vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Kubernetes configuration N/A N/A Removed batch/v2alpha1=true from the --runtime-config option for the cluster's Kubernetes API server. 
 Kubernetes Dashboard v2.0.0-rc7 v2.0.0 See the [Kubernetes Dashboard release notes](https://github.com/kubernetes/dashboard/releases/tag/v2.0.0). 
 Kubernetes NodeLocal DNS cache 1.15.8 1.15.12 <br><br> * See the [Kubernetes NodeLocal DNS cache release notes](https://github.com/kubernetes/dns/releases/tag/1.15.12).<br> * [NodeLocal DNS cache](https://cloud.ibm.com/docs/containers?topic=containers-cluster_dnsdns_cache) is now generally available, but still disabled by default.<br> * In Kubernetes 1.18, you might also use [zone-aware DNS](https://cloud.ibm.com/docs/containers?topic=containers-cluster_dnsdns_zone_aware) instead of just NodeLocal DNS cache, to increase DNS performance and availability in a multizone cluster.<br><br><br> 
 Load balancer and load balancer monitor for IBM Cloud Provider 177 207 Improved application logging. Updated image for [CVE-2020-1967](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1967). 
 Pause container image 3.1 3.2 See the [pause container image release notes](https://github.com/kubernetes/kubernetes/blob/master/build/pause/CHANGELOG.md).
Open the Kubernetes [dashboard](https://cloud.ibm.com/docs/containers?topic=containers-deploy_appcli_dashboard) and click + Create.
2. Enter your app details in 1 of 2 ways.



* Select Specify app details and enter the details.
* Select Upload a YAML or JSON file to upload your app [configuration file](https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/).



Need help with your configuration file? Check out this [example YAML file](https://github.com/IBM-Cloud/kube-samples/blob/master/deploy-apps-clusters/deploy-ibmliberty.yaml). In this example, a container is deployed from the ibmliberty image in the US-South region. Learn more about [securing your personal information](https://cloud.ibm.com/docs/containers?topic=containers-securitypi) when you work with Kubernetes resources.
3. Verify that you successfully deployed your app in one of the following ways.



* In the Kubernetes dashboard, click Deployments. A list of successful deployments is displayed.
* If your app is [publicly available](https://cloud.ibm.com/docs/containers?topic=containers-cs_network_planningpublic_access), navigate to the cluster overview page in your IBM Cloud® Kubernetes Service dashboard. Copy the subdomain, which is located in the cluster summary section and paste it into a browser to view your app.









 Deploying apps with the CLI 

After a cluster is created, you can deploy an app into that cluster by using the Kubernetes CLI.

Before you begin



* Install the required [CLIs](https://cloud.ibm.com/docs/containers?topic=containers-cli-install).
* [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.]
Kubernetes configuration N/A N/A The Kubernetes API server audit policy configuration is updated to not log the /openapi/v2* read-only URL. In addition, the Kubernetes controller manager configuration increased the validity duration of signed kubelet certificates from 1 to 3 years. 
 OpenVPN client configuration N/A N/A The OpenVPN client vpn-* pod in the kube-system namespace now sets dnsPolicy to Default to prevent the pod from failing when cluster DNS is down. 
 Trusted compute agent e132aa4 13c7ef0 Updated image for [CVE-2016-7076](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7076), [CVE-2017-1000368](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000368), and [CVE-2019-11068](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11068). 







 Change log for worker node fix pack 1.12.7_1550, released 29 April 2019 

The following table shows the changes that are in the worker node fix pack 1.12.7_1550.



Changes since version 1.12.7_1549

 Component Previous Current Description 

 Ubuntu packages N/A N/A Updates to installed Ubuntu packages. 
 containerd 1.1.6 1.1.7 See the [containerd release notes](https://github.com/containerd/containerd/releases/tag/v1.1.7). 







 Change log for worker node fix pack 1.12.7_1549, released 15 April 2019 

The following table shows the changes that are in the worker node fix pack 1.12.7_1549.



Changes since version 1.12.7_1548

 Component Previous Current Description
Kubernetes snapshot CRDs IBM Cloud Kubernetes Service installs Kubernetes snapshot custom resource definition (CRD) version v1beta1. If you use other Kubernetes snapshot CRD versions v1 or v1alpha1, you must change the version to v1beta1. To check the currently installed version of your snapshot CRDs, run grep snapshot.storage.k8s.io <<(kubectl get apiservices). Follow the Kubernetes documentation to [Upgrade from v1alpha1 to v1beta1](https://github.com/kubernetes-csi/external-snapshotterupgrade-from-v1alpha1-to-v1beta1) to make sure that your snapshot CRDs are at the correct v1beta1 version. The steps to downgrade from version v1 to v1beta1 are the same as those to upgrade from v1alpha1. Do not follow the instructions to upgrade from version v1beta1 to version v1. 
 OpenVPN replaced by Konnectivity [Konnectivity](https://kubernetes.io/docs/tasks/extend-kubernetes/setup-konnectivity/) replaces OpenVPN as the network proxy that is used to secure the communication of the Kubernetes API server master to worker nodes in the cluster. If your apps rely on the OpenVPN implementation of Kubernetes master to worker node communication, update them to support [Konnectivity](https://kubernetes.io/docs/tasks/extend-kubernetes/setup-konnectivity/). 
 Pod access via service account token For clusters that run Kubernetes 1.21 and later, the service account tokens that pods use to communicate with the Kubernetes API server are time-limited, automatically refreshed, scoped to a particular audience of users (the pod), and invalidated after the pod is deleted. To continue communicating with the API server, you must design your apps to read the refreshed token value on a regular basis, such as every minute.
* Certified Kubernetes
* Version 1.20 is unsupported as of 19 June 2022
* Istio add-on



* [15 June 2022](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-jun1522)



* IBM Cloud Monitoring metrics and label updates
* Block Storage for VPC add-on.



* [13 June 2022](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-jun1322)



* Block Storage for VPC add-on.



* [10 June 2022](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-jun1022)



* Log Analysis and IBM Cloud Activity Tracker changes
* Ingress ALB change log updates
* Block Storage for VPC add-on.



* [9 June 2022](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-jun922)



* New! Kubernetes 1.24
* Deprecated and unsupported Kubernetes versions



* [7 June 2022](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-jun722)



* CLI change log update



* [6 June 2022](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-jun622)



* Worker node fix pack



* [3 June 2022](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-jun322)



* Master fix pack update



* [1 June 2022](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-jun122)



* Istio add-on
Kubernetes configuration N/A N/A The Kubernetes API server audit policy configuration is updated to not log the /openapi/v2* read-only URL. In addition, the Kubernetes controller manager configuration increased the validity duration of signed kubelet certificates from 1 to 3 years. 
 OpenVPN client configuration N/A N/A The OpenVPN client vpn-* pod in the kube-system namespace now sets dnsPolicy to Default to prevent the pod from failing when cluster DNS is down. 
 Trusted compute agent e132aa4 13c7ef0 Updated image for [CVE-2016-7076](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7076), [CVE-2017-1000368](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000368), and [CVE-2019-11068](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11068). 







 Change log for worker node fix pack 1.11.9_1556, released 29 April 2019 

The following table shows the changes that are in the worker node fix pack 1.11.9_1556.



Changes since version 1.11.9_1555

 Component Previous Current Description 

 Ubuntu packages N/A N/A Updates to installed Ubuntu packages. 
 containerd 1.1.6 1.1.7 See the [containerd release notes](https://github.com/containerd/containerd/releases/tag/v1.1.7). 







 Change log for worker node fix pack 1.11.9_1555, released 15 April 2019 

The following table shows the changes that are in the worker node fix pack 1.11.9_1555.



Changes since 1.11.9_1554

 Component Previous Current Description
Kubernetes configuration N/A N/A The Kubernetes API server audit policy configuration is updated to not log the /openapi/v2* read-only URL. In addition, the Kubernetes controller manager configuration increased the validity duration of signed kubelet certificates from 1 to 3 years. 
 OpenVPN client configuration N/A N/A The OpenVPN client vpn-* pod in the kube-system namespace now sets dnsPolicy to Default to prevent the pod from failing when cluster DNS is down. 
 Trusted compute agent e132aa4 13c7ef0 Updated image for [CVE-2016-7076](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7076), [CVE-2017-1000368](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000368), and [CVE-2019-11068](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11068). 







 Change log for worker node fix pack 1.13.5_1519, released 29 April 2019 

The following table shows the changes that are in the worker node fix pack 1.13.5_1519.



Table 1. Changes since version 1.13.5_1518

 Component Previous Current Description 

 Ubuntu packages N/A N/A Updates to installed Ubuntu packages. 
 containerd 1.2.5 1.2.6 See the [containerd release notes](https://github.com/containerd/containerd/releases/tag/v1.2.6). 







 Change log for worker node fix pack 1.13.5_1518, released 15 April 2019 

The following table shows the changes that are in the worker node fix pack 1.13.5_1518.



Table 1. Changes since version 1.13.5_1517

 Component Previous Current Description
Kubernetes DNS N/A N/A Increased Kubernetes DNS pod memory limit from 170Mi to 400Mi to handle more cluster services. 
 Load balancer and load balancer monitor for IBM Cloud Provider 132 143 Updated image for [CVE-2019-6486](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6486). 
 OpenVPN client and server 2.4.6-r3-IKS-13 2.4.6-r3-IKS-25 Updated image for [CVE-2019-1559](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1559). 
 Trusted compute agent 1ea5ad3 5f3d092 Updated image for [CVE-2019-6454](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6454). 







 Change log for worker node fix pack 1.10.12_1546, released 27 February 2019 

The following table shows the changes that are in the worker node fix pack 1.10.12_1546.



Table 1. Changes since version 1.10.12_1544

 Component Previous Current Description 

 Kernel 4.4.0-141 4.4.0-142 Updated worker node images with kernel update for [CVE-2018-19407](https://changelogs.ubuntu.com/changelogs/pool/main/l/linux/linux_4.4.0-142.168/changelog). 







 Change log for worker node fix pack 1.10.12_1544, released 15 February 2019 

The following table shows the changes that are in the worker node fix pack 1.10.12_1544.



Table 1. Changes since version 1.10.12_1543

 Component Previous Current Description
Create a Kubernetes secret configuration file that contains your Block Storage for Classic credentials.

kind: Secret
apiVersion: v1
metadata:
name: demo-secret
namespace: default
type: Opaque
stringData:
management_address: demo-management-address Example: baremetal-cluster.xiv.ibm.com
username: demo-username
data:
password: AAAA1AAA
2. Create the secret in your cluster.

oc apply -f <secret.yaml>
3. Create a storage class that uses the Block Storage for Classic driver.

kind: StorageClass
apiVersion: storage.k8s.io/v1
metadata:
name: demo-storageclass
provisioner: block.csi.ibm.com
parameters:
SpaceEfficiency: deduplicated Optional.
pool: demo-pool
csi.storage.k8s.io/provisioner-secret-name: demo-secret
csi.storage.k8s.io/provisioner-secret-namespace: default
csi.storage.k8s.io/controller-publish-secret-name: demo-secret
csi.storage.k8s.io/controller-publish-secret-namespace: default
csi.storage.k8s.io/controller-expand-secret-name: demo-secret
csi.storage.k8s.io/controller-expand-secret-namespace: default
csi.storage.k8s.io/fstype: xfs Optional. Values ext4xfs. The default is ext4.
volume_name_prefix: demoPVC Optional
allowVolumeExpansion: true
Show more
4. Create the storage class in your cluster.

oc apply -f sc.yaml
5. Verify that the storage class is created.

oc get sc
6. Create a PVC that references the storage class that you created earlier.

kind: PersistentVolumeClaim
apiVersion: v1
metadata:
For example, [Kubernetes does not support](https://kubernetes.io/releases/version-skew-policy/)oc client versions that are 2 or more versions apart from the server version (n +/- 2).



1. Verify that the oc CLI version that you run on your local machine matches the Kubernetes version that is installed in your cluster. Show the oc CLI version that is installed in your cluster and your local machine.

oc version

Example output:

Client Version: version.Info{Major:"1", Minor:"23", GitVersion:"v1.26", GitCommit:"641856db18352033a0d96dbc99153fa3b27298e5", GitTreeState:"clean", BuildDate:"2019-03-25T15:53:57Z", GoVersion:"go1.12.1", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"23", GitVersion:"v1.26+IKS", GitCommit:"e15454c2216a73b59e9a059fd2def4e6712a7cf0", GitTreeState:"clean", BuildDate:"2019-04-01T10:08:07Z", GoVersion:"go1.11.5", Compiler:"gc", Platform:"linux/amd64"}

The CLI versions match if you can see the same version in GitVersion for the client and the server. You can ignore the +IKS part of the version for the server.
2. If the oc CLI versions on your local machine and your cluster don't match, either update your cluster or [install a different CLI version on your local machine](https://cloud.ibm.com/docs/openshift?topic=openshift-cli-install).







 Checking and updating the Block Storage for Classic driver
With Kubernetes version 1.22 or later, you can use containerd configuration files on worker nodes to configure pulling from a container registry. You can use a daemonset to update the configurations across all nodes in a cluster, which prevents configurations from being wiped when worker nodes reload or when new workers are added.



 Example daemonset to update a containerd custom registry configuration 

Use the example YAML file to define a daemonset that runs on all worker nodes to set or update a containerd registry host configuration and mount to the corresponding containerd registry path.

The example sets the following registry host configuration for dockerhub. This registry host configuration is already provided and automatically configured during the worker provisioning phase. The init container initializes hosts.toml on every worker node after deployment and after worker nodes reload or restart.

server = "https://docker.io"
[host."https://registry-1.docker.io"]
capabilities = ["pull", "resolve"]

Example YAML file:

apiVersion: apps/v1
kind: DaemonSet
metadata:
labels:
name: containerd-dockerhub-registry-config
name: containerd-dockerhub-registry-config
namespace: kube-system
spec:
selector:
matchLabels:
name: containerd-dockerhub-registry-config
template:
metadata:
labels:
name: containerd-dockerhub-registry-config
spec:
initContainers:
- image: alpine:3.13.6
name: containerd-dockerhub-registry-config
command:
- /bin/sh
- -c
- 
!/bin/sh
set -uo pipefail
cat << EOF > /etc/containerd/certs.d/docker.io/hosts.toml
server = "https://docker.io"
[host."https://registry-1.docker.io"]
: Kubernetes version [1.19.4_1528](https://cloud.ibm.com/docs/containers?topic=containers-changelog_1191194_1528), [1.18.12_1534](https://cloud.ibm.com/docs/containers?topic=containers-118_changelog11812_1534), [1.17.14_1546](https://cloud.ibm.com/docs/containers?topic=containers-117_changelog11714_1546), and [1.16.15_1553](https://cloud.ibm.com/docs/containers?topic=containers-116_changelog11615_1553)..





 3 December 2020 

Cluster autoscaler add-on
: Patch update 1.0.1_146 is released. For more information, see the [Cluster autoscaler add-on change log](https://cloud.ibm.com/docs/openshift?topic=openshift-ca_changelog).

Istio add-on
: Versions [1.6.14](https://cloud.ibm.com/docs/containers?topic=containers-istio-changelog1614) and [1.7.5](https://cloud.ibm.com/docs/containers?topic=containers-istio-changelog175) of the Istio managed add-on are released.





 1 December 2020 

Default Kubernetes Ingress image
: In all new IBM Cloud Kubernetes Service clusters, default application load balancers (ALBs) now run the Kubernetes Ingress image. In existing clusters, ALBs continue to run the previously supported IBM Cloud Kubernetes Service Ingress image, which is now deprecated. For more information and migration actions, see [Setting up Kubernetes Ingress](https://cloud.ibm.com/docs/containers?topic=containers-managed-ingress-about).







 November 2020 



 24 November 2020 

New! Reservations to reduce classic worker node costs
Kubernetes resource permissions by service and corresponding RBAC roles

 Service access role Corresponding RBAC role, binding, and scope Kubernetes resource permissions 

 Reader role When scoped to one namespace: view cluster role applied by the ibm-view role binding in that namespace.<br><br><br><br> * When scoped to all namespaces: view cluster role applied by the ibm-view role binding in each namespace of the cluster. You can also view the cluster in the IBM Cloud console and CLI.<br><br><br> <br><br> * Read access to resources in a namespace<br> * No read access to roles and role bindings or to Kubernetes secrets<br> * Access the Red Hat OpenShift dashboard to view resources in a namespace.<br><br><br> 
 Writer role When scoped to one namespace: edit cluster role applied by the ibm-edit role binding in that namespace.<br><br>When scoped to all namespaces: edit cluster role applied by the ibm-edit role binding in each namespace of the cluster <br><br> * Read/write access to resources in a namespace<br> * No read/write access to roles and role bindings<<br> * Access the Kubernetes dashboard to view resources in a namespace.<br><br><br>
Kubernetes v1.12.9 v1.12.10 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.12.10). Update resolves [CVE-2019-11248](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11248). For more information, see [IBM security bulletin](https://www.ibm.com/support/pages/node/967113)). 
 Ubuntu packages N/A N/A Updated worker node images with package updates for [CVE-2019-13012](https://ubuntu.com/security/CVE-2019-13012) and [CVE-2019-7307](https://ubuntu.com/security/CVE-2019-7307.html). 







 Change log for master fix pack 1.12.10_1560, released 15 July 2019 

The following table shows the changes that are in the master fix pack 1.12.10_1560.



Changes since version 1.12.9_1559

 Component Previous Current Description 

 Calico v3.3.6 v3.6.4 See the [Calico release notes](https://docs.tigera.io/calico/latest/release-notes/.). Update resolves [TTA-2019-001](https://www.tigera.io/security-bulletins/TTA-2019-001). For more information, see the [IBM security bulletin](https://www.ibm.com/support/pages/node/959551). 
 CoreDNS configuration N/A N/A Changed the default CoreDNS configuration from a 5 to 30 second TTL for DNS records in the kubernetes zone. This change aligns with the default KubeDNS configuration. Existing CoreDNS configurations are unchanged.
Kubernetes v1.22.7 v1.22.8 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.22.8). 
 Load balancer and Load balancer monitor for IBM Cloud Provider 1747 1865 Updated the image to resolve CVEs. Updated to use Go version 1.17.8. Set gratuitous ARP at the correct time on LBv1. 
 Operator Lifecycle Manager 0.16.1-IKS-15 0.16.1-IKS-16 Resolve [CVE-2022-0778](https://nvd.nist.gov/vuln/detail/CVE-2022-0778). 
 Portieris admission controller v0.12.2 v0.12.3 See the [Portieris admission controller release notes](https://github.com/IBM/portieris/releases/tag/v0.12.3) 







 Change log for worker node fix pack 1.22.8_1546, released 28 March 2022 



Changes since version 1.22.7_1543

 Component Previous Current Description
* For Kubernetes audit logs and verbosity, see the [Kubernetes documentation](https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/).
* Only one audit webhook can be created in a cluster.
* You must have the [Administrator IBM Cloud IAM platform access role](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-perms) for the IBM Cloud Kubernetes Service cluster.



To get started, follow the instructions to send Kubernetes API audit logs [to a resource in the IBM Cloud private network](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server-priv), or [to an external server](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server-external).





 Forwarding Kubernetes API audit logs to Log Analysis 

To forward audit logs to IBM Log Analysis, you can create a Kubernetes audit system by using the provided image and deployment.

The following example uses the icr.io/ibm/ibmcloud-kube-audit-to-logdna image to forward logs to Log Analysis. This image is for demonstration purposes only. For a production solution, configure and maintain your own log forwarding image.

The Kubernetes audit system in your cluster consists of an audit webhook, a log collection service and web server app, and a logging agent. The webhook collects the Kubernetes API server events from your cluster master. The log collection service is a Kubernetes ClusterIP service that is created from an image from the public IBM Cloud registry. This service exposes a simple node.js HTTP web server app that is exposed only on the private network. The web server app parses the log data from the audit webhook and creates each log as a unique JSON line. Finally, the logging agent forwards the logs from the web server app to IBM Log Analysis, where you can view the logs.
Kubernetes v1.13.7 v1.13.8 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.13.8). Update resolves [CVE-2019-11248](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11248) (see [IBM security bulletin](https://www.ibm.com/support/pages/node/967113)). 
 Ubuntu packages N/A N/A Updated worker node images with package updates for [CVE-2019-13012](https://ubuntu.com/security/CVE-2019-13012) and [CVE-2019-7307](https://ubuntu.com/security/CVE-2019-7307.html). 







 Change log for master fix pack 1.13.8_1529, released 15 July 2019 

The following table shows the changes that are in the master fix pack 1.13.8_1529.



Table 1. Changes since version 1.13.7_1528

 Component Previous Current Description 

 Calico v3.4.4 v3.6.4 See the [Calico release notes](https://docs.tigera.io/calico/latest/release-notes/.). Update resolves [TTA-2019-001](https://www.tigera.io/security-bulletins/TTA-2019-001). For more information, see the [IBM security bulletin](https://www.ibm.com/support/pages/node/959551). 
 CoreDNS configuration N/A N/A Changed the default CoreDNS configuration from a 5 to 30 second TTL for DNS records in the kubernetes zone. This change aligns with the default KubeDNS configuration. Existing CoreDNS configurations are unchanged.