vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Change log for master fix pack 1.16.15_1554, released 14 December 2020 

The following table shows the changes that are in the master fix pack patch update 1.16.15_1554. Master patch updates are applied automatically.



Changes since version 1.16.15_1552

 Component Previous Current Description 

 Gateway-enabled cluster controller 1105 1184 Updated to use Go version 1.15.5. Updated image to implement additional IBM security controls. 
 GPU device plug-in and installer c7a8cf7 adcae42 Updated the GPU drivers to version [450.80.02](https://www.nvidia.com/download/driverResults.aspx/165294). Updated image for [CVE-2020-28367](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28367), [CVE-2020-28366](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28366), and [CVE-2020-28362](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28362). Updated image to implement additional IBM security controls. 
 IBM Calico extension 378 544 Updated to use the universal base image (UBI) and to use Go version 1.15.5. Updated image to implement additional IBM security controls. 
 IBM Cloud File Storage for Classic monitor 379 384 Updated to use Go version 1.15.5 and to run as a non-root user. Updated image to implement additional IBM security controls. 
 IBM Cloud File Storage for Classic plug-in 379 384 Updated to use Go version 1.15.5 and to run with a least privileged security context. Updated image to implement additional IBM security controls. 
 IBM Cloud Provider v1.16.15-382 v1.16.15-394 Updated image to implement additional IBM security controls.
4.9.43 4.9.45 For more information, see the [change log](https://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.htmlocp-4-9-45). 







 Change log for worker node fix pack 4.9.43_1549_openshift, released 01 August 2022 

The following table shows the changes that are in the worker node fix pack 4.9.43_1549_openshift. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 4.9.42_1547_openshift

 Component Previous Current Description 

 RHEL 7 Packages N/A N/A N/A 
 Red Hat OpenShift on IBM Cloud. 4.9.42 4.9.43 For more information, see the [change log](https://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.htmlocp-4-9-43). 







 Change log for master fix pack 4.9.42_1548_openshift, released 26 July 2022 

The following table shows the changes that are in the master fix pack 4.9.42_1548_openshift. Master patch updates are applied automatically.



Changes since version 4.9.37_1544_openshift

 Component Previous Current Description 

 Cluster health image v1.3.8 v1.3.9 Updated Go dependencies and to use Go version 1.18.4. Fixed minor typographical error in the add-on daemonset not available health status. 
 Gateway-enabled cluster controller 1680 1792 Updated to use Go version 1.17.11.
Change log for master fix pack 1.15.12_1550, released 18 August 2020 

The following table shows the changes that are in the master fix pack patch update 1.15.12_1550. Master patch updates are applied automatically.



Changes since version 1.15.12_1549

 Component Previous Current Description 

 Cluster health image v1.1.8 v1.1.9 Updated to use Go version 1.13.13. 
 GPU device plug-in and installer 8c24345 bacb9e1 Updated image for [CVE-2020-14039](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14039) and [CVE-2020-15586](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15586). 
 IBM Cloud File Storage for Classic plug-in and monitor 376 377 Fixed a bug that prevents persistent volume claim (PVC) creation failures from being retried. 
 Key Management Service provider v1.0.0 v1.0.1 Updated image for [CVE-2020-15586](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15586). 
 Kubernetes add-on resizer 1.8.5 1.8.11 See the [Kubernetes add-on resizer release notes](https://github.com/kubernetes/autoscaler/releases/tag/addon-resizer-1.8.11). 
 Kubernetes configuration N/A N/A The Kubernetes API server audit policy configuration is updated to include auditing of all API groups except apiregistration.k8s.io and coordination.k8s.io.
After you complete these steps, your authorized cluster users can access the Kubernetes master from a VPN or IBM Cloud Direct Link connection.

IBM Cloud® Direct Link
: Added IBM Cloud Direct Link to the [VPN connectivity](https://cloud.ibm.com/docs/openshift?topic=openshift-vpn) page as a way to create a direct, private connection between your remote network environments and IBM Cloud Kubernetes Service without routing over the public internet.

Ingress ALB change log
: Updated the [ALB ingress-auth image to build 330](https://cloud.ibm.com/docs/containers?topic=containers-cluster-add-ons-changelogkube_ingress_changelog).

Red Hat OpenShift beta
: [Added a lesson](https://cloud.ibm.com/docs/containers?topic=containers-cluster-add-ons-changelogfluentd_changelog) about how to modify app deployments for privileged security context constraints for IBM Log Analysis and IBM Cloud Monitoring add-ons.





 6 June 2019 

Fluentd change log
: Added a [Fluentd version change log](https://cloud.ibm.com/docs/containers?topic=containers-cluster-add-ons-changelogfluentd_changelog).

Ingress ALB change log
: Updated the [ALB nginx-ingress image to build 470](https://cloud.ibm.com/docs/containers?topic=containers-cluster-add-ons-changelogkube_ingress_changelog).





 5 June 2019 

CLI reference
: Updated the [CLI reference page](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-cli) to reflect multiple changes for the release of version [0.3.34](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_cli_changelog) of the IBM Cloud Kubernetes Service CLI plug-in.

New!
Ubuntu 16.04 packages N/A N/A Updated worker node images with package updates for [CVE-2009-5155](https://nvd.nist.gov/vuln/detail/CVE-2009-5155) and [CVE-2020-6096](https://nvd.nist.gov/vuln/detail/CVE-2020-6096). 







 Change log for master fix pack 1.17.17_1563, released 24 May 2021 

The following table shows the changes that are in the master fix pack patch update 1.17.17_1563. Master patch updates are applied automatically.



Changes since version 1.17.17_1560

 Component Previous Current Description 

 Cluster health image v1.1.21 v1.1.22 Updated image to implement additional IBM security controls and for [CVE-2020-26160](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26160), [CVE-2020-28483](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28483) and [CVE-2021-20305](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20305). 
 Gateway-enabled cluster controller 1322 1352 Updated to use Go version 1.15.11.
4.10.24 4.10.26 For more information, see the [change log](https://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.htmlocp-4-10-26). 







 Change log for worker node fix pack 4.10.24_1529_openshift, released 01 August 2022 

The following table shows the changes that are in the worker node fix pack 4.10.24_1529_openshift. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 4.10.21_1527_openshift

 Component Previous Current Description 

 RHEL 7 Packages N/A N/A N/A 
 Red Hat OpenShift on IBM Cloud. 4.10.21 4.10.24 For more information, see the [change log](https://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.htmlocp-4-10-24). 







 Change log for master fix pack 4.10.22_1528_openshift, released 26 July 2022 

The following table shows the changes that are in the master fix pack 4.10.22_1528_openshift. Master patch updates are applied automatically.



Changes since version 4.10.17_1524_openshift

 Component Previous Current Description 

 Cluster health image v1.3.8 v1.3.9 Updated Go dependencies and to use Go version 1.18.4. Fixed minor typographical error in the add-on daemonset not available health status. 
 Gateway-enabled cluster controller 1680 1792 Updated to use Go version 1.17.11.
Change log for master fix pack 4.8.57_1600_openshift, released 27 April 2023 

The following table shows the changes that are in the master fix pack 4.8.57_1600_openshift. Master patch updates are applied automatically.



Changes since version 4.8.57_1596_openshift

 Component Previous Current Description 

 Cluster health image v1.3.17 v1.3.19 Updated Go to version 1.19.8 and updated dependencies. 
 IBM Calico extension 1366-amd64 1390-amd64 Eliminate IP syscall. 
 IBM Cloud Block Storage driver and plug-in v2.4.0 v2.4.5 Updated universal base image (UBI) to resolve CVEs. Updated Go to version 1.19.8 and updated dependencies. 
 IBM Cloud Controller Manager v1.21.14-12 v1.21.14-14 Update Go dependencies. 
 IBM Cloud File Storage for Classic plug-in and monitor 429 431 Updated Go to version 1.19.8 and updated dependencies. Update UBI base image. 
 Key Management Service provider v2.6.4 v2.6.5 Updated Go to version 1.19.7 and updated dependencies. 
 Load balancer and load balancer monitor for IBM Cloud Provider 2420 2486 Updated Go to version 1.19.7 and updated dependencies.
Change log for master fix pack 4.11.39_1557_openshift, released 25 May 2023 

The following table shows the changes that are in the master fix pack 4.11.39_1557_openshift. Master patch updates are applied automatically.



Changes since version 4.11.35_1553_openshift

 Component Previous Current Description 

 Cluster health image v1.3.19 v1.3.20 Updated Go to version 1.19.9 and updated dependencies. Updated the base image. Resolved add-on health bugs. 
 etcd v3.5.7 v3.5.8 See the [etcd release notes](https://github.com/etcd-io/etcd/releases/v3.5.8). 
 IBM Cloud Controller Manager v1.24.13-1 v1.24.13-6 Updated support of the Kubernetes 1.24.13 release. Updated Go dependencies. Key rotation. 
 IBM Cloud RBAC Operator 778ef2b 4e2f346 Make armada-rbac-sync FIPS compliant 
 Key Management Service provider v2.6.5 v2.6.6 Updated Go to version 1.19.9 and updated dependencies. 
 OpenVPN client 2.6.4-r0-IKS-27 2.5.8-r0-IKS-674 Reverted to previous version. 
 OpenVPN server 2.6.4-r0-IKS-26 2.5.8-r0-IKS-673 Reverted to previous version. 
 Portieris admission controller v0.13.4 v0.13.5 See the [Portieris admission controller release notes](https://github.com/IBM/portieris/releases/tag/v0.13.5). 
 Red Hat OpenShift on IBM Cloud.
Change log for master fix pack 4.6.48_1570_openshift, released 26 January 2022 

The following table shows the changes that are in the master fix pack patch update 4.6.48_1570_openshift. Master patch updates are applied automatically.



Changes since version 4.6.47_1569_openshift

 Component Previous Current Description 

 Calico N/A N/A Changed to improve Calico availability during updates. 
 Cluster health image v1.2.20 v1.2.21 Updated to use Go version 1.17.5, updated Go dependencies and golangci-lint. 
 IBM Calico extension 900 923 Updated universal base image (UBI) to the 8.5-218 version to resolve CVEs. Updated to use Go version 1.16.13. 
 IBM Cloud Block Storage for Classic driver and plug-in v2.1.3 v2.1.6 Updated to use Go version 1.16.13. 
 IBM Cloud Controller Manager v1.19.16-5 v1.19.16-6 Exclude CVE-2020-14312 from scanning 
 IBM Cloud File Storage for Classic plug-in and monitor 402 404 Updated universal base image (UBI) to the 8.5-218 version to resolve CVEs. Updated to use Go version 1.16.13. 
 IBM Cloud RBAC Operator 3430e03 0fc9949 Updated universal base image (UBI) to the 8.5-218 version to resolve CVEs. Updated to use Go version 1.16.13. 
 Key Management Service provider v2.3.12 v2.3.13 Updated Go dependencies and golangci-lint. 
 Load balancer and load balancer monitor for IBM Cloud Provider 1660 1748 Updated the Alpine base image to the 3.15 version to resolve CVEs. Updated to use Go version 1.17.6. 
 Red Hat OpenShift 4.6.47 4.6.48 Changed the duration of the Kubernetes API server certificate from 825 days to 730 days. Changed the duration of the cluster CA certificate from 30 years to 10 years.
For more information about service endpoints, see worker-to-master and user-to-master communication in [classic clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-plan_basicsworkeruser-master) and [VPC clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-plan_vpc_basicsvpc-workeruser-master).

If you enable the private cloud service endpoint, you can create a subnet allowlist. Only authorized requests to your cluster master that originate from subnets in the allowlist are permitted through the cluster's private cloud service endpoint. For more information, see [Creating an allowlist for the private cloud service endpoint](https://cloud.ibm.com/docs/containers?topic=containers-access_clusterprivate-se-allowlist).





 Rotating CA certificates in your cluster 

Revoke existing certificate authority (CA) certificates in your cluster and issue new CA certificates.

By default, certificate authority (CA) certificates are administered to secure access to various components of your cluster, such as the master API server. As you use your cluster, you might want to revoke the certificates issued by the existing CA. For example, the administrators of your team might use a certificate signing request (CSR) to manually generate certificates that are signed by the cluster's CA for worker nodes in the cluster. If an administrator leaves your organization, you can ensure that they no longer have admin access to your cluster by creating a new CA and certificates for your cluster, and removing the old CA and certificates.



1. Create a CA for your cluster. Certificates that are signed by this new CA are issued for the cluster master components, and the API server is refreshed.

ibmcloud oc cluster ca create -c CLUSTER
2. Ensure that your cluster's master health is normal, the API server refresh is complete, and any master updates are complete. It might take several minutes for the master API server to refresh.

ibmcloud oc cluster get --cluster CLUSTER
3. Check the status of the CA creation.
To enable VRF, run ibmcloud account update --service-endpoint-enable true. This command output prompts you to open a support case to enable your account to use VRF and service endpoints. VRF eliminates the VLAN spanning option for your account because all VLANs are able to communicate. When VRF is enabled, any system that is connected to any of the private VLANs in the same IBM Cloud account can communicate with the cluster worker nodes. You can isolate your cluster from other systems on the private network by applying [Calico private network policies](https://cloud.ibm.com/docs/openshift?topic=openshift-network_policiesisolate_workers).
* [VLAN spanning](https://cloud.ibm.com/docs/vlans?topic=vlans-vlan-spanningvlan-spanning): If you can't or don't want to enable VRF, such as if you don't need the master to be accessible on the private network or if you use a gateway appliance to access the master over the public VLAN, enable VLAN spanning. For example, if you have an existing gateway appliance and then add a cluster, the new portable subnets that are ordered for the cluster aren't configured on the gateway appliance but VLAN spanning enables routing between the subnets. To enable VLAN spanning, you need the Network > Manage Network VLAN Spanning[infrastructure permission](https://cloud.ibm.com/docs/openshift?topic=openshift-access-credsinfra_access), or you can request the account owner to enable it. To check whether VLAN spanning is already enabled, use the ibmcloud oc vlan spanning get[command](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_vlan_spanning_get). You can't enable the private cloud service endpoint if you choose to enable VLAN spanning instead of VRF.









 Worker-to-master and user-to-master communication: Service endpoints
Change log for worker node fix pack 4.5.40_1544_openshift, released 6 July 2021 

The following table shows the changes that are in the worker node fix pack 4.5.40_1544_openshift. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 4.5.40_1542_openshift

 Component Previous Current Description 

 HA proxy 700dc6 aae810 Updated image with fixes for [CVE-2021-3520](https://nvd.nist.gov/vuln/detail/CVE-2021-3520), [CVE-2021-20271](https://nvd.nist.gov/vuln/detail/CVE-2021-20271), [CVE-2021-3516](https://nvd.nist.gov/vuln/detail/CVE-2021-3516), [CVE-2021-3517](https://nvd.nist.gov/vuln/detail/CVE-2021-3517), [CVE-2021-3518](https://nvd.nist.gov/vuln/detail/CVE-2021-3518), [CVE-2021-3537](https://nvd.nist.gov/vuln/detail/CVE-2021-3537), and [CVE-2021-3541](https://nvd.nist.gov/vuln/detail/CVE-2021-3541). 







 Change log for master fix pack 4.5.40_1543_openshift, released 28 June 2021 

The following table shows the changes that are in the master fix pack patch update 4.5.40_1543_openshift. Master patch updates are applied automatically.



Changes since version 4.5.39_1539_openshift

 Component Previous Current Description 

 Cluster health image v1.2.12 v1.2.13 Updated to use Go version 1.15.12.
The following table shows the changes that are in the master fix pack patch update 1.18.16_1543. Master patch updates are applied automatically.



Changes since version 1.18.16_1543

 Component Previous Current Description 

 Load balancer and load balancer monitor for IBM Cloud Provider 1165 1274 Fixed a bug that might cause version 2.0 network load balancers (NLBs) to crash and restart on load balancer updates. 







 Change log for master fix pack 1.18.16_1543, released 22 February 2021 

The following table shows the changes that are in the master fix pack patch update 1.18.16_1543. Master patch updates are applied automatically.



Changes since version 1.18.15_1538

 Component Previous Current Description 

 Calico v3.13.4 v3.13.5 See the [Calico release notes](https://docs.tigera.io/archive). 
 Cluster health image v1.1.16 v1.1.18 Updated to use Go version 1.15.7. Updated image to implement additional IBM security controls. 
 Gateway-enabled cluster controller 1195 1232 Updated to use Go version 1.15.7. 
 IBM Calico extension 567 618 Updated to use Go version 1.15.7. 
 IBM Cloud Controller Manager v1.18.15-3 v1.18.16-2 Updated to support the Kubernetes 1.18.16 release and to use calicoctl version 3.13.5. Updated image to implement additional IBM security controls and for [DLA-2509-1](https://www.debian.org/lts/security/2020/dla-2509). Updated version 1.0 and 2.0 network load balancers (NLBs) to run as a non-root user by default, with privileged escalation as needed. 
 IBM Cloud File Storage for Classic plug-in and monitor 385 388 Improved the retry logic for provisioning persistent volume claims (PVCs). 
 IBM Cloud RBAC Operator f859228 86de2b7 Updated to use Go version 1.15.7.
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: system:masters
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: system:nodes
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: system:serviceaccounts
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: system:authenticated
Show more







 Step 4: Checking for non-IBM PSPs 

Complete the steps to check whether your cluster uses non-IBM PSPs.

Upgrading to version 1.25 fails if the command output includes additional PSPs to those in the following example. You might have additional PSP from third party applications and require updates to the applications or working with the application vendors to determine the proper upgrade strategy to use for those applications.



1. List your pod security policies.

kubectl get podsecuritypolicies -o name
2. Review the command output.

Warning: policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+
podsecuritypolicy.policy/ibm-anyuid-hostaccess-psp
podsecuritypolicy.policy/ibm-anyuid-hostpath-psp
podsecuritypolicy.policy/ibm-anyuid-psp
podsecuritypolicy.policy/ibm-privileged-psp
podsecuritypolicy.policy/ibm-restricted-psp
3. Update your apps to use the IBM PSPs.









 Migration steps 

If you determine that your cluster pod security configuration does not meet the [migration pre-requisites](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission-migrationpsa-upgrade-reqs), you must follow these migration steps to upgrade your cluster.

Several of the following Pod Security migration steps include links to sections in the Kubernetes documentation.
nfs vers=3.0









 Scaling down the default File Storage for Classic plug-in 

By default, your classic IBM Cloud Kubernetes Service clusters include the File Storage for Classic plug-in. If you don't need to use File Storage for Classic in your cluster, you can conserve cluster resources by scaling down the plug-in and watcher components. Later, you can scale back up to one replica if you need File Storage for Classic. You can't change other settings or remove the deployment entirely. Because the plug-in is still installed, it is updated along with the cluster version updates even if you scaled the plug-in down.

Before you begin:



* [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)
* Make sure that you have the Manager IAM service access role for the cluster, so that you can make changes to deployments in the kube-system namespace.



To scale down the File Storage for Classic plug-in:



1. Scale down the File Storage for Classic plug-in and watcher deployments to 0 replicas.

kubectl scale deployment -n kube-system --replicas=0 ibm-file-plugin

kubectl scale deployment -n kube-system --replicas=0 ibm-storage-watcher

If you need File Storage for Classic later, you can scale the plug-in back up with the following commands. kubectl scale deployment -n kube-system --replicas=1 ibm-file-plugin && kubectl scale deployment -n kube-system --replicas=1 ibm-storage-watcher
2. Optional: Confirm that the plug-in is scaled down. The scale-down is successful when the pods are removed and remain removed even after the master state is changed, such as by a cluster refresh or update.



1. Confirm that the pods are removed.
Ubuntu 18.04 packages 4.15.0-153 4.15.0-154 Updated worker node images and kernel with package updates for [CVE-2021-3711](https://nvd.nist.gov/vuln/detail/CVE-2021-3711) and [CVE-2021-3712](https://nvd.nist.gov/vuln/detail/CVE-2021-3712). 







 Change log for master fix pack 1.21.4_1528, released 25 August 2021 

The following table shows the changes that are in the master fix pack patch update 1.21.4_1528. Master patch updates are applied automatically.



Changes since version 1.21.3_1525

 Component Previous Current Description 

 Calico N/A N/A Updated the rolling update configuration for the calico-node daemonset in the kube-system namespace. The configuration is now the same regardless of the number of cluster worker nodes. 
 Cluster health image v1.2.14 v1.2.15 Updated to use Go version 1.15.15. Updated universal base image (UBI) to the latest 8.4 version to resolve CVEs. 
 CoreDNS 1.8.0 1.8.4 See the [CoreDNS release notes](https://coredns.io/2021/05/28/coredns-1.8.4-release/). 
 Gateway-enabled cluster controller 1348 1444 Updated image for [CVE-2021-36159](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36159). 
 GPU device plug-in and installer 483ccc2 8c8bcdf Updated to use Go version 1.16.6. 
 IBM Calico extension 747 763 Updated to use Go version 1.16.6. Updated UBI to the latest 8.4-205 version to resolve CVEs.