vania-janet/multiturn-rag-retrieval-data huggingface dataset:
(https://cloud.ibm.com/docs-content/v1/content/ba89e173287b28d1453d2a327d8a1f74ae2f1662/schematics/images/checkmark.svg) ![Check mark icon.](https://cloud.ibm.com/docs-content/v1/content/ba89e173287b28d1453d2a327d8a1f74ae2f1662/schematics/images/checkmark.svg) ![Check mark icon.](https://cloud.ibm.com/docs-content/v1/content/ba89e173287b28d1453d2a327d8a1f74ae2f1662/schematics/images/checkmark.svg) 



Schematics Agents is a beta-1 feature that are available for evaluation and testing purposes. It is not intended for production usage.





 Agent permissions 

The following are the different permissions that you an user need to create and deploy the Schematics agent.



* Permission to deploy an agent
* Permission for agent to connect with Schematics
* Permission to users to manage agents





 Permission to deploy an agent 

Agent recommends to use a service ID and API key to provision the prerequisite the IBM Cloud resources such as IBM Cloud Kubernetes Service or Red Hat OpenShift, IBM Cloud Object Storage, and IBM Cloud Object Storage bucket.

Following are the maximum permission and roles that services should have to deploy an agent.



Permissions to deploy an agent

 Resources Service role Platform role 

 IBM Cloud Kubernetes Service Manager Viewer 
 Resource Group Administrator 
 Red Hat OpenShift or Kubernetes Service Object Writer Administrator 
 IBM Cloud Object Storage Object Writer ++ Administrator ++ 
 IBM Cloud Object Storage bucket Object Writer + Writer Administrator 
 Schematics Manager Operator 







 Permission for agent to connect with Schematics 

Consider the following access are provided for an agent to connect with Schematics.
IBM Cloud Continuous Delivery docs 

Adopt a DevOps or DevSecOps approach by using Continuous Delivery, which includes open toolchains that automate the building and deploying of applications. Use the documentation, architetcure references, and more to support your build and deploy needs.

 Developer tools 

[API & SDK reference](https://cloud.ibm.com/apidocs/toolchain)[Terraform reference](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest)

 Recommended content 

[Getting started with Continuous Delivery Learn how to create a simple deployment toolchain that supports development, deployment, and operations tasks.](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-getting-started)[Toolchain availability, templates, and tutorials Learn about the available toolchain templates, and related tutorials, that include specific sets of tool integrations to support development, deployment, and operations tasks.](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-cd_about)[Deploy an app on Kubernetes Learn how to create an open toolchain by using deployment strategies that have Kubernetes as the deployment target.](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-tutorial-cd-kubernetes)

 Learn more 

[IBM Developer<br><br>Visit IBM Developer for technical articles, code patterns, tutorials, and more.<br><br>![112-Developer-tools.svg](https://cloud.ibm.com/media/docs/images/homepage/112-Developer-tools.svg)](https://developer.ibm.com/depmodels/cloud/)[Architecture Center<br><br>Discover the architecture references available for this product.<br><br>!
: The ID or name of the IBM Cloud Monitoring service instance that you use in your monitoring configuration. This value is optional. If you don't provide this value, the IBM Cloud Monitoring service instance is automatically retrieved





 ibmcloud ob monitoring config create 

Virtual Private Cloud

Classic infrastructure

Create a monitoring configuration for your cluster to automatically collect cluster and pod metrics, and send them to IBM Cloud Monitoring.

This command deploys a Monitoring agent as a Kubernetes daemon set in your cluster. The agent collects cluster and pod metrics, such as the worker node CPU and memory usage, and the amount of incoming and outgoing network traffic for your pods. For more information, see [Forwarding cluster and app metrics to IBM Cloud Monitoring](https://cloud.ibm.com/docs/openshift?topic=openshift-health-monitoropenshift_monitoring).

ibmcloud ob monitoring config create --cluster CLUSTER --instance MONITORING_INSTANCE [--sysdig-access-key ACCESS_KEY] [--private-endpoint]

Minimum required permissions:



* Administrator platform access role and Manager service access role for all Kubernetes namespaces in IBM Cloud Kubernetes Service
* Editor platform access role and Manager server access role for IBM Cloud Monitoring



Command options:

--cluster CLUSTER
: The name or ID of the cluster for which you want to create a monitoring configuration for IBM Cloud Monitoring. To retrieve your cluster name or ID, run ibmcloud oc clusters. This value is required.

--instance MONITORING_INSTANCE
: The ID or name of the IBM Cloud Monitoring service instance that you want to use to create the monitoring configuration. The service instance must be in the same IBM Cloud account as your cluster, but can be in a different resource group or region than your cluster. To create a service instance, follow the steps in [Provision an instance](https://cloud.ibm.com/docs/monitoring?topic=monitoring-provision). This value is required.

--sysdig-access-key ACCESS_KEY
: The Monitoring access key that you want to use for your configuration. This value is optional.
5.3.2 IBM Cloud Kubernetes Service has a set of [default Calico and Kubernetes network policies defined](https://cloud.ibm.com/docs/containers?topic=containers-network_policiesdefault_policy) and [additional network policies can optionally be added](https://cloud.ibm.com/docs/containers?topic=containers-network_policiesadding_network_policies). 
 5.4.2 IBM Cloud Kubernetes Service can optionally [enable a Kubernetes Key Management Service (KMS) provider](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkms). 
 5.5.1 IBM Cloud Kubernetes Service can optionally [enable enforcing image security](https://cloud.ibm.com/docs/Registry?topic=Registry-security_enforce_portieris). 
 5.6.2 IBM Cloud Kubernetes Service does not annotate all pods with [seccomp profiles](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 5.6.3 IBM Cloud Kubernetes Service deploys some system components that do not set a pod or container securityContext. 
 5.6.4 IBM Cloud Kubernetes Service deploys some Kubernetes resources to the default names.
Kubernetes worker crn:v1:bluemix:public:containers-kubernetes:us-south:a/59bcbfa6ea2f006b4ed7094c1a08dcdd:8042b2a8af6a4a5cbf6dbe09e07311d2:worker:kube-hou02-pa8042b2a8af6a4a5cbf6dbe09e07311d2-w1 
 Resource group crn:v1:bluemix:public:resource-controller:global:a/59bcbfa6ea2f006b4ed7094c1a08dcdd:resource-group:59bcbfa6ea2f006b4ed7094c1a08dcdd 
 Service instance crn:v1:bluemix:public:cloud-object-storage:global:a/59bcbfa6ea2f006b4ed7094c1a08dcdd:1a0ec336-f391-4091-a6fb-5e084a4c56f4:: 
 Bucket crn:v1:bluemix:public:cloud-object-storage:global:a/59bcbfa6ea2f006b4ed7094c1a08dcdd:1a0ec336-f391-4091-a6fb-5e084a4c56f4:bucket:mybucket 
 Child service crn:v1:bluemix:public:resource-catalog::a/9d67f37fdf745e1b3cbef0ee4e6f2eda::composite:is.vpn
Kubernetes v1.25.3 v1.25.4 [CVE-2022-3294](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3294) and [CVE-2022-3162](https://nvd.nist.gov/vuln/detail/CVE-2022-3162). For more information, see [IBM Cloud Kubernetes Service is affected by Kubernetes API server security vulnerabilities CVE-2022-3294 and CVE-2022-3162](https://www.ibm.com/support/pages/node/6844715). See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.25.4). 







 Change log for worker node fix pack 1.25.3_1521, released 07 November 2022 

The following table shows the changes that are in the worker node fix pack 1.25.3_1521. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.25.2_1519

 Component Previous Current Description
Kubernetes v1.23.13 v1.23.14 [CVE-2022-3294](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3294) and [CVE-2022-3162](https://nvd.nist.gov/vuln/detail/CVE-2022-3162). For more information, see [IBM Cloud Kubernetes Service is affected by Kubernetes API server security vulnerabilities CVE-2022-3294 and CVE-2022-3162](https://www.ibm.com/support/pages/node/6844715). See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.23.14). 







 Change log for worker node fix pack 1.23.13_1551, released 07 November 2022 

The following table shows the changes that are in the worker node fix pack 1.23.13_1551. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.23.12_1549

 Component Previous Current Description
Create a Kubernetes service configuration file that is named myservice.yaml and define a service of type LoadBalancer with a dummy NLB IP address. The following example uses the IP address 1.1.1.1 as the NLB IP address. Replace <zone> with the zone where you want to check for available IPs.

apiVersion: v1
kind: Service
metadata:
labels:
run: myservice
name: myservice
namespace: default
annotations:
service.kubernetes.io/ibm-load-balancer-cloud-provider-zone: "<zone>"
spec:
ports:
- port: 80
protocol: TCP
targetPort: 80
selector:
run: myservice
sessionAffinity: None
type: LoadBalancer
loadBalancerIP: 1.1.1.1
Show more
2. Create the service in your cluster.

kubectl apply -f myservice.yaml
3. Inspect the service.

kubectl describe service myservice

The creation of this service fails because the Kubernetes master can't find the specified NLB IP address in the Kubernetes ConfigMap. When you run this command, you can see the error message and a list of available public IP addresses for the cluster.

Error on cloud load balancer a8bfa26552e8511e7bee4324285f6a4a for service default/myservice with UID 8bfa2655-2e85-11e7-bee4-324285f6a4af: Requested cloud provider IP 1.1.1.1 is not available. The following cloud provider IP addresses are available: <list_of_IP_addresses>







 Freeing up used IP addresses 

You can free up a used portable IP address by deleting the network load balancer (NLB) service or disabling the Ingress application load balancer (ALB) that is using the portable IP address.

Before you begin
Kubernetes v1.17.7 v1.17.9 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.17.9). The update resolves CVE-2020-8559 (see the [IBM security bulletin](https://www.ibm.com/support/pages/node/6249915)). 
 Kubernetes configuration N/A N/A The Kubernetes API server audit policy configuration is updated to include auditing the scheduling.k8s.io API group and the tokenreviews resource. 
 Kubernetes Dashboard v2.0.1 v2.0.3 See the [Kubernetes Dashboard release notes](https://github.com/kubernetes/dashboard/releases/tag/v2.0.3). 
 OpenVPN server 2.4.6-r3-IKS-131 2.4.6-r3-IKS-222 Removed the deprecated comp-lzo compression configuration option and updated the default cipher that is used for encryption. 
 Operator Lifecycle Manager 0.14.1 0.14.1-IKS-1 Updated image for [CVE-2020-1967](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1967). 







 Change log for worker node fix pack 1.17.9_1532, released 20 July 2020 

The following table shows the changes that are in the worker node fix pack 1.17.9_1532. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.17.7_1530

 Component Previous Current Description 

 HAProxy 2.0.15-afe432 1.8.25-384f42 See the [HAProxy change log](https://www.haproxy.org/download/1.8/src/CHANGELOG).
Kubernetes (worker node) v1.22.6 v1.23.2 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.23.2). 
 Kubernetes configuration N/A N/A Updated the [feature gate configuration](https://cloud.ibm.com/docs/containers?topic=containers-service-settingsfeature-gates). 
 Kubernetes CSI snapshotter CRDs v4.0.0 v4.2.1 See the [Kubernetes container storage interface (CSI) snapshotter release notes](https://github.com/kubernetes-csi/external-snapshotter/releases/tag/v4.2.1). 
 Kubernetes Dashboard v2.3.1 v2.4.0 See the [Kubernetes Dashboard release notes](https://github.com/kubernetes/dashboard/releases/tag/v2.4.0). 
 Kubernetes Metrics Server v0.5.2 v0.6.0 See the [Kubernetes Metrics Server release notes](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.0). 
 Kubernetes NodeLocal DNS cache 1.21.3 1.21.4 See the [Kubernetes NodeLocal DNS cache release notes](https://github.com/kubernetes/dns/releases/tag/1.21.4). 
 Operator Lifecycle Manager 0.16.1-IKS-15 None Operator Lifecycle Manager is no longer installed nor managed by IBM. Existing installs are unchanged and no longer managed after an upgrade. 
 Operator Lifecycle Manager Catalog v1.15.3 None Operator Lifecycle Manager is no longer installed nor managed by IBM. Existing installs are unchanged and no longer managed after an upgrade.
The Kubernetes [Device Plug-in](https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins/) sets the default resource request to match the limit.<br><br><br><br> * You must specify the key as nvidia.com/gpu.<br> * Enter the whole number of GPUs that you request, such as 2. Note that container pods don't share GPUs and GPUs can't be overcommitted. For example, if you have only 1 mg1c.16x128 machine, then you have only 2 GPUs in that machine and can specify a maximum of 2.<br><br><br> 



2. Apply the YAML file. For example:

kubectl apply -f nvidia-devicequery.yaml
3. Check the job pod by filtering your pods by the nvidia-devicequery label. Verify that the STATUS is Completed.

kubectl get pod -a -l 'name in (nvidia-devicequery)'

Example output

NAME READY STATUS RESTARTS AGE
nvidia-devicequery-ppkd4 0/1 Completed 0 36s
4. Describe the pod to see how the GPU device plug-in scheduled the pod.



* In the Limits and Requests fields, see that the resource limit that you specified matches the request that the device plug-in automatically set.
* In the events, verify that the pod is assigned to your GPU worker node.

kubectl describe pod nvidia-devicequery-ppkd4

Example output

NAME: nvidia-devicequery-ppkd4
Namespace: default
...
Limits:
nvidia.com/gpu: 1
Requests:
nvidia.com/gpu: 1
...
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
: The Kubernetes web terminal add-on is deprecated and becomes unsupported 1 July 2021. Instead, use the [IBM Cloud Shell](https://cloud.ibm.com/docs/cloud-shell?topic=cloud-shell-shell-ui).

Istio add-on
: [Version 1.9.4 of the Istio managed add-on](https://cloud.ibm.com/docs/containers?topic=containers-istio-changelogv19) is released.

Deprecated Ubuntu 16 end of support date
: The Ubuntu 16 worker node flavors were deprecated 1 December 2020, with an initial unsupported date of April 2021. To give customers more time to migrate to a newer Ubuntu version, the end of support date is extended to 31 December 2021. Before 31 December 2021, [update the worker pools in your cluster to run Ubuntu 18](https://cloud.ibm.com/docs/containers?topic=containers-updatemachine_type). For more information, see the [IBM Cloud blog](https://www.ibm.com/cloud/blog/announcements/new-bare-metal-servers-available-for-kubernetes-and-openshift-clusters).





 11 May 2021 

VPC cluster healthchecks
: If you set up [VPC security groups](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-security-group) or [VPC access control lists (ACLs)](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-acls) to secure your cluster network, you can now create the rules to allow the necessary traffic from the control plane IP addresses and Akamai IPv4 IP addresses to health check your ALBs. Previously, a quota on the number of rules per security group or ACL prevented the ability to create all necessary rules for health checks.





 10 May 2021 

New! PX-Backup is now available
Kubernetes v1.16.11 v1.16.13 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.16.13). The update resolves CVE-2020-8559 (see the [IBM security bulletin](https://www.ibm.com/support/pages/node/6249915)). 
 Kubernetes configuration N/A N/A The Kubernetes API server audit policy configuration is updated to include auditing the scheduling.k8s.io API group and the tokenreviews resource. 
 Kubernetes Dashboard v2.0.1 v2.0.3 See the [Kubernetes Dashboard release notes](https://github.com/kubernetes/dashboard/releases/tag/v2.0.3). 
 Operator Lifecycle Manager 0.14.1 0.14.1-IKS-1 Updated image for [CVE-2020-1967](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1967). 







 Change log for worker node fix pack 1.16.13_1539, released 20 July 2020 

The following table shows the changes that are in the worker node fix pack 1.16.13_1539. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.16.11_1537

 Component Previous Current Description 

 HAProxy 2.0.15-afe432 1.8.25-384f42 See the [HAProxy change log](https://www.haproxy.org/download/1.8/src/CHANGELOG). Fixes a connection leak that happens when HAProxy is under high load.
Kubernetes dashboard v1.8.3 v1.10.1 See the [Kubernetes dashboard release notes](https://github.com/kubernetes/dashboard/releases/tag/v1.10.1). Update resolves [CVE-2018-18264](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18264). 
 GPU installer 390.12 410.79 Updated the installed GPU drivers to 410.79. 







 Change log for worker node fix pack 1.12.3_1533, released 7 January 2019 

The following table shows the changes that are in the worker node fix pack 1.12.3_1533.



Changes since version 1.12.3_1532

 Component Previous Current Description 

 Kernel 4.4.0-139 4.4.0-141 Updated worker node images with kernel update for [CVE-2017-5753, CVE-2018-18690](https://changelogs.ubuntu.com/changelogs/pool/main/l/linux/linux_4.4.0-141.167/changelog). 







 Change log for worker node fix pack 1.12.3_1532, released 17 December 2018 

The following table shows the changes that are in the worker node fix pack 1.12.2_1532.



Changes since version 1.12.3_1531

 Component Previous Current Description 

 Ubuntu packages N/A N/A Updates to installed Ubuntu packages. 







 Change log for 1.12.3_1531, released 5 December 2018 

The following table shows the changes that are in the patch 1.12.3_1531.



Changes since version 1.12.2_1530

 Component Previous Current Description 

 IBM Cloud Provider v1.12.2-68 v1.12.3-91 Updated to support the Kubernetes 1.12.3 release.
Kubernetes dashboard v1.8.3 v1.10.1 See the [Kubernetes dashboard release notes](https://github.com/kubernetes/dashboard/releases/tag/v1.10.1). Update resolves [CVE-2018-18264](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18264). <br>If you access the dashboard via kubectl proxy, the SKIP button on the login page is removed. Instead, [use a Token to log in](https://cloud.ibm.com/docs/containers?topic=containers-deploy_appcli_dashboard). 
 GPU installer 390.12 410.79 Updated the installed GPU drivers to 410.79. 







 Change log for worker node fix pack 1.11.5_1539, released 7 January 2019 

The following table shows the changes that are in the worker node fix pack 1.11.5_1539.



Changes since version 1.11.5_1538

 Component Previous Current Description 

 Kernel 4.4.0-139 4.4.0-141 Updated worker node images with kernel update for [CVE-2017-5753, CVE-2018-18690](https://changelogs.ubuntu.com/changelogs/pool/main/l/linux/linux_4.4.0-141.167/changelog). 







 Change log for worker node fix pack 1.11.5_1538, released 17 December 2018 

The following table shows the changes that are in the worker node fix pack 1.11.5_1538.



Changes since version 1.11.5_1537

 Component Previous Current Description 

 Ubuntu packages N/A N/A Updates to installed Ubuntu packages. 







 Change log for 1.11.5_1537, released 5 December 2018 

The following table shows the changes that are in the patch 1.11.5_1537.



Changes since version 1.11.4_1536

 Component Previous Current Description
However, if HA is important for your CA strategy, it is possible to configure your nodes for maximum availability. Kubernetes includes built in HA by immediately restarting the pod if the CA becomes unavailable. However, if you cannot tolerate any downtime for your CA, you have the option to configure replica sets for your CA. A replica set is a Kubernetes mechanism that is used to guarantee the availability of the pod. The use of replica sets ensures that multiple replicas of the pod are running at all times. If one of the CA replicas becomes unavailable, Kubernetes immediately switches to another CA replica, therefore there is no downtime waiting for a CA to restart.







 HA Checklist 

The following table contains a list of options to consider as you plan for increasing degrees of HA.



Table 1. Comparison of deployment scenarios to increase your network HA
This table has row and column headers. The row headers identify the deployment scenarios. The column headers identify available options in each scenario to increase your HA.

 Single node Single cluster with multiple nodes Multizone Multiple clusters across regions 

 Redundant peers ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/c5288bed34c3820e3a5251d820ee91adcd2591a3/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/c5288bed34c3820e3a5251d820ee91adcd2591a3/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/c5288bed34c3820e3a5251d820ee91adcd2591a3/icons/checkmark-icon.svg) !
Kubernetes dashboard v1.8.3 v1.10.1 See the [Kubernetes dashboard release notes](https://github.com/kubernetes/dashboard/releases/tag/v1.10.1). Update resolves [CVE-2018-18264](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18264). <br>If you access the dashboard via kubectl proxy, the SKIP button on the login page is removed. Instead, [use a Token to log in](https://cloud.ibm.com/docs/containers?topic=containers-deploy_appcli_dashboard). 
 GPU installer 390.12 410.79 Updated the installed GPU drivers to 410.79. 







 Change log for worker node fix pack 1.10.11_1538, released 7 January 2019 

The following table shows the changes that are in the worker node fix pack 1.10.11_1538.



Table 1. Changes since version 1.10.11_1537

 Component Previous Current Description 

 Kernel 4.4.0-139 4.4.0-141 Updated worker node images with kernel update for [CVE-2017-5753, CVE-2018-18690](https://changelogs.ubuntu.com/changelogs/pool/main/l/linux/linux_4.4.0-141.167/changelog). 







 Change log for worker node fix pack 1.10.11_1537, released 17 December 2018 

The following table shows the changes that are in the worker node fix pack 1.10.11_1537.



Table 1. Changes since version 1.10.11_1536

 Component Previous Current Description 

 Ubuntu packages N/A N/A Updates to installed Ubuntu packages. 







 Change log for 1.10.11_1536, released 4 December 2018 

The following table shows the changes that are in patch 1.10.11_1536.



Table 1. Changes since version 1.10.8_1532