vania-janet/multiturn-rag-retrieval-data huggingface dataset:
5.3.2 Ensure that all Namespaces have Network Policies defined Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-benchmark-remediations-126) Shared 







 5.4 Secrets management 



Section 5.4 Secrets management benchmark results

 Section Recommendation Scored? Level Result Responsibility 

 5.4.1 Prefer using secrets as files over secrets as environment variables Not Scored 1 Pass Shared 
 5.4.2 Consider external secret storage Not Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-benchmark-remediations-126) Shared 







 5.5 Extensible admission control 



Section 5.5 Extensible admission control benchmark results

 Section Recommendation Scored? Level Result Responsibility 

 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller Not Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-benchmark-remediations-126) Shared 







 5.6 General policies 



Section 5.6 General policies benchmark results

 Section Recommendation Scored? Level Result Responsibility 

 5.6.1 Create administrative boundaries between resources using namespaces Not Scored 1 Pass Shared 
 5.6.2 Ensure that the seccomp profile is set to docker/default in your pod definitions Not Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-benchmark-remediations-126) Shared 
 5.6.3 Apply Security Context to Your Pods and Containers Not Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-benchmark-remediations-126) Shared 
 5.6.4 The default namespace should not be used Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-benchmark-remediations-126) Shared
Remove subnets that you previously added to the allowlist for a cluster's private cloud service endpoint.

After a subnet is removed, any requests that originate from this subnet to the cluster master through the private cloud service endpoint are denied.

ibmcloud oc cluster master private-service-endpoint allowlist rm --cluster CLUSTER --subnet SUBNET [--subnet SUBNET ...] [-q]

Minimum required permissions
: Editor platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

--subnet SUBNET
: Required: The subnet CIDR. Specify more than one subnet by using multiple repeated options.

-f
: Optional: Force the command to run without user prompts.

-q
: Optional: Do not show the message of the day or update reminders.



 Example cluster master private-service-endpoint allowlist rm command 

ibmcloud oc cluster master private-service-endpoint allowlist rm --cluster mycluster
--subnet 1.1.1.1/16









 ibmcloud oc cluster master private-service-endpoint disable 

Classic infrastructure

Version 3.11 only: Disable the [private cloud service endpoint](https://cloud.ibm.com/docs/openshift?topic=openshift-plan_basicsworkeruser-master) to remove private accessibility to your cluster master.

Important: Before you disable the private endpoint, you first must complete the following steps to enable the public cloud service endpoint:



1. Enable the public cloud service endpoint by running ibmcloud oc cluster master public-service-endpoint enable --cluster <cluster_name>.
2. Follow the prompt in the CLI to refresh the Kubernetes master API server.
3. [Reload all the worker nodes in your cluster to pick up the public endpoint configuration.]
Change log for master fix pack 3.11.306_1573_openshift, released 16 November 2020 

The following table shows the changes that are in the master fix pack patch update 3.11.306_1573_openshift. Master patch updates are applied automatically.



Changes since version 3.11.286_1570_openshift

 Component Previous Current Description 

 Cluster health image v1.1.12 v1.1.13 Updated image for [DLA-2424-1](https://www.debian.org/lts/security/2020/dla-2424). 
 IBM Cloud Controller Manager v1.15.12-343 v1.15.12-404 Updated image for [DLA-2424-1](https://www.debian.org/lts/security/2020/dla-2424). 
 IBM Cloud File Storage for Classic plug-in and monitor 378 379 Updated to use the universal base image (UBI) and to use Go version 1.15.2. 
 Key Management Service provider v1.0.3 v1.0.4 Updated image for [DLA-2424-1](https://www.debian.org/lts/security/2020/dla-2424). 
 Red Hat OpenShift 3.11.286 3.11.306 See the [Red Hat OpenShift release notes](https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.htmlocp-3-11-306). 







 Change log for worker node fix pack 3.11.306_1572_openshift, released 9 November 2020 

The following table shows the changes that are in the worker node fix pack update 3.11.306_1572_openshift. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 3.11.306_1571_openshift

 Component Previous Current Description
Change log for master fix pack 4.3.40_1546_openshift, released 16 November 2020 

The following table shows the changes that are in the master fix pack patch update 4.3.40_1546_openshift. Master patch updates are applied automatically.



Changes since version 4.3.38_1544_openshift

 Component Previous Current Description 

 Cluster health image v1.1.12 v1.1.13 Updated image for [DLA-2424-1](https://www.debian.org/lts/security/2020/dla-2424). 
 IBM Cloud Controller Manager v1.17.13-1 v1.17.14-1 Updated to support the Kubernetes 1.17.14 release. Updated image for [DLA-2424-1](https://www.debian.org/lts/security/2020/dla-2424). 
 IBM Cloud File Storage for Classic plug-in and monitor 378 379 Updated to use the universal base image (UBI) and to use Go version 1.15.2.
Change log for master fix pack 4.4.29_1525_openshift, released 16 November 2020 

The following table shows the changes that are in the master fix pack patch update 4.4.29_1525_openshift. Master patch updates are applied automatically.



Changes since version 4.4.27_1523_openshift

 Component Previous Current Description 

 Cluster health image v1.1.12 v1.1.13 Updated image for [DLA-2424-1](https://www.debian.org/lts/security/2020/dla-2424). 
 IBM Cloud Controller Manager v1.17.13-1 v1.17.14-1 Updated to support the Kubernetes 1.17.14 release. Updated image for [DLA-2424-1](https://www.debian.org/lts/security/2020/dla-2424). 
 IBM Cloud File Storage for Classic plug-in and monitor 378 379 Updated to use the universal base image (UBI) and to use Go version 1.15.2.
Change log for master fix pack 1.19.15_1560, released 28 September 2021 

The following table shows the changes that are in the master fix pack patch update 1.19.15_1560. Master patch updates are applied automatically.



Changes since version 1.19.14_1557

 Component Previous Current Description 

 Calico N/A N/A Increased liveness and readiness probe timeouts to 10 seconds. 
 Gateway-enabled cluster controller 1444 1510 Updated image for [CVE-2021-3711](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3711) and [CVE-2021-3712](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3712). 
 GPU device plug-in and installer a9461a8 eb817b2 Updated to use Go version 1.16.7. 
 IBM Cloud Controller Manager v1.19.14-1 v1.19.15-1 Updated to support the Kubernetes 1.19.15 release. Fixed a bug that may cause node initialization to fail when a new node reuses the name of a deleted node. 
 IBM Cloud RBAC Operator 945df65 e3cb629 Updated to use Go version 1.16.7. 
 IBM Cloud File Storage for Classic plug-in and monitor 398 400 Updated to use Go version 1.16.7. Updated universal base image (UBI) to the latest 8.4-208 version to resolve CVEs. 
 Kubernetes v1.19.14 v1.19.15 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.19.15). 
 Kubernetes API server auditing configuration N/A N/A Updated to support verbose[Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server).
To check your auto update settings, run the ibmcloud ks ingress alb autoupdate get command.<br> * ALB OAuth-Proxy add-on: networking.k8s.io/v1beta1 is compatible with ALB OAuth-Proxy add-on version 2.0.0 only. If you use the ALB OAuth-Proxy add-on you must update the add-on to version 2.0.0 before updating your cluster to 1.22.<br><br><br> 
 Unsupported: Service service.alpha.kubernetes.io/tolerate-unready-endpoints annotation Services no longer support the service.alpha.kubernetes.io/tolerate-unready-endpoints annotation. The annotation has been deprecated since Kubernetes version 1.11 and has been replaced by the spec.publishNotReadyAddresses field. If your services rely on this annotation, update them to use the spec.publishNotReadyAddresses field instead. For more information on this field, see [DNS for Services and Pods](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/). 







 Update after master 

The following table shows the actions that you must take after you update the Kubernetes master.



Changes to make after you update the master to Kubernetes 1.22

 Type Description 

 Endpoint Security Mitigation Kubernetes cluster role system:aggregate-to-edit has removed endpoints permissions as a security mitigation for [CVE-2021-25740](https://nvd.nist.gov/vuln/detail/CVE-2021-25740). If your cluster does not require any customizations to the system:aggregate-to-edit cluster role, besides removing the endpoints permission, allow Kubernetes to reconcile the permissions by running the kubectl annotate --overwrite clusterrole/system:aggregate-to-edit rbac.authorization.kubernetes.io/autoupdate=true command.
Change log for master fix pack 3.11.346_1578_openshift, released 19 January 2021 

The following table shows the changes that are in the master fix pack patch update 3.11.346_1578_openshift. Master patch updates are applied automatically.



Changes since version 3.11.346_1577_openshift

 Component Previous Current Description 

 Cluster health image v1.1.13 v1.1.16 Updated image to implement additional IBM security controls. 
 IBM Cloud File Storage for Classic plug-in and monitor 384 385 Updated image for [CVE-2020-1971](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1971) and [CVE-2020-24659](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24659). 
 Key Management Service provider v1.0.5 v1.0.7 Fixed bug to ignore conflict errors during KMS secret re-encryption. Updated to use Go version 1.15.5. Updated image for [CVE-2020-1971](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1971). 
 Load balancer and load balancer monitor for IBM Cloud Provider 1004 1078 Updated image for [CVE-2020-1971](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1971). 







 Change log for worker node fix pack 3.11.346_1578_openshift, released 18 January 2021 

The following table shows the changes that are in the worker node fix pack 3.11.346_1578_openshift. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 3.11.346_1576_openshift

 Component Previous Current Description
Change log for master fix pack 4.12.16_1545_openshift, released 25 May 2023 

The following table shows the changes that are in the master fix pack 4.12.16_1545_openshift. Master patch updates are applied automatically.



Changes since version 4.12.13_1541_openshift

 Component Previous Current Description 

 Cluster health image v1.3.19 v1.3.20 Updated Go to version 1.19.9 and updated dependencies. Updated the base image. Resolved add-on health bugs. 
 IBM Cloud Controller Manager v1.25.9-2 v1.25.9-7 Updated support of the Kubernetes 1.25.9 release. Updated Go dependencies. Key rotation. 
 Key Management Service provider v2.6.5 v2.6.6 Updated Go to version 1.19.9 and updated dependencies. 
 OpenVPN client 2.6.4-r0-IKS-27 2.5.8-r0-IKS-674 Reverted to previous version. 
 OpenVPN server 2.6.4-r0-IKS-26 2.5.8-r0-IKS-673 Reverted to previous version. 
 Portieris admission controller v0.13.4 v0.13.5 See the [Portieris admission controller release notes](https://github.com/IBM/portieris/releases/tag/v0.13.5). 
 Red Hat OpenShift on IBM Cloud. 4.12.13 4.12.16 For more information, see the [change log](https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.htmlocp-4-12-16). 







 Change log for worker node fix pack 4.12.16_1544_openshift, released 23 May 2023 

The following table shows the changes that are in the worker node fix pack 4.12.16_1544_openshift.
After you complete these steps, your authorized cluster users can access the Kubernetes master from a VPN or IBM Cloud Direct Link connection.

IBM Cloud® Direct Link
: Added IBM Cloud Direct Link to the [VPN connectivity](https://cloud.ibm.com/docs/containers?topic=containers-vpn) page as a way to create a direct, private connection between your remote network environments and IBM Cloud Kubernetes Service without routing over the public internet.

Ingress ALB change log
: Updated the [ALB ingress-auth image to build 330](https://cloud.ibm.com/docs/containers?topic=containers-cluster-add-ons-changelogkube_ingress_changelog).





 6 June 2019 

Fluentd change log
: Added a [Fluentd version change log](https://cloud.ibm.com/docs/containers?topic=containers-cluster-add-ons-changelogfluentd_changelog).

Ingress ALB change log
: Updated the [ALB nginx-ingress image to build 470](https://cloud.ibm.com/docs/containers?topic=containers-cluster-add-ons-changelogkube_ingress_changelog).





 5 June 2019 

CLI reference
: Updated the [CLI reference page](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-cli) to reflect multiple changes for the release of version [0.3.34](https://cloud.ibm.com/docs/containers?topic=containers-cs_cli_changelog) of the IBM Cloud Kubernetes Service CLI plug-in.





 4 June 2019 

Version change logs
: Master fix pack update change log documentation is available for version [4.5.24_1527_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-changelog_archive4524_1527), [4.4.31_1531_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-changelog_archive4431_1531), [4.3.40_1552_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-changelog_archive4340_1552), and [3.11.346_1578_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_changelog_311311346_1578_master).





 18 January 2021 

Knative add-on is unsupported
: The Knative add-on is automatically removed from your cluster. Instead, use the [Knative open source project](https://knative.dev/docs/install/) or [IBM Cloud® Code Engine](https://cloud.ibm.com/docs/codeengine?topic=codeengine-getting-started), which includes Knative's open-source capabilities.

Worker node versions
IBM Support might identify other issues in your cluster that you must fix before the master can be updated. 









 Disabling remote health reporting 

OpenShift Container Platform collects anonymized health reports about your cluster through a [telemetry component that is enabled by default](https://docs.openshift.com/container-platform/4.11/support/remote_health_monitoring/about-remote-health-monitoring.html) in your Red Hat OpenShift on IBM Cloud cluster.

You might want to disable this remote health reporting to comply with privacy laws, organizational standards, or data governance practices. To disable, you must modify the global configuration for the cluster and reload all the worker nodes.



1. Check that the telemetry reporting pod runs in your cluster.

oc get pods -n openshift-monitoring

Example output

NAME READY STATUS RESTARTS AGE
telemeter-client-7cfd7cb85-lm9dt 3/3 Running 0 4d13h
...
2. Follow the Red Hat OpenShift instructions to [update the global pull secret in the cluster to disable remote health reporting](https://docs.openshift.com/container-platform/4.11/support/remote_health_monitoring/opting-out-of-remote-health-reporting.html).
3. To pick up the global configuration changes, reload all the worker nodes in your cluster.



1. Note the ID of the worker nodes in your cluster.

ibmcloud oc worker ls -c <cluster_name_or_ID>
2. Reload each worker node. You can reload multiple worker nodes by including multiple -w options, but make sure to leave enough worker nodes running at the same time for your apps to avoid an outage.

ibmcloud oc worker reload -c <cluster_name_or_ID> -w <workerID_1> -w <workerID_2>



4. After the worker nodes are back in a healthy state, verify that the telemetry reporting pod no longer runs in your cluster.

oc get pods -n openshift-monitoring
ibmcloud oc cluster master private-service-endpoint allowlist disable --cluster CLUSTER [-f] [-q]

Minimum required permissions
: Editor platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

-f
: Optional: Force the command to run without user prompts.

-q
: Optional: Do not show the message of the day or update reminders.



 Example cluster master private-service-endpoint allowlist disable command 

ibmcloud oc cluster master private-service-endpoint allowlist disable --cluster mycluster







 ibmcloud oc cluster master private-service-endpoint allowlist enable 

Virtual Private Cloud

Classic infrastructure

Enable the subnet allowlist feature for a cluster's private cloud service endpoint.

After you run this command, use the [ibmcloud oc cluster master private-service-endpoint allowlist command](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_master_pse_allowlist_add) to add subnets to the allowlist. Only authorized requests to your cluster master that originate from subnets in the allowlist are permitted through the cluster's private cloud service endpoint. If the public cloud service endpoint is enabled for your cluster, authorized requests are still permitted through the public cloud service endpoint.

ibmcloud oc cluster master private-service-endpoint allowlist enable --cluster CLUSTER [-f] [-q]

Minimum required permissions
: Editor platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

-f
: Optional: Force the command to run without user prompts.

-q
: Optional: Do not show the message of the day or update reminders.



 Example cluster master private-service-endpoint allowlist enable command
Using the following install-config.yaml file shown in the figure, update it using your deployment details from the [previous table](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-openshift-runbook-runbook-install-introopenshift-runbook-runbook-install-yaml-table):



1. Update the base domain name.
2. Update the metadata name with the Red Hat OpenShift cluster name.
3. Provide the following vCenter Server information:



* vCenter IP address
* vCenter username and password
* Datacenter name
* Datastore name



4. Paste the Pull Secret.
5. Paste the SSH key.
6. The following figure shows the install-config.yaml file. Copy the file to the clipboard.



apiVersion: v1
baseDomain: acmeskb.net
compute:
- hyperthreading: Enabled
name: worker
replicas: 0
controlPlane:
hyperthreading: Enabled
name: master
replicas: 3
metadata:
name: ocp
platform:
vsphere:
vcenter: 10.208.17.2
username: administrator@vsphere.local
password: 's3cretPassw0rd'
datacenter: datacenter1
defaultDatastore: vsanDatastore
pullSecret: 'COPY PULL SECRET HERE'
sshKey: 'COPY PUBLIC SSH KEY HERE'
Show more

In the SSH session to the bastion node with root privileges, use the following commands to create the install-config.yaml file:

cd /opt/ocpinstall
vi install-config.yaml

Type i to enter insert mode, paste the file contents. Press Esc, then type :wq to save the file and exit the vi editor.

The Red Hat OpenShift Installer deletes this file so to keep a copy use the following command:
: Master fix pack update change log documentation is available for version [1.21.2_1522](https://cloud.ibm.com/docs/containers?topic=containers-changelog_1211212_1522), [1.20.8_1544](https://cloud.ibm.com/docs/containers?topic=containers-changelog_1201208_1544), [1.19.12_1551](https://cloud.ibm.com/docs/containers?topic=containers-changelog_11911912_1551), [1.18.20_1556](https://cloud.ibm.com/docs/containers?topic=containers-118_changelog11820_1556), and [1.17.17_1567](https://cloud.ibm.com/docs/containers?topic=containers-117_changelog11717_1567).





 24 June 2021 

CLI change log
: Updated the IBM Cloud Kubernetes Service CLI plug-in change log page for the [release of version 1.0.295](https://cloud.ibm.com/docs/containers?topic=containers-cs_cli_changelog10).





 23 June 2021 

Cluster autoscaler add-on
: [Version 1.0.3](https://cloud.ibm.com/docs/containers?topic=containers-ca_changelog) of the cluster autoscaler add-on is available.





 22 June 2021 

IBM Cloud Object Storage plug-in
: Version 2.1.2 of the IBM Cloud Object Storage plug-in is released. Update your clusters to use the latest version. For more information, see the [IBM Cloud Object Storage plug-in change log](https://cloud.ibm.com/docs/containers?topic=containers-cos_plugin_changelog).

Worker node versions
The following table shows the changes that are in the master fix pack patch update 1.18.12_1533. Master patch updates are applied automatically.



Changes since version 1.18.10_1531

 Component Previous Current Description 

 Cluster health image v1.1.12 v1.1.13 Updated image for [DLA-2424-1](https://www.debian.org/lts/security/2020/dla-2424). 
 GPU device plug-in and installer 0c07674 b966c41 Updated image for [CVE-2019-20386](https://nvd.nist.gov/vuln/detail/CVE-2019-20386), [CVE-2019-13050](https://nvd.nist.gov/vuln/detail/CVE-2019-13050), [CVE-2020-8177](https://nvd.nist.gov/vuln/detail/CVE-2020-8177), [CVE-2019-14889](https://nvd.nist.gov/vuln/detail/CVE-2019-14889), [CVE-2020-1730](https://nvd.nist.gov/vuln/detail/CVE-2020-1730), [CVE-2020-10029](https://nvd.nist.gov/vuln/detail/CVE-2020-10029), [CVE-2020-1751
Change log for master fix pack 1.15.2_1514, released 17 August 2019 

The following table shows the changes that are in the master fix pack 1.15.2_1514.



Table 1. Changes since version 1.15.1_1513

 Component Previous Current Description 

 Key Management Service provider 167 207 Fixed an issue that causes the Kubernetes [key management service (KMS) provider](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkeyprotect) to fail to manage Kubernetes secrets. 







 Change log for master fix pack 1.15.2_1513, released 15 August 2019 

The following table shows the changes that are in the master fix pack 1.15.2_1513.



Table 1. Changes since version 1.15.1_1511

 Component Previous Current Description 

 Calico configuration N/A N/A Calico calico-kube-controllers deployment in the kube-system namespace sets a memory limit on the calico-kube-controllers container. In addition, the calico-node deployment in the kube-system namespace no longer includes the flexvol-driverinit container. 
 Cluster health N/A N/A Cluster health shows Warning state if a cluster control plane operation failed or was canceled. For more information, see (/docs/containers?topic=containers-debug_clusters">Debugging clusters]. 
 GPU device plug-in and installer d91d200 07c9b67 Image updated for [CVE-2019-14697](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14697). 
 IBM Cloud Provider v1.15.1-86 v1.15.2-94 Updated to support the Kubernetes 1.15.2 release. 
 IBM Cloud File Storage for Classic plug-in 347 348 Image updated for [CVE-2019-14697](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14697).