vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Use the [Deployments](https://cloud.ibm.com/docs/watson-knowledge-studio-data?topic=watson-knowledge-studio-data-managedeployments) and [StatefulSets](https://cloud.ibm.com/docs/watson-knowledge-studio-data?topic=watson-knowledge-studio-data-managestatefulsets) tables to determine the pod names of the components.

You can use the following command to check the status of each node.

kubectl get nodes -l node-role.kubernetes.io/worker=true





 Viewing logs from the IBM Cloud Pak for Data Logging dashboard 



1. Make sure an ELK stack is deployed to your cluster. See [IBM Cloud Private Logging](https://www.ibm.com/support/knowledgecenter/en/SSBS6K_3.1.2/manage_metrics/logging_elk.html) for more details.
2. Login to the ICP console of your cluster by accessing https://{cluster_CA_domain}:8443 using your Web browser.



* {cluster_CA_domain}: your cluster CA domain name. e.g., mycluster.icp.



3. Open Kibana by accessing Side Menu -> Platform -> Logging
4. Viewing and querying logs. See [Viewing and querying logs](https://www.ibm.com/support/knowledgecenter/en/SSBS6K_3.1.2/manage_metrics/logging_elk.htmlviewing-and-querying-logs) for more general information.



* To see all logs of your installation, query logs by kubernetes.pod:"{release_name}-. {release name} is the Helm release name of your installation.
* [Isolating clusters on the private network](https://cloud.ibm.com/docs/openshift?topic=openshift-network_policiesisolate_workers).







 Allowing traffic from your cluster in other services' allowlists or in on-premises allowlists 

If you want to access services that run inside or outside IBM Cloud or on-premises and that are protected by an allowlist, you can add the IP addresses of your worker nodes in that allowlist to allow outbound network traffic to your cluster. For example, you might want to read data from an IBM Cloud database that is protected by an allowlist, or specify your worker node subnets in an on-premises allowlist to allow network traffic from your cluster.



1. [Access your Red Hat OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-access_cluster).
2. Get the worker node subnets or the worker node IP addresses.



* Worker node subnets: If you anticipate changing the number of worker nodes in your cluster frequently, such as if you enable the [cluster autoscaler](https://cloud.ibm.com/docs/openshift?topic=openshift-cluster-scaling-classic-vpc), you might not want to update your allowlist for each new worker node. Instead, you can add the VLAN subnets that the cluster uses. Keep in mind that the VLAN subnet might be shared by worker nodes in other clusters. Note that the primary public subnets that Red Hat OpenShift on IBM Cloud provisions for your cluster come with 14 available IP addresses, and can be shared by other clusters on the same VLAN. When you have more than 14 worker nodes, another subnet is ordered, so the subnets that you need to allow can change. To reduce the frequency of change, create worker pools with worker node flavors of higher CPU and memory resources so that you don't need to add worker nodes as often.



1. List the worker nodes in your cluster.

ibmcloud oc worker ls --cluster <cluster_name_or_ID>
2.
ibmcloud ks worker-pool get --worker-pool WORKER_POOL --cluster CLUSTER [--output json] [-q]

Minimum required permissions
: Viewer platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-p, --worker-pool WORKER_POOL
: Required: The name of the worker node pool that you want to view the details of. To list available worker pools, run ibmcloud ks worker-pool ls --cluster <cluster_name_or_ID>.

-c, --cluster CLUSTER
: Required: The name or ID of the cluster where the worker pool is located.

--output json
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.



 Example worker-pool get command 

ibmcloud ks worker-pool get --worker-pool pool1 --cluster my_cluster







 ibmcloud ks worker-pool label rm 

Virtual Private Cloud

Classic infrastructure

Remove all custom Kubernetes labels from all worker nodes in a worker pool.

To remove an individual label from a worker pool, you can run the ibmcloud ks worker-pool label set command with only the custom labels that you want to keep.

ibmcloud ks worker-pool label rm --cluster CLUSTER --worker-pool POOL [-f] [-q]

Minimum required permissions
: Operator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster where the worker pool is located.

-p, --worker-pool WORKER_POOL
: Required: The name of the worker node pool that you want to view the details of. To list available worker pools, run ibmcloud ks worker-pool ls --cluster <cluster_name_or_ID>.

-f
: Optional: Force the command to run with no user prompts.

-q
: Optional: Do not show the message of the day or update reminders.



 Example worker-pool label rm command
ibmcloud oc cluster master audit-webhook set --cluster <cluster> --remote-server https://127.0.0.1:2040/api/v1/namespaces/ibm-kube-audit/services/kube-audit-forwarder/proxy/post --ca-cert <certificate-authority> --client-cert <client-certificate> --client-key <client-key>
10. Verify that the audit webhook is created in your cluster.

ibmcloud oc cluster master audit-webhook get --cluster <cluster_name_or_ID>

Example output

OK
Server: https://127.0.0.1:2040/api/v1/namespaces/ibm-kube-audit/services/kube-audit-forwarder/proxy/post
Policy: default
11. Apply the webhook to your Kubernetes API server by refreshing the cluster master. The master might take several minutes to refresh.

ibmcloud oc cluster master refresh --cluster <cluster_name_or_ID>



After the master refresh completes, your logs are sent to the private IP address of your logging resource.







 Worker node audit logs 

Red Hat OpenShift on IBM Cloud uses the Linux Auditing System component, auditd, to monitor and log activity on the worker nodes. Although worker node auditing is enabled by default, no auditing data is available until you set up log forwarding to a Log Analysis instance or external server.



 Understanding the worker node audit configuration 

The logs are stored in the /var/log/audit directory on the worker nodes. You can view the logs in Log Analysis or your external server after you set up log forwarding.

Auditd collects logs on various events, including the following:



* Linux system calls (syscalls)
* SELinux denials
* SELinux policy modifications
* Software modifications through the yum package installer
* Systemd operations
* Linux user and group modifications
* Netfilter change modifications
* SSH Logins







 Setting up log forwarding for worker nodes
* [Version 4.13 parameters](https://cloud.ibm.com/docs/openshift?topic=openshift-deploy-odf-classicodf-classic-params-413)
* [Version 4.10, 4.11, and 4.12 parameters](https://cloud.ibm.com/docs/openshift?topic=openshift-deploy-odf-classicodf-classic-params-410)
* [Version 4.9 parameters](https://cloud.ibm.com/docs/openshift?topic=openshift-deploy-odf-classicodf-classic-params-48)



* [Limitations](https://cloud.ibm.com/docs/openshift?topic=openshift-deploy-odf-classicodf-limitations-classic)



[Updating Classic worker nodes that use OpenShift Data Foundation](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift-storage-update-classicopenshift-storage-update-classic)



* [Update the cluster master](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift-storage-update-classicupdate-cluster-master-classic)
* [Determine which worker nodes you want to update](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift-storage-update-classicdetermine-worker-nodes-classic)
* [Scale down OpenShift Data Foundation](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift-storage-update-classicscale-down-odf-classic)
* [Cordon and drain the worker node](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift-storage-update-classiccordon-drain-worker-node-classic)
Make sure you include the --hard option.

ibmcloud oc worker reboot --cluster <cluster_name_or_id> --worker <worker_id> --hard
4. Mark the worker as available to be scheduled.

oc uncordon <worker_id>



For workers with the cx2d., bx2d., or mx2d. flavors:



1. Cordon the worker.

oc cordon <worker_id>
2. Drain the worker.

oc drain <worker_id>
3. Replace the worker. A new worker node is provisioned on a host that is not undergoing maintenance.

ibmcloud oc worker replace --cluster <cluster_name_or_ID> --worker <worker_node_ID>
Change log for worker node fix pack 1.22.2_1528, released 10 November 2021 

The following table shows the changes that are in the worker node fix pack patch update 1.22.2_1528. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.22.2_1527

 Component Previous Current Description 

 Ubuntu 18.04 packages N/A N/A Updated worker node image packages for [CVE-2020-16592](https://nvd.nist.gov/vuln/detail/CVE-2020-16592), [CVE-2020-27781](https://nvd.nist.gov/vuln/detail/CVE-2020-27781), [CVE-2021-25219](https://nvd.nist.gov/vuln/detail/CVE-2021-25219), [CVE-2021-3487](https://nvd.nist.gov/vuln/detail/CVE-2021-3487), [CVE-2021-3524](https://nvd.nist.gov/vuln/detail/CVE-2021-3524), [CVE-2021-3531](https://nvd.nist.gov/vuln/detail/CVE-2021-3531), and [CVE-2021-40490](https://nvd.nist.gov/vuln/detail/CVE-2021-40490). 







 Change log for master fix pack 1.22.2_1526, released 29 October 2021 

The following table shows the changes that are in the master fix pack update 1.22.2_1526. Master patch updates are applied automatically.



Changes since version 1.22.2_1522

 Component Previous Current Description
Review the change logs for Red Hat OpenShift on IBM Cloud version 3.11 patch updates.



 Change log for worker node fix pack 3.11.705_1634_openshift, released 7 June 2022 

The following table shows the changes that are in the worker node fix pack 3.11.705_1634_openshift. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 3.11.685_1632_openshift

 Component Previous Current Description 

 RHEL 7 Packages N/A N/A Worker node package updates for [CVE-2022-24903](https://nvd.nist.gov/vuln/detail/CVE-2022-24903). 
 Red Hat OpenShift on IBM Cloud node 3.11.685 3.11.705 See the [Red Hat OpenShift on IBM Cloud release notes](https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.htmlocp-3-11-705). 







 Change log for master fix pack 3.11.705_1633_openshift, released 3 June 2022 

The following table shows the changes that are in the master fix pack 3.11.705_1633_openshift. Master patch updates are applied automatically.



Changes since version 3.11.664_1629_openshift

 Component Previous Current Description 

 Cluster health image v1.1.36 v1.1.37 Updated Go to version 1.17.10 and also updated the dependencies. Update registry base image version to 104 
 IBM Cloud File Storage for Classic plug-in and monitor 408 410 Updated universal base image (UBI) to version 8.6-751 to resolve CVEs. 
 Key Management Service provider v1.0.26 v1.0.27 Updated Go to version 1.17.10 and updated the golang dependencies. 
 Load balancer and load balancer monitor for IBM Cloud Provider 1915 1997 Updated Go to version 1.17.10 and updated dependencies.
Follow the instructions in the [ibmcloud ks worker reload command](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_worker_reload) to safely reschedule any running pods on your worker node before you reload your worker node. Note that during the reload, your worker node machine is updated with the latest image and data is deleted if not [stored outside the worker node](https://cloud.ibm.com/docs/containers?topic=containers-storage-plan).



2. [Follow the instructions](https://cloud.ibm.com/docs/containers?topic=containers-helminstall_v3) to install the Helm version 3 client on your local machine.
3. Add the IBM Cloud Helm chart repository to the cluster where you want to use the IBM Cloud Block Storage for Classic plug-in.

If you enabled [VRF](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpointvrf) and [service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpointservice-endpoint) in your IBM Cloud account, you can use the private IBM Cloud Helm repository to keep your image pull traffic on the private network. If you can't enable VRF or service endpoints in your account, use the public registry domain: helm repo add iks-charts https://icr.io/helm/iks-charts.

helm repo add iks-charts https://icr.io/helm/iks-charts
4. Update the Helm repo to retrieve the latest version of all Helm charts in this repo.

helm repo update
5. Install the IBM Cloud Block Storage for Classic plug-in and give your installation a name, for example: block-storage-plugin. When you install the plug-in, pre-defined block storage classes are added to your cluster.

helm install <name> iks-charts/ibmcloud-block-storage-plugin -n <namespace>

Example output
Ubuntu 16.04 packages 4.4.0-194-generic 4.4.0-197-generic Updated worker node image with kernel and package updates for [CVE-2020-0427](https://nvd.nist.gov/vuln/detail/CVE-2020-0427), [CVE-2020-12352](https://nvd.nist.gov/vuln/detail/CVE-2020-12352), [CVE-2020-14351](https://nvd.nist.gov/vuln/detail/CVE-2020-14351), [CVE-2020-25645](https://nvd.nist.gov/vuln/detail/CVE-2020-25645), and [CVE-2020-4788](https://nvd.nist.gov/vuln/detail/CVE-2020-4788). 







 Change log for worker node fix pack 1.19.4_1527, released 23 November 2020 

The following table shows the changes that are in the worker node fix pack 1.19.4_1527. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.19.3_1526

 Component Previous Current Description 

 Kubernetes v1.19.3 v1.19.4 See the [Kubernetes change log](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.16.mdv1194).
* [Cordon and drain the worker node](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift-storage-update-vpccordon-drain-worker-node-vpc)
* [Upgrade the worker node](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift-storage-update-vpcupgrade-worker-node-vpc)
* [Clean up the resources from the old node](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift-storage-update-vpccleanup-os-storage-vpc)
* [Add the new storage node](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift-storage-update-vpcadd-storage-node-vpc)
* [Update the OpenShift Data Foundation add-on](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift-storage-update-vpcupdate-ocs-add-on-vpc)
* [Update your cluster resource](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift-storage-update-vpcupdate-ocs-resource-yaml-vpc)



[Installing OpenShift Data Foundation on a private cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift-storage-odf-privateopenshift-storage-odf-private)



* [Prerequisites](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift-storage-odf-privateodf-private-prereq)
* [Create an additional subnet in your VPC and attach a Public Gateway](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift-storage-odf-privateodf-storage-private-vm)
The update resolves CVE-2018-1002102 (see the [IBM security bulletin](https://www.ibm.com/support/pages/node/6404300)) and CVE-2020-8559 (see the [IBM security bulletin](https://www.ibm.com/support/pages/node/6404296)). 







 Change log for worker node fix pack 3.11.346_1576_openshift, released 21 December 2020 

The following table shows the changes that are in the worker node fix pack update 3.11.346_1576_openshift. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 3.11.318_1575_openshift

 Component Previous Current Description 

 HA proxy db4e6d 9b2dca Image update for [CVE-2020-1971](https://nvd.nist.gov/vuln/detail/CVE-2020-1971) and [CVE-2020-24659](https://nvd.nist.gov/vuln/detail/CVE-2020-24659). 
 Red Hat OpenShift node 3.11.318 3.11.346 See the [Red Hat OpenShift release notes](https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.htmlocp-3-11-346).
The following table shows the changes that are in the worker node fix pack update 3.11.272_1565_openshift. Worker node patch updates can be applied by updating or reloading the worker node



Changes since version 3.11.248_1564_openshift

 Component Previous Current Description 

 RHEL 7 packages 3.10.0-1127.18.2.el7 3.10.0-1127.19.1.el7 Updated worker node image with kernel and package updates. 
 Red Hat OpenShift node 3.11.248 3.11.272 See the [Red Hat OpenShift release notes](https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.htmlocp-3-11-272). 







 Change log for master fix pack 3.11.248_1564_openshift, released 18 August 2020 

The following table shows the changes that are in the master fix pack patch update 3.11.248_1564_openshift. Master patch updates are applied automatically.



Changes since version 3.11.232_1561_openshift

 Component Previous Current Description 

 Calico node configuration N/A N/A Disabled the pod readiness probe and removed the felix check from the pod liveness probe. 
 Cluster health image v1.1.8 v1.1.9 Updated to use Go version 1.13.13. 
 IBM Cloud File Storage for Classic plug-in and monitor 376 377 Fixed a bug that prevents persistent volume claim (PVC) creation failures from being retried. 
 Key Management Service provider v1.0.0 v1.0.1 Updated image for [CVE-2020-15586](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15586).
Load balancer and load balancer monitor for IBM Cloud Provider 1004 1078 Updated image for [CVE-2020-1971](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1971). 







 Change log for worker node fix pack 1.16.15_1557, released 18 January 2021 

The following table shows the changes that are in the worker node fix pack 1.16.15_1557. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.16.15_1555

 Component Previous Current Description 

 Ubuntu 16.04 packages 4.4.0-197-generic 4.4.0-200-generic Updated worker node image with kernel and package updates for [CVE-2018-20482](https://nvd.nist.gov/vuln/detail/CVE-2018-20482), [CVE-2019-9923](https://nvd.nist.gov/vuln/detail/CVE-2019-9923), [CVE-2020-28374](https://nvd.nist.gov/vuln/detail/CVE-2020-28374), [CVE-2020-29361](https://nvd.nist.gov/vuln/detail/CVE-2020-29361) external}, and [CVE-2020-29362](https://nvd.nist.gov/vuln/detail/CVE-2020-29362) external}.
: For classic clusters in Tokyo, updated the Red Hat OpenShift on IBM Cloud IP addresses that you must open in a [public gateway firewall device](https://cloud.ibm.com/docs/openshift?topic=openshift-firewallfirewall_outbound) or [Calico network isolation policies](https://github.com/IBM-Cloud/kube-samples/tree/master/calico-policies/public-network-isolation).

Worker node versions
: Worker node fix pack update change log documentation is available.
: [4.5.22_1524_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-changelog_archive4522_1524), [4.4.31_1528_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-changelog_archive4431_1528), [4.3.40_1549_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-changelog_archive4340_1549), and [3.11.346_1576_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_changelog_311311346_1576_master).





 18 December 2020 

CLI change log
: Updated the Red Hat OpenShift on IBM Cloud CLI plug-in change log page for the [release of version 1.0.208](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_cli_changelog10).

IBM Cloud Object Storage plug-in
: Version 2.0.6 of the IBM Cloud Object Storage plug-in is released. For more information, see the [IBM Cloud Object Storage plug-in change log](https://cloud.ibm.com/docs/openshift?topic=openshift-cos_plugin_changelog).





 17 December 2020 

Audit documentation
4.12.13 4.12.16 For more information, see the [change log](https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.htmlocp-4-12-16). 







 Change log for worker node fix pack 4.12.16_1544_openshift, released 23 May 2023 

The following table shows the changes that are in the worker node fix pack 4.12.16_1544_openshift. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 4.12.15_1542_openshift

 Component Previous Current Description 

 Red Hat OpenShift on IBM Cloud. 4.12.15 4.12.16 see [change logs](https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.htmlocp-4-12-16).
Change log for worker node fix pack 1.21.5_1538, released 10 November 2021 

The following table shows the changes that are in the worker node fix pack patch update 1.21.5_1538. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 1.21.5_1537

 Component Previous Current Description 

 Ubuntu 18.04 packages N/A N/A Updated worker node image packages for [CVE-2020-16592](https://nvd.nist.gov/vuln/detail/CVE-2020-16592), [CVE-2020-27781](https://nvd.nist.gov/vuln/detail/CVE-2020-27781), [CVE-2021-25219](https://nvd.nist.gov/vuln/detail/CVE-2021-25219), [CVE-2021-3487](https://nvd.nist.gov/vuln/detail/CVE-2021-3487), [CVE-2021-3524](https://nvd.nist.gov/vuln/detail/CVE-2021-3524), [CVE-2021-3531](https://nvd.nist.gov/vuln/detail/CVE-2021-3531), and [CVE-2021-40490](https://nvd.nist.gov/vuln/detail/CVE-2021-40490). 







 Change log for master fix pack 1.21.5_1536, released 29 October 2021 

The following table shows the changes that are in the master fix pack update 1.21.5_1536. Master patch updates are applied automatically.



Changes since version 1.21.5_1531

 Component Previous Current Description
Ubuntu 16.04 packages 4.4.0-173-generic 4.4.0-174-generic Updated worker node images with kernel and package updates for [CVE-2019-20096](https://nvd.nist.gov/vuln/detail/CVE-2019-20096), [CVE-2016-9840](https://nvd.nist.gov/vuln/detail/CVE-2016-9840), [CVE-2016-9841](https://nvd.nist.gov/vuln/detail/CVE-2016-9841), [CVE-2016-9842](https://nvd.nist.gov/vuln/detail/CVE-2016-9842), and [CVE-2016-9843](https://nvd.nist.gov/vuln/detail/CVE-2016-9843). 







 Change log for fix pack 1.16.7_1524, released 17 February 2020 

The following table shows the changes that are in the master and worker node fix pack update 1.16.7_1524. Master patch updates are applied automatically. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node. For more information, see [Update types](https://cloud.ibm.com/docs/containers?topic=containers-cs_versionsupdate_types).



Changes since version 1.16.5_1523

 Component Location Previous Current Description 

 containerd Worker v1.3.2 v1.3.3 See [containerd release notes](https://github.com/containerd/containerd/releases/tag/v1.3.3).