vania-janet/multiturn-rag-retrieval-data huggingface dataset:
: Updated the Red Hat OpenShift on IBM Cloud CLI plug-in change log page for the [release of version 1.0.84](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_cli_changelog10).

Image pull secrets
: Now, the default-icr-io and default-<region>-icr-io image pull secrets in the default project are replaced by a single all-icr-io image pull secret that has credentials to all the public and private regional registry domains. Clusters that run Red Hat OpenShift 3.11 still have the previous default-<region>-icr-io image pull secrets for backwards compatibility.

Ingress status
: Added information about [health reporting for your Ingress components](https://cloud.ibm.com/docs/openshift?topic=openshift-ingress-status).

Tuning Calico
: Added information about [tuning Calico parameters](https://cloud.ibm.com/docs/openshift?topic=openshift-kernel) to match the network throughput of your cluster environment.

Version change logs
: Master and worker node change log documentation is available.
: Red Hat OpenShift [4.3.21_1523_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-changelog_archive4321_1523) for worker nodes, [4.3.19_1523_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-changelog_archive4319_1523) for masters, and [3.11.216_1551_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_changelog_311311216_1551).





 20 May 2020 

New! Virtual Private Cloud Generation 2
Why can't the ownership of the mount path be changed? 

Virtual Private Cloud

Classic infrastructure

This troubleshooting topic applies only to Red Hat OpenShift clusters that run version 3.11.

  What’s happening 

You created a deployment that mounts an IBM Cloud Object Storage bucket to your app. During the deployment, you try to change the ownership of the volume mount path, but this action fails. You see error messages similar to the following:

chown: changing ownership of '<volume_mount_path>': Input/output error
chown: changing ownership of '<volume_mount_path>': Operation not permitted

  Why it’s happening 

When you create a bucket in IBM Cloud Object Storage, the bucket is managed by s3fs-fuse. The UID and GID that own the volume mount path are automatically set by Fuse when you mount the bucket to your app and can't be changed.

  How to fix it 

You can't change the ownership of the volume mount path. However, you can change the UID and GID for a file or a directory that is stored under your volume mount path. For more information, see [Object storage: Accessing files with a non-root user fails](https://cloud.ibm.com/docs/openshift?topic=openshift-cos_nonroot_access).
Red Hat OpenShift target_roks
VMware vCenter Server target_vcenter
Virtual private cloud target_vpc-x86
Power Systems Virtual Server target_power-iaas

Provider ID
Third party ibm_third_party
Community ibm_community
IBM ibm_created

Works with ID
SAP Certified sap_certified
Quantum Technologies quantum_tech
Satellite Enabled satellite_enabled
HPC hpc

Delivery method ID
Cloud Paks cloud_pak
Helm charts helm
Operators operator
OVA Images ova
Starter kits template
Terraform terraform
Server Images vsi_image
Blueprint blueprint
Toolchains toolchain

Compliance ID
EU Supported eu_access
Financial Services Validated fs_ready
HIPAA Enabled hipaa
IAM-enabled rc_compatible
Service Endpoint Supported service_endpoint_supported

Release ID
Beta ibm_beta
Deprecated ibm_deprecated

Support ID
Third party supported support_third_party
Community supported support_community
IBM supported support_ibm

Category ID Tags
Compute compute compute,compute_classic,content,openwhisk,runtime,virtualservers,compute_baremetal
Containers containers containers,clusters,registry
Networking network network,network_vpc,network_classic,network_edge,network_interconnectivity
Storage storage storage,storage_vpc,storage_classic,storage_datamovement
Converged infrastructure converged_infra converged_infra
Enterprise applications enterprise_app enterprise_app
AI / Machine Learning ai watson,ai
Analytics analytics data_analytics,business_analytics,analytics
Blockchain blockchain blockchain
Databases databases data_management,database
Developer tools devops dev_ops
Logging and monitoring logging_monitoring logging_monitoring
Migration migration_tools migration_tools
Integration integration integration,api
Internet of Things iot internet_of_things
Security security security
Mobile mobile mobile,web_and_app







 ibmcloud catalog offering create 

Run the following command to add a product to a private catalog in the account.
* Deploy your application on your own choice of infrastructure, such as Virtual Server Instances (VSI).
* Perform custom tasks, such as updating some configurations in a Red Hat® OpenShift® cluster.



In these cases, select "custom" as a deployment target.



 Performing a custom deployment 



* DevSecOps templates are fully customizable. You can provide your own stages and steps in the pipeline-config.yml file of the deployment repository.
* You can provide your custom scripts in the setup, deploy, and acceptance-test stages in the pipeline-config.yml file.
* These scripts are run during the continuous deployment (CD) pipeline run.
Red Hat OpenShift on IBM Cloud 99.999% [Understanding high availability and disaster recovery for Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-ha) 
 IBM Cloud Code Engine 99.999% [High availability and disaster recovery for Code Engine](https://cloud.ibm.com/docs/codeengine?topic=codeengine-ha-dr) 







 Networking services 

The following table describes the service level objectives (SLOs) for the high impact IBM Cloud networking services in a high availability configuration.



Table 10. Service level objectives (SLOs) for the IBM Cloud networking services

 Networking service Availability target High availability guidance 

 IBM Cloud DNS Services 99.999% [Understanding high availability and disaster recovery for DNS Services](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-ha-dr) 
 IBM Cloud Transit Gateway 99.999% [High availability and disaster recovery](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-ha-dr) 
 IBM Cloud Internet Services 99.999% [Use Virtual Servers to build highly available and scalable web app](https://cloud.ibm.com/docs/cloud-infrastructure?topic=solution-tutorials-highly-available-and-scalable-web-application) 
 IBM Cloud Direct Link 99.999% [High Availability and disaster recovery for Direct Link](https://cloud.ibm.com/docs/dl?topic=dl-ha-dr) 
 Flow Logs for VPC 99.999% [About IBM Cloud Flow Logs for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-flow-logs) 







 AI/Machine Learning services 

The following table describes the service level objectives (SLOs) for the high impact IBM Cloud AI or machine learning services in a high availability configuration.



Table 11. Service level objectives (SLOs) for the IBM Cloud AI/machine learning services

 AI/Machine Learning service Availability target High availability guidance
For information on accessing your Red Hat OpenShift on IBM Cloud cluster via the tools above, see accessing [Red Hat OpenShift clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-access_clusteraccess_oc_cl).





 Step 9: Remove SSH port from security group and access control list 

Now that Teleport is installed and setup, remove SSH port 22 from the allowed list of ports within the configured security group and access control list that is assigned to the virtual server and subnet.





 Related controls in IBM Cloud Framework for Financial Services 

See the [related controls for bastion host](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-bastionnext-steps).
Virtual Private Cloud

Classic infrastructure

Use the public or private cloud service endpoint to send metrics from your cluster to your Monitoring service instance.

To use the private cloud service endpoint, your cluster must be enabled for using private cloud service endpoints. Red Hat OpenShift on IBM Cloud clusters that run version 4 don't support private cloud service endpoints. You must use a cluster that runs version 3.11 to use this option.

ibmcloud ob monitoring config enable public-endpoint|private-endpoint --cluster CLUSTER --instance MONITORING_INSTANCE

Minimum required permissions:



* Administrator platform access role and Manager service access role for all Kubernetes namespaces in IBM Cloud Kubernetes Service
* Editor platform access role and Manager server access role for IBM Cloud Monitoring



Command options:

public-endpoint|private-endpoint
: Enter public-endpoint to use the public cloud service endpoint of your IBM Cloud Monitoring service instance, or private-endpoint to use the private cloud service endpoint to send metrics from your cluster. This value is required. To use the private cloud service endpoint, your cluster must be enabled for using private cloud service endpoints. Red Hat OpenShift on IBM Cloud clusters that run version 4 don't support private cloud service endpoints. You must use a cluster that runs version 3.11 to use this option.

--cluster CLUSTER
: The name or ID of the cluster for which you want to enable the private or public cloud service endpoint to connect to your Monitoring service instance. To retrieve your cluster name or ID, run ibmcloud oc clusters. This value is required.

--instance MONITORING_INSTANCE
: The ID or name of the IBM Cloud Monitoring service instance to which you want to connect by using the public or private cloud service endpoint. To retrieve the name, run ibmcloud resource service-instances. This value is required.





 ibmcloud ob monitoring config replace 

Virtual Private Cloud

Classic infrastructure

Replace the IBM Cloud Monitoring service instance or service access key that you use in your Monitoring configuration.

Replace the service access key of an existing IBM Cloud Monitoring service instance:
* Red Hat OpenShift Do CLI (odo)
* Redis CLI (redis-cli)
* SoftLayer CLI (slcli)
* Terraform CLI (terraform) and IBM Cloud Provider plug-in for Terraform (ibmcloud terraform)
* tmux terminal multiplexer (tmux)
* UnZip extraction utility (unzip)
* Vim text editor (vim)
* XZ Utils (xz, xzcat, xzcmp, xzdiff, xzegrep, xzfgrep, xzgrep, xzless, xzmore)
* Yarn package manager (yarn)
* yq YAML processor (yq)
* Zip archive utility (zip)
* Simple Python Version Management (pyenv)







 Packages and libraries 



* apt-transport-https
* bash-completion
* build-essential
* ca-certificates
* cron
* dnsutils
* gettext
* inetutils-ping
* libevent-dev
* libncurses5-dev
* locales
* musl
* net-tools
* pkg-config
* powerline-shell
* Python requests
* python-virtualenv
* python-setuptools
* python-pip
* python3-pip
* ruby-dev
* silversearcher-ag
* software-properties-common
* zlib1g-dev
Before you begin [Access your Red Hat OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-access_cluster).

To change the VLANs that a worker pool uses to provision worker nodes.



1. List the names of the worker pools in your cluster.

ibmcloud oc worker-pool ls --cluster <cluster_name_or_ID>
2. Determine the zones for one of the worker pools. In the output, look for the Zones field.

ibmcloud oc worker-pool get --cluster <cluster_name_or_ID> --worker-pool <pool_name>
3. For each zone that you found in the previous step, get an available public and private VLAN that are compatible with each other.



1. Check the available public and private VLANs that are listed under Type in the output.

ibmcloud oc vlan ls --zone <zone>
2. Check that the public and private VLANs in the zone are compatible. To be compatible, the Router must have the same pod ID. In this example output, the Router pod IDs match: 01a and 01a. If one pod ID was 01a and the other was 02a, you can't set these public and private VLAN IDs for your worker pool.

ID Name Number Type Router Supports Virtual Workers
229xxxx 1234 private bcr01a.dal12 true
229xxxx 5678 public fcr01a.dal12 true
3. If you need to order a new public or private VLAN for the zone, you can order in the [IBM Cloud console](https://cloud.ibm.com/docs/vlans?topic=vlans-ordering-premium-vlansordering-premium-vlans), or use the following command. Remember that the VLANs must be compatible, with matching Router pod IDs as in the previous step. If you are creating a pair of new public and private VLANs, they must be compatible with each other.
Platform logs generated from Red Hat OpenShift on IBM Cloud and virtual server instances can be collected by using your own software solution or by using the previously mentioned solution for [Setting up an operational logging solution](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-logging-operational-tutorial).





 Other IBM Cloud services 

There is not a Financial Services Validated solution for capturing operational platform logs from other IBM Cloud services. These are usually collected by [sending them to IBM Cloud Log Analysis](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-cloud_services). However, if seeking the Financial Services Validated designation, you should not send platform logs to IBM Cloud Log Analysis.







 Related controls in IBM Cloud Framework for Financial Services 

The following [IBM Cloud Framework for Financial Services controls](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-aboutframework-control-requirements) are most related to this guidance. However, in addition to following the guidance here, do your own due diligence to ensure you meet the requirements.



Table 1. Related controls in IBM Cloud Framework for Financial Services

 Family Control 

 Contingency Planning (CP) [CP-2 (3) Contingency Plan | Resume Essential Missions / Business Functions](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-2.3) <br>[CP-6 Alternate Storage Site](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-6) <br>[CP-7 Alternate Processing Site](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-7) <br>[CP-10 Information System Recovery and Reconstitution](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-10)
* [Configure the Red Hat OpenShift on IBM Cloud monitoring stack](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-monitoring-operational-tutorialstep3-configure-monitoring-stack)
* [Configure monitoring for a user-defined Red Hat OpenShift on IBM Cloud project](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-monitoring-operational-tutorialstep4-configure-monitoring-user-defined-project)
* [Step 5: Configure monitoring for a virtual server instance](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-monitoring-operational-tutorialstep5-configure-monitoring-virtual-server-instance)



* [Linux](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-monitoring-operational-tutorialstep5-configure-monitoring-virtual-server-instance-linux)
* [Windows](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-monitoring-operational-tutorialstep5-configure-monitoring-virtual-server-instance-windows)
* [Custom endpoint for exposing-metrics](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-monitoring-operational-tutorialstep5-configure-monitoring-virtual-server-instance-custom-endpoint)



* [Set up a custom Grafana dashboard](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-monitoring-operational-tutorialstep6-set-up-a-custom-grafana-dashboard)
<br><br> * [Entrust CloudControl on IBM Cloud overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-entrust-cc_considerations)<br> * Entrust official website: [Entrust DataControl for IBM Cloud](https://www.entrust.com/digital-security/multi-cloud-encryption/datacontrol-ibm-cloud)<br><br><br> 
 [ Power Systems Virtual Server](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-getting-started) Power Systems Virtual Server is a Power Systems offering. You can use Power Systems Virtual Server to integrate with Hyper Protect Crypto Services to securely store and protect encryption key information for AIX and Linux. [Integrating Power Systems Virtual Server with Hyper Protect Crypto Services](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-integrate-hpcs) 







 Container service integrations 

By integrating with Hyper Protect Crypto Services, you can encrypt the Kubernetes secrets and etcd component of your Kubernetes master with your own root keys that are managed in Hyper Protect Crypto Services.



Table 4. Supported container services

 Service Description Integration instruction 

 [IBM Cloud Kubernetes Service](https://cloud.ibm.com/docs/containers) IBM Cloud Kubernetes Service is a managed offering that is built for creating a Kubernetes cluster of compute hosts to deploy and manage containerized applications on IBM Cloud. [Encrypting the Kubernetes master's local disk and secrets by using a KMS provider](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkeyprotect) 
 [Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift) Red Hat OpenShift on IBM Cloud is a managed offering to create your own Red Hat OpenShift on IBM Cloud cluster of compute hosts to deploy and manage containerized apps on IBM Cloud.
Apps and container platform You can choose to create [community Kubernetes or Red Hat OpenShift clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-faqscontainer_platforms) to manage your containerized apps. Your app build processes don't differ because of the infrastructure provider, but how you expose the app does. For more information, see [Choosing an app exposure service](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_network_planning). 
 App networking All pods that are deployed to a worker node are assigned a private IP address in the 172.30.0.0/16 range and are routed between worker nodes on the worker node private IP address of the private VLAN. To expose the app on the public network, your cluster must have worker nodes on the public VLAN. Then, you can create a NodePort, LoadBalancer (NLB), or Ingress (ALB) service. For more information, see [Planning in-cluster and external networking for apps](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_network_planning). 
 Storage You can choose from non-persistent and persistent storage solutions such as file, block, object, and software-defined storage. For more information, see [Planning highly available persistent storage](https://cloud.ibm.com/docs/openshift?topic=openshift-storage-plan). 
 User access To create classic infrastructure clusters, you must set up [infrastructure credentials](https://cloud.ibm.com/docs/openshift?topic=openshift-access-creds) for each region and resource group. To let users manage the cluster, use [IBM Cloud IAM platform access roles](https://cloud.ibm.com/docs/openshift?topic=openshift-iam-platform-access-roles).
* [Assigning a Bare Metal Server host to your Red Hat OpenShift cluster](https://cloud.ibm.com/docs/satellite?topic=satellite-assign-bare-metalassign-bare-metal-to-cluster)







 Setting up virtualization on a Satellite location 

[Setting up virtualization on a Satellite location](https://cloud.ibm.com/docs/satellite?topic=satellite-virtualization-locationvirtualization-location)



* [Prerequisites](https://cloud.ibm.com/docs/satellite?topic=satellite-virtualization-locationvirt-bare-metal-prereq)
* [Bare Metal Server requirements for Satellite](https://cloud.ibm.com/docs/satellite?topic=satellite-virtualization-locationvirt-setup-bare-metal)
* [Attaching bare metal servers to your location](https://cloud.ibm.com/docs/satellite?topic=satellite-virtualization-locationassign-bm-loc-virt)
* [Assigning a Bare Metal Server host to your Red Hat OpenShift cluster](https://cloud.ibm.com/docs/satellite?topic=satellite-virtualization-locationassign-bare-metal-cluster-virt)
* [Setting up storage for your cluster](https://cloud.ibm.com/docs/satellite?topic=satellite-virtualization-locationvirt-cluster-storage)
* [Installing the virtualization operator](https://cloud.ibm.com/docs/satellite?topic=satellite-virtualization-locationvirt-operator-install)
* [Setting up the virtctl CLI](https://cloud.ibm.com/docs/satellite?topic=satellite-virtualization-locationvirt-tools)
* [Creating a data volume for your virtual machine](https://cloud.ibm.com/docs/satellite?topic=satellite-virtualization-locationvirt-vm-storage)
* Supported: 2.7.9, 2.7.8, 2.7.7, 2.7.6, 2.7.5, 2.7.4, 2.7.3, 2.7.2
* Deprecated: 2.7.1, 2.7.0, 2.6.9, 2.6.8, 2.6.7
* Unsupported: 2.6.6 and earlier



For release dates and change logs for each strongSwan Helm chart version, run helm show readme iks-charts/strongswan and look for the Version History section.

To upgrade your strongSwan Helm chart to the latest version, use the helm upgrade command.

helm upgrade -f config.yaml <release_name> iks-charts/strongswan

You can disable the VPN connection by deleting the Helm chart.

helm uninstall <release_name> -n <namespace>





 Using a Virtual Router Appliance 

The [Virtual Router Appliance (VRA)](https://cloud.ibm.com/docs/virtual-router-appliance?topic=virtual-router-appliance-about-the-vra) provides the latest Vyatta 5600 operating system for x86 bare metal servers. You can use a VRA as VPN gateway to securely connect to an on-premises network.

All public and private network traffic that enters or exits the cluster VLANs is routed through a VRA. You can use the VRA as a VPN endpoint to create an encrypted IPSec tunnel between servers in IBM Cloud infrastructure and on-premises resources. For example, the following diagram shows how an app on a worker node in Red Hat OpenShift on IBM Cloud can communicate with an on-premises server via a VRA VPN connection on the private VLAN:

Zoom

![Expose an app in Red Hat OpenShift on IBM Cloud by using a load balancer.]
If enabled, [Service Mesh](https://docs.openshift.com/container-platform/4.11/service_mesh/v1x/servicemesh-release-notes.html) uses the Multus plug-in.

openshift-network-operator
: The [cluster network operator (CNO)](https://docs.openshift.com/container-platform/4.11/networking/cluster-network-operator.html) manages the cluster network components that are set up by default, such as the CNI pod network provider plug-in and DNS operator.

openshift-operator-lifecycle-manager
: The [operator lifecycle manager (OLM)](https://docs.openshift.com/container-platform/4.11/operators/understanding/olm/olm-understanding-olm.html) manages the lifecycle of all operators and the catalog that run in the cluster, including the operators for the default components and any custom operators that you add.

openshift-service-ca, openshift-service-ca-operator
: The certificate authority (CA) operator runs certificate signing and injects certificates into API server resources and configmaps in the cluster. For more information, see the [GitHub project](https://github.com/openshift/service-ca-operator).







 VPC cluster service architecture 

The following architectural overviews are specific to the VPC infrastructure provider, which is available for clusters that run version 4 only. For an architectural overview for the classic infrastructure provider, see [Classic cluster service architecture](https://cloud.ibm.com/docs/openshift?topic=openshift-service-architectureservice-architecture).

Review the architecture diagrams and then scroll through the following table for a description of master and worker node components in Red Hat OpenShift on IBM Cloud clusters that run version 4 on virtual private cloud (VPC) compute infrastructure.



 Cluster with public and private cloud service endpoints