vania-janet/multiturn-rag-retrieval-data huggingface dataset:
allow-sys-mgmt Allows incoming connections for specific IBM Cloud infrastructure systems that are used to manage the worker nodes. 
 allow-vrrp Allows VRRP packets, which monitor and move virtual IP addresses between worker nodes. 



Default Kubernetes policies that limits access to the Kubernetes Dashboard are also created. Kubernetes policies don't apply to the host endpoint, but at the pod-level instead, and to all classic and VPC clusters.



Default Kubernetes policies for each cluster

 Kubernetes policy Description 

 dashboard-metrics-scraper Kubernetes 1.20 or later: Provided in the kube-system namespace: Blocks all pods from accessing the Kubernetes Dashboard metrics scraper. This policy doesn't prevent the Kubernetes Dashboard from accessing the dashboard metrics. Further, this policy doesn't impact accessing the dashboard metrics from the IBM Cloud console or from using kubectl proxy. If a pod requires access to the dashboard metrics scraper, deploy the pod in a namespace that has the dashboard-metrics-scraper-policy: allow label. 
 kubernetes-dashboard Provided in the kube-system namespace: Blocks all pods from accessing the Kubernetes Dashboard. This policy doesn't impact accessing the dashboard from the IBM Cloud console or by using kubectl proxy. If a pod requires access to the dashboard, deploy the pod in a namespace that has the kubernetes-dashboard-policy: allow label. 







 Installing and configuring the Calico CLI 

To view, manage, and add Calico policies, install and configure the Calico CLI.



1. Set the context for your cluster to run Calico commands.



* Kubernetes version 1.19 and later:



1. Download the kubeconfig configuration file for your cluster.

ibmcloud ks cluster config --cluster <cluster_name_or_ID>
2. Set the DATASTORE_TYPE environment variable to kubernetes.

export DATASTORE_TYPE=kubernetes





2.
* [Observability: Monitoring](https://cloud.ibm.com/docs/containers?topic=containers-api-at-iamks-observability-monitoring)
* [Private service endpoint allowlist](https://cloud.ibm.com/docs/containers?topic=containers-api-at-iamks-acl)
* [Satellite](https://cloud.ibm.com/docs/containers?topic=containers-api-at-iamsat-api)
* [Storage](https://cloud.ibm.com/docs/containers?topic=containers-api-at-iamks-storage)
* [Worker nodes and worker pools](https://cloud.ibm.com/docs/containers?topic=containers-api-at-iamks-workers)







 IAM and user access permissions 

[Understanding user access permissions](https://cloud.ibm.com/docs/containers?topic=containers-access_referenceaccess_reference)



* [Permissions to create a cluster](https://cloud.ibm.com/docs/containers?topic=containers-access_referencecluster_create_permissions)



[IAM platform access roles](https://cloud.ibm.com/docs/containers?topic=containers-iam-platform-access-rolesiam-platform-access-roles)



* [Kubernetes Service](https://cloud.ibm.com/docs/containers?topic=containers-iam-platform-access-rolesiam-platform-access-roles-include-containers-kubernetes-roles)



[IAM service access roles](https://cloud.ibm.com/docs/containers?topic=containers-iam-service-access-rolesiam-service-access-roles)



* [Kubernetes Service](https://cloud.ibm.com/docs/containers?topic=containers-iam-service-access-rolesiam-service-access-roles-include-containers-kubernetes-roles)
The ID is used to create an IAM service policy for your service ID.

ibmcloud resource service-instance "<instance_name>" | grep GUID
8. [Create an IAM service policy](https://cloud.ibm.com/docs/cli/reference/ibmcloud?topic=cli-ibmcloud_commands_iamibmcloud_iam_service_policy_create) to grant your service ID access to your Key Protect instance. The following command grants your service ID Reader access to your Key Protect instance. The Reader access role is the minimum service access role that your service ID must have to retrieve Key Protect keys. For more information, see [Managing user access for Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-access).

ibmcloud iam service-policy-create <service_ID_name> --roles Reader --service-name kms --service-instance <service_instance_GUID>
9. Create another IAM service access policy to give your service ID access to your cluster. The following command grants the Viewer platform access role and the Writer service access role to your service ID for your cluster. You can retrieve your cluster ID by running ibmcloud ks cluster get <cluster_name>.

ibmcloud iam service-policy-create <service_ID_name> --roles Writer,Viewer --service-name containers-kubernetes --service-instance <cluster_ID>
10. If you already have the ibmcloud-block-storage-plugin Helm chart installed, you must remove the Helm chart and install a new version.

If you installed the plug-in without using Helm, you must manually remove the block storage plug-in deployment and all associated resources before installing a new version.

helm uninstall <name> <namespace>
11. Install the ibmcloud-block-storage-plugin Helm chart.

helm install <name> iks-charts/ibmcloud-block-storage-plugin
12. Create an ibm-block-secrets namespace.
1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root. Scored 1 Pass IBM 
 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600. Scored 1 Pass IBM 







 1.2 API server 



Section 1.2 API server benchmark results

 Section Recommendation Scored? Level Result Responsibility 

 1.2.1 Ensure that the --anonymous-auth option is set to false. Not Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-125cis-benchmark-remediations-125) IBM 
 1.2.2 Ensure that the --basic-auth-file option is not set. Scored 1 Pass IBM 
 1.2.3 Ensure that the --token-auth-file parameter is not set. Scored 1 Pass IBM 
 1.2.4 Ensure that the --kubelet-https option is set to true. Scored 1 Pass IBM 
 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key options are set as appropriate. Scored 1 Pass IBM 
 1.2.6 Ensure that the --kubelet-certificate-authority option is set as appropriate. Scored 1 Pass IBM 
 1.2.7 Ensure that the --authorization-mode option is not set to AlwaysAllow. Scored 1 Pass IBM 
 1.2.8 Ensure that the --authorization-mode option includes Node. Scored 1 Pass IBM 
 1.2.9 Ensure that the --authorization-mode option includes RBAC. Scored 1 Pass IBM 
 1.2.10 Ensure that the admission control plug-in EventRateLimit is set. Not Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-125cis-benchmark-remediations-125) IBM
* [Private service endpoint allowlist](https://cloud.ibm.com/docs/openshift?topic=openshift-api-at-iamks-acl)
* [Satellite](https://cloud.ibm.com/docs/openshift?topic=openshift-api-at-iamsat-api)
* [Storage](https://cloud.ibm.com/docs/openshift?topic=openshift-api-at-iamks-storage)
* [Worker nodes and worker pools](https://cloud.ibm.com/docs/openshift?topic=openshift-api-at-iamks-workers)







 IAM and user access permissions 

[Understanding user access permissions](https://cloud.ibm.com/docs/openshift?topic=openshift-access_referenceaccess_reference)



* [Permissions to create a cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-access_referencecluster_create_permissions)



[IAM platform access roles](https://cloud.ibm.com/docs/openshift?topic=openshift-iam-platform-access-rolesiam-platform-access-roles)



* [Kubernetes Service](https://cloud.ibm.com/docs/openshift?topic=openshift-iam-platform-access-rolesiam-platform-access-roles-include-containers-kubernetes-roles)



[IAM service access roles](https://cloud.ibm.com/docs/openshift?topic=openshift-iam-service-access-rolesiam-service-access-roles)



* [Kubernetes Service](https://cloud.ibm.com/docs/openshift?topic=openshift-iam-service-access-rolesiam-service-access-roles-include-containers-kubernetes-roles)
1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root. Scored 1 Pass IBM 
 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600. Scored 1 Pass IBM 







 1.2 API server 



Section 1.2 API server benchmark results

 Section Recommendation Scored? Level Result Responsibility 

 1.2.1 Ensure that the --anonymous-auth option is set to false. Not Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-124cis-benchmark-remediations-124) IBM 
 1.2.2 Ensure that the --basic-auth-file option is not set. Scored 1 Pass IBM 
 1.2.3 Ensure that the --token-auth-file parameter is not set. Scored 1 Pass IBM 
 1.2.4 Ensure that the --kubelet-https option is set to true. Scored 1 Pass IBM 
 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key options are set as appropriate. Scored 1 Pass IBM 
 1.2.6 Ensure that the --kubelet-certificate-authority option is set as appropriate. Scored 1 Pass IBM 
 1.2.7 Ensure that the --authorization-mode option is not set to AlwaysAllow. Scored 1 Pass IBM 
 1.2.8 Ensure that the --authorization-mode option includes Node. Scored 1 Pass IBM 
 1.2.9 Ensure that the --authorization-mode option includes RBAC. Scored 1 Pass IBM 
 1.2.10 Ensure that the admission control plug-in EventRateLimit is set. Not Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-124cis-benchmark-remediations-124) IBM
* [Allowing ingress from a cluster to another service](https://cloud.ibm.com/docs/containers?topic=containers-vpc-firewallvpc-allowlist_workers_ingress)
* [Allowing egress to a cluster from another service](https://cloud.ibm.com/docs/containers?topic=containers-vpc-firewallvpc-allowlist_workers_egress)



* [Updating IAM allowlists for Kubernetes Service IP addresses](https://cloud.ibm.com/docs/containers?topic=containers-vpc-firewalliam_allowlist_vpc)



[Managing security and compliance with Kubernetes](https://cloud.ibm.com/docs/containers?topic=containers-manage-security-compliancemanage-security-compliance)



* [Monitoring security and compliance posture with Kubernetes](https://cloud.ibm.com/docs/containers?topic=containers-manage-security-compliancemonitor-clusters)



* [Available goals for Kubernetes](https://cloud.ibm.com/docs/containers?topic=containers-manage-security-complianceclusters-available-goals)











 Managing the cluster network 



 Classic clusters 

[Configuring classic subnets and IP addresses](https://cloud.ibm.com/docs/containers?topic=containers-subnetssubnets)



* [Overview of classic networking in IBM Cloud Kubernetes Service](https://cloud.ibm.com/docs/containers?topic=containers-subnetsbasics)



* [VLANs](https://cloud.ibm.com/docs/containers?topic=containers-subnetsbasics_vlans)
* [Subnets and IP addresses](https://cloud.ibm.com/docs/containers?topic=containers-subnetsbasics_subnets)
* [Finding subnets provisioned in your account](https://cloud.ibm.com/docs/containers?topic=containers-subnetsfinding_subnets_account)
The security groups applied to a cluster cannot be changed once the cluster is created. You can [change the rules of the security groups](https://cloud.ibm.com/docs/containers?topic=containers-vpc-security-groupvpc-sg-create-rules) that are applied to the cluster, but you cannot add or remove security groups at the cluster level. If you apply the incorrect security groups at cluster create time, you must delete the cluster and create a new one. See [Adding VPC security groups to clusters and worker pools during create time](https://cloud.ibm.com/docs/containers?topic=containers-vpc-security-groupvpc-sg-cluster) for more details before adding security groups to your cluster.

--sm-group GROUP
: Optional. The secret group ID of the Secrets Manager instance where your secrets are persisted. To get a secret group ID, see the [Secrets Manager CLI reference](https://cloud.ibm.com/docs/secrets-manager-cli-plugin?topic=secrets-manager-cli-plugin-secrets-manager-clisecrets-manager-secret-groups-cli). Use this option to specify a [secret group](https://cloud.ibm.com/docs/secrets-manager-cli-plugin?topic=secrets-manager-cli-plugin-secrets-manager-clisecrets-manager-secret-groups-cli) that controls who on your team has access to cluster secrets.

--sm-instance INSTANCE
: Optional. The CRN of the Secrets Manager instance. To get the CRN of an instance, run ibmcloud ks ingress instance ls --cluster CLUSTER. Include this option if you want to register a Secrets Manager instance to the cluster.

--pod-subnet
: In the first cluster that you create in a VPC, the default pod subnet is 172.17.0.0/18. In the second cluster that you create in that VPC, the default pod subnet is 172.17.64.0/18.
Writer role When scoped to one namespace: edit cluster role applied by the ibm-edit role binding in that namespace.<br><br>When scoped to all namespaces: edit cluster role applied by the ibm-edit role binding in each namespace of the cluster <br><br> * Read/write access to resources in a namespace<br> * No read/write access to roles and role bindings<<br> * Access the Kubernetes dashboard to view resources in a namespace.<br><br><br> 
 Manager role When scoped to one namespace: admin cluster role applied by the ibm-operate role binding in that namespace<br><br>When scoped to all namespaces: cluster-admin cluster role applied by the ibm-admin cluster role binding that applies to all namespaces When scoped to one namespace:<br><br><br><br> * Read/write access to all resources in a namespace but not to resource quota or the namespace itself<br> * Create RBAC roles and role bindings in a namespace<br> * Access the Kubernetes dashboard to view all resources in a namespace <br> When scoped to all namespaces:<br> * Read/write access to all resources in every namespace<br> * Create RBAC roles and role bindings in a namespace or cluster roles and cluster role bindings in all namespaces<br> * Access the Kubernetes dashboard<br> * Create an Ingress resource that makes apps publicly available<br> * Review cluster metrics such as with the kubectl top pods, kubectl top nodes, or kubectl get nodes commands<br> * [Create and update privileged and unprivileged (restricted) pods](https://cloud.ibm.com/docs/containers?topic=containers-pspcustomize_psp)<br><br><br> 







 Kubernetes resource permissions per RBAC role 

Every user who is assigned an IBM Cloud IAM service access role is also automatically assigned a corresponding, predefined Kubernetes role-based access control (RBAC) role.
[Understanding access control for clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-access-overviewaccess-overview)



* [Access control checklist](https://cloud.ibm.com/docs/openshift?topic=openshift-access-overviewaccess-checklist)



* [IBM Cloud access control](https://cloud.ibm.com/docs/openshift?topic=openshift-access-overviewaccess-checklist-iam)
* [Other types of access control](https://cloud.ibm.com/docs/openshift?topic=openshift-access-overviewaccess-checklist-other)



* [Understanding IAM access policies and roles](https://cloud.ibm.com/docs/openshift?topic=openshift-access-overviewaccess_policies)



* [Pick the correct access policy and role for your users](https://cloud.ibm.com/docs/openshift?topic=openshift-access-overviewaccess_roles)
* [Assign access roles to individual or groups of users in IBM Cloud IAM](https://cloud.ibm.com/docs/openshift?topic=openshift-access-overviewiam_individuals_groups)
* [Scope user access to cluster instances, namespaces, or resource groups](https://cloud.ibm.com/docs/openshift?topic=openshift-access-overviewresource_groups)





[Setting up API key credentials so the service can access the infrastructure and other cloud services](https://cloud.ibm.com/docs/openshift?topic=openshift-access-credsaccess-creds)



* [Setting up the API key for most use cases](https://cloud.ibm.com/docs/openshift?topic=openshift-access-credsapi_key_most_cases)
Classic infrastructure > Devices > Check All virtual servers and Auto virtual server access ibmcloud sl user permission-edit <user_id> --permission ACCESS_ALL_GUEST --enable true 
 Access All Hardware Designate access to all bare metal worker nodes. Without this permission, a user who creates one cluster might not be able to view the bare metal worker nodes of another cluster even if the user has IAM access to both clusters. Classic infrastructure > Devices > Check All bare metal servers and Auto bare metal server access ibmcloud sl user permission-edit <user_id> --permission ACCESS_ALL_HARDWARE --enable true 
 Add Compute with Public Network Port Let worker nodes have a port that can be accessible on the public network. Classic infrastructure > Permissions > Network ibmcloud sl user permission-edit <user_id> --permission PUBLIC_NETWORK_COMPUTE --enable true 
 Manage DNS Set up public load balancer or Ingress networking to expose apps. Classic infrastructure > Permissions > Services ibmcloud sl user permission-edit <user_id> --permission DNS_MANAGE --enable true 
 Edit Hostname/Domain Set up public load balancer or Ingress networking to expose apps. Classic infrastructure > Permissions > Devices ibmcloud sl user permission-edit <user_id> --permission HOSTNAME_EDIT --enable true 
 Add IP Addresses Add IP addresses to public or private subnets that are used for cluster load balancing. Classic infrastructure > Permissions > Network ibmcloud sl user permission-edit <user_id> --permission IP_ADD --enable true 
 Manage Network Subnet Routes Manage public and private VLANs and subnets that are used for cluster load balancing. Classic infrastructure > Permissions > Network ibmcloud sl user permission-edit <user_id> --permission NETWORK_ROUTE_MANAGE --enable true 
 Manage Port Control Manage ports that are used for app load balancing. Classic infrastructure > Permissions > Devices ibmcloud sl user permission-edit <user_id> --permission PORT_CONTROL --enable true 
 Manage Certificates (SSL) Set up certificates that are used for cluster load balancing. Classic infrastructure > Permissions > Services ibmcloud sl user permission-edit <user_id> --permission SECURITY_CERTIFICATE_MANAGE --enable true
Manager role When scoped to one namespace: admin cluster role applied by the ibm-operate role binding in that namespace<br><br>When scoped to all namespaces: cluster-admin cluster role applied by the ibm-admin cluster role binding that applies to all namespaces When scoped to one namespace:<br><br><br><br> * Read/write access to all resources in a namespace but not to resource quota or the namespace itself<br> * Create RBAC roles and role bindings in a namespace<br> * Access the Kubernetes dashboard to view all resources in a namespace <br> When scoped to all namespaces:<br> * Read/write access to all resources in every namespace<br> * Create RBAC roles and role bindings in a namespace or cluster roles and cluster role bindings in all namespaces<br> * Access the Kubernetes dashboard<br> * Create an Ingress resource that makes apps publicly available<br> * Review cluster metrics such as with the kubectl top pods, kubectl top nodes, or kubectl get nodes commands<br> * [Create and update privileged and unprivileged (restricted) pods](https://cloud.ibm.com/docs/containers?topic=containers-pspcustomize_psp)<br><br><br> 







 Kubernetes resource permissions per RBAC role 

Every user who is assigned an IBM Cloud IAM service access role is also automatically assigned a corresponding, predefined Kubernetes role-based access control (RBAC) role. If you plan to manage your own custom Kubernetes RBAC roles, see [Creating custom RBAC permissions for users, groups, or service accounts](https://cloud.ibm.com/docs/containers?topic=containers-usersrbac). For the username details, see [IBM Cloud IAM issuer details for RBAC users](https://cloud.ibm.com/docs/containers?topic=containers-iam-service-access-rolesiam-issuer-users).
5. To get help and support for Maximo Application Suite as a Service, see the IBM support guide on IBM.com:

[https://www.ibm.com/support/pages/node/733923](https://www.ibm.com/support/pages/node/733923)
6. Register for Maximo Application Suite Onboarding Kick-Off Training. To register, see link below:

[https://ibm.webex.com/webappng/sites/ibm/webinar/webinarSeries/register/6f56e66f6c584bb3ac5dbd1a7601619f](https://ibm.webex.com/webappng/sites/ibm/webinar/webinarSeries/register/6f56e66f6c584bb3ac5dbd1a7601619f)

Maximo Application Suite Onboarding Kick-Off Meeting Deck:

[https://ibm.ent.box.com/s/3xixg4xr12rtzagrqumneo789yt3597r](https://ibm.ent.box.com/s/3xixg4xr12rtzagrqumneo789yt3597r)
For more information, see [Reviewing the Schematics job details](https://cloud.ibm.com/docs/schematics?topic=schematics-wks-state).

You can also view logs that are automatically generated for your Satellite location setup and collected in an IBM Log Analysis instance. For more information, see [Logging for Satellite](https://cloud.ibm.com/docs/satellite?topic=satellite-health).





 Feedback and questions 



1. Search for your question and post in the IBM Cloud [Slack](https://cloud.ibm.com/kubernetes/slack), in the satellite channel.
2. Review forums such as Stack Overflow to see whether other users ran into the same issue. When you use the forums to ask a question, tag your question so that it is seen by the IBM Cloud development teams.



* For questions about Satellite, use the tags ibm-cloud and satellite.
* If you have technical questions about developing or deploying clusters or apps with Red Hat OpenShift, post your question on [Stack Overflow](https://stackoverflow.com/questions/tagged/ibm-cloud+containers) and tag your question with ibm-cloud, openshift, and containers.
* See [Getting help](https://cloud.ibm.com/docs/get-support?topic=get-support-using-avatarusing-avatar) for more details about using the forums.









 Contacting support 



1. Before you open a support case, gather relevant information about your Satellite environment.



1. Get the details of the resource that you want help with troubleshooting, such as your Satellite location or a host.

ibmcloud sat location get --location <location_name_or_ID>

ibmcloud sat host get --location <location_name_or_ID> --host <host_ID>
2. For any hosts, include relevant details about the underlying infrastructure provider, such as if the host is in an Amazon Web Services, Google Cloud Platform, Microsoft Azure, or other environment.
3.
* By submitting the order, the client agrees to these terms and thus grants consent to IBM Support to access their instances at any time without prior notification to swiftly resolve issues that pertain to the environment or to prevent future failures.
* This consent applies to all instances currently being ordered throughout their lifecycle. Instances and instance components that are provisioned in the future might require additional consent.







 Steady-state operations 

If the client has not granted consent to proactive support for an instance in the initial provisioning and ordering, they must include explicit consent in any future service tickets, if wanted. Statements of consent must follow the set guidelines or will be considered void.





 Related links 



* [vCenter Server with Hybridity Bundle overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_hybrid_overview)
* [Contacting IBM Support](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-trbl_support)