vania-janet/multiturn-rag-retrieval-data huggingface dataset:
[Set pod priority](https://cloud.ibm.com/docs/containers?topic=containers-pod_priority) to indicate the relative priority of the pods that make up your cluster's workload.
4. Authorize who can create and update pods by configuring [pod security policies (PSPs)](https://cloud.ibm.com/docs/containers?topic=containers-psp).









 Logging and monitoring 

Set up logging and monitoring to help you troubleshoot issues and improve the health and performance of your Kubernetes clusters and apps.



1. Cluster and app logging: [Choose a logging solution](https://cloud.ibm.com/docs/containers?topic=containers-healthlogging_overview), such as IBM® Log Analysis, to monitor container logs as well as user-initiated administrative activities.
2. Audit logging: [Forwarding Kubernetes API audit logs to IBM Log Analysis](https://cloud.ibm.com/docs/containers?topic=containers-health-audit)
3. Monitoring: [Choose a monitoring solution](https://cloud.ibm.com/docs/containers?topic=containers-health-monitorview_metrics), such as IBM Cloud® Monitoring, to gain operational visibility into the performance and health of your apps.



Need help? Check out [Troubleshooting logging and monitoring](https://cloud.ibm.com/docs/containers?topic=containers-cs_dashboard_graphs).





 Add a registry and CI/CD 

Set up an image registry and a continuous integration and delivery (CI/CD) pipeline for your cluster.



1. Registry: Choose and set up an [image registry](https://cloud.ibm.com/docs/containers?topic=containers-registry) so that developers can pull images from the registry in their app deployment YAML files.
2. CI/CD:



* Review available [options for automating app deployment](https://cloud.ibm.com/docs/containers?topic=containers-cicd).
5.1.5 IBM Cloud Kubernetes Service does not set [automountServiceAccountToken: false](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/use-the-default-service-account-to-access-the-api-server) for each default service account. 
 5.1.6 IBM Cloud Kubernetes Service deploys some system components that could set [automountServiceAccountToken: false](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/use-the-default-service-account-to-access-the-api-server). 
 5.2.1 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.2.2 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.2.3 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.2.4 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.2.5 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.2.6 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp).
* [Security services](https://cloud.ibm.com/docs/containers?topic=containers-supported_integrationssecurity_services)
* [Storage services](https://cloud.ibm.com/docs/containers?topic=containers-supported_integrationsstorage_services)
* [Database services](https://cloud.ibm.com/docs/containers?topic=containers-supported_integrationsdatabase_services)







 Default service settings for Kubernetes components 

[Default service settings for Kubernetes components](https://cloud.ibm.com/docs/containers?topic=containers-service-settingsservice-settings)



* [kube-apiserver](https://cloud.ibm.com/docs/containers?topic=containers-service-settingskube-apiserver)
* [kube-controller-manager](https://cloud.ibm.com/docs/containers?topic=containers-service-settingskube-controller-manager)
* [kubelet](https://cloud.ibm.com/docs/containers?topic=containers-service-settingskubelet)
* [kube-scheduler](https://cloud.ibm.com/docs/containers?topic=containers-service-settingskube-scheduler)
* [kube-proxy](https://cloud.ibm.com/docs/containers?topic=containers-service-settingskube-proxy)
* [Feature gates](https://cloud.ibm.com/docs/containers?topic=containers-service-settingsfeature-gates)







 Related links 

[Community Kubernetes documentation](https://kubernetes.io/docs/home/)

[IBM Developer - Containers](https://developer.ibm.com/technologies/containers/)

[IBM Developer - Kubernetes](https://developer.ibm.com/components/kubernetes/)





 VPC flavors
Provide the ability to set up private ALBs and public or private network load balancers (NLBs).<br> * Support native Kubernetes public and private load balancers and Ingress routes for exposing services externally.<br> * Install Calico as the container networking interface, and set up default Calico network policies to control basic cluster traffic.<br><br><br> <br><br> * Set up any additional app networking capabilities that are needed, such as private ALBs, public or private NLBs, or additional Calico network policies.<br><br><br> 
 Observability <br><br> * Provide Log Analysis and Monitoring as managed add-ons to enable observability of your cluster and container environments. Maintenance is simplified for you because IBM provides the installation and updates for the managed add-ons.<br> * Provide cluster integration with Activity Tracker and send IBM Cloud Kubernetes Service API events for auditability.<br><br><br> <br><br> * [Set up and monitor the health](https://cloud.ibm.com/docs/containers?topic=containers-health) of your container logs and cluster metrics.<br> * Set up and, if applicable, [configure kube-audit logs](https://cloud.ibm.com/docs/containers?topic=containers-health-audit) to be sent to [Activity Tracker](https://cloud.ibm.com/docs/containers?topic=containers-at_events).<br><br><br> 







 Change management 

You and IBM share responsibilities for keeping your clusters at the latest container platform and operating system versions, along with recovering infrastructure resources that might require changes. You are responsible for change management of your application data.



Table 3. Responsibilities for change management

 Resource IBM responsibilities Your responsibilities
[Set pod priority](https://cloud.ibm.com/docs/openshift?topic=openshift-pod_priority) to indicate the relative priority of the pods that make up your cluster's workload.
4. Authorize who can create and update pods by configuring [security context constraints (SCCs)](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scc).









 Logging and monitoring 

Set up logging and monitoring to help you troubleshoot issues and improve the health and performance of your Kubernetes clusters and apps.



1. Understand options: [Choose solutions for app and cluster logging, audit logging, and monitoring](https://cloud.ibm.com/docs/openshift?topic=openshift-healthoc_logmet_options) based on your needs.
2. Log Analysis and Monitoring: To monitor cluster health, forward logs to [IBM Log Analysis](https://cloud.ibm.com/docs/openshift?topic=openshift-healthopenshift_logging) and metrics to [IBM Cloud Monitoring](https://cloud.ibm.com/docs/openshift?topic=openshift-health-monitor).







 Add a registry and CI/CD 

Set up an image registry and a continuous integration and delivery (CI/CD) pipeline for your cluster.



1. Registry: Choose and set up an [image registry](https://cloud.ibm.com/docs/openshift?topic=openshift-registry) so that developers can pull images from the registry in their app deployment YAML files. Your cluster comes with the following default configurations that your developers can use.



* Internal Red Hat OpenShift container registry: The [internal registry](https://cloud.ibm.com/docs/openshift?topic=openshift-registryopenshift_internal_registry) is set up by default, with the images stored in an attached storage device.
: Added [steps](https://cloud.ibm.com/docs/containers?topic=containers-istio-healthistio_inspect) to launch the ControlZ component inspection and Envoy sidecar dashboards for the Istio managed add-on.

Tuning network performance
: Added [steps](https://cloud.ibm.com/docs/containers?topic=containers-kernelcalico-portmap) for disabling the portmap plug-in for for the Calico container network interface (CNI).

Use the internal KVDB in Portworx
: Automatically set up a key-value database (KVDB) during the Portworx installation to store your Portworx metadata. For more information, see [Using the Portworx KVDB](https://cloud.ibm.com/docs/containers?topic=containers-storage_portworx_kv_store).







 November 2019 



 26 November 2019 

CLI change log
: Updated the IBM Cloud Kubernetes Service CLI plug-in change log page for the [release of version 0.4.61](https://cloud.ibm.com/docs/containers?topic=containers-cs_cli_changelog).

Cluster autoscaling for VPC clusters
: You can [set up the cluster autoscaler](https://cloud.ibm.com/docs/containers?topic=containers-cluster-scaling-helm) on clusters that run on the first generation of compute for Virtual Private Cloud (VPC).

New! Reservations and limits for PIDs
: Worker nodes that run Kubernetes version 1.14 or later set [process ID (PID) reservations and limits that vary by flavor](https://cloud.ibm.com/docs/containers?topic=containers-planning_worker_nodesresource_limit_node), to help prevent malicious or runaway apps from consuming all available PIDs.

Version change log
: Worker node patch updates are available.
* Control network traffic to your apps for [classic](https://cloud.ibm.com/docs/containers?topic=containers-network_policies) and [VPC](https://cloud.ibm.com/docs/containers?topic=containers-vpc-network-policy) clusters.



Explore other capabilities for your cluster.



* Check out [IBM Cloud and 3rd-party services](https://cloud.ibm.com/docs/containers?topic=containers-supported_integrations), such as Portworx.
* Enhance your app lifecycle with [managed add-ons](https://cloud.ibm.com/docs/containers?topic=containers-managed-addons) like Istio.



Looking for an overview of all your options in IBM Cloud Kubernetes Service? Check out the curated [learning path for administrators](https://cloud.ibm.com/docs/containers?topic=containers-learning-path-admin) or [learning path for developers](https://cloud.ibm.com/docs/containers?topic=containers-learning-path-dev).
own, or other services to your cluster such as by using Operators, you are responsible for these services and for working with the appropriate provider to troubleshoot any issues.<br> * Use the provided tools and features to [configure and deploy](https://cloud.ibm.com/docs/containers?topic=containers-app); [keep up-to-date](https://cloud.ibm.com/docs/containers?topic=containers-update_appapp_rolling); [set up resource requests and limits](https://cloud.ibm.com/docs/containers?topic=containers-appresourcereq); [size your worker pool](https://cloud.ibm.com/docs/containers?topic=containers-strategysizing) to have enough resources to run your apps; [set up permissions](https://cloud.ibm.com/docs/containers?topic=containers-usersusers); [integrate with other services](https://cloud.ibm.com/docs/containers?topic=containers-supported_integrationssupported_integrations); [externally serve](https://cloud.ibm.com/docs/containers?topic=containers-cs_network_planningcs_network_planning); [save, back up, and restore data](https://cloud.ibm.com/docs/containers?topic=containers-storage-plan); and otherwise manage your [highly available](https://cloud.ibm.com/docs/containers?topic=containers-haha) and resilient workloads.<br><br><br>
1.2.22 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server). 
 1.2.23 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server). 
 1.2.24 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server). 
 1.2.25 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server). 
 1.2.33 IBM Cloud Kubernetes Service can optionally [enable a Kubernetes Key Management Service (KMS) provider](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkms). 
 1.2.34 IBM Cloud Kubernetes Service can optionally [enable a Kubernetes Key Management Service (KMS) provider](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkms). 
 1.3.6 IBM Cloud Kubernetes Service rotates certificates on every worker node reload or update. 
 3.2.1 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server). 
 3.2.2 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server).
5.2.2 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.2.3 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.2.4 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.2.5 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.2.6 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.2.7 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.2.8 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.2.9 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.3.2 IBM Cloud Kubernetes Service has a set of [default Calico and Kubernetes network policies defined](https://cloud.ibm.com/docs/containers?topic=containers-network_policiesdefault_policy) and [additional network policies can optionally be added](https://cloud.ibm.com/docs/containers?topic=containers-network_policiesadding_network_policies).
1.2.6 Ensure that the --kubelet-certificate-authority option is set as appropriate. Scored 1 Pass IBM 
 1.2.7 Ensure that the --authorization-mode option is not set to AlwaysAllow. Scored 1 Pass IBM 
 1.2.8 Ensure that the --authorization-mode option includes Node. Scored 1 Pass IBM 
 1.2.9 Ensure that the --authorization-mode option includes RBAC. Scored 1 Pass IBM 
 1.2.10 Ensure that the admission control plug-in EventRateLimit is set. Not Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-121cis-benchmark-remediations-121) IBM 
 1.2.11 Ensure that the admission control plug-in AlwaysAdmit is not set. Scored 1 Pass IBM 
 1.2.12 Ensure that the admission control plug-in AlwaysPullImages is set. Not Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-121cis-benchmark-remediations-121) IBM 
 1.2.13 Ensure that the admission control plug-in SecurityContextDeny is set if PodSecurityPolicy is not used. Not Scored 1 Pass IBM 
 1.2.14 Ensure that the admission control plug-in ServiceAccount is set. Scored 1 Pass IBM 
 1.2.15 Ensure that the admission control plug-in NamespaceLifecycle is set. Scored 1 Pass IBM 
 1.2.16 Ensure that the admission control plug-in PodSecurityPolicy is set. Scored 1 Pass IBM 
 1.2.17 Ensure that the admission control plug-in NodeRestriction is set. Scored 1 Pass IBM 
 1.2.18 Ensure that the --insecure-bind-address option is not set. Scored 1 Pass IBM 
 1.2.19 Ensure that the --insecure-port option is set to 0. Scored 1 Pass IBM 
 1.2.20 Ensure that the --secure-port option is not set to 0.
: Added steps for [exposing Istio-managed apps with TLS termination](https://cloud.ibm.com/docs/containers?topic=containers-istio-meshistio_expose_bookinfo_tls), [securing in-cluster traffic by enabling mTLS](https://cloud.ibm.com/docs/containers?topic=containers-istio-meshmtls), and [Updating the Istio add-ons](https://cloud.ibm.com/docs/containers?topic=containers-istioistio_update).

Knative
: Added instructions for how to use volumes to access secrets and config maps, pull images from a private registry, scale apps based on CPU usage, change the default container port, and change the scale-to-zero-grace-period.

Version change logs
: Updated the change logs for [1.15.2_1513](https://cloud.ibm.com/docs/containers?topic=containers-115_changelog1152_1513), [1.14.5_1529](https://cloud.ibm.com/docs/containers?topic=containers-114_changelog1145_1529), [1.13.9_1532](https://cloud.ibm.com/docs/containers?topic=containers-113_changelog1139_1532), and [1.12.10_1563](https://cloud.ibm.com/docs/containers?topic=containers-112_changelog11210_1563) master fix pack updates.





 12 August 2019 

CLI change log
: Updated the IBM Cloud Kubernetes Service CLI plug-in change log page for the [release of version 0.3.103](https://cloud.ibm.com/docs/containers?topic=containers-cs_cli_changelog).

Ingress ALB change log
* Consider [enabling the cluster autoscaler](https://cloud.ibm.com/docs/openshift?topic=openshift-cluster-scaling-classic-vpc) to automatically add or remove worker nodes in response to your cluster workload resource requests.
* Manually [resize your worker pool](https://cloud.ibm.com/docs/openshift?topic=openshift-add_workers) to remove worker nodes that you don't need. Keep in mind that you can't scale a worker pool down to zero worker nodes.
* Use Kubernetes features such as [horizontal pod autoscaling](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/), [pod priority](https://cloud.ibm.com/docs/openshift?topic=openshift-pod_priority), and [resource requests and limits](https://cloud.ibm.com/docs/containers?topic=containers-appresourcereq) to control how resources are used within your cluster.
* Consider setting up a [monitoring tool](https://cloud.ibm.com/docs/openshift?topic=openshift-health) such as IBM Cloud Monitoring and creating alerts for your workloads when they need more resources.



6. [View your usage](https://cloud.ibm.com/docs/billing-usage?topic=billing-usage-viewingusageviewingusage) to continuously refine how you consume IBM Cloud services.
7. [Set spending notifications](https://cloud.ibm.com/docs/billing-usage?topic=billing-usage-spending).
5.2.1 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.2.2 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.2.3 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.2.4 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.2.5 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.2.6 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.2.7 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.2.8 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp). 
 5.2.9 IBM Cloud Kubernetes Service can optionally [configure pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psp).
: Added a [troubleshooting section](https://cloud.ibm.com/docs/openshift?topic=openshift-debug_clusters) to the Creating a Red Hat OpenShift on IBM Cloud cluster tutorial.





 18 June 2019 

CLI change log
: Updated the IBM Cloud Kubernetes Service CLI plug-in change log page for the [release of versions 0.3.47 and 0.3.49](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_cli_changelog).

Ingress ALB change log
: Updated the [ALB nginx-ingress image to build 473 and ingress-auth image to build 331](https://cloud.ibm.com/docs/containers?topic=containers-cluster-add-ons-changelogkube_ingress_changelog).

Removing persistent storage
: Updated the information for how you are billed when you delete persistent storage.

Service bindings with private endpoint
: [Added steps](https://cloud.ibm.com/docs/openshift?topic=openshift-service-binding) for how to manually create service credentials with the private cloud service endpoint when you bind the service to your cluster.





 14 June 2019 

kubectl troubleshooting
: Added a [troubleshooting topic](https://cloud.ibm.com/docs/openshift?topic=openshift-ts_cliskubectl_fails) for when you have a kubectl client version that is 2 or more versions apart from the server version or the Red Hat OpenShift version of kubectl, which does not work with community Kubernetes clusters.

Tutorials landing page
: Replaced the related links page with a new tutorials landing page for all tutorials that are specific to Kubernetes Service.

Using existing subnets to create a cluster
: Updated the [steps](https://cloud.ibm.com/docs/containers?topic=containers-storage_cos_install) to install the IBM Cloud Object Storage plug-in with or without the Helm server, Tiller.

Ingress ALB change log
: Updated the [ALB nginx-ingress image to build 467](https://cloud.ibm.com/docs/containers?topic=containers-cluster-add-ons-changelogkube_ingress_changelog).

Kustomize
: Added an example of [reusing Kubernetes configuration files across multiple environments with Kustomize](https://cloud.ibm.com/docs/containers?topic=containers-appkustomize).

Razee
: Added [Razee](https://github.com/razee-io/Razee) to the supported integrations to visualize deployment information in the cluster and to automate the deployment of Kubernetes resources.







 May 2019 



 30 May 2019 

CLI reference
: Updated the [CLI reference page](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-cli) to reflect multiple changes for the [release of version 0.3.33](https://cloud.ibm.com/docs/containers?topic=containers-cs_cli_changelog) of the IBM Cloud Kubernetes Service CLI plug-in.

Troubleshooting storage
: Added a file and block storage troubleshooting topic for [PVC pending states](https://cloud.ibm.com/docs/containers?topic=containers-file_pvc_pending).



* Added a block storage troubleshooting topic for when [an app can't access or write to PVC](https://cloud.ibm.com/docs/containers?topic=containers-block_app_failures).







 28 May 2019 

Cluster add-ons change log
* Delete the cluster.







 Related content 



* [IBM Cloud Kubernetes Service](https://cloud.ibm.com/docs/containers)
* [Continuous Deployment to Kubernetes](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-continuous-deployment-to-kubernetescontinuous-deployment-to-kubernetes)
* [Scaling a deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/scaling-a-deployment)
* [Horizontal Pod Autoscaling](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough/)