker communication to other IBM Cloud services or on-premises networks 

Allow your worker nodes to securely communicate with other IBM Cloud services and to an on-premises network.



 Communication with other IBM Cloud services over the private or public network
Example cluster master private-service-endpoint allowlist add command 

ibmcloud ks cluster master private-service-endpoint allowlist add --cluster mycluster --subnet 1.1.1.1/16







 ibmcloud ks cluster master private-service-endpoint allowlist disable 

Virtual Private Cloud

Classic infrastructure

Disable the subnet allowlist feature for a cluster's private cloud service endpoint.

After you disable this feature, authorized requests to your cluster master through the cluster's private cloud service endpoint can originate from any subnet.

ibmcloud ks cluster master private-service-endpoint allowlist disable --cluster CLUSTER [-f] [-q]

Minimum required permissions
: Editor platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

-f
: Optional: Force the command to run without user prompts.

-q
: Optional: Do not show the message of the day or update reminders.



 Example cluster master private-service-endpoint allowlist disable command 

ibmcloud ks cluster master private-service-endpoint allowlist disable --cluster mycluster







 ibmcloud ks cluster master private-service-endpoint allowlist enable 

Virtual Private Cloud

Classic infrastructure

Enable the subnet allowlist feature for a cluster's private cloud service endpoint.

After you run this command, use the [ibmcloud ks cluster master private-service-endpoint allowlist command](https://cloud.ibm.com/docs/cli?topic=cli-kubernetes-service-clics_master_pse_allowlist_add) to add subnets to the allowlist. Only authorized requests to your cluster master that originate from subnets in the allowlist are permitted through the cluster's private cloud service endpoint. If the public cloud service endpoint is enabled for your cluster, authorized requests are still permitted through the public cloud service endpoint.

ibmcloud ks cluster master private-service-endpoint allowlist enable --cluster CLUSTER [-f] [-q]
Ubuntu 16.04 packages 4.4.0-178-generic 4.4.0-179-generic Updated worker node images with package and kernel updates for [CVE-2019-1547](https://nvd.nist.gov/vuln/detail/CVE-2019-1547), [CVE-2019-1551](https://nvd.nist.gov/vuln/detail/CVE-2019-1551), [CVE-2019-1563](https://nvd.nist.gov/vuln/detail/CVE-2019-1563), and [CVE-2020-12762](https://nvd.nist.gov/vuln/detail/CVE-2020-12762). 







 Change log for 1.17.6_1526, released 26 May 2020 

The following table shows the changes that are in the master and worker node update 1.17.6_1526. Master patch updates are applied automatically. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node. For more information, see [Update types](https://cloud.ibm.com/docs/containers?topic=containers-cs_versionsupdate_types).



Changes since version 1.17.5_1524

 Component Location Previous Current Description 

 Cluster health image Master v1.1.1 v1.1.4 When cluster add-ons don't support the current cluster version, a warning is now returned in the cluster health state. 
 etcd Master v3.4.3 v3.4.7 See the [etcd release notes](https://github.com/etcd-io/etcd/releases/v3.4.7). 
 Gateway-enabled cluster controller Master 1045 1082 Updated image for [CVE-2020-1967](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1967).
Ubuntu 16.04 packages 4.4.0-178-generic 4.4.0-179-generic Updated worker node images with package and kernel updates for [CVE-2019-1547](https://nvd.nist.gov/vuln/detail/CVE-2019-1547), [CVE-2019-1551](https://nvd.nist.gov/vuln/detail/CVE-2019-1551), [CVE-2019-1563](https://nvd.nist.gov/vuln/detail/CVE-2019-1563), and [CVE-2020-12762](https://nvd.nist.gov/vuln/detail/CVE-2020-12762). 







 Change log for 1.15.12_1540, released 26 May 2020 

The following table shows the changes that are in the master and worker node update 1.15.12_1540. Master patch updates are applied automatically. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node. For more information, see [Update types](https://cloud.ibm.com/docs/containers?topic=containers-cs_versionsupdate_types).



Changes since version 1.15.11_1538

 Component Location Previous Current Description 

 Cluster health image Master v1.1.1 v1.1.4 When cluster add-ons don't support the current cluster version, a warning is now returned in the cluster health state. 
 etcd Master v3.3.18 v3.3.20 See the [etcd release notes](https://github.com/etcd-io/etcd/releases/v3.3.20). 
 Gateway-enabled cluster controller Master 1045 1082 Updated image for [CVE-2020-1967](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1967).
Ubuntu 16.04 packages 4.4.0-178-generic 4.4.0-179-generic Updated worker node images with package and kernel updates for [CVE-2019-1547](https://nvd.nist.gov/vuln/detail/CVE-2019-1547), [CVE-2019-1551](https://nvd.nist.gov/vuln/detail/CVE-2019-1551), [CVE-2019-1563](https://nvd.nist.gov/vuln/detail/CVE-2019-1563), and [CVE-2020-12762](https://nvd.nist.gov/vuln/detail/CVE-2020-12762). 







 Change log for 1.16.10_1533, released 26 May 2020 

The following table shows the changes that are in the master and worker node update 1.16.10_1533. Master patch updates are applied automatically. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node. For more information, see [Update types](https://cloud.ibm.com/docs/containers?topic=containers-cs_versionsupdate_types).



Changes since version 1.16.9_1531

 Component Location Previous Current Description 

 Cluster health image Master v1.1.1 v1.1.4 When cluster add-ons don't support the current cluster version, a warning is now returned in the cluster health state. 
 etcd Master v3.3.18 v3.3.20 See the [etcd release notes](https://github.com/etcd-io/etcd/releases/v3.3.20). 
 Gateway-enabled cluster controller Master 1045 1082 Updated image for [CVE-2020-1967](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1967).
: Standard clusters in [accounts that are enabled with VRF and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint): Enable the [private cloud service endpoint](https://cloud.ibm.com/docs/openshift?topic=openshift-plan_basicsworkeruser-master) so that your Kubernetes master and the worker nodes communicate over the private VLAN. If you specify this option, you must also enable the public cloud service endpoint by using the --public-service-endpoint option. Note that you can't later change the cloud service endpoints. After you create the cluster, you can get the endpoint by running ibmcloud oc cluster get --cluster <cluster_name_or_ID>.

--public-service-endpoint
: Enable the [public cloud service endpoint](https://cloud.ibm.com/docs/openshift?topic=openshift-plan_basicsworkeruser-master) so that your Kubernetes master can be accessed over the public network, for example to run oc commands from your command line. If you have an [account that is enabled with VRF and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint) and also include the --private-service-endpoint option, master-worker node communication goes over the private and the public network. After you create the cluster, you can get the endpoint by running ibmcloud oc cluster get --cluster <cluster_name_or_ID>.

--workers WORKER
: Specify at least 2 worker nodes to include in the cluster. For more information, see [What is the smallest size cluster that I can make?](https://cloud.ibm.com/docs/openshift?topic=openshift-faqssmallest_cluster). If you create a cluster with only one worker node per zone, you might experience issues with Ingress. For high availability, create a cluster with at least two workers per zone.
Example cluster master private-service-endpoint allowlist add command 

ibmcloud ks cluster master private-service-endpoint allowlist add --cluster mycluster --subnet 1.1.1.1/16







 ibmcloud ks cluster master private-service-endpoint allowlist disable 

Virtual Private Cloud

Classic infrastructure

Disable the subnet allowlist feature for a cluster's private cloud service endpoint.

After you disable this feature, authorized requests to your cluster master through the cluster's private cloud service endpoint can originate from any subnet.

ibmcloud ks cluster master private-service-endpoint allowlist disable --cluster CLUSTER [-f] [-q]

Minimum required permissions
: Editor platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

-f
: Optional: Force the command to run without user prompts.

-q
: Optional: Do not show the message of the day or update reminders.



 Example cluster master private-service-endpoint allowlist disable command 

ibmcloud ks cluster master private-service-endpoint allowlist disable --cluster mycluster







 ibmcloud ks cluster master private-service-endpoint allowlist enable 

Virtual Private Cloud

Classic infrastructure

Enable the subnet allowlist feature for a cluster's private cloud service endpoint.

After you run this command, use the [ibmcloud ks cluster master private-service-endpoint allowlist command](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_master_pse_allowlist_add) to add subnets to the allowlist. Only authorized requests to your cluster master that originate from subnets in the allowlist are permitted through the cluster's private cloud service endpoint. If the public cloud service endpoint is enabled for your cluster, authorized requests are still permitted through the public cloud service endpoint.

ibmcloud ks cluster master private-service-endpoint allowlist enable --cluster CLUSTER [-f] [-q]

Minimum required permissions
ibmcloud oc cluster master satellite-service-endpoint allowlist get --cluster CLUSTER [-q]

Minimum required permissions: IBM Cloud IAM Viewer platform access role for Satellite.

Command options:

-c, --cluster CLUSTER
: Required. The name or ID of the cluster.

-q
: Optional: Do not show the message of the day or update reminders.

Example:

ibmcloud oc cluster master satellite-service-endpoint allowlist get --cluster my-cluster





 ibmcloud oc cluster master satellite-service-endpoint allowlist remove 

Satellite

Remove a subnet from a Satellite cluster's service endpoint allowlist. Authorized requests to the cluster master that originate from the subnet are no longer permitted through the Satellite service endpoint. This command can be used only with Satellite clusters that are CoreOS-enabled.

ibmcloud oc cluster master satellite-service-endpoint allowlist remove --cluster CLUSTER --subnet SUBNET [--subnet SUBNET ...] [-f] [-q]

Minimum required permissions: IBM Cloud IAM Editor platform access role for Satellite.

Command options:

-c, --cluster CLUSTER
: Required. The name or ID of the cluster.

-f
: Optional: Force the command to run with no user prompts.

-q
: Optional: Do not show the message of the day or update reminders.

Example:

ibmcloud oc cluster master satellite-service-endpoint allowlist remove --cluster my-cluster --subnet 1.1.1.1/16 --subnet SUBNET 1.1.1.1/32 [-q]





 ibmcloud oc worker-pool create satellite 

Satellite

Create a worker pool for your Red Hat OpenShift cluster in IBM Cloud Satellite.

ibmcloud oc worker-pool create satellite --cluster CLUSTER --host-label LABEL [--host-label LABEL ...] --name NAME [--operating-system SYSTEM] --size-per-zone WORKERS_PER_ZONE --zone ZONE [--label LABEL ...]
You can use this information for planning purposes, such as to estimate the general time that the version might become unsupported.

Dates that are marked with a dagger (†) are tentative and subject to change.



Release history for Red Hat OpenShift on IBM Cloud version 4.12.

 Supported? Red Hat OpenShift / Kubernetes version Release date Unsupported date 

 Supported 4.12 / 1.25 23 February 2023 26 February 2025† 







 Preparing to update 

Review changes that you might need to make when you [update a cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-update) to version 4.12. This information summarizes updates that are likely to have an impact on deployed apps when you update.

Before you update: Review the following list of considerations and limitations before you update your cluster to version 4.11. Some entries are relevant to specific add-ons. To check if you have an add-on enabled in your cluster, run ibmcloud oc cluster addon ls.

Calico BGP password
: When you upgrade your cluster to version 4.12, a [BGP password](https://docs.tigera.io/calico/latest/reference/resources/bgppeerbgppassword) is automatically configured for Calico. This might disrupt pod networking for several seconds while the BGP password configuration is applied.



 Update before master 

The following table shows the actions that you must take before you [update the cluster master](https://cloud.ibm.com/docs/openshift?topic=openshift-updatemaster).



Changes to make before you update the master to Red Hat OpenShift 4.12

 Type Description
IBM provides an updated unsupported target date for the release. An unsupported countdown to this date will be provided at least 45 days before the release becomes unsupported. IBM provides minimal support for the release in alignment with the Kubernetes community. This support phase is generally the final phase before the release becomes unsupported and overrides the maintenance and extended support phases should there be any overlap. Security patch updates might not be provided. During the deprecation period, the version is still supported and your cluster is still functional, but might require updating to a supported release to fix security vulnerabilities. For example, by adding or reloading worker nodes.
4. Unsupported version: The version is unsupported. IBM only provides support to upgrade to a supported release. The version is unsupported. Unsupported clusters are not provided with security and patch updates and are not supported by IBM Cloud Support. Although your cluster and apps might continue to run for a time, you can no longer create, reload, or take other corrective actions on your cluster master or worker nodes when an issue occurs. You can still delete the cluster or worker nodes, or update the cluster to the next version. Review the potential impacts and immediately [update the cluster](https://cloud.ibm.com/docs/containers?topic=containers-updateupdate) to continue receiving important security updates and support. If the cluster master runs two or more versions behind the oldest supported version, you can no longer apply updates and must delete the cluster and create a new one.
5. Archived: The version is unsupported with no upgrade path. IBM provides no support. IBM reserves the right to shut down the control planes for such clusters.



If you wait until your cluster is two or more minor versions behind the oldest supported version, you can't update the cluster.
ibmcloud oc cluster master audit-webhook set --cluster <cluster> --remote-server https://127.0.0.1:2040/api/v1/namespaces/ibm-kube-audit/services/ibmcloud-kube-audit-service/proxy/post --ca-cert <certificate-authority> --client-cert <client-certificate> --client-key <client-key>
11. Verify that the audit webhook is created in your cluster.

ibmcloud oc cluster master audit-webhook get --cluster <cluster_name_or_ID>

Example output

Server: https://127.0.0.1:2040/api/v1/namespaces/ibm-kube-audit/services/ibmcloud-kube-audit-service/proxy/post
Policy: default
12. Apply the webhook to your Kubernetes API server by refreshing the cluster master. It might take several minutes for the master to refresh.

ibmcloud oc cluster master refresh --cluster <cluster_name_or_ID>
13. While the master refreshes, [provision an instance of IBM Log Analysis and deploy a logging agent to every worker node in your cluster](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-tutorial-use-logdna). The logging agent is required to forward logs from inside your cluster to the IBM Log Analysis service. If you already set up logging agents in your cluster, you can skip this step.
14. After the master refresh completes and the logging agents are running on your worker nodes, you can [view your Kubernetes API audit logs in IBM Log Analysis](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-tutorial-use-logdna).



After you set up the audit webhook in your cluster, you can monitor version updates to the kube-audit-to-logdna image by running ibmcloud cr image-list --include-ibm | grep ibmcloud-kube-audit.