vania-janet/multiturn-rag-retrieval-data huggingface dataset:
[Choose a monitoring solution](https://cloud.ibm.com/docs/containers?topic=containers-health-monitorview_metrics), such as IBM Cloud® Monitoring, to gain operational visibility into the performance and health of your apps.



3. Logging: [Choose a logging solution](https://cloud.ibm.com/docs/containers?topic=containers-healthlogging_overview), such as IBM® Log Analysis, to monitor container logs.



Need help? Check out [Troubleshooting logging and monitoring](https://cloud.ibm.com/docs/containers?topic=containers-cs_dashboard_graphs).





 Update your app 

Perform rolling updates and rollbacks of apps without downtime for your users.



1. Update strategy: [Plan your strategy for keeping your app up-to-date](https://cloud.ibm.com/docs/containers?topic=containers-update_appupdating_apps).
2. Set up updates:



* Add a [rolling update to your deployment file](https://cloud.ibm.com/docs/containers?topic=containers-update_appapp_rolling)
* Perform A/B, canary, and phased rollouts with the [Istio managed add-on](https://cloud.ibm.com/docs/containers?topic=containers-istio-qs).
* Set up [a continuous delivery pipeline for a cluster](https://cloud.ibm.com/docs/containers?topic=containers-cicd).



3. Scaling: Enable [horizontal pod autoscaling](https://cloud.ibm.com/docs/containers?topic=containers-update_appapp_scaling) to automatically increase or decrease the number of instances of your apps based on CPU.







 Secure your app 

Use Kubernetes secrets to store confidential information, such as credentials or keys, and encrypt data in Kubernetes secrets to prevent unauthorized users from accessing sensitive app information.



1. Secrets:



1.
1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root Scored 1 Pass IBM 
 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive Scored 1 Pass IBM 
 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 Scored 1 Pass IBM 







 1.2 API server 



Section 1.2 API server benchmark results

 Section Recommendation Scored? Level Result Responsibility 

 1.2.1 Ensure that the --anonymous-auth argument is set to false Not Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-remediations-127) IBM 
 1.2.2 Ensure that the --basic-auth-file argument is not set Scored 1 Pass IBM 
 1.2.3 Ensure that the --token-auth-file parameter is not set Scored 1 Pass IBM 
 1.2.4 Ensure that the --kubelet-https argument is set to true Scored 1 Pass IBM 
 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate Scored 1 Pass IBM 
 1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate Scored 1 Pass IBM 
 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow Scored 1 Pass IBM 
 1.2.8 Ensure that the --authorization-mode argument includes Node Scored 1 Pass IBM 
 1.2.9 Ensure that the --authorization-mode argument includes RBAC Scored 1 Pass IBM 
 1.2.10 Ensure that the admission control plugin EventRateLimit is set Not Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-127cis-benchmark-remediations-127) IBM 
 1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set Scored 1 Pass IBM
1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root Scored 1 Pass IBM 
 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive Scored 1 Pass IBM 
 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 Scored 1 Pass IBM 







 1.2 API server 



Section 1.2 API server benchmark results

 Section Recommendation Scored? Level Result Responsibility 

 1.2.1 Ensure that the --anonymous-auth argument is set to false Not Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-benchmark-remediations-126) IBM 
 1.2.2 Ensure that the --basic-auth-file argument is not set Scored 1 Pass IBM 
 1.2.3 Ensure that the --token-auth-file parameter is not set Scored 1 Pass IBM 
 1.2.4 Ensure that the --kubelet-https argument is set to true Scored 1 Pass IBM 
 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate Scored 1 Pass IBM 
 1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate Scored 1 Pass IBM 
 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow Scored 1 Pass IBM 
 1.2.8 Ensure that the --authorization-mode argument includes Node Scored 1 Pass IBM 
 1.2.9 Ensure that the --authorization-mode argument includes RBAC Scored 1 Pass IBM 
 1.2.10 Ensure that the admission control plugin EventRateLimit is set Not Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-benchmark-remediations-126) IBM 
 1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set Scored 1 Pass IBM
* [4.1 Worker node configuration files](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-49cis-benchmark-41-49)
* [4.2 Kubelet](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-49cis-benchmark-42-49)



* [5 Kubernetes policies](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-49cis-section-5-49)



* [5.1 RBAC and service accounts](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-49cis-benchmark-51-49)
* [5.2 Pod security policies](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-49cis-benchmark-52-49)
* [5.3 Network policies and CNI](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-49cis-benchmark-53-49)
* [5.4 Secrets management](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-49cis-benchmark-54-49)
* [5.5 Extensible admission control](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-49cis-benchmark-55-49)
* [5.6 General policies](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-49cis-benchmark-56-49)



* [IBM remediations and explanations](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-49ibm-remediations-and-explanations-49)
name: "http-server"
volumeMounts:
- mountPath: "/mnt/data"
name: task-pv-storage
Show more
2. Then, to copy data from your local machine to the pod you would use a command like this:

kubectl cp <local_filepath>/<filename> <namespace>/<pod>:<pod_filepath>
3. Copy data from a pod in your cluster to your local machine:

kubectl cp <namespace>/<pod>:<pod_filepath>/<filename> <local_filepath>/<filename>







 Set up backups for persistent storage 

File shares and block storage are provisioned into the same location as your cluster. The storage itself is hosted on clustered servers by IBM to provide high availability. However, file shares and block storage are not backed up automatically and might be inaccessible if the entire location fails. To protect your data from being lost or damaged, you can set up periodic backups, which you can use to restore your data when needed.

For more information, see [Planning for storage](https://cloud.ibm.com/docs/containers?topic=containers-storage-plan) options for NFS file storage and block storage.







 Prepare your code 



 Apply the 12-factor principles 

The [twelve-factor app](https://12factor.net/) is a methodology for building cloud native apps. When you want to containerize an app, move this app to the cloud, and orchestrate the app with Kubernetes, it is important to understand and apply some of these principles. Some of these principles are required in IBM Cloud.

The following key principles are required:



* Codebase - All source code and configuration files are tracked inside a version control system (for example a GIT repository), this is required if using DevOps pipeline for deployment.
* Build, release, run - The 12-factor app uses strict separation between the build, release, and run stages. This can be automated with an integrated DevOps delivery pipeline to build and test the app before deploying it to the cluster.
* [ibmcloud ks versions](https://cloud.ibm.com/docs/containers?topic=containers-icks_mapicks_map_versions)
* [ibmcloud ks api](https://cloud.ibm.com/docs/containers?topic=containers-icks_mapicks_map_api)
* [ibmcloud ks init](https://cloud.ibm.com/docs/containers?topic=containers-icks_mapicks_map_init)
* [ibmcloud ks script](https://cloud.ibm.com/docs/containers?topic=containers-icks_mapicks_map_script)
* [ibmcloud ks security-group](https://cloud.ibm.com/docs/containers?topic=containers-icks_mapicks_map_security_group)
* [ibmcloud ks storage](https://cloud.ibm.com/docs/containers?topic=containers-icks_mapicks_map_storage)



[IBM Cloud Kubernetes Service CLI reference](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clikubernetes-service-cli)



* [IBM Cloud Kubernetes Service commands](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clicli_commands)
* [cluster commands](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clicluster)



* [ibmcloud ks cluster addon disable](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_cluster_addon_disable)
* [ibmcloud ks cluster addon enable](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_cluster_addon_enable)
Provide the ability to set up private ALBs and public or private network load balancers (NLBs).<br> * Support native Kubernetes public and private load balancers and Ingress routes for exposing services externally.<br> * Install Calico as the container networking interface, and set up default Calico network policies to control basic cluster traffic.<br><br><br> <br><br> * Set up any additional app networking capabilities that are needed, such as private ALBs, public or private NLBs, or additional Calico network policies.<br><br><br> 
 Observability <br><br> * Provide Log Analysis and Monitoring as managed add-ons to enable observability of your cluster and container environments. Maintenance is simplified for you because IBM provides the installation and updates for the managed add-ons.<br> * Provide cluster integration with Activity Tracker and send Red Hat OpenShift on IBM Cloud API events for auditability.<br><br><br> <br><br> * [Set up and monitor the health](https://cloud.ibm.com/docs/containers?topic=containers-health) of your container logs and cluster metrics.<br> * Set up and, if applicable, [configure](https://cloud.ibm.com/docs/containers?topic=containers-health-audit)kube-audit logs to be sent to [Activity Tracker](https://cloud.ibm.com/docs/containers?topic=containers-at_events).<br><br><br> 







 Change management 

You and IBM share responsibilities for keeping your clusters at the latest container platform and operating system versions, along with recovering infrastructure resources that might require changes. You are responsible for change management of your application data.



Table 3. Responsibilities for change management

 Resource IBM responsibilities Your responsibilities
Provide the ability to set up private ALBs and public or private network load balancers (NLBs).<br> * Support native Kubernetes public and private load balancers and Ingress routes for exposing services externally.<br> * Install Calico as the container networking interface, and set up default Calico network policies to control basic cluster traffic.<br><br><br> <br><br> * Set up any additional app networking capabilities that are needed, such as private ALBs, public or private NLBs, or additional Calico network policies.<br><br><br> 
 Observability <br><br> * Provide Log Analysis and Monitoring as managed add-ons to enable observability of your cluster and container environments. Maintenance is simplified for you because IBM provides the installation and updates for the managed add-ons.<br> * Provide cluster integration with Activity Tracker and send Red Hat OpenShift on IBM Cloud API events for auditability.<br><br><br> <br><br> * [Set up and monitor the health](https://cloud.ibm.com/docs/containers?topic=containers-health) of your container logs and cluster metrics.<br> * Set up and, if applicable, [configure kube-audit logs](https://cloud.ibm.com/docs/openshift?topic=openshift-health-audit) to be sent to [Activity Tracker](https://cloud.ibm.com/docs/openshift?topic=openshift-at_events).<br><br><br> 







 Change management 

You and IBM share responsibilities for keeping your clusters at the latest container platform and operating system versions, along with recovering infrastructure resources that might require changes. You are responsible for change management of your application data.



Table 3. Responsibilities for change management

 Resource IBM responsibilities Your responsibilities
* [2 Etcd node configuration](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-section-2-126)
* [3 Control plane configuration](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-section-3-126)



* [3.1 Authentication and authorization](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-benchmark-31-126)
* [3.2 Logging](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-benchmark-32-126)



* [4 Worker node security configuration](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-section-4-126)



* [4.1 Worker node configuration files](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-benchmark-41-126)
* [4.2 Kubelet](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-benchmark-42-126)



* [5 Kubernetes policies](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-section-5-126)



* [5.1 RBAC and service accounts](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-benchmark-51-126)
* [5.2 Pod Security Policies](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-benchmark-52-126)
* [5.3 Network policies and CNI](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-benchmark-53-126)
* [Changing the number or duration of keepalive connections](https://cloud.ibm.com/docs/containers?topic=containers-comm-ingress-annotationskeepalive_time)
* [Changing the number of simultaneous connections or worker processes](https://cloud.ibm.com/docs/containers?topic=containers-comm-ingress-annotationsworker_processes_connections)
* [Changing the number of open files for worker processes](https://cloud.ibm.com/docs/containers?topic=containers-comm-ingress-annotationsmax-worker-files)
* [Tuning kernel performance](https://cloud.ibm.com/docs/containers?topic=containers-comm-ingress-annotationsingress_kernel)





[Observing Kubernetes Ingress](https://cloud.ibm.com/docs/containers?topic=containers-cs_ingress_monitorcs_ingress_monitor)



* [Setting up monitoring with IBM Cloud Monitoring](https://cloud.ibm.com/docs/containers?topic=containers-cs_ingress_monitoringress_health_mon)







 Managing certificates and secrets 

[Managing TLS and non-TLS certificates and secrets](https://cloud.ibm.com/docs/containers?topic=containers-secretssecrets)



* [Managing TLS certificates and secrets with Ingress](https://cloud.ibm.com/docs/containers?topic=containers-secretstls)



* [Setting up TLS secrets for the IBM-provided Ingress subdomain](https://cloud.ibm.com/docs/containers?topic=containers-secretstls-default)
* [Setting up TLS secrets for custom subdomains](https://cloud.ibm.com/docs/containers?topic=containers-secretstls-custom)



* [Managing non-TLS secrets](https://cloud.ibm.com/docs/containers?topic=containers-secretsnon-tls)
[Ansible](https://cloud.ibm.com/docs-content/v1/content/ba89e173287b28d1453d2a327d8a1f74ae2f1662/schematics/images/ansible.png) [Ansible](https://www.ansible.com/) is a configuration management and provisioning tool, similar to Chef and Puppet. It is designed to automate the configuration and management of environments, and deploy app workloads in the cloud. ![Check mark](https://cloud.ibm.com/docs-content/v1/content/ba89e173287b28d1453d2a327d8a1f74ae2f1662/schematics/images/checkmark.svg) ![Check mark](https://cloud.ibm.com/docs-content/v1/content/ba89e173287b28d1453d2a327d8a1f74ae2f1662/schematics/images/checkmark.svg) 
 ![Helm](https://cloud.ibm.com/docs-content/v1/content/ba89e173287b28d1453d2a327d8a1f74ae2f1662/schematics/images/helm.svg) [Helm](https://helm.sh/) is a Kubernetes package manager that uses Helm charts to define, install, and upgrade complex Kubernetes apps in an IBM Cloud Kubernetes Service cluster. ![Check mark](https://cloud.ibm.com/docs-content/v1/content/ba89e173287b28d1453d2a327d8a1f74ae2f1662/schematics/images/checkmark.svg) 
 !
: With operators, you can manage the lifecycle of the apps in your cluster, including third-party software and services that you integrate into your cluster from the [OperatorHub](https://operatorhub.io/). You can consistently install, update, and monitor system components by using operators or by making operators available to developers that work in specific projects or across projects. To set up operators, see [Using Operators in version 4 clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-operatorsoperators_4).

Razee
: [Razee](https://razee.io/) is an open-source project that automates and manages the deployment of Kubernetes resources across clusters, environments, and cloud providers, and helps you to visualize deployment information for your resources so that you can monitor the rollout process and find deployment issues more quickly. For more information about Razee and how to set up Razee in your cluster to automate your deployment process, see the [Razee documentation](https://github.com/razee-io/Razee).





 Setting up a continuous delivery pipeline for a cluster 

Adopt a DevOps approach by using IBM® Continuous Delivery Pipeline for IBM Cloud®, which includes open toolchains that automate the building and deployment of containerized apps.

Before you begin, make sure that you have at least the following permissions in IBM Cloud IAM:



* Editor platform access role and Writer service access role to the Kubernetes Service cluster. For more information, see [User access permissions](https://cloud.ibm.com/docs/openshift?topic=openshift-access_reference).
* Viewer platform access role to the resource group of the cluster where you want to create the toolchain.
* Editor platform access role to the Toolchain service (note that this service is separate than Continuous Delivery).



To add a continuous delivery pipeline to your cluster,



1.
What is Virtuozzo? 

Virtuozzo is a container-based virtualization solution that allows the sharing of hardware by using an abstraction layer. Virtuozzo creates containers, also known as VEs or VPSs, that simulate a server. The container acts and responds mostly as if it were a stand-alone server. The container is separate from other containers that are on the same physical server in that they cannot access other containers files, IPC resources, or memory. The network can be configured to be shared between multiple containers or isolated.

Virtuozzo is not a hypervisor or a software interface to a hypervisor. It operates in a mixture of kernel and user space within a proprietary kernel. This configuration allows containers to essentially borrow resources when needed, while the resources are available on the host node.

More information can be found at [Virtuozzo ![External link icon](https://cloud.ibm.com/docs-content/v1/content/icons/launch-glyph.svg)](https://virtuozzo.com/).
Learn about Code Engine 

IBM Cloud® Code Engine (or "Code Engine") was developed by IBM with the goal of helping you create modern, source-centric, containerized, and serverless apps and jobs. The platform is designed to address the needs of developers who just want their code to run. Code Engine abstracts the operational burden of building, deploying, and managing workloads in Kubernetes so that developers can focus on what matters most to them: the source code.



 Benefits of Code Engine 

Review the capabilities that Code Engine provides to run your workloads.



Table 1. Code Engine benefits

 Capability Description 

 Runs your workloads Code Engine runs your HTTP-driven applications and your run-to-completion batch jobs. 
 Fully managed service Code Engine takes care of all the cluster management, including provisioning, configuring, scaling, and managing servers so you do not need to worry about the underlying infrastructure. 
 Builds your code Code Engine pulls your source code and creates the container image for you. Code Engine supports both Dockerfile and Cloud Native Buildpack. 
 Private workloads Store your source code in private repositories and push your images to private registries and Code Engine can access them. 
 Fully integrated Code Engine is fully integrated into IBM Cloud so that you can take advantage of the full catalog of IBM Cloud services. 
 Event-driven workloads Extend the functionality of your applications with messages (events) from event producers. Your application can then react to those events and perform actions based on them. 
 Autoscales - even to zero Code Engine automatically scales your workloads up and down, and even down to zero when no requests are active. You pay for only the resources that you consume. 
 Control access Assign platform and services access permissions to your projects in IBM Cloud Identity and Access Management to control who can provision and manage resources in your IBM Cloud account. 
 Based on open source Code Engine is built on a set of open source technologies such as Kubernetes, Knative, Istio, and Tekton, keeping your apps and jobs portable. 
 DDoS protection Code Engine provides out-of-the-box DDoS protection for your application. Code Engine's DDoS protection is provided by Cloud Internet Services (CIS) at no additional cost to you.
Razee Deployment automation [Razee](https://razee.io/) is an open-source project that automates and manages the deployment of Kubernetes resources across clusters, environments, and cloud providers, and helps you to visualize deployment information for your resources so that you can monitor the rollout process and find deployment issues more quickly. For more information about Razee and how to set up Razee in your cluster to automate your deployment process, see the [Razee documentation](https://github.com/razee-io/Razee). Yes Yes 
 IBM Cloud Secrets Manager Ingress secrets and certificates You can use Secrets Manager to store and manage your Ingress secrets and certificates. For more information, see [Setting up Secrets Manager in your Kubernetes Service cluster](https://cloud.ibm.com/docs/containers?topic=containers-secrets-mgr). Yes Yes 
 IBM Cloud Schematics/ Terraform Infrastructure and IBM Cloud service automation Terraform is an open-source software that enables predictable and consistent provisioning of IBM Cloud platform, classic infrastructure, and VPC infrastructure resources by using a high-level scripting language. IBM Cloud Schematics delivers Terraform-as-a-Service so that you can model the resources that you want in your IBM Cloud environment, and enable Infrastructure as Code (IaC). For more information about how to use native Terraform to create a cluster, see [Creating single and multizone Kubernetes and Red Hat OpenShift clusters](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-tutorial-tf-clusters). Yes Yes 







 DevOps services 



Table 2. DevOps services

 Service Description Classic VPC 

 Cloud Foundry Public Deploy and manage your own Cloud Foundry platform on a Kubernetes cluster to develop, package, deploy, and manage cloud-native apps, and leverage the IBM Cloud ecosystem to bind additional services to your apps. When you create an Cloud Foundry Public instance, you must configure your Kubernetes cluster by choosing the flavor and VLANs for your worker nodes.