vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Change log for master fix pack 1.13.12_1546, released 17 December 2019 

The following table shows the changes that are in the master fix pack 1.13.12_1546.



Changes since version 1.13.12_1545

 Component Previous Current Description 

 IBM Cloud File Storage for Classic and monitor 353 354 Updated to support [non-root user access to an NFS file share](https://cloud.ibm.com/docs/containers?topic=containers-cs_storage_nonroot) by allocating a group ID (GID) in the storage class. 
 Key Management Service provider 254 270 Improves performance of secret management by minimizing the number of data encryption keys (DEKs) that are used to unwrap secrets in the cluster. In addition, the IBM Key Protect Go client is updated. 









 Change log for worker node fix pack 1.13.12_1545, released 9 December 2019 

The following table shows the changes that are in the worker node fix pack 1.13.12_1545.



Changes since version 1.13.12_1544

 Component Previous Current Description 

 containerd v1.2.10 v1.2.11 See the [containerd release notes](https://github.com/containerd/containerd/releases/tag/v1.2.11). Update resolves [CVE-2019-17596](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17596). 
 Ubuntu 16.04 kernel and packages 4.4.0-169-generic 4.4.0-170-generic Updated worker node images with kernel and package updates for [CVE-2018-20784](https://nvd.nist.gov/vuln/detail/CVE-2018-20784), [CVE-2019-16168](https://nvd.nist.gov/vuln/detail/CVE-2019-16168), and [CVE-2019-5827](https://nvd.nist.gov/vuln/detail/CVE-2019-5827).
CAs Like peers and ordering nodes, if replica sets are chosen for a CA, an anti-affinity policy automatically distributes the CA replica sets across worker nodes in the cluster, based on resource availability.

This scenario uses redundant peers, ordering nodes, and CA replica sets, across multiple worker nodes in a single cluster or zone, which protects against node failure, but cannot protect from a cluster or zone failure. Therefore, it is not recommended for production.







 Multizone HA 

Zoom

![Blockchain HA single zone options](https://cloud.ibm.com/docs-content/v1/content/c5288bed34c3820e3a5251d820ee91adcd2591a3/blockchain/images/HA_Diagram_2.svg)

Figure 2. Blockchain HA single zone options

Zone failure.

Multizone clusters with multiple worker nodes and anti-affinity:

Think of a zone as a data center. A zone failure affects all physical compute hosts and NFS storage. Failures include power, cooling, networking, or storage outages, and natural disasters, like flooding, earthquakes, and hurricanes. To protect against a zone failure, you must have clusters in at least two different zones that are load balanced by an external load balancer. By default when you deploy a Kubernetes cluster in IBM Cloud, the cluster is configured with multi-zone support, including three zones, although you can choose two zones.

A single zone is sufficient for a development and test environment if you can tolerate a zone outage. Therefore, to leverage the HA benefits of multiple zones, when you provision your cluster, ensure that multiple zones are selected. Two zones are better than one, but three are recommended for HA to increase the likelihood that the two additional zones can absorb the workload of any single zone failure. When redundant peers from the same organization and channel, and ordering nodes, are spread across multiple zones, a failure in any one zone should not affect the ability of the network to process transactions because the workload will shift to the blockchain nodes in the other zones.

You can use the IBM Blockchain Platform console to specify the zone where a CA, peer, or ordering node is created.
* Updates the UBI Image to 8.7-1049.1675784874.
* Updates the default values for CPU request and CPU limit to 100m and 500m respectively.
* Updates the default values for Memory request and Memory limit1 to 128Mi and 500Mi respectively.
* Resolves [CVE-2022-47629](https://nvd.nist.gov/vuln/detail/CVE-2022-47629).







 Change log for version 2.2.9, released 13 February 2023 



* Adds support for the --set allowCrossNsSecret=true/false option when you install the IBM Cloud Object Storage plug-in. For more information, see [Installing the IBM Cloud Object Storage plug-in](https://cloud.ibm.com/docs/containers?topic=containers-storage_cos_install).
* Adds support for Wasabi and AWS s3 providers on Satellite clusters.
* On Satellite clusters, the object store endpoint is now auto populated based on the cos.storageClass and s3provider options.







 Change log for version 2.2.8, released 23 January 2023 



* Updates the UBI Image to 8:8.7-1049
* Adds PriorityClasses for driver and plug-in pods
* Updates tolerations for plug-in pod
* Adds support for encrypting buckets with IBM Key Protect by using your root key CRN when creating buckets.
JVM: 11.0.11 (Eclipse OpenJ9 openj9-0.26.0)
OS: Linux 5.10.47-linuxkit amd64

 oc version
Client Version: 4.9.7

 zip
Copyright (c) 1990-2008 Info-ZIP - Type 'zip "-L"' for software license.
This is Zip 3.0 (July 5th 2008), by Info-ZIP.

 unzip
UnZip 6.00 of 20 April 2009, by Debian. Original by Info-ZIP.

 git --version
git version 2.34.1

 curl
curl 7.58.0 (x86_64-pc-linux-gnu) libcurl/7.58.0 OpenSSL/1.1.1 zlib/1.2.11 libidn2/2.0.4 libpsl/0.19.1 (+libidn2/2.0.4) nghttp2/1.30.0 librtmp/2.3

 wget
GNU Wget 1.19.4 built on linux-gnu.

 openssl version
OpenSSL 1.1.1 11 Sep 2018

 make
GNU Make 4.1

 docker
Client:
Version: 20.10.9
API version: 1.41
Go version: go1.16.8
Git commit: c2ea9bc
Built: Mon Oct 4 16:03:22 2021
OS/Arch: linux/amd64
Context: default

 dc --version
dc (GNU bc 1.07.1) 1.4.1

 ed --version
GNU Ed 1.10
Show more





 Version 2.15 

To view the contents of version 2.15, from the running image, type default_versions.sh.

The IBM Cloud CLI provides code risk analysis commands. You can use the IBM Cloud CLI to analyze your code for vulnerabilities and compliance with certain rules. Code Risk Analyzer is available in all IBM Cloud regions where toolchains are supported.
Ubuntu 20.04 packages 5.4.0-132 5.4.0-135 Worker node kernel & package updates for [CVE-2022-2309](https://nvd.nist.gov/vuln/detail/CVE-2022-2309), [CVE-2022-38533](https://nvd.nist.gov/vuln/detail/CVE-2022-38533), [CVE-2022-40303](https://nvd.nist.gov/vuln/detail/CVE-2022-40303), [CVE-2022-40304](https://nvd.nist.gov/vuln/detail/CVE-2022-40304), [CVE-2022-41916](https://nvd.nist.gov/vuln/detail/CVE-2022-41916). 
 Kubernetes 1.23.14 1.23.15 For more information, see the [change log](https://github.com/kubernetes/kubernetes/releases/tag/v1.23.15). 







 Change log for master fix pack 1.23.15_1555, released 14 December 2022 

The following table shows the changes that are in the master fix pack 1.23.15_1555. Master patch updates are applied automatically.



Changes since version 1.23.14_1552

 Component Previous Current Description 

 Cluster health image v1.3.13 v1.3.14 Updated Go dependencies. Exclude ingress status from cluster status aggregation. 
 etcd v3.4.21 v3.4.22 See the [etcd release notes](https://github.com/etcd-io/etcd/releases/v3.4.22). 
 GPU device plug-in and installer cce0cfa 03fd318 Update GPU images with Go version 1.19.2 to resolve vulnerabilities
Ubuntu 20.04 packages 5.4.0-132 5.4.0-135 Worker node kernel & package updates for [CVE-2022-2309](https://nvd.nist.gov/vuln/detail/CVE-2022-2309), [CVE-2022-38533](https://nvd.nist.gov/vuln/detail/CVE-2022-38533), [CVE-2022-40303](https://nvd.nist.gov/vuln/detail/CVE-2022-40303), [CVE-2022-40304](https://nvd.nist.gov/vuln/detail/CVE-2022-40304), [CVE-2022-41916](https://nvd.nist.gov/vuln/detail/CVE-2022-41916). 
 Kubernetes 1.24.8 1.24.9 For more information, see the [change log](https://github.com/kubernetes/kubernetes/releases/tag/v1.24.9). 







 Change log for master fix pack 1.24.9_1547, released 14 December 2022 

The following table shows the changes that are in the master fix pack 1.24.9_1547. Master patch updates are applied automatically.



Changes since version 1.24.8_1544

 Component Previous Current Description 

 Cluster health image v1.3.13 v1.3.14 Updated Go dependencies. Exclude ingress status from cluster status aggregation. 
 etcd v3.5.5 v3.5.6 See the [etcd release notes](https://github.com/etcd-io/etcd/releases/v3.5.6). 
 GPU device plug-in and installer cce0cfa 03fd318 Update GPU images with Go version 1.19.2 to resolve vulnerabilities
Ubuntu 20.04 packages 5.4.0-132 5.4.0-135 Worker node kernel & package updates for [CVE-2022-2309](https://nvd.nist.gov/vuln/detail/CVE-2022-2309), [CVE-2022-38533](https://nvd.nist.gov/vuln/detail/CVE-2022-38533), [CVE-2022-40303](https://nvd.nist.gov/vuln/detail/CVE-2022-40303), [CVE-2022-40304](https://nvd.nist.gov/vuln/detail/CVE-2022-40304), [CVE-2022-41916](https://nvd.nist.gov/vuln/detail/CVE-2022-41916). 
 Kubernetes 1.22.16 1.22.17 For more information, see the [change log](https://github.com/kubernetes/kubernetes/releases/tag/v1.22.17). 







 Change log for master fix pack 1.22.17_1582, released 14 December 2022 

The following table shows the changes that are in the master fix pack 1.22.17_1582. Master patch updates are applied automatically.



Changes since version 1.22.16_1578

 Component Previous Current Description 

 Cluster health image v1.3.13 v1.3.14 Updated Go dependencies. Exclude ingress status from cluster status aggregation. 
 etcd v3.4.21 v3.4.22 See the [etcd release notes](https://github.com/etcd-io/etcd/releases/v3.4.22). 
 GPU device plug-in and installer cce0cfa 03fd318 Update GPU images with Go version 1.19.2 to resolve vulnerabilities
Ubuntu 20.04 packages 5.4.0-132 5.4.0-135 Worker node kernel & package updates for [CVE-2022-2309](https://nvd.nist.gov/vuln/detail/CVE-2022-2309), [CVE-2022-38533](https://nvd.nist.gov/vuln/detail/CVE-2022-38533), [CVE-2022-40303](https://nvd.nist.gov/vuln/detail/CVE-2022-40303), [CVE-2022-40304](https://nvd.nist.gov/vuln/detail/CVE-2022-40304), [CVE-2022-41916](https://nvd.nist.gov/vuln/detail/CVE-2022-41916). 
 Kubernetes 1.25.4 1.25.5 For more information, see the [change log](https://github.com/kubernetes/kubernetes/releases/tag/v1.25.5). 







 Change log for master fix pack 1.25.5_1525, released 14 December 2022 

The following table shows the changes that are in the master fix pack 1.25.5_1525. Master patch updates are applied automatically.



Changes since version 1.25.4_1522

 Component Previous Current Description 

 Cluster health image v1.3.13 v1.3.14 Updated Go dependencies. Exclude ingress status from cluster status aggregation. 
 etcd v3.5.5 v3.5.6 See the [etcd release notes](https://github.com/etcd-io/etcd/releases/v3.5.6). 
 GPU device plug-in and installer cce0cfa 03fd318 Update GPU images with Go version 1.19.2 to resolve vulnerabilities
If your DNS provider doesn't offer this option, you can configure your client to wait for a specified amount of time, sometimes up to an hour. In Secrets Manager, after you call validate-dns-challenges, you can check the status of the certificate issuance by obtaining your certificate metadata. When the IssuanceInfo.State field that is returned changes to active, the certificate is issued.





 Ordering public certificates with your own DNS provider by using the CLI 

To order a public certificate with your own DNS provider by using the Secrets Manager CLI plug-in, run the [ibmcloud secrets-manager secret-create](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-cli-plugin-secrets-manager-clisecrets-manager-cli-secret-create-command) command. For example, the following command requests a public certificate secret from the certificate authority that you specify.

When you order a certificate, domain validation takes place to verify the ownership of your selected domains. This process can take a few minutes to complete.

ibmcloud secrets-manager secret-create --resources=
'[{
"name": "example-public-certificate",
"description": "Extended description for this secret.",
"secret_group_id": "bc656587-8fda-4d05-9ad8-b1de1ec7e712",
"labels":
"dev","us-south"
],
"dns": "manual",
"common_name": "cert_common_name"
"alt_names":
"alt_name1", "alt_name2"
],
"algorithm": "sha256WithRSAEncryption",
"key_algorithm": "rsaEncryption 2048 bit",
"rotation": {
"enabled": false,
"rotate_keys":false
},
"custom_metadata" : {
"anyKey" : "anyValue"
},
To rotate a key in a cluster with existing key encryption, rerun this command with a new root key ID.

Do not delete root keys in your KMS instance, even if you rotate to use a new key. If you delete a root key that a cluster uses, the cluster becomes unusable, loses all its data, and can't be recovered. When you rotate a root key, you can't reuse a previous root key for the same cluster.

ibmcloud oc kms enable --cluster CLUSTER_NAME_OR_ID --instance-id KMS_INSTANCE_ID --crk ROOT_KEY_ID [--kms-account-id ID] [--public-endpoint] [-q]

Minimum required permissions
: Administrator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

--container, -c CLUSTER_NAME_OR_ID
: The name or ID of the cluster.

--instance-id KMS_INSTANCE_ID
: The ID of the KMS instance that you want to use to encrypt the secrets in your cluster. To list available KMS instances, run ibmcloud oc kms instance ls.

--crk ROOT_KEY_ID
: The ID of the customer root key (CRK) in your KMS instance that you want to use to wrap the data encryption keys (DEK) that are stored locally in your cluster. To list available root keys, run ibmcloud oc kms crk ls --instance-id <kms_instance_id>.

--kms-account-id ID
: Optional: The ID of the account that contains the KMS instance you want to use for local disk or secret encryption.

--public-endpoint
: Optional: Specify this option to use the KMS public cloud service endpoint. If you don't include this option, the private cloud service endpoint is used by default.

-q
: Optional: Do not show the message of the day or update reminders.



 Example kms enable command
"bundle_certs": false,
"key_algorithm": "RSA2048",
"rotation": {
"auto_rotate": false,
"rotate_keys": false
}
}'
Show more

Order a public SSL/TLS certificate and assign it to an existing secret group.

curl -X POST "https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/public_cert/secrets/groups/{group_id}" -H 'Accept: application/json' -H 'X-Vault-Token: {Vault-Token}' -H 'Content-Type: application/json' -d '{
"name": "test-public-certificate-in-group",
"description": "Extended description for my secret.",
"ca": "my-configured-certificate-authority",
"dns": "my-configured-dns-provider",
"common_name": "example.com",
"alt_names": [
"www.example.com"
],
"labels": [
"dev",
"us-south"
],
"bundle_certs": false,
"key_algorithm": "RSA2048",
"rotation": {
"auto_rotate": false,
"rotate_keys": false
}
}'
Show more

Create a private SSL/TLS certificate and assign it to the default secret group.

curl -X POST "https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/private_cert/secrets" -H 'Accept: application/json' -H 'X-Vault-Token: {Vault-Token}' -H 'Content-Type: application/json' -d '{
"name": "test-private-certificate",
"description": "Extended description for my secret.",
[Menu icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/icon_hamburger.svg)> Resource List.
2. From the list of services, select your instance of Secrets Manager.
3. In the Secrets Manager UI, go to your Secrets list.
4. In the row for the secret that you want to inspect, click the Actions menu ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/actions-icon-vertical.svg)> Version history.

If the secret was rotated previously, the page displays information about the current and previous versions, for example the date that each version was created. Up to 50 versions can be listed for a secret.

If you're inspecting the version history of a public or imported certificate, you can also [download the certificate contents](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-access-secretsdownload-certificate-ui).
5. Optional: Update the metadata of the specific version of the secret that you are viewing.



1. To update the metadata of your secret version, upload a file or enter the metadata and the version metadata in JSON format.
2. Click Update.









 Listing secret versions from the CLI 

If you're auditing the version history of a secret, you can use the Secrets Manager CLI plug-in to view the general characteristics of each rotation.

To list all the versions that are associated with a secret, run the [ibmcloud secrets-manager secret-versions](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-cli-plugin-secrets-manager-clisecrets-manager-cli-secret-versions-command) command.
2. In the row for the certificate that you want to edit, click the Actions menu ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/actions-icon-vertical.svg)> Edit details.
3. Use the Automatic rotation option to add or remove a rotation policy for the secret.









 Setting an automatic rotation policy for private certificates 

If you prefer to schedule your private SSL or TLS certificates to be automatically renewed, you can enable automatic rotation for certificates when you create them, or by editing the details of an existing certificate. The certificate must



1. If you're [creating private certificates](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-private-certificatescreate-private-certificates), enable the rotation options.



1. To rotate the certificate automatically, switch the rotation toggle to On.
2. Select an interval and unit that specifies the number of days between scheduled rotations.

Depending on the certificate template that is associated with your private certificate, some restrictions on the rotation interval for the certificate might apply. For example, the rotation interval can't exceed the time-to-live (TTL) that is defined in the template. For more information, see [Certificate templates](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-certificate-templates).



2. If you're editing an existing private certificate, schedule automatic rotation by updating its details.



1. In the Secrets table, view a list of your existing Private certificates.
2. In the row for the certificate that you want to edit, click the Actions menu ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/actions-icon-vertical.svg)> Edit details.
To rotate a key in a cluster with existing key encryption, rerun this command with a new root key ID.

Do not delete root keys in your KMS instance, even if you rotate to use a new key. If you delete a root key that a cluster uses, the cluster becomes unusable, loses all its data, and can't be recovered. When you rotate a root key, you can't reuse a previous root key for the same cluster.

ibmcloud ks kms enable --cluster CLUSTER_NAME_OR_ID --instance-id KMS_INSTANCE_ID --crk ROOT_KEY_ID [--kms-account-id ID] [--public-endpoint] [-q]

Minimum required permissions
: Administrator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

--container, -c CLUSTER_NAME_OR_ID
: The name or ID of the cluster.

--instance-id KMS_INSTANCE_ID
: The ID of the KMS instance that you want to use to encrypt the secrets in your cluster. To list available KMS instances, run ibmcloud ks kms instance ls.

--crk ROOT_KEY_ID
: The ID of the customer root key (CRK) in your KMS instance that you want to use to wrap the data encryption keys (DEK) that are stored locally in your cluster. To list available root keys, run ibmcloud ks kms crk ls --instance-id <kms_instance_id>.

--kms-account-id ID
: Optional: The ID of the account that contains the KMS instance you want to use for local disk or secret encryption.

--public-endpoint
: Optional: Specify this option to use the KMS public cloud service endpoint. If you don't include this option, the private cloud service endpoint is used by default.

-q
: Optional: Do not show the message of the day or update reminders.



 Example kms enable command
When your certificate is issued, clean up and remove the TXT records from the domains in your DNS provider account.







 Creating new versions of private certificates 

If your Secrets Manager service instance is enabled for [private certificates](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-private-certificatescreate-private-certificates), you can manually renew a certificate that was previously issued by a certificate authority that is configured for your service instance.



1. In the console, click the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/icon_hamburger.svg)> Resource List.
2. From the list of services, select your instance of Secrets Manager.
3. In the Secrets Manager UI, go to the Secrets list.
4. In the row for the certificate that you want to rotate, click the Actions menu ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/actions-icon-vertical.svg)> Rotate.
5. Optional: Add metadata to your secret or to a specific version of your secret.



1. Upload a file or enter the metadata and the version metadata in JSON format.



6. Click Rotate.
7. Redeploy the latest certificate version to your TLS termination point.

To access the current version, you can [download the certificate](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-access-secrets) or retrieve it programmatically by using the [Get a secret](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2get-secret) API.









 Manually creating new versions of secrets from the CLI
Set the class implementing EncryptionPropertiesFactory:

sc.hadoopConfiguration.set("parquet.crypto.factory.class","com.ibm.parquet.key.management.IBMKeyToolsFactory")
2. Provide the IAM access token for the relevant keys:

sc.hadoopConfiguration.set("parquet.encryption.key.access.token" , "<token string>")
3. Call the regular parquet read commands, such as:

val dataFrame = spark.read.parquet("<path to encrypted files>")







 Key rotation 

If key rotation is required, the administrator has to rotate master keys in Key Protect using the procedure described in [Manually rotating keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-rotate-keys). Then the administrator can trigger Parquet key rotation by calling:

public static void KeyToolkit.rotateMasterKeys(String folderPath, Configuration hadoopConfig)

To enable Parquet key rotation, the following Hadoop configuration properties must be set:



* The parameters "parquet.encryption.key.access.token", "parquet.encryption.kms.instance.url", "parquet.encryption.kms.instance.id"
* The parameter "parquet.encryption.key.material.store.internally" must be set to "false"
* The parameter "parquet.encryption.kms.client.class" must be set to "com.ibm.parquet.key.management.KeyProtectClient"
* * The parameter "parquet.crypto.factory.class" must be set to "com.ibm.parquet.key.management.IBMKeyToolsFactory"

For example:

sc.hadoopConfiguration.set("parquet.encryption.key.access.token" , "<token string>")
sc.hadoopConfiguration.set("parquet.encryption.kms.instance.url" , "https://<region>.kms.cloud.ibm.com")