vania-janet/multiturn-rag-retrieval-data huggingface dataset:
To set up custom network policies, you must [install the calicoctl CLI](https://cloud.ibm.com/docs/containers?topic=containers-network_policiescli_install). 
 Support for IBM Cloud network firewalls IBM Cloud Kubernetes Service is compatible with all [IBM Cloud firewall offerings](https://www.ibm.com/cloud/network-security). For example, you can set up a firewall with custom network policies to provide dedicated network security for your standard cluster and to detect and remediate network intrusion. For example, you might choose to set up a [Virtual Router Appliance](https://cloud.ibm.com/docs/virtual-router-appliance?topic=virtual-router-appliance-about-the-vra) to act as your firewall and block unwanted traffic. When you set up a firewall, [you must also open up the required ports and IP addresses](https://cloud.ibm.com/docs/containers?topic=containers-firewallfirewall) for each region so that the master and the worker nodes can communicate. 







 What else can I do to reduce the surface for external attacks for Classic clusters? 

The more apps or worker nodes that you expose publicly, the more steps you must take to prevent external malicious attacks. Review the following table to find options for how to keep apps and worker nodes private.



Private services and worker node options

 Security feature Description 

 Limit the number of exposed apps By default, your apps and services that run within the cluster are not reachable over the public internet. You can choose if you want to expose your apps to the public, or if you want your apps and services be reachable on the private network only. When you keep your apps and services private, you can leverage the built-in security features to assure secured communication between worker nodes and pods. To expose services and apps to the public internet, you can leverage the [NLB and Ingress ALB support](https://cloud.ibm.com/docs/containers?topic=containers-cs_network_planningpublic_access) to securely make your services publicly available.
: Editor platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: The name or ID of the cluster.

-q
: Optional: Do not show the message of the day or update reminders.



 Example ingress alb health-checker enable command 

ibmcloud ks ingress alb health-checker enable --cluster mycluster







 ibmcloud ks ingress alb health-checker get 

Virtual Private Cloud

Classic infrastructure

View the details of the health checker for an Ingress ALB in a cluster.

ibmcloud ks ingress alb health-checker get --cluster CLUSTER [--output OUTPUT] [-q]

Minimum required permissions
: Viewer platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: The name or ID of the cluster.

--output json
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.



 Example ingress alb health-checker get command 

ibmcloud ks ingress alb health-checker get --cluster mycluster







 ibmcloud ks ingress alb ls 

Virtual Private Cloud

Classic infrastructure

List all Ingress ALB IDs in a cluster and view whether an update for the ALB pods is available.

If no ALB IDs are returned, then the cluster does not have a portable subnet. You can [create](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_cluster_subnet_create) or [add](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_cluster_subnet_add) subnets to a cluster. Afterward, ALBs are automatically created for you.

ibmcloud ks ingress alb ls --cluster CLUSTER [--output json] [-q]

Minimum required permissions
: Editor platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: The name or ID of the cluster.

-q
: Optional: Do not show the message of the day or update reminders.



 Example ingress alb health-checker enable command 

ibmcloud ks ingress alb health-checker enable --cluster mycluster







 ibmcloud ks ingress alb health-checker get 

Virtual Private Cloud

Classic infrastructure

View the details of the health checker for an Ingress ALB in a cluster.

ibmcloud ks ingress alb health-checker get --cluster CLUSTER [--output OUTPUT] [-q]

Minimum required permissions
: Viewer platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: The name or ID of the cluster.

--output json
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.



 Example ingress alb health-checker get command 

ibmcloud ks ingress alb health-checker get --cluster mycluster







 ibmcloud ks ingress alb ls 

Virtual Private Cloud

Classic infrastructure

List all Ingress ALB IDs in a cluster and view whether an update for the ALB pods is available.

If no ALB IDs are returned, then the cluster does not have a portable subnet. You can [create](https://cloud.ibm.com/docs/cli?topic=cli-kubernetes-service-clics_cluster_subnet_create) or [add](https://cloud.ibm.com/docs/cli?topic=cli-kubernetes-service-clics_cluster_subnet_add) subnets to a cluster. Afterward, ALBs are automatically created for you.

ibmcloud ks ingress alb ls --cluster CLUSTER [--output json] [-q]

Minimum required permissions
IBM Calico extension 320 349 Updated image for [CVE-2020-1967](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1967). 
 IBM Cloud Controller Manager v1.17.5-1 v1.18.2-3 Updated to support the Kubernetes 1.18.2 release and to use calicoctl version 3.13.3. Updated network load balancer (NLB) events to use the latest IBM Cloud troubleshooting documentation. 
 IBM Cloud File Storage for Classic plug-in and monitor 358 371 Updated image for [CVE-2020-1967](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1967). 
 Kubernetes v1.17.5 v1.18.2 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.18.2). The master update resolves CVE-2020-8555 (see the [IBM security bulletin](https://www.ibm.com/support/pages/node/6220220)). 
 Kubernetes admission controllers configuration N/A N/A Added CertificateApproval, CertificateSigning, CertificateSubjectRestriction and DefaultIngressClass to the --enable-admission-plugins option for the cluster's [Kubernetes API server](https://cloud.ibm.com/docs/containers?topic=containers-service-settingskube-apiserver). 
 Kubernetes configuration N/A N/A Removed batch/v2alpha1=true from the --runtime-config option for the cluster's Kubernetes API server. 
 Kubernetes Dashboard v2.0.0-rc7 v2.0.0 See the [Kubernetes Dashboard release notes](https://github.com/kubernetes/dashboard/releases/tag/v2.0.0).
To retrieve the cluster name or ID, run ibmcloud oc cluster ls. This value is required.

--instance MONITORING_INSTANCE
: The ID or name of the IBM Cloud Monitoring service instance that you used in your monitoring configuration. To retrieve the service instance name, run ibmcloud resource service-instances. This value is required.

Example command

ibmcloud ob monitoring config delete --cluster mycluster --instance mymonitoringinstance





 ibmcloud ob monitoring config list 

Virtual Private Cloud

Classic infrastructure

List all Monitoring configurations that were created for your cluster with the Red Hat OpenShift on IBM Cloud observability plug-in.

To list monitoring configurations that you manually set up without using the Red Hat OpenShift on IBM Cloud observability plug-in, you must first make this configuration available to the plug-in by using the [ibmcloud ob monitoring agent discover](https://cloud.ibm.com/docs/openshift?topic=openshift-observability_climonitoring_agent_discover) command.

ibmcloud ob monitoring config list --cluster CLUSTER

Minimum required permissions:



* Administrator platform access role and Manager service access role for the ibm-observe Kubernetes namespaces in IBM Cloud Kubernetes Service.
* Viewer platform access role for IBM Cloud Monitoring



Command options:

--cluster CLUSTER
: The name or ID of the cluster for which you want to list existing Monitoring configurations. This value is required.





 ibmcloud ob monitoring config enable public-endpoint|private-endpoint 

Virtual Private Cloud

Classic infrastructure

Use the public or private cloud service endpoint to send metrics from your cluster to your Monitoring service instance.

To use the private cloud service endpoint, your cluster must be enabled for using private cloud service endpoints. Red Hat OpenShift on IBM Cloud clusters that run version 4 don't support private cloud service endpoints. You must use a cluster that runs version 3.11 to use this option.
If you don't grant Satellite Config access, you can't later use the Satellite Config functionality to view or deploy Kubernetes resources for your clusters. If you want to enable access later, you can [create custom RBAC roles for Satellite Config](https://cloud.ibm.com/docs/satellite?topic=satellite-setup-clusters-satconfigcustom-access-cluster-wide).

--host-label, -hl LABEL
: Optional. Enter existing labels that describe Satellite hosts, formatted as -hl key=value pairs, so hosts with matching labels can be automatically assigned as worker nodes for the cluster. To find available host labels, run ibmcloud sat host get --host <host_name_or_ID> --location <location_name_or_ID>.

--infrastructure-topology TOPOLOGY
: Optional. Specify whether the cluster runs a single worker node or the default setup of three of worker nodes. To create a single-node cluster, specify single-replica. This option is only supported for Red Hat OpenShift on IBM Cloud version 4.11 or later and requires that you specify a Satellite location with CoreOS enabled. Note that single-node clusters lack high availability and are only recommended for specific circumstances. By provisioning a single-node cluster, you accept that you are more likely to experience downtime and disruptions in your workload.

--operating-system REDHAT_7_64|REDHAT_8_64|RHCOS
: Optional. The operating system of the worker nodes in your cluster. For a list of available operating sysems by cluster version, see [Available Red Hat OpenShift versions](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_versionsopenshift_versions_available). Note that to use your RHCOS hosts in your clusters, you must create a Red Hat CoreOS-enabled location and a cluster that runs version 4.9 or later.
If you can't or don't want to enable VRF, enable [VLAN spanning](https://cloud.ibm.com/docs/vlans?topic=vlans-vlan-spanningvlan-spanning). To perform this action, you need the Network > Manage Network VLAN Spanning[infrastructure permission](https://cloud.ibm.com/docs/containers?topic=containers-access-credsinfra_access), or you can request the account owner to enable it. To check whether VLAN spanning is already enabled, use the ibmcloud ks vlan spanning get --region <region>[command](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_vlan_spanning_get).

When you enable VRF or VLAN spanning for your account, network segmentation is removed for your clusters.

Review the following table to see your options for how to achieve network segmentation when you enable VRF or VLAN spanning for your account.



Network segmentation options

 Security feature Description 

 Set up custom network policies with Calico You can use the built-in Calico interface to [set up custom Calico network policies](https://cloud.ibm.com/docs/containers?topic=containers-network_policiesnetwork_policies) for your worker nodes. For example, you can allow or block network traffic on specific network interfaces, for specific pods, or services. To set up custom network policies, you must [install the calicoctl CLI](https://cloud.ibm.com/docs/containers?topic=containers-network_policiescli_install). 
 Support for IBM Cloud network firewalls IBM Cloud Kubernetes Service is compatible with all [IBM Cloud firewall offerings](https://www.ibm.com/cloud/network-security). For example, you can set up a firewall with custom network policies to provide dedicated network security for your standard cluster and to detect and remediate network intrusion.
Classic infrastructure

Check whether automatic updates for the Ingress ALB add-on are enabled and whether your ALBs are updated to the latest image version.

ibmcloud ks ingress alb autoupdate get --cluster CLUSTER [--output json] [-q]

Minimum required permissions
: Editor platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

--output json
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.





 ibmcloud ks ingress alb create classic 

Classic infrastructure

Create a public or private ALB in a classic cluster. The ALB that you create is enabled by default.

ibmcloud ks ingress alb create classic --cluster CLUSTER --type (PUBLIC|PRIVATE) --vlan VLAN_ID --zone ZONE [--ip IP] [--version IMAGE_VERSION] [-q]

Minimum required permissions
: Editor platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: The name or ID of the cluster.

--type (PUBLIC|PRIVATE)
: The type of ALB: public or private. This type must match the vlan.

--vlan VLAN_ID
: The ID of the VLAN to create the ALB on. This VLAN must match the ALB type and must be in the same zone as the ALB that you want to create.

--zone ZONE
: The zone to create the ALB in.

--ip IP
: Optional: An IP address to assign to the ALB. This IP must be on the vlan that you specified and must be in the same zone as the ALB that you want to create. This IP address must not be in use by another load balancer or ALB in the cluster. To see the IP addresses that are currently in use, run kubectl get svc --all-namespaces.
(https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)
* Make sure that you are assigned a [service access role](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-perms) that grants the appropriate Kubernetes RBAC role so that you can work with Kubernetes resources in the namespace.



To scale your apps,



1. Deploy your app to a cluster from the CLI. For more complex deployments, you might need to create a [configuration file](https://cloud.ibm.com/docs/containers?topic=containers-deploy_appapp_cli).

kubectl create deployment <app_name> --image=<image>
2. Set CPU resource limits in millicores for the containers that run in your deployment, such as 100m. You can also set memory limits, but the horizontal pod autoscaler only considers CPU resource limits for scaling purposes. For more information, see the [kubectl set resources documentation](https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands-em-resources-em-).

kubectl set resources deployment <app_name> --limits=cpu=100m
3. Create a horizontal pod autoscaler and define your policy. For more information, see the [kubectl autoscale documentation](https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commandsautoscale).

kubectl autoscale deployment <deployment_name> --cpu-percent=<percentage> --min=<min_value> --max=<max_value>



Table 2. Understanding your command options

 Options Description 

 --cpu-percent The average CPU utilization that is maintained by the Horizontal Pod Autoscaler, which is specified as a percentage. 
 --min The minimum number of deployed pods that are used to maintain the specified CPU utilization percentage.
See [Updating your cluster's containerd registry host configuration](https://cloud.ibm.com/docs/containers?topic=containers-registryupdate_containerd_registry_config) and the [containerd CRI plugin configuration guide](https://github.com/containerd/containerd/blob/v1.5.5/docs/cri/config.mdregistry-configuration). 
 IBM Cloud Controller Manager v1.21.5-1 v1.22.2-1 Updated to support the Kubernetes 1.22.2 release. In addition, the code for this component is now [open source](https://github.com/IBM-Cloud/cloud-provider-ibm). 
 Kubernetes v1.21.5 v1.22.2 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.22.2). This update resolves [CVE-2021-25741](https://nvd.nist.gov/vuln/detail/CVE-2021-25741). For more information, see the [IBM security bulletin](https://www.ibm.com/support/pages/node/6496649)). 
 Kubernetes add-on resizer 1.8.13 1.8.14 See the [Kubernetes add-on resizer release notes](https://github.com/kubernetes/autoscaler/releases/tag/addon-resizer-1.8.14). 
 Kubernetes admission controllers configuration N/A N/A Added PodSecurity to the --disable-admission-plugins option for the cluster's [Kubernetes API server](https://cloud.ibm.com/docs/containers?topic=containers-service-settingskube-apiserver). Pod security continues to be [configured via pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp).
To continue communicating with the API server, you must design your apps to read the refreshed token value on a regular basis, such as every minute. For more information, see [Bound Service Account Tokens](https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/1205-bound-service-account-tokens/README.md).

Admission controllers
: Admission controllers are implemented for specific features in Kubernetes and IBM Cloud Kubernetes Service. With admission controllers, you can set up policies in your cluster that determine whether a particular action in the cluster is allowed or not. In the policy, you can specify conditions when a user can't perform an action, even if this action is part of the general permissions that you assigned the user by using RBAC roles. Therefore, admission controllers can provide an extra layer of security for your cluster before an API request is processed by the Kubernetes API server.

When you create a cluster, IBM Cloud Kubernetes Service automatically installs the default [Kubernetes admission controllers](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/) in a particular order in the Kubernetes master, which can't be changed by the user. Review the order of default admission controllers by cluster version in the [kube-apiserver component reference information](https://cloud.ibm.com/docs/containers?topic=containers-service-settingskube-apiserver).

You can [install your own admission controllers in the cluster](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/admission-webhooks) or choose an optional admission controller, such as [Portieris](https://cloud.ibm.com/docs/openshift?topic=openshift-imagesportieris-image-sec). With Portieris, you can block container deployments from unsigned images.
If you get the same error, then contact the account administrator and verify that you have sufficient permissions to bind services (see the following account admin steps).







 As the account admin 



1. Verify that the user who experiences this problem has [Editor permissions for IBM Cloud Kubernetes Service](https://cloud.ibm.com/docs/openshift?topic=openshift-userschecking-perms).
2. Verify that the user who experiences this problem has the [Cloud Foundry developer role for the space](https://cloud.ibm.com/docs/account?topic=account-mngcfupdate_cf_access) where the service is provisioned.
3. If the correct permissions exists, try assigning a different permission and then re-assigning the required permission.
4. Wait a few minutes, then let the user try to bind the service again.
5. If this does not resolve the problem, then the IBM Cloud IAM permissions are out of sync and you can't resolve the issue yourself. [Contact IBM support](https://cloud.ibm.com/docs/get-support?topic=get-support-using-avatar) by opening a support case. Make sure to provide the cluster ID, the user ID, and the service instance ID.



1. Retrieve the cluster ID.

ibmcloud oc cluster ls
2. Retrieve the service instance ID.

ibmcloud service show <service_name> --guid
To help you quickly find the product that you're looking for, you can now filter the products to view services only, software only, or professional services only. For more information, see [IBM Cloud catalog](https://cloud.ibm.com/docs/overview?topic=overview-whatis-platformcatalog).







 July 2021 



 27 July 2021 

Assigning access to federated users and compute resources by using trusted profiles
: You can use trusted profiles to automatically grant federated users in your account access to resources with conditions based on SAML attributes from your corporate directory. You can also use trusted profiles to manage the authorization of applications that are running in compute resources, such as IBM Cloud Kubernetes Service, to access other IBM Cloud services without the need for service IDs or API keys. For more information, see [Creating trusted profiles](https://cloud.ibm.com/docs/account?topic=account-create-trusted-profilefederated-users-steps).





 15 July 2021 

Scoping support cases to what matters to you
: When you create a case in the IBM Cloud Support Center, you now have options to narrow the subject of your case to a specific topic that's most closely related to the issue you're experiencing. As a result, you can ensure that your support case gets routed to the appropriate support engineer and resolved as efficiently as possible. For more information, see [Creating support cases](https://cloud.ibm.com/docs/get-support?topic=get-support-open-casecreating-support-case).





 14 July 2021 

Delivering notifications by using Slack webhooks
: In addition to generic webhooks, you can now add Slack webhooks to your distribution list and receive account-wide IBM Cloud notifications through them. To create a webhook, you need to set up an app in Slack and a unique URL. With this new webhook integration, you can easily receive the notifications in a selected Slack channel in which you installed your app.
Administrator Create, delete, update a software instance<br><br>View the details page for the software instance<br><br>View the logs for the software instance<br><br>Assign IAM permissions 







 Support center 

You can give users access to manage support cases.



Table 19. Roles and example actions for the Support Center service

 Roles Actions 

 Viewer View cases<br><br>Search cases 
 Operator Not applicable 
 Editor View cases<br><br>Search cases<br><br>Update cases<br><br>Create cases 
 Administrator View cases<br><br>Search cases<br><br>Update cases<br><br>Create cases 



Assign users the viewer role on the user management service in addition to a support center access policy so the user can see all cases in the account regardless of user list visibility settings. If the user list visibility is set to be restricted, this can limit a user's ability to view, search, and manage support cases in an account that they didn't open themselves.





 User management 

You can give users access to view users in an account, invite and remove users, and view and update user profile settings.



Table 20. Roles and example actions for the User Management service

 Roles Actions 

 Viewer View users in the account<br><br>View user profile settings 
 Operator View users in the account<br><br>View user profile settings 
 Editor View, invite, remove, and update users from the account<br><br>View and update user profile settings 
 Administrator View, invite, remove, and update users from the account<br><br>View and update user profile settings 



The viewer role on the user management service is a role that is commonly assigned for users assigned a role to view or manage support cases. If an account owner restricts the visibility of the user list in the IAM settings, users can't see support cases that are opened by other users in the account. However, if they are assigned the viewer role for the user management service, the user list visibility setting doesn't affect the ability to view cases in the account.





 Activity Tracker Event Routing 

You can give users access to run platform actions.



Table 21.