Site map

Getting started with IBM Cloud Kubernetes Service

Getting started with IBM Cloud Kubernetes Service

• Review the basics

• Prepare your account

• Create a cluster environment strategy

• Create a cluster

• Deploy a sample app

• What's next?

Understanding IBM Cloud Kubernetes Service

Understanding IBM Cloud Kubernetes Service

• What is Kubernetes?

• What are containers?

• What compute host infrastructure does IBM Cloud Kubernetes Service offer?

• What are the benefits of using the service?

• Comparison between Red Hat OpenShift and Kubernetes clusters

• Related resources

Your responsibilities with using IBM Cloud Kubernetes Service

Your responsibilities with using IBM Cloud Kubernetes Service

• Overview of shared responsibilities

• Tasks for shared responsibilities by area

  • Incident and operations management

  • Change management

  • Identity and access management

  • Security and regulation compliance

  • Disaster recovery

  • Applications and data

Use cases

Overview of use cases

Financial services use cases for IBM Cloud

• Mortgage company trims costs and accelerates regulatory compliance

  • Context

  • Solution

  • Results

• Payment tech company streamlines developer productivity, deploying AI-enabled tools to their partners 4 times faster

  • Context

  • Solution

  • Results

Healthcare use cases for IBM Cloud

• Healthcare provider migrates workloads from inefficient VMs to Ops-friendly containers for reporting and patient systems

  • Context

  • Solution

  • Results

• Research nonprofit securely hosts sensitive data while it grows research with partners

  • Context

  • Solution

  • Results

Retail use cases for IBM Cloud

• Brick-and-mortar retailer shares data, by using APIs with global business partners to drive omnichannel sales

  • Context

  • Solution

  • Results

• Traditional grocer increases customer traffic and sales with digital insights

  • Context

  • Results

Transportation use cases for IBM Cloud

• Shipping company increases availability of worldwide systems for business partner ecosystem

  • Context

  • Solution

  • Results

• Airline delivers innovative Human Resources (HR) benefits site in under 3 weeks

  • Context

  • Solution

  • Results

Government use cases for IBM Cloud

• Regional government improves collaboration and velocity with community Developers who combine public-private data

  • Context

  • Solution

  • Results

• Large public port secures exchange of port data and shipping manifests that connect public and private organizations

  • Context

  • Solution

  • Results

Learning paths

Learning path for administrators

• Plan your environment

• Create a cluster

• Manage the network

• Secure your cluster

• Logging and monitoring

• Add a registry and CI/CD

• Add storage

• Add integrations

• Manage the lifecycle

Learning path for developers

• Access the cluster

• Plan your deployment

• Develop your app

• Deploy your app

• Test, log, and monitor

• Update your app

• Secure your app

• Expose your app

• Add app storage

• Add integrations

Release notes

Release notes

• October 2025

  • 22 October 2025

    • CLI version 1.0.727 is available.

  • 21 October 2025

    • IBM Cloud Kubernetes Service worker node fix packs are available.

  • 14 October 2025

    • Ingress ALB cluster add-on patch updates.

  • 13 October 2025

    • New! General availability of the IBM Cloud Object Storage cluster add-on

  • 08 October 2025

    • IBM Cloud Kubernetes Service worker node fix packs are available.

  • 06 October 2025

    • Version 1.33 is now the default version for IBM Cloud Kubernetes Service.

  • 03 October 2025

    • IBM Cloud Kubernetes Service master fix packs.

  • 02 October 2025

    • CLI version 1.0.724 is available.

• September 2025

  • 30 September 2025

    • Security Bulletin: IBM Cloud Kubernetes Service is affected by Kubernetes API server security vulnerabilities

  • 25 September 2025

    • CLI version 1.0.718 is available.

  • 23 September 2025

    • IBM Cloud Kubernetes Service worker node fix packs are available.

  • 22 September 2025

    • Cluster autoscaler add-on patch updates for IBM Cloud Kubernetes Service.

    • VPC File CSI Driver cluster add-on patch updates.

    • IBM Storage Operator cluster add-on patch updates.

  • 16 September 2025

    • Ingress ALB cluster add-on patch updates.

  • 09 September 2025

    • IBM Cloud Kubernetes Service worker node fix packs are available.

  • 08 September 2025

    • New! Version support timelines

  • 04 September 2025

    • CLI version 1.0.717 is available.

• August 2025

  • 26 August 2025

    • IBM Cloud Kubernetes Service worker node fix packs are available.

  • 22 August 2025

    • IBM Storage Operator cluster add-on patch updates.

    • VPC File CSI Driver cluster add-on patch updates.

    • IBM Cloud Kubernetes Service master fix packs.

  • 20 August 2025

    • IBM Cloud Object Storage plug-in updates.

  • 19 August 2025

    • ALB OAuth Proxy cluster add-on patch updates.

    • Ingress ALB cluster add-on patch updates.

  • 14 August 2025

    • IBM Cloud Kubernetes Service worker node fix packs are available.

    • CLI version 1.0.715 is available.

  • 12 August 2025

    • IBM Cloud Kubernetes Service version 1.33 Kubernetes certification

  • 08 August 2025

    • Trusted profiles

  • 05 August 2025

    • CLI version 1.0.714 is available.

    • IBM Cloud Object Storage plug-in updates.

• July 2025

  • 31 July 2025

    • IBM Cloud Kubernetes Service master fix packs.

    • New! IBM Cloud Kubernetes Service version 1.33.

    • IBM Cloud Kubernetes Service version 1.30 is deprecated.

    • IBM Cloud Kubernetes Service version 1.29 is unsupported.

  • 30 July 2025

    • IBM Cloud Kubernetes Service worker node fix packs are available.

  • 25 July 2025

    • Cluster autoscaler add-on patch updates for IBM Cloud Kubernetes Service.

  • 22 July 2025

    • ALB OAuth Proxy cluster add-on patch updates.

  • 21 July 2025

    • Ingress ALB cluster add-on patch updates.

  • 18 July 2025

    • IBM Storage Operator cluster add-on patch updates.

    • VPC File CSI Driver cluster add-on patch updates.

    • Cluster autoscaler add-on patch updates for IBM Cloud Kubernetes Service.

  • 17 July 2025

    • Ingress ALB cluster add-on patch updates.

  • 15 July 2025

    • IBM Cloud Kubernetes Service worker node fix packs are available.

  • 14 July 2025

    • VPC Block CSI Driver cluster add-on patch updates.

  • 01 July 2025

    • IBM Cloud Kubernetes Service worker node fix packs are available.

• June 2025

  • 23 June 2025

    • ALB OAuth Proxy cluster add-on patch updates.

  • 18 June 2025

    • IBM Cloud Kubernetes Service master fix packs.

  • 17 June 2025

    • Ingress ALB cluster add-on patch updates.

  • 16 June 2025

    • CLI version 1.0.706 is available.

    • IBM Cloud Kubernetes Service worker node fix packs are available.

    • IBM Storage Operator cluster add-on patch updates.

    • VPC File CSI Driver cluster add-on patch updates.

  • 04 June 2025

    • IBM Cloud Kubernetes Service worker node fix packs are available.

  • 02 June 2025

    • VPC Block CSI Driver cluster add-on patch updates.

    • Ingress ALB cluster add-on patch updates.

• May 2025

  • 30 May 2025

    • IBM Cloud Kubernetes Service version 1.28 is unsupported.

    • Ubuntu 20 is unsupported.

  • 28 May 2025

    • IBM Cloud Kubernetes Service master fix packs.

  • 20 May 2025

    • IBM Cloud Kubernetes Service worker node fix packs are available.

  • 15 May 2025

    • New! Montreal multizone region

  • 09 May 2025

    • VPC Block CSI Driver cluster add-on patch updates.

  • 07 May 2025

    • IBM Cloud Kubernetes Service worker node fix packs are available.

    • Ingress ALB cluster add-on patch updates.

• April 2025

  • 30 April 2025

    • IBM Cloud Kubernetes Service master fix packs.

  • 29 April 2025

    • Istio add-on patch updates.

  • 27 April 2025

    • ALB OAuth Proxy cluster add-on patch updates.

  • 24 April 2025

    • IBM Cloud Object Storage plug-in updates.

  • 22 April 2025

    • Cluster autoscaler add-on patch updates for IBM Cloud Kubernetes Service.

    • IBM Cloud Kubernetes Service worker node fix packs are available.

  • 21 April 2025

    • Ingress ALB cluster add-on patch updates.

  • 08 April 2025

    • IBM Cloud Object Storage plug-in updates.

  • 07 April 2025

    • Ingress ConfigMap change log updates

  • 02 April 2025

    • Ingress ALB cluster add-on patch updates.

  • 01 April 2025

    • Creating Ubuntu 20 clusters or worker pools in cluster versions 1.29 - 1.31 is no longer supported.

• March 2025

  • 27 March 2025

    • IBM Cloud Kubernetes Service master fix packs.

  • 25 March 2025

    • Ingress ALB cluster add-on patch updates.

  • 24 March 2025

    • IBM Cloud Kubernetes Service worker node fix packs are available.

  • 17 March 2025

    • Ingress ALB cluster add-on patch updates.

  • 13 March 2025

    • CLI version 1.0.687 is available.

    • ALB OAuth Proxy cluster add-on patch updates.

  • 11 March 2025

    • IBM Cloud Kubernetes Service worker node fix packs are available.

    • Ingress ALB cluster add-on patch updates.

  • 10 March 2025

    • Cluster autoscaler add-on patch updates for IBM Cloud Kubernetes Service.

    • IBM Cloud Object Storage plug-in updates.

  • 05 March 2025

    • Version 1.32 is now the default version for IBM Cloud Kubernetes Service.

    • Migrating from the Observability plug-in to IBM Cloud Logs

  • 04 March 2025

    • Istio add-on patch updates.

• February 2025

  • 26 February 2025

    • Ingress ALB cluster add-on patch updates.

  • 24 February 2025

    • IBM Cloud Kubernetes Service worker node fix packs are available.

  • 19 February 2025

    • IBM Cloud File Storage for VPC cluster add-on patch updates.

    • IBM Cloud Kubernetes Service master fix packs.

  • 17 February 2025

    • CLI version 1.0.679 is available.

    • Block Storage for VPC cluster add-on patch updates.

  • 12 February 2025

    • IBM Cloud Kubernetes Service worker node fix packs are available.

  • 11 February 2025

    • CLI version 1.0.677 is available.

  • 10 February 2025

    • New! Worker node flavors with H200 GPU support are available on an allowlist basis for VPC clusters.

  • 06 February 2025

    • Static Route cluster add-on patch updates.

• January 2025

  • 30 January 2025

    • IBM Cloud Kubernetes Service worker node fix packs are available.

  • 29 January 2025

    • New! IBM Cloud Kubernetes Service version 1.32.

  • 28 January 2025

    • Istio add-on patch updates.

  • 24 January 2025

    • IBM Cloud Object Storage plug-in updates.

  • 23 January 2025

    • IBM Cloud Kubernetes Service master fix packs.

  • 13 January 2025

    • IBM Cloud Kubernetes Service worker node fix packs are available.

  • 08 January 2025

    • Ingress ALB cluster add-on patch updates.

  • 06 January 2025

    • IBM Cloud Kubernetes Service worker node fix packs are available.

• December 2024

  • 16 December 2024

    • IBM Cloud Kubernetes Service worker node fix packs are available.

  • 11 December 2024

    • Block Storage for VPC add-on versions 5.1.31_656 and 5.2.26_657.

    • IBM Cloud File Storage for VPC cluster add-on patch updates.

    • Storage Operator cluster add-on patch update.

  • 05 December 2024

    • IBM Cloud Kubernetes Service worker node fix packs are available.

  • 04 December 2024

    • IBM Cloud Kubernetes Service master fix packs.

  • 03 December 2024

    • Istio add-on patch updates.

    • Ingress ALB cluster add-on patch updates.

• November 2024

  • 21 November 2024

    • IBM Cloud Object Storage plug-in updates.

  • 20 November 2024

    • Ubuntu 24 is now the default operating system for IBM Cloud Kubernetes Service versions 1.29 and 1.30.

    • Block Storage for VPC cluster add-on patch updates.

  • 19 November 2024

    • CLI version 1.0.674 is available.

  • 18 November 2024

    • IBM Cloud Kubernetes Service worker node fix packs are available.

  • 14 November 2024

    • Secure by default networking can now be enabled on VPC clusters that were created before 1.30.

    • CLI version 1.0.673 is available.

  • 13 November 2024

    • IBM Cloud Kubernetes Service master fix packs.

  • 07 November 2024

    • New! A new tutorial is available for IBM Cloud Kubernetes Service that covers how to migrate from a private service endpoint allowlist (PSE) to context based restrictions (CBR).

  • 05 November 2024

    • IBM Cloud Kubernetes Service worker node fix packs are available.

• October 2024

  • 31 October 2024

    • ALB OAuth Proxy cluster add-on patch updates.

    • Version 1.31 is now the default version for IBM Cloud Kubernetes Service.

  • 30 October 2024

    • IBM Cloud Kubernetes Service master fix packs.

  • 21 October 2024

    • IBM Cloud Kubernetes Service worker node fix packs are available.

  • 17 October 2024

    • Ingress ALB cluster add-on patch updates.

  • 11 October 2024

    • Istio add-on patch update 1.22.5 has been reverted.

  • 10 October 2024

    • Istio add-on patch updates.

  • 09 October 2024

    • Ubuntu 20 for IBM Cloud Kubernetes Service clusters is deprecated and support ends on 31 May 2025.

    • IBM Cloud Kubernetes Service worker node fix packs.

  • 07 October 2024

    • New! The gx3d.160x1792.8h100 worker node flavor with H100 GPU support is available for VPC clusters.

  • 03 October 2024

    • Block Storage for VPC cluster add-on patch updates.

    • IBM Cloud File Storage for VPC cluster add-on patch updates.

    • Storage Operator cluster add-on patch update.

    • Static route add-on version patch update.

  • 01 October 2024

    • New! The IBM Cloud Object Storage cluster add-on is available in Beta for allowlisted accounts.

• September 2024

  • 26 September 2024

    • IBM Cloud Object Storage plug-in updates.

  • 25 September 2024

    • IBM Cloud Kubernetes Service master fix packs.

  • 24 September 2024

    • Ubuntu 24 is now available for IBM Cloud Kubernetes Service clusters.

    • IBM Cloud Object Storage plug-in updates.

  • 23 September 2024

    • Ingress ALB cluster add-on patch updates.

    • IBM Cloud Kubernetes Service worker node fix packs.

  • 20 September 2024

    • IBM Cloud Kubernetes Service version 1.31 Kubernetes certification

    • Istio add-on version 1.23.1 is available.

  • 18 September 2024

    • IBM Cloud Kubernetes Service CLI plug-in version 1.0.665 is available.

    • New! IBM Cloud Kubernetes Service version 1.31.

    • IBM Cloud Kubernetes Service version 1.28 is deprecated.

    • IBM Cloud Kubernetes Service version 1.27 is unsupported.

    • Istio add-on version 1.22.4 is available.

  • 16 September 2024

    • New! The IBM Cloud® and Compliance Center Workload Protection integration is available for VPC clusters in the UI.

  • 12 September 2024

    • Ingress ALB patch updates.

  • 10 September 2024

    • CLI version 1.0.657 is available.

    • IBM Cloud Kubernetes Service worker node fix packs.

• August 2024

  • 29 August 2024

    • IBM Cloud Object Storage plug-in updates.

  • 28 August 2024

    • IBM Cloud Kubernetes Service master fix packs.

  • 27 August 2024

    • Ingress ALB cluster add-on patch updates.

  • 26 August 2024

    • IBM Cloud File Storage for VPC cluster add-on patch updates.

    • Storage Operator cluster add-on patch update.

    • IBM Cloud Kubernetes Service worker node fix packs.

  • 23 August 2024

    • CLI version 1.0.652 is available.

  • 22 August 2024

    • New audit events for cluster operations

  • 20 August 2024

    • Istio add-on versions 1.22.3, 1.21.5, and 1.20.8 are available.

• July 2024

  • 31 July 2024

    • IBM Cloud Kubernetes Service master fix packs.

    • IBM Cloud Object Storage plug-in updates.

  • 29 July 2024

    • IBM Cloud Kubernetes Service worker node fix packs.

  • 17 July 2024

    • IBM Cloud Object Storage plug-in updates.

    • IBM Cloud Kubernetes Service CLI version 1.0.640 is available.

  • 15 July 2024

    • IBM Cloud Kubernetes Service worker node fix packs.

    • Block Storage for VPC cluster add-on patch updates.

    • IBM Cloud File Storage for VPC cluster add-on patch updates.

    • Storage Operator cluster add-on patch update.

    • Cluster autoscaler add-on patch updates for IBM Cloud Kubernetes Service.

  • 12 July 2024

    • IBM Cloud Kubernetes Service CLI version 1.0.638 is available.

  • 11 July 2024

    • Ingress ALB updates are available for IBM Cloud Kubernetes Service.

  • 10 July 2024

    • IBM Cloud Kubernetes Service CLI version 1.0.635 is available.

  • 9 July 2024

    • IBM Cloud Kubernetes Service CLI version 1.0.632 is available.

    • IBM Cloud Kubernetes Service worker node fix packs.

  • 3 July 2024

    • IBM Cloud File Storage for VPC add-on version 2.0 is available in Beta.

• June 2024

  • 24 June 2024

    • Version 1.30 is the default version for IBM Cloud Kubernetes Service.

    • Ubuntu 24 in Beta

    • Storage optimized flavors for IBM Cloud Kubernetes Service VPC clusters

    • IBM Cloud Kubernetes Service CLI version 1.0.630 is available.

  • 21 June 2024

    • Cluster autoscaler add-on patch updates for IBM Cloud Kubernetes Service.

    • Block Storage for VPC add-on patch updates.

    • IBM Cloud File Storage for VPC add-on patch updates.

  • 20 June 2024

    • Cluster autoscaler add-on patch update for IBM Cloud Kubernetes Service.

    • Ingress ALB updates are available for IBM Cloud Kubernetes Service.

    • Istio add-on versions 1.22.1 is available.

  • 19 June 2024

    • IBM Cloud Kubernetes Service master and worker node fix packs.

    • Istio add-on versions 1.21.3 and 1.20.7 are available.

  • 17 June 2024

    • IBM Cloud Kubernetes Service CLI version 1.0.628 is available.

  • 5 June 2024

    • IBM Cloud Object Storage plug-in version 2.2.26.

  • 4 June 2024

    • IBM Cloud Kubernetes Service worker node fix packs.

    • ALB OAuth Proxy add-on patch updates.

  • 3 June 2024

    • IBM Cloud Kubernetes Service version 1.26 is no longer supported.

  • 30 May 2024

    • Ingress ALB updates are available for IBM Cloud Kubernetes Service.

  • 29 May 2024

    • New! IBM Cloud Kubernetes Service version 1.30.

    • IBM Cloud Kubernetes Service version 1.30 Kubernetes certification

    • Important networking changes for IBM Cloud Kubernetes Service VPC clusters created at version 1.30.

    • Important changes to the default cluster provisioning behavior for new VPC clusters beginning with version 1.30.

    • Managing outbound traffic protection in new version 1.30 VPC clusters.

    • IBM Cloud Kubernetes Service version 1.27 is deprecated.

    • IBM Cloud Kubernetes Service master fix packs.

  • 23 May 2024

    • IBM Cloud Kubernetes Service worker node fix packs.

  • 10 May 2024

    • Block Storage for VPC add-on patch update.

    • IBM Cloud File Storage for VPC add-on patch update.

    • Istio add-on version 1.19 is no longer supported.

  • 08 May 2024

    • Istio add-on versions 1.21.2 and 1.20.6 are available.

    • ALB OAuth Proxy add-on patch updates.

  • 07 May 2024

    • IBM Cloud Kubernetes Service worker node fix packs.

  • 05 May 2024

    • IBM Cloud Kubernetes Service cluster autoscaler add-on patch updates.

  • 02 May 2024

    • IBM Cloud Kubernetes Service CLI version 1.0.618 is available.

• April 2024

  • 29 April 2024

    • Ingress ConfigMap update

  • 24 April 2024

    • IBM Cloud Kubernetes Service master and worker node fix packs.

    • Istio add-on versions 1.21.1, 1.20.5, and 1.19.9 are available.

    • IBM Cloud Object Storage plug-in version 2.2.25.

    • IBM Cloud Kubernetes Service CLI version 1.0.617 is available.

  • 18 April 2024

    • IBM Cloud Kubernetes Service CLI version 1.0.613 is available.

  • 09 April 2024

    • Worker node fix packs are available for IBM Cloud Kubernetes Service.

  • 03 April 2024

    • Istio add-on patch updates.

    • ALB OAuth Proxy add-on patch updates.

    • IBM Cloud Kubernetes Service cluster autoscaler add-on patch updates.

    • Version 1.0.9 of the cluster autoscaler add-on is deprecated with an end of support date of 30 April 2024.

• March 2024

  • 27 March 2024

    • Master patch updates for IBM Cloud Kubernetes Service clusters. Master patches are applied automatically over the course of several days. You can choose to use the ibmcloud ks cluster master update command yourself without waiting for the update automation to apply the patch. Review the change logs for your cluster version.

  • 25 March 2024

    • Worker node fix packs are available for IBM Cloud Kubernetes Service.

    • New! NVIDIA L40 GPU support. You can now create VPC clusters with worker nodes which have NVIDIA L40 GPUs.

  • 18 March 2024

    • Ingress ALB updates are available for IBM Cloud Kubernetes Service.

  • 15 March 2024

    • Worker node fix packs are available for IBM Cloud Kubernetes Service.

    • Version 1.29 is the default version for IBM Cloud Kubernetes Service.

  • 08 March 2024

    • Block Storage for VPC add-on patch updates.

    • IBM Cloud File Storage for VPC add-on patch update.

  • 06 March 2024

    • Istio add-on versions 1.20.3 and 1.19.7 are available.

    • CLI version 1.0.601 is available.

• February 2024

  • 28 February 2024

    • IBM Cloud Kubernetes Service cluster autoscaler version 1.2.1 is available.

    • Master patch updates for IBM Cloud Kubernetes Service clusters. Master patches are applied automatically over the course of several days. You can choose to use the ibmcloud ks cluster master update command yourself without waiting for the update automation to apply the patch. Review the change logs for your cluster version.

  • 27 February 2024

    • Worker node fix packs are available for IBM Cloud Kubernetes Service.

    • CLI version 1.0.597 is available.

  • 26 February 2024

    • New! NVIDIA L4 GPU support. You can now create VPC clusters with worker nodes which have NVIDIA L4 GPUs.

    • Ingress ALB patch updates 1.9.4_6376_iks, 1.8.4_6375_iks, and 1.6.4_6374_iks for IBM Cloud Kubernetes Service.

    • New worker node flavors are available with L4 GPUs.

  • 22 February 2024

    • IBM Cloud Object Storage plug-in version 2.2.24.

  • 21 February 2024

    • Kubernetes version 1.29 certification

    • IBM Cloud Kubernetes Service cluster autoscaler add-on patch updates 1.0.9_377 and 1.2.0_365.

  • 19 February 2024

    • Ingress ALB versions 1.9.4_6359_iks and 1.8.4_6363_iks are available for IBM Cloud Kubernetes Service.

  • 16 February 2024

    • IBM Cloud Kubernetes Service cluster autoscaler add-on patch update 1.1.0_362.

  • 14 February 2024

    • New! IBM Cloud Kubernetes Service version 1.29.

    • Master fix pack 1.29.1_1524 and worker node fix pack 1.29.1_1525.

    • Starting with IBM Cloud Kubernetes Service version 1.29, Calico components run in the calico-system namespace and the Tigera operator components run in the tigera-operator namespace.

    • IBM Cloud Kubernetes Service version 1.26 is deprecated.

  • 13 February 2024

    • Worker node fix packs are available for IBM Cloud Kubernetes Service.

    • Ingress ALB versions 1.9.4_6346_iks, 1.8.4_6345_iks, 1.6.4_6344_iks are available for IBM Cloud Kubernetes Service.

  • 08 February 2024

    • CLI version 1.0.595 is available.

    • Block Storage for VPC add-on versions 5.2.15_501 and 5.1.21_506 are available.

    • IBM Cloud File Storage for VPC add-on version 1.2.6_130 is available.

  • 07 February 2024

    • Istio add-on versions 1.20.2, 1.19.6, and 1.18.7 are available.

  • 05 February 2024

    • Ingress ALB updates

  • 01 February 2024

    • Master fix packs are available for IBM Cloud Kubernetes Service

    • IBM Cloud Kubernetes Service version 1.25 is no longer supported.

    • IBM Cloud Kubernetes Service cluster autoscaler add-on patch update 1.0.8_346.

• January 2024

  • 30 January 2024

    • Worker node fix packs are available.

  • 29 January 2024

    • IBM Cloud Object Storage plug-in version 2.2.23.

  • 22 January 2024

    • Ingress ALB updates

  • 19 January 2024

    • CLI version 1.0.589 is available.

  • 17 January 2024

    • Worker node fix packs are available.

  • 16 January 2024

    • Cluster autoscaler add-on patch updates 1.2.0_322 and 1.0.9_328.

    • ALB OAuth Proxy add-on version 2.0.0_2063.

  • 10 January 2024

    • Subscribe to the IBM Cloud documentation release notes via RSS.

    • Ingress ALB updates

    • Istio cluster add-on versions 1.20.0, 1.19.5, and 1.18.6.

    • Istio add-on version 1.18 will no longer be supported on 21 February 2024

    • IBM Cloud File Storage for VPC cluster add-on patch update 1.2.5_107.

    • Block Storage for VPC cluster add-on patch updates 5.2.14_485 and 5.1.19_486.

  • 2 January 2024

    • Worker node fix packs are available.

• December 2023

  • 18 December 2023

    • Worker node fix packs are available.

  • 14 December 2023

    • Information on worker node removal priority.

    • Kubernetes version 1.24 is unsupported.

  • 8 December 2023

    • Security Bulletin: IBM Cloud Kubernetes Service is affected by Kubernetes API server security vulnerabilities

  • 7 December 2023

    • Istio add-on version 1.20.0.

  • 6 December 2023

    • Master fix packs are available.

  • 5 December 2023

    • Istio add-on version 1.19.4.

  • 4 December 2023

    • Ingress ALB updates

    • Worker node fix packs are available.

• November 2023

  • 29 November 2023

    • Worker node fix packs are available.

  • 27 November 2023

    • The Beta File Storage for VPC cluster add-on is now available to all accounts.

    • Cluster autoscaler add-on patch updates 1.2.0_290, 1.0.9_290, 1.0.8_292, and 1.0.7_291.

    • Block Storage for VPC add-on versions 5.0.23_437 and 5.1.16_446, and 5.2.11_447.

    • IBM Cloud File Storage for VPC add-on patch 1.1.10_93 and 1.2.3_97.

  • 21 November 2023

    • Ingress ALB updates

  • 20 November 2023

    • You can now specify a custom pod subnet size when creating a VPC cluster.

    • IBM Cloud Object Storage plug-in version 2.2.22.

  • 15 November 2023

    • The cluster autoscaler add-on now supports version 1.28 clusters.

    • Master fix packs are available.

  • 13 November 2023

    • IBM Cloud Object Storage plug-in version 2.2.21.

    • Block Storage for VPC add-on versions 5.0.21_401 and 5.1.15_419, and 5.2.10_428.

    • Cluster autoscaler add-on patch updates 1.0.9_195, 1.0.8_233, and 1.0.7_185.

    • IBM Cloud File Storage for VPC add-on patch 1.1.9_87.

  • 10 November 2023

    • Updated sorting and formatting for the Classic and VPC cluster flavor pages.

  • 9 November 2023

    • Worker node fix packs are available.

  • 7 November 2023

    • CLI version 1.0.579 is available.

    • Ingress ALB updates

  • 06 November 2023

    • Kubernetes version 1.28 is now the default version for new IBM Cloud Kubernetes Service clusters.

• October 2023

  • 31 October 2023

    • VNI functionality for limiting access to File Storage for VPC by node, zone, worker pool and more.

    • IBM Cloud File Storage for VPC add-on version 1.2.

  • 30 October 2023

    • IBM Cloud Object Storage plug-in version 2.2.20

    • Setting up alerts for Block Storage for Classic PVs with limited network connectivity.

  • 25 October 2023

    • Master fix packs are available.

    • ALB OAuth Proxy add-on version 2.0.0_1901.

  • 23 October 2023

    • Worker node fix packs are available.

    • Ingress ALB version 1.8.4_5586_ikss

  • 18 October 2023

    • Istio add-on version 1.18.5 and 1.17.8.

    • ALB OAuth Proxy add-on version 2.0.0_1889.

  • 17 October 2023

    • Ingress ALB versions 1.8.1_5543_iks, 1.6.4_5544_iks, and 1.5.1_5542_iks

  • 11 October 2023

    • Ingress ALB versions 1.5.1_5436_iks, 1.6.4_5435_iks, and 1.8.1_5434_iks

    • IBM Cloud Object Storage plug-in version 2.2.19

  • 10 October 2023

    • CLI version 1.0.573 is available.

    • Istio add-on version 1.19.3.

  • 9 October 2023

    • Worker node fix packs are available.

  • 5 October 2023

    • Ingress ALB versions 1.8.1_5384_iks, 1.6.4_5406_iks, and 1.5.1_5407_iks

  • 4 October 2023

    • Cluster autoscaler add-on version 1.0.9_134.

  • 3 October 2023

    • Istio add-on versions 1.17.6 and 1.18.3.

• September 2023

  • 27 September 2023

    • Worker node fix packs are available.

  • 26 September 2023

    • ALB OAuth Proxy add-on version 2.0.0_1843.

  • 25 September 2023

    • Block Storage for VPC add-on version 5.2.

  • 22 September 2023

    • Kubernetes version 1.28 certification

  • 20 September 2023

    • New! IBM Cloud Kubernetes Service version 1.28.

    • Master fix pack 1.28.2_1527 and worker node fix pack 1.28.1_1523.

    • Networking changes for VPC clusters 1.28 and later

    • Trusted profile updates for Kubernetes clusters version 1.28 and later.

    • New! Updated GPU drivers with version 1.28 clusters.

    • Master fix packs are available.

  • 18 September 2023

    • CLI version 1.0.566 is available.

  • 15 September 2023

    • Cluster autoscaler add-on versions 1.0.9_103,1.0.8_104, and 1.0.7_102.

  • 14 September 2023

    • IBM Cloud File Storage for VPC add-on version 1.1.7_49

    • Block Storage for VPC add-on versions 5.0.19_358 and 5.1.13_345.

  • 12 September 2023

    • Worker node fix packs are available.

  • 7 September 2023

    • IBM Cloud Object Storage plug-in version 2.2.18

• August 2023

  • 31 August 2023

    • Ingress ALB versions 1.8.1_5317_iks, 1.6.4_5270_iks, and 1.5.1_5318_iks

  • 30 August 2023

    • Master fix packs are available.

  • 29 August 2023

    • New! Madrid multizone region

    • Worker node fix packs are available.

  • 15 August 2023

    • Worker node fix packs are available.

  • 9 August 2023

    • ALB OAuth Proxy add-on version 2.0.0_1715.

  • 8 August 2023

    • Istio add-on versions 1.16.7, 1.17.5, and 1.18.2.

  • 7 August 2023

    • Cluster autoscaler add-on versions 1.0.9_81,1.0.8_82, and 1.0.7_83.

  • 3 August 2023

    • CIS benchmarks for Red Hat OpenShift version 4.13.

  • 1 August 2023

    • Worker node fix packs are available.

    • Block Storage for VPC add-on versions 5.0.17_266 and 5.1.12_285.

• July 2023

  • 31 July 2023

    • Ubuntu 18 is no longer supported.

  • 28 July 2023

    • IBM Cloud Object Storage plug-in version 2.2.17.

  • 27 July 2023

    • Master fix packs are available

    • IBM Cloud File Storage for VPC add-on version 1.1.6

    • Istio add-on version 1.16.6, 1.17.4, and 1.18.1.

  • 26 July 2023

    • Ingress ALB versions 1.6.4_5219_iks, 1.5.1_5217_iks, and 1.4.0_5218_iks

  • 25 July 2023

    • End of support for the free cluster tier

  • 24 July 2023

    • Cluster autoscaler add-on version 1.0.9_70.

    • Static route add-on version 1.0.0_1122.

  • 21 July 2023

    • Cluster autoscaler add-on update command.

  • 19 July 2023

    • CLI version 1.0.540 is available.

  • 17 July 2023

    • Worker node fix packs 1.24.15_1576, 1.25.11_1552, 1.26.6_1544, and 1.27.3_1532.

  • 12 July 2023

    • ALB OAuth Proxy add-on version 2.0.0_1669.

  • 11 July 2023

    • New! OpenShift Data Foundation add-on version 4.13.0.

  • 6 July 2023

    • Cluster autoscaler add-on version 1.0.8_56 and 1.0.7_57.

    • Istio add-on version 1.18.0.

    • Pod security admission updates

  • 5 July 2023

    • Ingress ALB versions 1.6.4_5161_iks, 1.5.1_5160_iks, and 1.4.0_5159_iks

  • 3 July 2023

    • IBM Cloud Object Storage plug-in version 2.2.16

    • IBM Cloud File Storage for VPC add-on version 1.1

    • Worker node fix packs 1.24.15_1574, 1.25.11_1550, 1.26.6_1542, and 1.27.3_1530.

• June 2023

  • 27 June 2023

    • Master fix packs 1.24.15_1573, 1.25.11_1549, 1.26.6_1541, and 1.27.3_1529.

  • 26 June 2023

    • CLI version 1.0.528.

  • 23 June 2023

    • Free cluster tier deprecation

  • 22 June 2023

    • Cluster autoscaler add-on version 1.0.9_44.

    • Istio add-on version 1.17.3.

  • 21 June 2023

    • Block Storage for VPC add-on versions 5.0.16_127 and 5.1.11_126.

  • 20 June 2023

    • Worker node fix pack updates

  • 19 June 2023

    • IBM Cloud Object Storage plug-in version 2.2.15

  • 8 June 2023

    • Istio add-on version 1.16.5.

  • 6 June 2023

    • Ingress ALB versions 1.6.4_5067_iks, 1.5.1_5074_iks, and 1.4.0_5068_iks

  • 5 June 2023

    • Worker node fix packs 1.24.14_1571, 1.25.10_1547, 1.26.5_1539, and 1.27.2_1527.

Tutorials library for Kubernetes Service

Tutorials library for Kubernetes Service

Setting up your first cluster in your Virtual Private Cloud (VPC)

Setting up your first cluster in your Virtual Private Cloud (VPC)

• Audience

• Objectives

• What you'll get

• Prerequisites

• Create a cluster in VPC

• Deploy a privately available app

• Set up a Load Balancer for VPC to expose your app publicly

• What's next?

Planning your cluster environment

Creating a highly available cluster strategy

• Decide how many clusters to create

• Determine how many locations are needed

  • Multizone clusters

  • Multiple clusters linked with load balancers

  • Single zone clusters

• Select a cluster type

• Select an operating system for the cluster

• Define a cluster naming strategy

• Decide how many worker nodes for each cluster

• Select worker node flavors

• Determine worker node capacity for the resources

• Choose how many namespaces to create within the cluster

• Establish resource requests and limits for the namespaces

• Make your apps highly available too

• Next steps

Understanding VPC cluster networking

• Worker-to-worker communication using VPC subnets

• Worker-to-master and user-to-master communication using Virtual private endpoints or cloud service endpoints

• Worker-to-master communication in VPC clusters

• User-to-master communication in VPC clusters

• Worker communication to other services or networks

• Communication with other IBM Cloud services over the private or public network

• Communication with resources in on-premises data centers

  • Communication with resources in other VPCs

  • Communication with IBM Cloud classic resources

• External communication to apps that run on worker nodes

• Private traffic to cluster apps

• Public traffic to cluster apps

• Example scenarios for VPC cluster network setups

  • Scenario: Run internet-facing app workloads in a VPC cluster

  • Worker-to-worker communication

  • Worker-to-master and user-to-master communication

  • Worker communication to other services or networks

  • External communication to apps that run on worker nodes

• Scenario: Run internet-facing app workloads in a VPC cluster with limited public egress

  • Worker-to-worker communication

  • Worker-to-master and user-to-master communication

  • Worker communication to other services or networks

  • External communication to apps that run on worker nodes

• Extend your on-premises data center to a VPC cluster

  • Worker-to-worker communication

  • Worker-to-master and user-to-master communication

  • Worker communication to other services or networks

  • External communication to apps that run on worker nodes

• Next steps

Understanding Classic cluster networking

• Worker-to-worker communication: classic VLANs and subnets

  • VLAN connections for worker nodes

  • Worker node communication across subnets and VLANs

• Worker-to-master and user-to-master communication: Service endpoints

  • Public service endpoint only

  • Public and private cloud service endpoints

  • Private service endpoint only

• Worker communication to other IBM Cloud services or on-premises networks

  • Communication with other IBM Cloud services over the private or public network

  • IBM Cloud® Direct Link for communication over the private network with resources in on-premises data centers

  • strongSwan IPSec VPN connection for communication over the public network with resources in on-premises data centers

• External communication to apps that run on worker nodes

  • Private traffic to cluster apps

  • Public traffic to cluster apps

• Scenario: Running internet-facing app workloads in a classic cluster

  • Worker-to-worker communication in classic clusters with internet-facing workloads

  • Worker-to-master and user-to-master communication in classic clusters with internet-facing workloads

  • Worker communication to other services or networks with internet-facing workloads

  • External communication to apps that run on worker nodes with internet-facing workloads

• Scenario: Allow limited public connectivity with a gateway appliance

  • Worker-to-worker communication, worker-to-master and user-to-master communication with a gateway appliance

  • Worker communication to other services or networks with a gateway appliance

  • External communication to apps that run on worker nodes with a gateway appliance

• Scenario: Extend your on-premises data center to a classic cluster

  • Worker-to-worker communication for private clusters

  • Worker-to-master and user-to-master communication for private clusters

  • Worker communication to other services or networks for private clusters

  • External communication to apps that run on worker nodes for private clusters

• Next steps

Encryption overview

• Control plane

• Worker node disks

• Cluster secrets

• Persistent storage

• Worker-to-worker traffic

• Next steps

IBM Cloud Kubernetes Service storage overview

• Non-persistent storage options

• Single zone clusters

• Multizone clusters

• Next steps

Documenting your environment architecture

• Step 1: Understanding your app and architecture

  • Example 1: A basic app running in a single OpenShift cluster

  • Example 2: A multi-cluster architecture with a global load balancer and Cloudant service

  • Example 3: A VSI client contacting a VPC network load balancer with an external service backend

• Step 2: Choose a tool

• Step 3: Create the diagram

• Next steps

Preparing your account

Preparing your account to create clusters

• Create or upgrade your account

• Set user permissions

• Optional: Create a trusted profile

• Plan your resource groups

• Cluster-specific account setup

• Next steps

IAM roles and actions

• Kubernetes Service

• Permissions to create a cluster

• Example custom IAM roles

• Classic infrastructure roles

  • Required classic infrastructure permissions

  • Suggested classic infrastructure permissions

Installing the CLI

Installing the CLI

• Understanding the CLI tools

• Running the installation command

• Verifying the installation

• Installing CLI plug-ins and tools

• Install the Kubernetes CLI

Updating the CLI

• Updating the IBM Cloud CLI

• Updating installed plug-ins

Uninstalling the stand-alone IBM Cloud CLI

• Uninstalling on Windows

• Uninstalling on Linux and macOS

Setting up the API

Setting up the API

• About the API

• Automating cluster deployments with the API

• Working with your cluster by using the Kubernetes API

• Refreshing IAM access tokens with the API

Creating clusters

Creating classic clusters

• Prerequisites

• Creating a classic cluster in the console

• Creating a classic cluster in the CLI

• Example commands to create classic clusters

• Creating a single-zone classic cluster with Terraform

• Next steps for Classic clusters

Creating VPC clusters

• Prerequisites and notes

• Creating a VPC cluster in the console

• Creating VPC clusters from the CLI

• Example commands to create VPC clusters

• Creating a VPC cluster with Terraform

• Next steps for VPC clusters

Creating clusters on dedicated hosts for VPC

Accessing clusters

Accessing clusters

• Prerequisites

• Accessing clusters through the public cloud service endpoint

• Accessing clusters through the private cloud service endpoint

  • Accessing VPC clusters through the private cloud service endpoint

  • Accessing classic clusters through the private cloud service endpoint

• Accessing VPC clusters through the Virtual Private Endpoint Gateway

  • Protecting clusters using context based restrictions

Accessing the cluster master with admission controllers and webhooks

• What are the default admission controllers in my cluster?

• Can I create my own admission controllers?

• What are the best practices for using webhooks?

• What other types of apps use admission controllers?

  • Setting up admission controller webhooks

• I need help with a broken webhook. What can I do?

Accessing private clusters

Adding worker nodes

Adding worker nodes to Classic clusters

• Creating a new worker pool

• Resizing a worker pool

• Adding a zone to a worker pool

Adding worker nodes to VPC clusters

• Resizing a worker pool

• Creating a new worker pool

• Adding a zone to a worker pool

Managing the cluster and worker node lifecycle

Checking your cluster version, operating system, and Kubernetes server version

• Checking your cluster master version, worker node version, and worker node operating system in the console

• Checking your cluster master version in the CLI

• Checking your worker node version in the CLI

• Checking a cluster's Kubernetes server version in the CLI

• Checking your worker node operating system in the CLI

Updating clusters, worker nodes, and cluster components

• Updating the master

  • Steps to update the cluster master

• Updating classic worker nodes

  • Prerequisites

  • Updating classic worker nodes in the CLI with a configmap

  • Updating classic worker nodes in the console

• Updating VPC worker nodes

  • Prerequisites

  • Updating VPC worker nodes in the CLI

  • Updating VPC worker nodes in the console

• Updating flavors (machine types)

• How are worker pools scaled down?

• Updating cluster components

  • Managing automatic updates for Fluentd

  • Managing automatic updates for Ingress ALBs

• Updating managed add-ons

Creating and managing dedicated hosts on VPC Gen 2 infrastructure

• Setting up dedicated hosts in the CLI

• Removing worker nodes from a dedicated host in the CLI

• Removing dedicated hosts in the CLI

• Removing dedicated hosts pools in the CLI

Preparing for host maintenance updates

• Identifying your affected workers

• Actions to take before the maintenance period

  • Workers in Classic clusters

  • Workers in VPC clusters

Setting the cluster credentials

• Considerations

• Resetting the cluster API key

• Removing user credentials and permissions

Rotating CA certificates in your cluster

Migrating to a new Ubuntu version

• Default operating system by cluster version

• Ubuntu 24 limitations

• Migration steps

Adding tags and labels to clusters

• Adding tags to clusters with the console

• Adding tags to clusters with the CLI

• Adding labels to existing worker pools

Checking worker node resource reserves

Setting up encryption

Setting up a key management service (KMS) provider

• Rotating your KMS root key

Setting up cluster secret encryption

• Enabling secret encryption from the CLI

• Enabling secret encryption from the console

• Rotating the root key for your cluster

• Verifying secret encryption

Setting up worker node disk encryption for VPC clusters

Encrypting worker-to-worker traffic with WireGuard

• Enabling WireGuard encryption

• Disabling WireGuard encryption

Enhancing security

Security for IBM Cloud Kubernetes Service

• Overview of security threats for your cluster

• Kubernetes API server and etcd

  • How is access to my API server granted?

  • What does IBM Cloud Kubernetes Service do to secure my API server and etcd data store?

  • What else can I do to secure my API server?

• Worker node

  • Who owns the worker node and am I responsible to secure it?

  • How does my worker node setup look?

• Network

  • Network segmentation and privacy for classic clusters

  • What network traffic is allowed for my Classic cluster by default?

  • What is network segmentation and how can I set it up for a Classic cluster?

  • What else can I do to reduce the surface for external attacks for Classic clusters?

  • What if I want to connect my cluster to an on-prem data center?

  • Network segmentation and privacy for VPC clusters

  • What network traffic is allowed for my VPC cluster by default?

  • What is network segmentation and how can I set it up for a VPC cluster?

  • What else can I do to reduce the surface for external attacks for VPC clusters?

  • Securely expose apps with LoadBalancer and Ingress services

  • Can I use security groups to manage my cluster's network traffic?

  • How can I secure the source IP within the cluster?

  • How can I do TLS termination with LoadBalancer and Ingress services?

• Persistent storage

• Monitoring and logging

• Image and registry

• Container isolation and security

  • Should I set up a single-tenant or a multi-tenant cluster?

• Storing personal information

• Kubernetes security bulletins

Architecture and dependencies of the service

• Classic cluster

  • Non-VRF or VRF-enabled account with public cloud service endpoint only

  • VRF-enabled account with private and public cloud service endpoints

  • Kubernetes master components

  • Worker node components

  • kube-system namespace

  • ibm-system namespace

  • default namespace

• VPC cluster

Overview of personal and sensitive data storage and removal options

• What information is stored with IBM when using IBM Cloud Kubernetes Service?

• How is my information stored and encrypted?

• Where is my information stored?

• How can I remove my information?

Protecting cluster resources with context-based restrictions

• How IBM Cloud Kubernetes Service integrates with context-based restrictions

  • Protecting cluster resources

  • Protecting specific APIs

  • Ensure IBM Cloud Kubernetes Service can maintain access to other IBM Cloud resources when CBR is enabled for them

• Creating network zones

  • Creating network zones from the API

  • Creating network zones from the CLI

  • Creating network zones from the console

• Creating rules

  • Creating rules by using the API

  • Creating rules from the CLI

  • Creating rules from the console

• Limitations

Example context-based restrictions scenarios

• Understanding the scenario

• Prerequisites

• Creating your network zone

• Creating your CBR rule

• Testing your context-based restrictions

• Additional scenarios

  • Allowing different IPs to access the public and private service endpoints

  • Allowing different IPs to access different API types over the public and private service endpoints

Migrating from a private service endpoint allowlist to context based restrictions (CBR)

• Before you begin

• Step 1: Review the details of your allowlist

• Step 2: Creating a network zone

  • Creating a network zone in the console

  • Creating a network zone by using the CLI

• Step 3: Creating a CBR rule

  • Creating a CBR rule in the console

  • Creating a CBR rule by using the CLI

• Step 4: Disabling the private service endpoint allowlist

• Step 5: Testing the CBR rule

• Step 6: Adding or removing subnets that can access the cluster

  • Modifying your network zone from the console

  • Modify your network zone from the CLI

• Removing context based restrictions from the private service endpoint

• Deleting a rule from the console

• Deleting a rule from the CLI

• Next steps

Managing access control

Configuring a trusted profile for cluster components

• About trusted profiles

• Minimum access requirements

  • Minimum requirements for all storage components

  • Minimum requirements for individual storage components

  • VPC block storage

  • Classic block storage

  • VPC file storage

  • Classic file storage

  • Cluster autoscaler

  • Object Storage

  • ODF billing agent

• Set up a trusted profile in the CLI

• Set up a trusted profile with the UI

• Set up a trusted profile with the API

• Setting the trusted profile for a cluster or resource group

• Limitations and considerations

Understanding Classic infrastructure credentials

• Accessing a different classic infrastructure account

Understanding RBAC permissions

• What are the types of RBAC roles?

• What are RBAC role bindings and cluster role bindings?

• What do these roles look like in my cluster?

• Can I create custom roles or cluster roles?

• When do I need to use custom cluster role bindings and role bindings?

• Creating custom RBAC permissions for users, groups, or service accounts

• Extending existing permissions by aggregating cluster roles

  • What are some common operations that I might want to extend permissions for a default cluster role?

• Checking RBAC roles

  • Checking RBAC roles from the UI

  • Checking RBAC roles with the CLI

• Kubernetes service access roles and corresponding RBAC roles

  • Kubernetes resource permissions per RBAC role

  • IBM Cloud IAM issuer details for RBAC users

Authorizing resources with IAM trusted profiles

• Creating an IAM trusted profile

• Set the default trusted profile for the cluster

• Get the details of your trusted profile

• Configure your application pods to authenticate with IBM Cloud services

Assigning cluster access by using Terraform for IBM Cloud Kubernetes Service

• Creating a Kubernetes Service cluster by using Terraform

• Assigning IAM user access to Kubernetes Service clusters

Removing users

• Checking whether the user's credentials are used for infrastructure permissions

• Removing IBM Cloud IAM platform permissions and the associated pre-defined RBAC permissions

  • Removing custom RBAC permissions

Securing cluster workloads

Setting pod priority

• How does priority scheduling and preemption work?

• Understanding default priority classes

• Creating a priority class

• Assigning priority to your pods

Setting Kubernetes API priority and fairness

• Reviewing default flow schema and priority levels

  • Viewing IBM Cloud Kubernetes Service created priority level configurations

Pod security admission

• Understanding security profiles

• What if Pod Security Admission isn't the right choice for me?

• Configuring Pod Security admission namespace labels

• Default Pod Security Admission plug-in configuration

• Customizing the Pod Security Admission plug-in configuration

Migrating from PSPs to Pod Security Admission

• Upgrade requirements

  • Step 1: Check that all pods run under the ibm-privileged-psp PSP

  • Step 2: Verify the privileged-psp-user cluster role binding uses the default configuration

  • Step 3: Verify the restricted-psp-user cluster role binding uses the default configuration

  • Step 4: Checking for non-IBM PSPs

• Migration steps

  • Step 1: Enable Pod Security admission in your 1.24 cluster

  • Step 2: Review namespace permissions

  • Step 3: Simplify and standardize PSPs

  • Step 4: Update the namespaces in your cluster

  • Step 5: Review the namespace creation process

  • Step 6: Optional. Disable the PSP feature in the cluster

  • Step 7: Optional. Upgrade your cluster

• References

Controlling network traffic in Classic clusters

Using Calico network policies to control traffic on Classic clusters

• Objectives

• Audience

• Prerequisites

• Deploy an app and expose it by using an NLB

• Block all incoming traffic to all node ports

• Allow incoming traffic from a specific IP to the NLB

• Deny incoming traffic from specific IPs to the NLB

• Logging blocked traffic from specific IPs to the NLB

• What's next?

Controlling traffic with network policies

• Default Calico and Kubernetes network policies

• Installing and configuring the Calico CLI

• Viewing network policies

• Adding network policies

• Controlling inbound traffic to NLB or NodePort services

• Example Calico policies to restrict public or private network traffic

  • Applying public network policies

  • Applying private network policies

• Controlling traffic between pods

• Logging denied traffic

Opening required ports and IP addresses in your allowlist

• Opening ports in a corporate allowlist

  • Running ibmcloud, ibmcloud ks, and ibmcloud cr commands from behind an allowlist

  • Running kubectl commands from behind an allowlist

  • Running calicoctl commands from behind an allowlist

• Opening ports in gateway appliance allowlists

  • Opening required ports in a public allowlist

  • Opening required ports in a private allowlist

  • Opening ports in a public or private allowlist for inbound traffic

• Allowing the cluster to access resources through Calico network policies

• Allowing traffic from your cluster in other services' allowlists or in on-premises allowlists

• Updating IAM allowlists for Kubernetes Service network zones

  • Getting your Kubernetes Service subnet IP addresses

Configuring classic subnets and IP addresses

• Overview of classic networking in IBM Cloud Kubernetes Service

  • VLANs

  • Subnets and IP addresses

  • Finding subnets provisioned in your account

  • Network segmentation

• Using existing subnets to create a cluster

• Managing existing portable IP addresses

  • Viewing available portable public IP addresses

  • Freeing up used IP addresses

• Adding portable IP addresses

  • Adding portable IPs by ordering more subnets

  • Adding portable IPs by adding existing subnets to your cluster

• Managing subnet routing

  • Enabling routing between primary subnets on the same VLAN

  • Managing subnet routing for gateway appliances

• Removing subnets from a cluster

Changing service endpoints or VLAN connections

• Setting up the private cloud service endpoint

• Setting up the public cloud service endpoint

  • Steps to enable the public cloud service endpoint

  • Steps to disable the public cloud service endpoint

• Switching from the public cloud service endpoint to the private cloud service endpoint

• Changing your worker node VLAN connections

Setting up classic VPN connectivity

• Using the strongSwan IPSec VPN service Helm chart

• strongSwan VPN service considerations

• Configuring the strongSwan VPN in a multizone cluster

  • Configuring a single outbound VPN connection from a multizone cluster

  • Configuring a single inbound VPN connection to a multizone cluster

  • Configuring an inbound VPN connection in each zone of a multizone cluster

• Configuring the strongSwan Helm chart

  • Step 1: Get the strongSwan Helm chart

  • Step 2: Configure basic IPSec settings

  • Step 3: Select inbound or outbound VPN connection

  • Step 4: Access cluster resources over the VPN connection

  • Step 5: Access remote network resources over the VPN connection

  • Step 6 (optional): Enable monitoring with the Slack webhook integration

  • Step 7: Deploy the Helm chart

• Testing and verifying strongSwan VPN connectivity

• Limiting strongSwan VPN traffic by namespace or worker node

  • Limiting strongSwan VPN traffic by namespace

  • Limiting strongSwan VPN traffic by worker node

• Upgrading or disabling the strongSwan Helm chart

• Using a Virtual Router Appliance

Controlling network traffic in VPC clusters

Understanding secure by default Cluster VPC Networking

• Overview

• Virtual private endpoint (VPE) gateways

• Managed security groups

  • Worker security group

  • Master VPE gateway security group

  • Shared VPE gateway security group

  • Load balancer services security group

• Limitations

Managing outbound traffic protection in VPC clusters

• Disabling outbound traffic protection

  • Option 1: Disabling outbound traffic protection when you create a cluster

  • Option 2: Allowing outbound traffic through a custom security group

• Disabling outbound traffic protection for existing clusters

  • Option 1: Disabling outbound traffic protection from the CLI

  • Option 2: Adding a security group rule to the default cluster worker security group

• Enabling outbound traffic protection for existing clusters

• Example scenarios for selectively allowing outbound traffic

  • Accessing images from external container registries like DockerHub or quay.io

  • Accessing 1.30 clusters and the web console over the VPE

  • Allowing outbound traffic for webhooks

  • Allowing outbound traffic to a public service

  • Considerations for hub and spoke VPCs with outbound traffic protection

  • Allowing temporary traffic to the cluster API server over the public network

Enabling secure by default for clusters created at 1.29 and earlier

• Preparing to enable secure by default

• What happens when I enable secure by default?

• In what order are the changes applied?

• Enabling secure by default

Understanding VPC security groups in version 1.29 and earlier

• Virtual private endpoint (VPE) gateways

• Managed security groups

  • Security groups applied to cluster workers

  • Security groups applied to VPE gateways and VPC ALBs

• Minimum inbound and outbound requirements

  • Required inbound and outbound rules for cluster workers

  • Required rules for VPCs with a cluster that runs at version 1.28 or later

  • Required inbound and outbound rules for VPC ALBs

• Allow worker nodes to connect to the Ingress LoadBalancer

Creating and managing VPC security groups

• Adding security groups during cluster creation

  • If you only want the default security groups

  • If you want the cluster security group and your own additional security groups

  • If you only want your own security groups

• Adding security groups to worker pools during creation

  • If you do not want to attach additional security groups to the worker pool

  • If you want to attach extra security groups to the worker pool

• Viewing security groups

• Viewing security groups in the console

• Creating security group rules in the console

• Creating security group rules in the command line

• Allow worker nodes to connect to the Ingress LoadBalancer

Controlling traffic with ACLs

• Overview of ACLs

Controlling traffic between pods with Kubernetes policies

• Isolate app services within a namespace

• Isolate app services between namespaces

  • Required policy rules for VPCs with a cluster that runs at version 1.28 or later

Opening required ports and IP addresses in allowlists

• Opening ports in a corporate allowlist

  • Running ibmcloud, ibmcloud ks, and ibmcloud cr commands from behind an allowlist

  • Running kubectl commands from behind an allowlist

  • Running calicoctl commands from behind an allowlist

• Allowing traffic from your cluster in other services' allowlists or in on-premises allowlists

  • Allowing ingress from a cluster to another service

  • Allowing egress to a cluster from another service

• Opening ports in VPC Security Groups or VPC ACLs

  • Opening required ports in public allowlists

Configuring VPC subnets

• Overview of VPC networking in IBM Cloud Kubernetes Service

  • Subnets

  • Public gateways

  • Virtual private endpoints (VPE)

  • Network segmentation

  • VPC networking limitations

• Creating a VPC subnet and attaching a public gateway

  • Creating a VPC subnet in the console

  • Creating a VPC subnet in the CLI

• Creating VPC subnets for classic access

  • Creating VPC subnets for classic access in the console

  • Creating VPC subnets for classic access from the CLI

• Restricting public network traffic to a subnet with a public gateway

Setting up VPC VPN connectivity

• Communication with resources in on-premises data centers

  • IBM Cloud VPC VPN

  • Direct Link

• Communication with resources in other VPCs

  • IBM Cloud VPC VPN

  • IBM Cloud Transit Gateway

• Communication with IBM Cloud classic resources

  • Create a classic-access VPC

  • Use IBM Cloud Transit Gateway

Adding static routes to worker nodes

Adding static routes to worker nodes

• About static routes

• Enabling the static route add-on

  • Enabling the static route add-on from the console

  • Enabling the static route add-on with the CLI

• Creating static routes

Configuring the cluster DNS provider

Configuring the cluster DNS provider

• Autoscaling the cluster DNS provider

• Customizing the cluster DNS provider

• Setting up NodeLocal DNS cache

  • Enable NodeLocal DNS cache

  • Disable NodeLocal DNS cache

• Customizing NodeLocal DNS cache

  • Editing the node-local-dns ConfigMap for general configuration updates

  • Editing the node-local-dns-config ConfigMap to extend with stub domains or upstream servers

• Setting up zone-aware DNS

  • Setting up zone-aware DNS

  • Disabling and deleting zone-aware DNS

Setting up the cluster autoscaler

Preparing classic and VPC clusters for autoscaling

• Understanding scale-up and scale-down

• Following scalable deployment practices

  • Can I autoscale multiple worker pools at once?

  • How can I make sure that the cluster autoscaler responds to what resources my app needs?

  • Can I scale down a worker pool to zero (0) nodes?

  • Can I optimize my deployments for autoscaling?

  • Can I use taints and tolerations with autoscaled worker pools?

• Rebalancing or resizing autoscaled worker pools

• Preparing classic or VPC Gen 2 clusters for autoscaling

Enabling the cluster autoscaler add-on in your cluster

• Enabling the cluster autoscaler add-on from the console

• Enabling the cluster autoscaler add-on from the CLI

• Updating the cluster autoscaler add-on

• Removing the cluster autoscaler add-on from the console

• Removing the cluster autoscaler add-on from the CLI

Setting up autoscaling for your worker pools

• Customizing the cluster autoscaler configuration values

• Cluster autoscaler configmap reference

Deploying apps to worker pools where autoscaling is enabled

• Scaling up worker nodes before the worker pool has insufficient resources

• Pause pods

• Horizontal pod autoscaling (HPA)

Logging and monitoring

Logging for IBM Cloud Kubernetes Service

• Locations where logs are generated

• Locations where logs are sent to IBM Cloud Logs

• Locations where logs are sent by IBM Cloud Logs Routing

• Logs that are generated

• Enabling logging

• Enable logging in an existing cluster

• Enable logging while creating a cluster

• Viewing logs

• Launching IBM Cloud Logs from the Observability page

• Fields by log type

• Line identifiers by type

• Analyzing IBM Cloud Kubernetes Service logs

Monitoring metrics for IBM Cloud Kubernetes Service

• Locations where metrics are generated

• Enabling metrics for IBM Cloud Kubernetes Service

• Enable monitoring in an existing cluster

• Enable monitoring while creating a cluster

• Viewing metrics

  • Launching IBM Cloud® Monitoring from the Observability page

• Monitoring IBM Cloud Kubernetes Service

• Migrating to the new monitoring agent

Logging for clusters

• Choosing a logging solution

• Migrating logging and monitoring agents to Cloud Logs

  • Removing the observability plug-in agents

• Forwarding cluster and app logs to an external server

  • Understanding log forwarding to an external server

  • Forwarding cluster and app logs

  • Forwarding logs to your own server over the udp or tcp protocols

  • Forwarding logs to your own server over the tls protocol

  • Filtering logs that are forwarded

  • Verifying, updating, and deleting log forwarding

Monitoring cluster health

• Choosing a monitoring solution

• Migrating logging and monitoring agents to Cloud Logs

  • Reviewing your observability agents

  • Removing the observability plug-in agents

• Setting up IBM Cloud® Monitoring alerts

  • App alerts

  • Worker node alerts

  • Zone alerts

  • Cluster alerts

  • Account alerts

  • Block Storage for VPC alerts

• Monitoring worker node health with Autorecovery

  • Understanding the configmap components

  • Understanding the individual components of health checks

Reviewing service, API server, and worker node logs

• Kubernetes API server audit logs

  • Considerations and prerequisites

  • Forwarding Kubernetes API audit logs to Cloud Logs

  • Forwarding Kubernetes API audit logs to a resource in the IBM Cloud private network

  • Forwarding Kubernetes API audit logs to an external server on the public Internet

  • Managing API server log forwarding

• Service audit logs

Enabling Flow Logs for VPC cluster components

• Configuring a flow log collector

• Viewing worker node flow logs

IBM Cloud Logs events

• Cluster events

• Cluster account events

• Cluster add-on events

• Fluentd logging events

• Ingress ALB events

• Ingress secret events

• Observability events for logging and monitoring

• NLB DNS events

• Private service endpoint allowlist events

• Satellite events

• Storage events

• Worker node and worker pool events

• Viewing your cluster events

Setting up an image registry

Setting up an image registry

• Planning image registries

• Understanding how to authorize your cluster to pull images from a private registry

  • Default image pull secret setup

  • Private network connection to icr.io registries

• Updating existing clusters to use the API key image pull secret

  • Updating your image pull secret

• Using an image pull secret to access images in external private registries

  • Copying an existing image pull secret

  • Creating an image pull secret with different IAM API key credentials

  • Accessing images that are stored in other private registries

• Using the image pull secret to deploy containers

  • Storing the image pull secret in the Kubernetes service account for the selected namespace

• Setting up a cluster to pull entitled software

• Updating an IBM Cloud Kubernetes Service containerd custom registry configuration

  • Example daemonset to update a containerd custom registry configuration

Continuous integration and delivery for app development and deployment

Continuous integration and delivery for app development and deployment

• Before you begin

• Creating a toolchain with Delivery Pipeline

• Other resources for automating your pipeline

Developing and deploying apps

Planning app deployments

• Moving workloads to IBM Cloud Kubernetes Service

  • What kind of apps can I run in IBM Cloud Kubernetes Service?

  • What are some guidelines for developing stateless, cloud-native apps?

  • What about serverless apps?

  • I already have an app. How can I migrate it to IBM Cloud Kubernetes Service?

• Understanding Kubernetes objects for apps

  • I thought that I needed to put my app in a container. Now what's all this stuff about pods?

  • So if I can use a pod, why do I need all these different types of objects?

  • What type of Kubernetes objects can I make for my app?

  • What if I want my app configuration to use variables? How do I add these variables to the YAML?

  • How can I make sure that my app has the correct resources?

  • How can I add capabilities to my app configuration?

  • How can I add IBM services to my app, such as Watson?

• Planning highly available deployments

  • How can I increase the availability of my app?

  • How can I scale my app?

• Versioning and updating apps

  • How can I organize my deployments to make them easier to update and manage?

  • What app update strategies can I use?

  • How can I automate my app deployment?

• Setting up service discovery

  • How can I make sure that my services are connected to the correct deployments and ready to go?

  • How can I expose my services on the Internet?

• Securing apps

• Managing access and monitoring app health

  • How can I control who has access to my app deployments?

  • After I deploy my app, how can I monitor its health?

Building images for your apps

• Deploying containers from an IBM Cloud Container Registry image to the default Kubernetes namespace

• Referring to the image pull secret in your pod deployment

• Pushing images to IBM Cloud Container Registry

• Managing security of images in IBM Cloud Container Registry with Vulnerability Advisor

• Setting up trusted content for container images

• Enabling image security enforcement in your cluster

  • Enabling or disabling image security enforcement

  • Default image policies

Developing apps

• Specifying your app requirements in your YAML file

  • Basic deployment metadata

  • Replica set

  • Labels

  • Affinity

  • Container image

  • Port for the app's service

  • Resource requests and limits

  • Liveness and readiness probes

  • Pod Disruption Budget

  • Exposing the app service

  • Configmaps for container environment variables

  • Secrets for container environment variables

  • Persistent volumes for container storage

• Complete example deployment YAML

Deploying Kubernetes-native apps in clusters

• Launching the Kubernetes dashboard

  • Launching the Kubernetes dashboard from the IBM Cloud console

  • Launching the Kubernetes dashboard from the CLI

• Deploying apps with the Kubernetes dashboard

• Deploying apps with the CLI

• Deploying apps to specific worker nodes by using labels

• Deploying an app on an NVIDIA GPU machine

  • Prerequisites

  • Deploying a workload

Testing access to apps with NodePorts

• About NodePorts

• Enabling access to an app by using a NodePort service

Managing the app lifecycle

• Update strategies

• Scaling apps

• Managing rolling deployments to update your apps

• Setting up continuous integration and delivery

• Copying deployments to another cluster

Packaging apps for reuse in multiple environments with Kustomize

Setting up a service mesh with Istio

Getting started with Istio

• Step 1: Enable the Istio add-on

• Step 2: Set up the BookInfo sample app

• Step 3: Simulate a phased rollout of BookInfo

• Step 4: Monitor BookInfo with IBM Cloud Monitoring

• Step 5: Secure in-cluster traffic by enabling mTLS

About the managed Istio add-on

• What is Istio?

• What is Istio on IBM Cloud Kubernetes Service?

  • What does this look like in my cluster?

  • How does the update process work?

• What comes with the Istio add-on?

• Limitations

Setting up the Istio managed add-on

• Removing other Istio installations from a cluster

• Installing the Istio add-on

  • Installing the Istio add-on from the console

  • Installing the Istio add-on with the CLI

  • Installing the istioctl CLI

• Customizing the Istio installation

• Migrating from the Istio add-on to community Istio

  • Step 1: Disabling the Istio add-on from the console

  • Step 1: Disabling the Istio add-ons from the CLI

  • Step 2: Scale down the Istio operator

  • Step 3: Saving resources

  • Step 4: Changing the installer of the IOPs

  • Step 5: Removing the Istio operator and IOPs

  • Step 6: Removing the ConfigMap

• Uninstalling the Istio add-on

  • Step 1: Saving resources before uninstallation

  • Step 2: Uninstalling the Istio add-on

  • Step 3: Removing resources

  • Step 4: Remove the Istio operator

Updating Istio

• Before you begin

• Updating from version 1.23 to 1.24 of the Istio add-on

• Updating to 1.23 and earlier minor versions of the Istio add-on

• Updating the istioctl client and sidecars

• Updating from an unsupported version of the Istio add-on

Managing and exposing apps in the service mesh

• Understanding the BookInfo sample app

• Setting up the BookInfo sample app

• Publicly accessing BookInfo

  • Creating a gateway URL in Classic clusters

  • Creating a gateway URL in VPC clusters

  • Viewing the BookInfo web page in a browser

  • Exposing BookInfo by using an IBM-provided subdomain without TLS

  • Exposing BookInfo by using an IBM-provided subdomain with TLS

  • Configuring the bookinfo-gateway to use TLS termination

  • Understanding what happened

• Including apps in the Istio service mesh by setting up sidecar injection

  • Enabling automatic sidecar injection

  • Manually injecting sidecars

• Enabling or disabling public Istio load balancers

• Exposing the Istio ingress gateway with DNS

  • Exposing the Istio ingress gateway with DNS without TLS termination

  • Exposing the Istio ingress gateway with DNS with TLS termination

• Securing in-cluster traffic by enabling mTLS

Deploying custom Istio gateways in Helm

• Setting up Helm

• Modifying existing default gateways

• Creating additional gateways

  • Removing gateway deployments

Deploying custom Istio gateways in an IstioOperator

• Considerations

• Creating a custom ingress gateway for public traffic

  • Set up the BookInfo sample

  • Exposing BookInfo by using an IBM-provided subdomain with TLS

• Creating a custom ingress gateway for private network traffic

• Controlling custom gateway updates and versions

• Additional gateway customizations

• Creating a custom egress gateway

• Disabling the default gateways

Observing Istio traffic

• Enabling access logs for the entire mesh

• Enabling access logs for individual containers

• Setting up logging with IBM Cloud Logs

• Setting up monitoring with IBM Cloud Monitoring

• Launching the ControlZ component inspection and Envoy sidecar dashboards

  • ControlZ

  • Envoy

Exposing apps

Choosing an app exposure service

• Understanding load balancing for apps through Kubernetes service discovery

• Understanding Kubernetes service types

  • ClusterIP

  • NodePort

  • LoadBalancer

  • Ingress

• Planning public external load balancing

• Choosing a deployment pattern for classic clusters

  • NLB v1.0

  • NLB v2.0

  • Istio + NLB subdomain

  • Ingress ALB

• Choosing a deployment pattern for VPC clusters

  • VPC load balancer

  • Istio

  • Ingress ALB

• Planning private external load balancing

  • Choosing a deployment pattern for classic clusters

  • Choosing a deployment pattern for VPC clusters

Preventing app workloads from running on edge worker nodes

Preventing app workloads from running on edge worker nodes

Deploying the Sysdig agent on edge worker nodes

Deploying the Sysdig agent on edge worker nodes

Enabling the IBM Storage Operator cluster add-on

Enabling the IBM Storage Operator cluster add-on

• Disabling the ibm-storage-operator add-on

Setting up Block Storage for Classic

Setting up Block Storage for Classic

• Quick start for IBM Cloud Block Storage for Classic

• Installing the IBM Cloud Block Storage for Classic plug-in in your cluster

  • Updating the IBM Cloud Block Storage plug-in

  • Removing the IBM Cloud Block Storage plug-in

• Deciding on the block storage configuration

• Setting up encryption for Block Storage for Classic

  • Encrypting volume data by using your own storage class

  • Create a PVC that references your Block Storage for Classic secret

  • Verifying the encryption of your Block Storage for Classic volumes

• Adding block storage to apps

• Using existing block storage in your cluster

  • Retrieving the information of your existing block storage

  • Creating a persistent volume (PV) and a matching persistent volume claim (PVC)

• Using block storage in a stateful set

  • Creating the PVC by using dynamic provisioning when you create a stateful set

  • Static provisioning by using existing PVCs with a stateful set

• Changing the size and IOPS of your existing storage device

• Backing up and restoring data

  • Setting up periodic snapshots

  • Replicating snapshots to another zone

  • Duplicating storage

  • Backing up data to IBM Cloud® Object Storage

  • Copying data to and from pods and containers

• Storage class reference

  • Bronze

  • Silver

  • Gold

  • Custom

• Sample customized storage classes

  • Creating topology-aware storage

  • Specifying the zone and region

  • Mounting block storage with an XFS file system

• Removing persistent storage from a cluster

  • Understanding your storage removal options

  • Cleaning up persistent storage

• Setting up monitoring for limited connectivity PVs

• Assigning trusted profiles to block storage

Setting up Block Storage for VPC

Setting up Block Storage for VPC

• Quick start for IBM Cloud Block Storage for VPC

• Adding Block Storage for VPC to your apps

• Using an existing Block Storage for VPC instance

• Updating the Block Storage for VPC cluster add-on

  • Re-creating your own storage classes after updating to version 4.2

• Setting up encryption for Block Storage for VPC

• Customizing the default storage settings

  • Changing the default storage class

  • Creating your own storage class

  • Verifying your Block Storage for VPC file system

  • Updating the VolumeAttachLimit

  • Storing your custom PVC settings in a Kubernetes secret

  • Enabling every user to customize the default PVC settings

  • Enforcing base64 encoding for the Key Protect root key CRN

• Setting up volume expansion

  • Manually expanding volumes before add-on version 4.2

• Backing up and restoring data

• Understanding volume request capacity

• Assigning trusted profiles to block storage

Setting up snapshots with the Block Storage for VPC cluster add-on

• Creating an app

• Creating a volume snapshot

• Restoring from a volume snapshot

• Turning off snapshots

• Next steps

• Troubleshooting snapshots

Customizing the Block Storage for VPC configmap

• Block Storage for VPC configmap reference

Setting up Block Storage for VPC for unmanaged clusters

• Prerequisites

  • Labeling your worker nodes

  • Retrieving IAM and VPC details

• Creating the image pull secret in your cluster

• Creating the Block Storage for VPC driver deployment

• Deploying a stateful set that uses Block Storage for VPC

• Removing the Block Storage for VPC driver

• Config map reference

  • RHEL or CentOS ConfigMap

  • Ubuntu ConfigMap

Removing Block Storage for VPC from your cluster

• Cleaning up Block Storage for VPC

Migrating Block Storage for VPC apps and data between IBM Cloud accounts

• Prerequisites

• Get your account IDs

• Set up your permissions

• Optional: Deploy an app

• Create a snapshot

• Get the details of your snapshot

• Restore the snapshot in Account 2

• Redeploy your app

• Continue migrating your snapshots and apps to Account 2

Block Storage for VPC storage class reference

Setting up File Storage for Classic

Setting up File Storage for Classic

• Quick start for File Storage for Classic

• Deciding on the File Storage for Classic configuration

  • File storage types

  • IOPS

  • Reclaim policy

  • Billing type

• Adding File Storage for Classic to apps

• Using existing File Storage for Classic in your cluster

  • Preparing your existing storage

  • Creating a persistent volume and a persistent volume claim

• Using File Storage for Classic in a stateful set

  • Creating the PVC when you create a stateful set by using dynamic provisioning

  • Static provisioning: Using an existing PVC with your stateful set

• Changing the size and IOPS of your existing storage device

• Changing the default NFS version

  • Creating a customized storage class with a specific NFS version

  • Changing your existing PV to use a different NFS version

• Scaling down the default File Storage for Classic plug-in

• Backing up and restoring data

  • Setting up periodic snapshots

  • Replicating snapshots to another zone

  • Duplicating storage

  • Backing up data to IBM Cloud® Object Storage

  • Copying data to and from pods and containers

• Storage class reference

• Sample customized storage classes

  • Creating topology-aware storage

  • Specifying the zone for multizone clusters

  • Changing the default NFS version

• Removing persistent storage from a cluster

  • Understanding your storage removal options

  • Cleaning up persistent storage

• Assigning trusted profiles to file storage

Setting up File Storage for VPC

Enabling the IBM Cloud File Storage for VPC cluster add-on

• Considerations

• Enabling the add-on

• Next steps

• Assigning trusted profiles to file storage

Adding File Storage for VPC to apps

• Quick start for File Storage for VPC

• Migrating to a new storage class

• Setting up volume expansion

  • Before you begin

  • Expanding a mounted volume

• Attaching existing file storage to an app

• Creating your own storage class

• Setting the default storage class

• Deploying an app that runs as non-root

• Setting up KMS encryption for File Storage for VPC

• Setting up encryption in-transit (EIT)

• Limiting file share access by worker pool, zone, or worker node

  • Before you begin

  • Limiting file share access to pods on one worker node

  • Limiting file share access to pods on worker nodes in a single zone

  • Limiting file share access to pods on worker nodes in a single worker pool

  • Limiting file share access to pods on worker nodes in multiple worker pools

Managing IBM Cloud File Storage for VPC

• Updating the File Storage for VPC cluster add-on

• Setting resource and request limits in the configmap

• Disabling the add-on

• Understanding your storage removal options

• Cleaning up persistent storage

Storage class reference

Setting up Object Storage

Setting up your IBM Cloud Object Storage instance

• Creating an IBM Cloud Object Storage instance

• Creating IBM Cloud Object Storage service credentials

• Creating a secret for the object storage service credentials

  • Prerequisites

  • Creating an object storage secret in your cluster

• Assigning trusted profiles to COS storage

• Limitations

Installing the IBM Cloud Object Storage plug-in

• Installing the plug-in via Helm

• Updating the IBM Cloud Object Storage plug-in

• Removing the IBM Cloud Object Storage plug-in

• Deciding on the object storage configuration

• Verifying your installation

Deploying an app that uses COS

• Creating a deployment

• Using object storage in a stateful set

Setting capacity quotas for apps that use IBM Cloud Object Storage

• Objectives

• Prerequisites

• Creating a set of service credentials

• Creating a secret to store your credentials

• Installing the plug-in

• Dynamically provisioning a bucket with a quota

• Uploading a file to your bucket

• Creating an app that mounts the bucket

• Review

• Next steps

VPC: Setting up authorized IP addresses for IBM Cloud Object Storage

Migrating Cloud Object Storage (COS) apps and data between IBM Cloud accounts

• Prerequisites

• Optional: Deploy an app in your cluster

• Get the details of your app

• Install rclone

• Configure rclone for your bucket in Account 1

• Configure rclone for your bucket in Account 2

• View the contents of your COS buckets

• Syncing contents between buckets

• Redeploy your app in Account 2

Storage class reference

• IBM Cloud Object Storage Helm chart storage classes

Installing the IBM Cloud Object Storage cluster add-on

• Understanding bucket creation and removal

• Enabling the IBM Cloud Object Storage add-on from the CLI

• Deploying an app that uses IBM Cloud Object Storage

  • Create a Kubernetes secret that contains your COS credentials.

  • Create a PVC

  • Create a deployment

• Disabling the IBM Cloud Object Storage add-on

• Migrating from the Helm plug-in to the cluster add-on

• IBM Cloud Object Storage cluster add-on storage classes

Setting up Portworx

About Portworx

• What is software-defined storage (SDS)?

• What are the benefits of Portworx?

• How does Portworx work?

• What are the requirements to run Portworx?

• How can I make sure that my data is stored highly available?

• What volume topology offers the best performance for my pods?

• Can I install Portworx in a private cluster?

• Can I install Autopilot while using Portworx?

• How do I get support?

• What's next?

• Exploring other Portworx features

Planning your Portworx setup

• Limitations

• Overview of the Portworx lifecycle

• Creating a secret to store the KMS credentials

Preparing your cluster for Portworx

• Classic clusters

• VPC clusters

• Satellite clusters

Setting up the Portworx key-value store

• Setting up a key-value store for Portworx metadata

• Using the Portworx key-value database

Understanding encryption for Portworx

• Encryption overview

• Decryption overview

• Setting up volume encryption

  • Getting your KMS instance and credentials

Installing Portworx in your cluster

• Creating a Portworx volume

• Mounting the volume to your app

Installing Autopilot for Portworx

• Prerequisites

• Installing Autopilot

• Creating Rules

Updating Portworx in your cluster

• VPC: Updating worker nodes with Portworx volumes

Setting up disaster recovery with Portworx

Backing up and restoring apps and data with Portworx Backup

• Installing Portworx Backup

• Verifying your Portworx Backup installation

• Logging in to the Portworx Backup console

• Adding a backup location to your Portworx Backup service

• Adding IBM Cloud Kubernetes Service clusters to your Portworx Backup service

• Installing Stork on a non-Portworx cluster

• Creating a backup with the kmpd command

• Backing up and restoring cluster data with PX-Backup

  • Upgrading PX-Backup

Removing Portworx

• Removing Portworx volumes from apps

• Removing a worker node from your Portworx cluster or the entire Portworx cluster

• Removing the Portworx DaemonSet

• Removing Portworx from your cluster

Getting help and support

• Gathering logs

Backing up and restoring storage data

Backing up and restoring storage data

IBM Cloud storage utilities

IBM Cloud storage utilities

• Classic: Installing the IBM Cloud Block Storage Attacher plug-in (beta)

  • Updating the IBM Cloud Block Storage Attacher plug-in

  • Removing the IBM Cloud Block Volume Attacher plug-in

• Classic: Manually adding block storage to specific worker nodes

• Classic: Attaching raw block storage to non-SDS worker nodes

• VPC: Adding raw Block Storage for VPC to VPC worker nodes by using the API

  • Detaching raw and unformatted Block Storage for Classic from a worker node in a VPC cluster by using the API

  • Reviewing volume attachment details for a VPC worker node by using the API

• VPC: Attaching raw Block Storage for VPC to VPC worker nodes by using the CLI

  • Removing raw Block Storage for VPC from VPC worker nodes by using the CLI

• Backing up and restoring PVC data for file and block storage

  • Setting up an IBM Cloud Object Storage service instance

  • Using IBM Cloud Object Storage to back up and restore PVC data

• Setting up IBM Cloud Monitoring for storage volumes

  • Troubleshooting persistent storage when an IBM Cloud Monitoring alert is triggered

Enhancing cluster capabilities with integrations

IBM Cloud services and third-party integrations

• IBM Cloud services

  • IBM Cloud platform services

  • IBM Cloud classic infrastructure services

  • IBM Cloud VPC infrastructure services

• Kubernetes community and open source integrations

  • Integrations operated in partnership

  • Managed add-ons

  • Other third-party integrations

  • Extending Kubernetes API and software with CRDs and Operators

Adding services by using managed add-ons

• Adding managed add-ons

• Updating managed add-ons

• Reviewing add-on states and statuses

Adding services by using Helm charts

• About Helm in IBM Cloud Kubernetes Service

  • What is Helm and how do I use it?

  • What Helm charts are supported in IBM Cloud Kubernetes Service?

• Installing Helm v3 in your cluster

Binding service credentials to your cluster

• Manually binding service credentials to your cluster

• Adding services to clusters by using the service bind CLI

• Accessing service credentials from your apps

  • Mounting the secret as a volume to your pod

  • Referencing the secret in environment variables

• Removing a service from a cluster

Managing cluster costs

Understanding costs for your clusters

• Understanding costs by component

  • Worker nodes

  • What is the difference between virtual and physical machines?

  • Public bandwidth

  • Subnet IP addresses

  • Multizone load balancer

  • Storage

  • IBM Cloud services

  • Operators and other third-party integrations

  • VPC worker nodes

• Estimating costs

• Managing costs

Using reservations to reduce classic worker node costs

• Understanding reservations

  • Reservation usage and lifecycle

  • Billing and discounts

• Creating a reservation

• Using a reservation in a cluster

• Reviewing reservation usage

• Renewing expiring reservation

Tuning performance

Tuning performance

• Default worker node settings

  • Customizing the operating system

  • Hardware changes

• Modifying worker node kernel settings to optimize performance

• Optimizing pod performance

• Optimizing network keepalive sysctl settings

• Adjusting cluster metrics provider resources

  • Modify the metrics-server-config config map

  • Determining which resources to tune

• Enabling huge pages

• Changing the Calico maximum transmission unit (MTU)

• Disabling the port map plug-in

  • Disabling the port map plug-in in Kubernetes version 1.29 and later

  • Disabling the port map plug-in in Kubernetes version 1.28 and earlier

Removing clusters

Removing clusters

• Removing Satellite worker nodes or clusters

• Next steps

Version history

Kubernetes version information

• Available IBM Cloud® Kubernetes Service versions

• Update types

• Release lifecycle

• Preparing to update

• Archive

CIS Kubernetes Benchmark

• Supported benchmark versions

• Using the benchmark

  • What does the benchmark cover?

  • What do the benchmark recommendations mean?

  • What parts of the benchmark am I responsible for?

  • What if some part of the service fails to comply with a recommendation?

  • What else can I do to increase the security and compliance of my cluster?

• Running the worker node CIS Kubernetes benchmark

CLI plug-in reference

IBM Cloud Kubernetes Service CLI Map

• ibmcloud ks cluster

• ibmcloud ks worker

• ibmcloud ks worker-pool

• ibmcloud ks zone

• ibmcloud ks ingress

• ibmcloud ks logging

• ibmcloud ks nlb-dns

• ibmcloud ks webhook-create

• ibmcloud ks api-key

• ibmcloud ks credential

• ibmcloud ks infra-permissions

• ibmcloud ks kms

• ibmcloud ks quota

• ibmcloud ks subnets

• ibmcloud ks vlan

• ibmcloud ks vpcs

• ibmcloud ks flavors

• ibmcloud ks locations

• ibmcloud ks messages

• ibmcloud ks versions

• ibmcloud ks api

• ibmcloud ks init

• ibmcloud ks script

• ibmcloud ks security-group

• ibmcloud ks storage

IBM Cloud Kubernetes Service CLI reference

• IBM Cloud Kubernetes Service commands

• cluster commands

  • ibmcloud ks cluster addon disable

  • ibmcloud ks cluster addon enable

  • ibmcloud ks cluster addon get

  • ibmcloud ks cluster addon ls

  • ibmcloud ks cluster addon options

  • ibmcloud ks cluster addon update

  • ibmcloud ks cluster addon versions

  • ibmcloud ks cluster ca create

  • ibmcloud ks cluster ca get

  • ibmcloud ks cluster ca rotate

  • ibmcloud ks cluster ca status

  • ibmcloud ks cluster config

  • ibmcloud ks cluster create classic

  • ibmcloud ks cluster create vpc-gen2

  • ibmcloud ks cluster get

  • ibmcloud ks cluster image-security disable

  • ibmcloud ks cluster image-security enable

  • ibmcloud ks cluster ls

  • ibmcloud ks cluster master audit-webhook

  • ibmcloud ks cluster master console-oauth-access get

  • ibmcloud ks cluster master console-oauth-access set

  • ibmcloud ks cluster master pod-security get

  • ibmcloud ks cluster master pod-security policy disable

  • ibmcloud ks cluster master pod-security policy enable

  • ibmcloud ks cluster master pod-security policy get

  • ibmcloud ks cluster master pod-security set

  • ibmcloud ks cluster master pod-security unset

  • ibmcloud ks cluster master private-service-endpoint allowlist

  • ibmcloud ks cluster master private-service-endpoint disable

  • ibmcloud ks cluster master private-service-endpoint enable

  • ibmcloud ks cluster master public-service-endpoint disable

  • ibmcloud ks cluster master public-service-endpoint enable

  • ibmcloud ks cluster master refresh

  • ibmcloud ks cluster master update

  • ibmcloud ks cluster pull-secret apply

  • ibmcloud ks cluster rm

  • ibmcloud ks cluster service bind

  • ibmcloud ks cluster service ls

  • ibmcloud ks cluster service unbind

  • ibmcloud ks cluster subnet add

  • ibmcloud ks cluster subnet create

  • ibmcloud ks cluster subnet detach

  • Deprecated: ibmcloud ks cluster user-subnet add

  • Deprecated: ibmcloud ks cluster user-subnet rm

• Beta: dedicated commands

  • Beta: ibmcloud ks dedicated flavors

  • Beta: ibmcloud ks dedicated host create

  • Beta: ibmcloud ks dedicated host get

  • Beta: ibmcloud ks dedicated host ls

  • Beta: ibmcloud ks dedicated host placement disable

  • Beta: ibmcloud ks dedicated host placement enable

  • Beta: ibmcloud ks dedicated host rm

  • Beta: ibmcloud ks dedicated pool create

  • Beta: ibmcloud ks dedicated pool get

  • Beta: ibmcloud ks dedicated pool ls

  • Beta: ibmcloud ks dedicated pool rm

• worker commands

  • Deprecated: ibmcloud ks worker add

  • ibmcloud ks worker get

  • ibmcloud ks worker ls

  • ibmcloud ks worker reboot

  • ibmcloud ks worker reload

  • ibmcloud ks worker replace

  • ibmcloud ks worker rm

  • ibmcloud ks worker update

• worker-pool commands

  • ibmcloud ks worker-pool create classic

  • ibmcloud ks worker-pool create vpc-gen2

  • ibmcloud ks worker-pool get

  • ibmcloud ks worker-pool label rm

  • ibmcloud ks worker-pool label set

  • ibmcloud ks worker-pool ls

  • ibmcloud ks worker-pool operating-system set

  • ibmcloud ks worker-pool rebalance

  • ibmcloud ks worker-pool resize

  • ibmcloud ks worker-pool rm

  • ibmcloud ks worker-pool taint

  • ibmcloud ks worker-pool zones

• zone commands

  • ibmcloud ks zone add classic

  • ibmcloud ks zone add vpc-gen2

  • ibmcloud ks zone ls

  • ibmcloud ks zone network-set

  • ibmcloud ks zone rm

• ingress commands

  • ibmcloud ks ingress alb autoscale get

  • ibmcloud ks ingress alb autoscale set

  • ibmcloud ks ingress alb autoscale unset

  • ibmcloud ks ingress alb autoupdate disable

  • ibmcloud ks ingress alb autoupdate enable

  • ibmcloud ks ingress alb autoupdate get

  • ibmcloud ks ingress alb create classic

  • ibmcloud ks ingress alb create vpc-gen2

  • ibmcloud ks ingress alb disable

  • ibmcloud ks ingress alb enable classic

  • ibmcloud ks ingress alb enable vpc-gen2

  • ibmcloud ks ingress alb get

  • ibmcloud ks ingress alb health-checker disable

  • ibmcloud ks ingress alb health-checker enable

  • ibmcloud ks ingress alb health-checker get

  • ibmcloud ks ingress alb ls

  • ibmcloud ks ingress alb update

  • ibmcloud ks ingress alb versions

  • ibmcloud ks ingress domain create

  • ibmcloud ks ingress domain default replace

  • ibmcloud ks ingress domain get

  • ibmcloud ks ingress domain ls

  • ibmcloud ks ingress domain rm

  • ibmcloud ks ingress domain secret regenerate

  • ibmcloud ks ingress domain secret rm

  • ibmcloud ks ingress domain update

  • ibmcloud ks ingress instance default set

  • ibmcloud ks ingress instance default unset

  • ibmcloud ks ingress instance get

  • ibmcloud ks ingress instance ls

  • ibmcloud ks ingress instance register

  • ibmcloud ks ingress instance unregister

  • ibmcloud ks ingress lb get

  • ibmcloud ks ingress lb proxy-protocol disable

  • ibmcloud ks ingress lb proxy-protocol enable

  • ibmcloud ks ingress secret create

  • ibmcloud ks ingress secret field add

  • ibmcloud ks ingress secret field ls

  • ibmcloud ks ingress secret field rm

  • ibmcloud ks ingress secret get

  • ibmcloud ks ingress secret ls

  • ibmcloud ks ingress secret rm

  • ibmcloud ks ingress secret update

  • ibmcloud ks ingress status-report disable

  • ibmcloud ks ingress status-report enable

  • ibmcloud ks ingress status-report get

  • ibmcloud ks ingress status-report ignored-errors add

  • ibmcloud ks ingress status-report ignored-errors ls

  • ibmcloud ks ingress status-report ignored-errors rm

• logging commands

  • ibmcloud ks logging autoupdate disable

  • ibmcloud ks logging autoupdate enable

  • ibmcloud ks logging autoupdate get

  • ibmcloud ks logging config create

  • ibmcloud ks logging config get

  • ibmcloud ks logging config rm

  • ibmcloud ks logging config update

  • ibmcloud ks logging filter create

  • ibmcloud ks logging filter get

  • ibmcloud ks logging filter rm

  • ibmcloud ks logging filter update

  • ibmcloud ks logging refresh

• nlb-dns commands

  • ibmcloud ks nlb-dns add

  • ibmcloud ks nlb-dns create classic

  • ibmcloud ks nlb-dns create vpc-gen2

  • ibmcloud ks nlb-dns get

  • ibmcloud ks nlb-dns ls

  • ibmcloud ks nlb-dns monitor configure

  • Command options

  • ibmcloud ks nlb-dns monitor disable

  • ibmcloud ks nlb-dns monitor enable

  • ibmcloud ks nlb-dns monitor get

  • ibmcloud ks nlb-dns monitor ls

  • ibmcloud ks nlb-dns replace

  • ibmcloud ks nlb-dns rm classic

  • ibmcloud ks nlb-dns rm vpc-gen2

  • Experimental: ibmcloud ks nlb-dns secret regenerate

  • Experimental: ibmcloud ks nlb-dns secret rm

• ibmcloud ks vpc secure-by-default enable

  • Command options

• webhook-create command

  • Example webhook-create command

• api-key commands

  • ibmcloud ks api-key info

  • ibmcloud ks api-key reset

• credential commands

  • ibmcloud ks credential get

  • ibmcloud ks credential set classic

  • ibmcloud ks credential unset

• infra-permissions commands

  • ibmcloud ks infra-permissions get

• kms commands

  • ibmcloud ks kms crk ls

  • ibmcloud ks kms enable

  • ibmcloud ks kms instance ls

• quota commands

  • ibmcloud ks quota ls

• subnets command

• vlan commands

  • ibmcloud ks vlan ls

  • ibmcloud ks vlan spanning get

• ibmcloud ks vpc ls

  • Command options

• ibmcloud ks vpc outbound-traffic-protection disable

  • Command options

• ibmcloud ks vpc outbound-traffic-protection enable

  • Command options

• flavor command

  • flavor get command

  • flavor ls command

• messages command

• locations command

• versions command

• api command

• init command

• script commands

  • ibmcloud ks script update

• security-group commands

• ibmcloud ks security-group ls

  • Command options

  • ibmcloud ks security-group reset

  • ibmcloud ks security-group sync

• Beta: storage commands

  • ibmcloud ks storage attachment create

  • ibmcloud ks storage attachment get

  • ibmcloud ks storage attachment ls

  • ibmcloud ks storage attachment rm

  • ibmcloud ks storage volume get

  • ibmcloud ks storage volume ls

• ibmcloud ks experimental trusted-profile default get

  • Command options

• ibmcloud ks experimental trusted-profile default set

  • Command options

• ibmcloud ks experimental trusted-profile get

  • Command options

• ibmcloud ks experimental trusted-profile set

  • Command options