Site map

Getting started with IBM Cloud Kubernetes Service

Getting started with IBM Cloud Kubernetes Service

• Review the basics

• Prepare your account

• Create a cluster environment strategy

• Create a cluster

• Deploy a sample app

• What's next?

Understanding IBM Cloud Kubernetes Service

Understanding IBM Cloud Kubernetes Service

• What is Kubernetes?

• What are containers?

• What compute host infrastructure does IBM Cloud Kubernetes Service offer?

• What are the benefits of using the service?

• Comparison between Red Hat OpenShift and Kubernetes clusters

• Related resources

Your responsibilities with using IBM Cloud Kubernetes Service

Your responsibilities with using IBM Cloud Kubernetes Service

• Overview of shared responsibilities

• Tasks for shared responsibilities by area

  • Incident and operations management

  • Change management

  • Identity and access management

  • Security and regulation compliance

  • Disaster recovery

  • Applications and data

Use cases

Overview of use cases

Financial services use cases for IBM Cloud

• Mortgage company trims costs and accelerates regulatory compliance

  • Context

  • Solution

  • Results

• Payment tech company streamlines developer productivity, deploying AI-enabled tools to their partners 4 times faster

  • Context

  • Solution

  • Results

Healthcare use cases for IBM Cloud

• Healthcare provider migrates workloads from inefficient VMs to Ops-friendly containers for reporting and patient systems

  • Context

  • Solution

  • Results

• Research nonprofit securely hosts sensitive data while it grows research with partners

  • Context

  • Solution

  • Results

Retail use cases for IBM Cloud

• Brick-and-mortar retailer shares data, by using APIs with global business partners to drive omnichannel sales

  • Context

  • Solution

  • Results

• Traditional grocer increases customer traffic and sales with digital insights

  • Context

  • Results

Transportation use cases for IBM Cloud

• Shipping company increases availability of worldwide systems for business partner ecosystem

  • Context

  • Solution

  • Results

• Airline delivers innovative Human Resources (HR) benefits site in under 3 weeks

  • Context

  • Solution

  • Results

Government use cases for IBM Cloud

• Regional government improves collaboration and velocity with community Developers who combine public-private data

  • Context

  • Solution

  • Results

• Large public port secures exchange of port data and shipping manifests that connect public and private organizations

  • Context

  • Solution

  • Results

Learning paths

Learning path for administrators

• Plan your environment

• Create a cluster

• Manage the network

• Secure your cluster

• Logging and monitoring

• Add a registry and CI/CD

• Add storage

• Add integrations

• Manage the lifecycle

Learning path for developers

• Access the cluster

• Plan your deployment

• Develop your app

• Deploy your app

• Test, log, and monitor

• Update your app

• Secure your app

• Expose your app

• Add app storage

• Add integrations

Release notes

Release notes

• April 2024

  • 29 April 2024

    • Ingress ConfigMap update

  • 24 April 2024

    • IBM Cloud Kubernetes Service master and worker node fix packs.

    • Istio add-on versions 1.21.1, 1.20.5, and 1.19.9 are available.

    • IBM Cloud Object Storage plug-in version 2.2.25.

    • IBM Cloud Kubernetes Service CLI version 1.0.617 is available.

  • 18 April 2024

    • IBM Cloud Kubernetes Service CLI version 1.0.613 is available.

  • 09 April 2024

    • Worker node fix packs are available for IBM Cloud Kubernetes Service.

  • 03 April 2024

    • Istio add-on patch updates.

    • ALB OAuth Proxy add-on patch updates.

    • IBM Cloud Kubernetes Service cluster autoscaler add-on patch updates.

    • Version 1.0.9 of the cluster autoscaler add-on is deprecated with an end of support date of 30 April 2024.

• March 2024

  • 27 March 2024

    • Master patch updates for IBM Cloud Kubernetes Service clusters. Master patches are applied automatically over the course of several days. You can choose to use the ibmcloud ks cluster master update command yourself without waiting for the update automation to apply the patch. Review the change logs for your cluster version.

  • 25 March 2024

    • Worker node fix packs are available for IBM Cloud Kubernetes Service.

    • New! NVIDIA L40 GPU support. You can now create VPC clusters with worker nodes which have NVIDIA L40 GPUs.

  • 18 March 2024

    • Ingress ALB updates are available for IBM Cloud Kubernetes Service.

  • 15 March 2024

    • Worker node fix packs are available for IBM Cloud Kubernetes Service.

    • Version 1.29 is the default version for IBM Cloud Kubernetes Service.

  • 08 March 2024

    • Block Storage for VPC add-on patch updates.

    • IBM Cloud File Storage for VPC add-on patch update.

  • 06 March 2024

    • Istio add-on versions 1.20.3 and 1.19.7 are available.

    • CLI version 1.0.601 is available.

• February 2024

  • 28 February 2024

    • IBM Cloud Kubernetes Service cluster autoscaler version 1.2.1 is available.

    • Master patch updates for IBM Cloud Kubernetes Service clusters. Master patches are applied automatically over the course of several days. You can choose to use the ibmcloud ks cluster master update command yourself without waiting for the update automation to apply the patch. Review the change logs for your cluster version.

  • 27 February 2024

    • Worker node fix packs are available for IBM Cloud Kubernetes Service.

    • CLI version 1.0.597 is available.

  • 26 February 2024

    • New! NVIDIA L4 GPU support. You can now create VPC clusters with worker nodes which have NVIDIA L4 GPUs.

    • Ingress ALB patch updates 1.9.4_6376_iks, 1.8.4_6375_iks, and 1.6.4_6374_iks for IBM Cloud Kubernetes Service.

    • New worker node flavors are available with L4 GPUs.

  • 22 February 2024

    • IBM Cloud Object Storage plug-in version 2.2.24.

  • 21 February 2024

    • Kubernetes version 1.29 certification

    • IBM Cloud Kubernetes Service cluster autoscaler add-on patch updates 1.0.9_377 and 1.2.0_365.

  • 19 February 2024

    • Ingress ALB versions 1.9.4_6359_iks and 1.8.4_6363_iks are available for IBM Cloud Kubernetes Service.

  • 16 February 2024

    • IBM Cloud Kubernetes Service cluster autoscaler add-on patch update 1.1.0_362.

  • 14 February 2024

    • New! IBM Cloud Kubernetes Service version 1.29.

    • Master fix pack 1.29.1_1524 and worker node fix pack 1.29.1_1525.

    • Starting with IBM Cloud Kubernetes Service version 1.29, Calico components run in the calico-system namespace and the Tigera operator components run in the tigera-operator namespace.

    • IBM Cloud Kubernetes Service version 1.26 is deprecated.

  • 13 February 2024

    • Worker node fix packs are available for IBM Cloud Kubernetes Service.

    • Ingress ALB versions 1.9.4_6346_iks, 1.8.4_6345_iks, 1.6.4_6344_iks are available for IBM Cloud Kubernetes Service.

  • 08 February 2024

    • CLI version 1.0.595 is available.

    • Block Storage for VPC add-on versions 5.2.15_501 and 5.1.21_506 are available.

    • IBM Cloud File Storage for VPC add-on version 1.2.6_130 is available.

  • 07 February 2024

    • Istio add-on versions 1.20.2, 1.19.6, and 1.18.7 are available.

  • 05 February 2024

    • Ingress ALB updates

  • 01 February 2024

    • Master fix packs are available for IBM Cloud Kubernetes Service

    • IBM Cloud Kubernetes Service version 1.25 is no longer supported.

    • IBM Cloud Kubernetes Service cluster autoscaler add-on patch update 1.0.8_346.

• January 2024

  • 30 January 2024

    • Worker node fix packs are available.

  • 29 January 2024

    • IBM Cloud Object Storage plug-in version 2.2.23.

  • 22 January 2024

    • Ingress ALB updates

  • 19 January 2024

    • CLI version 1.0.589 is available.

  • 17 January 2024

    • Worker node fix packs are available.

  • 16 January 2024

    • Cluster autoscaler add-on patch updates 1.2.0_322 and 1.0.9_328.

    • ALB OAuth Proxy add-on version 2.0.0_2063.

  • 10 January 2024

    • Subscribe to the IBM Cloud documentation release notes via RSS.

    • Ingress ALB updates

    • Istio cluster add-on versions 1.20.0, 1.19.5, and 1.18.6.

    • Istio add-on version 1.18 will no longer be supported on 21 February 2024

    • IBM Cloud File Storage for VPC cluster add-on patch update 1.2.5_107.

    • Block Storage for VPC cluster add-on patch updates 5.2.14_485 and 5.1.19_486.

  • 2 January 2024

    • Worker node fix packs are available.

• December 2023

  • 18 December 2023

    • Worker node fix packs are available.

  • 14 December 2023

    • Information on worker node removal priority.

    • Kubernetes version 1.24 is unsupported.

  • 8 December 2023

    • Security Bulletin: IBM Cloud Kubernetes Service is affected by Kubernetes API server security vulnerabilities

  • 7 December 2023

    • Istio add-on version 1.20.0.

  • 6 December 2023

    • Master fix packs are available.

  • 5 December 2023

    • Istio add-on version 1.19.4.

  • 4 December 2023

    • Ingress ALB updates

    • Worker node fix packs are available.

• November 2023

  • 29 November 2023

    • Worker node fix packs are available.

  • 27 November 2023

    • The Beta File Storage for VPC cluster add-on is now available to all accounts.

    • Cluster autoscaler add-on patch updates 1.2.0_290, 1.0.9_290, 1.0.8_292, and 1.0.7_291.

    • Block Storage for VPC add-on versions 5.0.23_437 and 5.1.16_446, and 5.2.11_447.

    • IBM Cloud File Storage for VPC add-on patch 1.1.10_93 and 1.2.3_97.

  • 21 November 2023

    • Ingress ALB updates

  • 20 November 2023

    • You can now specify a custom pod subnet size when creating a VPC cluster.

    • IBM Cloud Object Storage plug-in version 2.2.22.

  • 15 November 2023

    • The cluster autoscaler add-on now supports version 1.28 clusters.

    • Master fix packs are available.

  • 13 November 2023

    • IBM Cloud Object Storage plug-in version 2.2.21.

    • Block Storage for VPC add-on versions 5.0.21_401 and 5.1.15_419, and 5.2.10_428.

    • Cluster autoscaler add-on patch updates 1.0.9_195, 1.0.8_233, and 1.0.7_185.

    • IBM Cloud File Storage for VPC add-on patch 1.1.9_87.

  • 10 November 2023

    • Updated sorting and formatting for the Classic and VPC cluster flavor pages.

  • 9 November 2023

    • Worker node fix packs are available.

  • 7 November 2023

    • CLI version 1.0.579 is available.

    • Ingress ALB updates

  • 06 November 2023

    • Kubernetes version 1.28 is now the default version for new IBM Cloud Kubernetes Service clusters.

• October 2023

  • 31 October 2023

    • VNI functionality for limiting access to File Storage for VPC by node, zone, worker pool and more.

    • IBM Cloud File Storage for VPC add-on version 1.2.

  • 30 October 2023

    • IBM Cloud Object Storage plug-in version 2.2.20

    • Setting up alerts for Block Storage for Classic PVs with limited network connectivity.

  • 25 October 2023

    • Master fix packs are available.

    • ALB OAuth Proxy add-on version 2.0.0_1901.

  • 23 October 2023

    • Worker node fix packs are available.

    • Ingress ALB version 1.8.4_5586_ikss

  • 18 October 2023

    • Istio add-on version 1.18.5 and 1.17.8.

    • ALB OAuth Proxy add-on version 2.0.0_1889.

  • 17 October 2023

    • Ingress ALB versions 1.8.1_5543_iks, 1.6.4_5544_iks, and 1.5.1_5542_iks

  • 11 October 2023

    • Ingress ALB versions 1.5.1_5436_iks, 1.6.4_5435_iks, and 1.8.1_5434_iks

    • IBM Cloud Object Storage plug-in version 2.2.19

  • 10 October 2023

    • CLI version 1.0.573 is available.

    • Istio add-on version 1.19.3.

  • 9 October 2023

    • Worker node fix packs are available.

  • 5 October 2023

    • Ingress ALB versions 1.8.1_5384_iks, 1.6.4_5406_iks, and 1.5.1_5407_iks

  • 4 October 2023

    • Cluster autoscaler add-on version 1.0.9_134.

  • 3 October 2023

    • Istio add-on versions 1.17.6 and 1.18.3.

• September 2023

  • 27 September 2023

    • Worker node fix packs are available.

  • 26 September 2023

    • ALB OAuth Proxy add-on version 2.0.0_1843.

  • 25 September 2023

    • Block Storage for VPC add-on version 5.2.

  • 22 September 2023

    • Kubernetes version 1.28 certification

  • 20 September 2023

    • New! IBM Cloud Kubernetes Service version 1.28.

    • Master fix pack 1.28.2_1527 and worker node fix pack 1.28.1_1523.

    • Networking changes for VPC clusters 1.28 and later

    • Trusted profile updates for Kubernetes clusters version 1.28 and later.

    • New! Updated GPU drivers with version 1.28 clusters.

    • Master fix packs are available.

  • 18 September 2023

    • CLI version 1.0.566 is available.

  • 15 September 2023

    • Cluster autoscaler add-on versions 1.0.9_103,1.0.8_104, and 1.0.7_102.

  • 14 September 2023

    • IBM Cloud File Storage for VPC add-on version 1.1.7_49

    • Block Storage for VPC add-on versions 5.0.19_358 and 5.1.13_345.

  • 12 September 2023

    • Worker node fix packs are available.

  • 7 September 2023

    • IBM Cloud Object Storage plug-in version 2.2.18

• August 2023

  • 31 August 2023

    • Ingress ALB versions 1.8.1_5317_iks, 1.6.4_5270_iks, and 1.5.1_5318_iks

  • 30 August 2023

    • Master fix packs are available.

  • 29 August 2023

    • New! Madrid multizone region

    • Worker node fix packs are available.

  • 15 August 2023

    • Worker node fix packs are available.

  • 9 August 2023

    • ALB OAuth Proxy add-on version 2.0.0_1715.

  • 8 August 2023

    • Istio add-on versions 1.16.7, 1.17.5, and 1.18.2.

  • 7 August 2023

    • Cluster autoscaler add-on versions 1.0.9_81,1.0.8_82, and 1.0.7_83.

  • 3 August 2023

    • CIS benchmarks for Red Hat OpenShift version 4.13.

  • 1 August 2023

    • Worker node fix packs are available.

    • Block Storage for VPC add-on versions 5.0.17_266 and 5.1.12_285.

• July 2023

  • 31 July 2023

    • Ubuntu 18 is no longer supported.

  • 28 July 2023

    • IBM Cloud Object Storage plug-in version 2.2.17.

  • 27 July 2023

    • Master fix packs are available

    • IBM Cloud File Storage for VPC add-on version 1.1.6

    • Istio add-on version 1.16.6, 1.17.4, and 1.18.1.

  • 26 July 2023

    • Ingress ALB versions 1.6.4_5219_iks, 1.5.1_5217_iks, and 1.4.0_5218_iks

  • 25 July 2023

    • End of support for the free cluster tier

  • 24 July 2023

    • Cluster autoscaler add-on version 1.0.9_70.

    • Static route add-on version 1.0.0_1122.

  • 21 July 2023

    • Cluster autoscaler add-on update command.

  • 19 July 2023

    • CLI version 1.0.540 is available.

  • 17 July 2023

    • Worker node fix packs 1.24.15_1576, 1.25.11_1552, 1.26.6_1544, and 1.27.3_1532.

  • 12 July 2023

    • ALB OAuth Proxy add-on version 2.0.0_1669.

  • 11 July 2023

    • New! OpenShift Data Foundation add-on version 4.13.0.

  • 6 July 2023

    • Cluster autoscaler add-on version 1.0.8_56 and 1.0.7_57.

    • Istio add-on version 1.18.0.

    • Pod security admission updates

  • 5 July 2023

    • Ingress ALB versions 1.6.4_5161_iks, 1.5.1_5160_iks, and 1.4.0_5159_iks

  • 3 July 2023

    • IBM Cloud Object Storage plug-in version 2.2.16

    • IBM Cloud File Storage for VPC add-on version 1.1

    • Worker node fix packs 1.24.15_1574, 1.25.11_1550, 1.26.6_1542, and 1.27.3_1530.

• June 2023

  • 27 June 2023

    • Master fix packs 1.24.15_1573, 1.25.11_1549, 1.26.6_1541, and 1.27.3_1529.

  • 26 June 2023

    • CLI version 1.0.528.

  • 23 June 2023

    • Free cluster tier deprecation

  • 22 June 2023

    • Cluster autoscaler add-on version 1.0.9_44.

    • Istio add-on version 1.17.3.

  • 21 June 2023

    • Block Storage for VPC add-on versions 5.0.16_127 and 5.1.11_126.

  • 20 June 2023

    • Worker node fix pack updates

  • 19 June 2023

    • IBM Cloud Object Storage plug-in version 2.2.15

  • 8 June 2023

    • Istio add-on version 1.16.5.

  • 6 June 2023

    • Ingress ALB versions 1.6.4_5067_iks, 1.5.1_5074_iks, and 1.4.0_5068_iks

  • 5 June 2023

    • Worker node fix packs 1.24.14_1571, 1.25.10_1547, 1.26.5_1539, and 1.27.2_1527.

• May 2023

  • 31 May 2023

    • Master fix packs 1.24.14_1568, 1.25.10_1545, and 1.26.5_1537.

  • 25 May 2023

    • CLI version 1.0.523.

    • Kubernetes version 1.27 certification

  • 24 May 2023

    • New! IBM Cloud Kubernetes Service version 1.27.

    • Master fix pack 1.27.2_1524 and worker node fix pack 1.27.2_1526.

    • Worker node fix packs 1.24.14_1570, 1.25.10_1546, and 1.26.5_1538.

  • 23 May 2023

    • Ingress ALB versions 1.6.4_4170_iks, 1.5.1_4168_iks, and 1.4.0_4169_iks

  • 16 May 2023

    • IBM Cloud File Storage for VPC add-on version 1.0.

  • 15 May 2023

    • Cluster autoscaler add-on versions 1.0.6_1077, 1.0.7_1076, 1.0.8_1078, and 1.1.0_1066.

    • IBM Cloud File Storage for VPC add-on version 1.1-beta

    • Block Storage for VPC add-on versions 5.0.12_1963 and 5.1.8_1970.

  • 10 May 2023

    • Create Classic and VPC clusters with Terraform

  • 9 May 2023

    • Worker node fix packs 1.24.13_1567, 1.25.9_1544, and 1.26.4_1536.

  • 4 May 2023

    • Ingress ALB version 1.6.4_4117_iks, 1.5.1_4113_iks, and 1.4.0_4114_iks

  • 2 May 2023

    • IBM Cloud Object Storage plug-in version 2.2.14

• April 2023

  • 27 April 2023

    • Ingress ALB version 1.6.4_4073_iks, 1.5.1_4064_iks, and 1.4.0_4062_iks

    • Master fix packs 1.23.17_1576, 1.24.13_1566, 1.25.9_1543, and 1.26.4_1535.

  • 26 April 2023

    • Cluster autoscaler add-on version 1.1.0_1060.

  • 24 April 2023

    • Worker node fix packs 1.23.17_1576, 1.24.13_1566, 1.25.9_1543, and 1.26.4_1535.

  • 20 April 2023

    • Istio add-on version 1.16.4 and 1.17.2.

  • 13 April 2023

    • ALB OAuth Proxy add-on version 2.0.0_1528.

  • 12 April 2023

    • Ingress ALB version 1.6.4_3976_iks, 1.5.1_3977_iks, and 1.4.0_3978_iks

  • 11 April 2023

    • CLI version 1.0.510.

    • Worker node fix packs 1.23.17_1574, 1.24.12_1564, 1.25.8_1541, and 1.26.3_1533.

  • 5 April 2023

    • Cluster autoscaler add-on versions 1.0.6_1010, 1.0.7_1021, and 1.0.8_1016.

    • Block Storage for VPC add-on versions 5.0.10_1869 and 5.1.6_1872.

  • 4 April 2023

    • Ingress ALB version 1.4.0_3953_iks, 1.5.1_3951_iks, and 1.6.4_3947_iks

  • 3 April 2023

    • Pod Security admission

    • IBM Cloud Object Storage plug-in version 2.2.13

• March 2023

  • 29 March 2023

    • Worker node fix packs 1.23.17_1572, 1.24.12_1562, 1.25.8_1539, and 1.26.3_1531.

    • Block Storage for VPC add-on versions 5.0.9_1862 and 5.1.5_1857.

    • Cluster autoscaler add-on versions 1.0.7_988 and 1.0.8_987.

  • 28 March 2023

    • Master fix packs 1.23.17_1569, 1.24.12_1559, 1.25.8_1536, and 1.26.3_1528.

    • Worker node fix packs 1.23.17_1570, 1.24.12_1560, 1.25.8_1537, and 1.26.3_1529.

  • 24 March 2023

    • Ingress ALB version 1.4.0_3896_iks, 1.5.1_3897_iks, and 1.6.4_3898_iks

  • 21 March 2023

    • New troubleshooting steps for workers in Critical or NotReady state.

  • 20 March 2023

    • IBM Cloud Object Storage plug-in version 2.2.12.

  • 16 March 2023

    • Cluster autoscaler add-on version 1.1.0_978.

  • 14 March 2023

    • Ingress ALB version 1.4.0_3862_iks, 1.5.1_3863_iks, and 1.6.4_3864_iks

    • Worker node fix packs 1.23.16_1568, 1.24.10_1558, 1.25.6_1535, and 1.26.1_1525.

  • 9 March 2023

    • Cluster autoscaler add-on version 1.0.8_968

    • Istio add-on version 1.15.6 and 1.16.3.

  • 7 March 2023

    • Worker node fix packs 1.23.16_1567, 1.24.10_1557, 1.25.6_1534, and 1.26.1_1524.

    • Cluster autoscaler add-on version 1.0.6_955 and 1.0.7_956.

    • Istio add-on version 1.17.1.

    • Block Storage for VPC add-on versions 4.4.17_1829, 5.0.7_1836, and 5.1.2_1828.

  • 3 March 2023

    • IBM Cloud Object Storage plug-in version 2.2.10.

  • 1 March 2023

    • CLI version 1.0.498.

    • ALB OAuth Proxy add-on version 2.0.0_1487.

• February 2023

  • 27 February 2023

    • Worker node fix packs 1.23.16_1563, 1.24.10_1554, 1.25.6_1532, and 1.26.1_1522.

  • 23 February 2023

    • Ingress ALB version 1.3.1_3807_iks, 1.4.0_3808_iks, and 1.5.1_3809_iks

  • 22 February 2023

    • ALB OAuth Proxy add-on version 2.0.0_1469.

  • 21 February 2023

    • IBM Cloud Object Storage plug-in version 2.2.10.

    • Block Storage for VPC add-on versions 4.4.17_1829, 5.0.7_1836, and 5.1.2_1828.

  • 20 February 2023

    • Ingress ALB version 1.3.1_3777_iks, 1.4.0_3783_iks, and 1.5.1_3779_iks

  • 17 February 2023

    • Cluster autoscaler add-on version 1.0.7_944.

  • 14 February 2023

    • Istio add-on 1.15.5 and 1.16.2

  • 13 February 2023

    • IBM Cloud Object Storage plug-in version 2.2.9 is available.

    • Worker node fix packs 1.23.16_1562, 1.24.10_1553, 1.25.6_1531, and 1.26.1_1521.

  • 10 February 2023

    • New troubleshooting doc for how to recover after deleting a portable subnet in Classic clusters.

    • Ingress ALB version 1.3.1_3754_iks and 1.4.0_3755_iks

  • 9 February 2023

    • Block Storage for VPC add-on version 5.1.

  • 8 February 2023

    • ALB OAuth Proxy add-on version 2.0.0_1420.

  • 2 February 2023

    • Istio add-on 1.14

  • 1 February 2023

    • New! Kubernetes 1.26

    • Master fix pack

    • Worker node fix pack

    • Persistent VPC load balancers

    • Customized VPC load balancer health checks

• January 2023

  • 30 January 2023

    • Master fix packs 1.23.16_1560, 1.24.10_1551, and 1.25.6_1529.

    • Worker node fix packs 1.23.16_1561, 1.24.10_1552, and 1.25.6_1530.

    • New! Optional secondary disks for worker nodes in VPC clusters.

    • CLI version 1.0.489.

    • Ingress ALB version 1.5.1_3705_iks, 1.4.0_3703_iks, and 1.3.1_3704_iks.

  • 24 January 2023

    • CLI version 1.0.487 change log update

    • Block Storage for VPC add-on versions 4.4.16_1779 and 5.0.5_1784.

    • Cluster autoscaler add-on version 1.0.7_940.

    • Ingress ALB version 1.3.1_3685_iks, 1.4.0_3684_iks, and 1.5.1_3683_iks

  • 23 January 2023

    • IBM Cloud Object Storage plug-in version 2.2.8 is available.

  • 16 January 2023

    • Worker node fix packs 1.23.15_1558, 1.24.9_1550, and 1.25.5_1528.

  • 10 January 2023

    • Block Storage for VPC add-on versions 4.4.15_1764 and 5.0.4_1773

    • Istio add-on versions 1.14.6, 1.15.4, and 1.16.1

  • 9 January 2023

    • Cluster autoscaler add-on versions 1.0.5_898, 1.0.6_899, 1.0.7_900, and 1.1.0_897.

  • 5 January 2023

    • IBM Cloud Object Storage plug-in version 2.2.7 is available.

  • 3 January 2023

    • Ingress ALB version 1.3.1_3538_iks, and 1.4.0_3537_iks

  • 2 January 2023

    • Worker node fix packs 1.22.17_1584, 1.23.15_1557, 1.24.9_1549, and 1.25.5_1527

• December 2022

  • 19 December 2022

    • Worker node fix packs 1.22.17_1583, 1.23.15_1556, 1.24.9_1548, and 1.25.5_1526

  • 15 December 2022

    • IBM Cloud Object Storage plug-in version 2.2.6 is available.

    • Ingress ALB version 1.2.1_3299_iks, 1.3.1_3298_iks, and 1.4.0_3297_iks

    • ALB OAuth Proxy add-on version 2.0.0_1354

  • 14 December 2022

    • Master fix pack 1.22.17_1582, 1.23.15_1555, 1.24.9_1547, and 1.25.5_1525

    • Ubuntu 20 is now available for IBM Cloud Kubernetes Service clusters

    • CLI version 1.0.480 change log update

  • 12 December 2022

    • Ingress ALB version 1.4.0_3212_iks change log updates

  • 9 December 2022

    • IBM Cloud Object Storage plug-in version 2.2.5 is available.

  • 8 December 2022

    • Ingress ALB version 1.3.1_3192_iks change log updates

  • 5 December 2022

    • IBM Cloud Object Storage plug-in version 2.2.4 is available.

    • Ingress ALB version 1.2.1_3186_iks change log updates

  • 1 December 2022

    • CLI version 1.0.471 change log update

• November 2022

  • 30 November 2022

    • Istio add-on version 1.16.0

    • Ingress ALB change log updates

  • 21 November 2022

    • Worker node fix pack 1.22.16_1579, 1.23.14_1553, 1.24.8_1545, and 1.25.4_1523

  • 17 November 2022

    • Block Storage for VPC add-on versions 4.4.13_1712 and 5.0.2_1713

  • 16 November 2022

    • ALB OAuth Proxy add-on version 2.0.0_1315

    • Master fix pack 1.22.16_1578, 1.23.14_1552, 1.24.8_1544, and 1.25.4_1522

  • 15 November 2022

    • New Ingress status messages

    • IBM Cloud Object Storage plug-in version 2.2.3 is available.

  • 11 November 2022

    • Block Storage for VPC add-on version 4.3.8_1705

  • 10 November 2022

    • Istio add-on version 1.15.3

  • 9 November 2022

    • Block Storage for VPC add-on version 4.4.12_1700 and 5.0.1_1695

  • 8 November 2022

    • IBM Cloud Object Storage plug-in version 2.2.2 is available.

  • 7 November 2022

    • Worker node fix pack 1.22.15_1577, 1.23.13_1551, 1.24.7_1543, and 1.25.3_1521

  • 3 November 2022

    • Changes to the Portworx update process beginning with version 2.12.

    • Cluster autoscaler add-on version 1.0.7_883.

• October 2022

  • 31 October 2022

    • Ingress ALB change log updates

  • 27 October 2022

    • ALB OAuth Proxy add-on version 2.0.0_1297

    • Master fix pack 1.22.15_1576, 1.23.13_1550, 1.24.7_1542, and 1.25.3_1520

  • 26 October 2022

    • Worker node fix pack 1.22.15_1575, 1.23.12_1549, 1.24.6_1541, and 1.25.2_1519

  • 25 October 2022

    • Istio add-on

  • 24 October 2022

    • Ingress ALB change log updates

  • 21 October 2022

    • CLI change log update

  • 12 October 2022

    • Istio add-on

  • 11 October 2022

    • Block Storage for VPC add-on version 5.0.

  • 10 October 2022

    • Worker node fix pack

    • Cluster autoscaler add-on version 1.0.6_828.

  • 7 October 2022

    • Kubernetes version 1.25 certification

  • 6 October 2022

    • New! Kubernetes 1.25

    • Master fix pack

    • Worker node fix pack

  • 4 October 2022

    • Istio add-on

  • 3 October 2022

    • CLI change log update

    • Ingress ConfigMap change log updates

    • Ingress ALB change log updates

    • ALB OAuth Proxy add-on

• September 2022

  • 30 September 2022

    • New! Enabling Flow logs for VPC components

  • 26 September 2022

    • Worker node fix pack

  • 23 September 2022

    • Block Storage for VPC add-on version 4.4.11_1614.

  • 22 September 2022

    • Cluster autoscaler add-on versions 1.1.0_798, 1.0.6_800, and 1.0.5_779.

    • Block Storage for VPC add-on version 4.3.7_1613.

  • 21 September 2022

    • CLI change log update

    • Ingress ALB change log updates

  • 20 September 2022

    • IBM Cloud Object Storage plug-in version 2.2.1 is available.

  • 15 September 2022

    • Istio add-on

  • 13 September 2022

    • Block Storage for VPC add-on version 4.4.10_1578 is available.

    • New! vGPU worker node flavors are now available for VPC Gen 2.

  • 12 September 2022

    • Block Storage for VPC add-on version 4.3.6_1579 is available.

    • IBM Cloud Object Storage plug-in version 2.2.0 is available.

    • CLI change log update

    • ALB OAuth Proxy add-on

  • 8 September 2022

    • CLI change log update

  • 7 September 2022

    • Master fix pack update

• August 2022

  • 31 August 2022

    • Cluster autoscaler add-on

  • 29 August 2022

    • Worker node fix pack

  • 26 August 2022

    • CLI change log update

  • 25 August 2022

    • Block Storage for VPC add-on version 4.4.9_1566 is available.

    • Ingress ALB change log updates

  • 24 August 2022

    • Block Storage for VPC add-on version 4.3.5_1563 is available.

    • IBM Cloud Object Storage plug-in version 2.1.21 is available.

  • 17 August 2022

    • IBM Cloud Object Storage plug-in version 2.1.20 is available.

    • Cluster autoscaler add-on

  • 16 August 2022

    • Worker node fix pack

    • Istio add-on

  • 11 August 2022

    • Dynamically provision IBM Cloud Object Storage buckets with quotas enabled

    • Ingress ALB change log updates

  • 5 August 2022

    • CLI change log update

  • 3 August 2022

    • New! IBM Cloud File Storage for VPC CSI Driver (Beta)

  • 2 August 2022

    • Ingress ALB change log updates

  • 1 August 2022

    • Worker node fix pack

• July 2022

  • 27 July 2022

    • IBM Cloud Object Storage plug-in version 2.1.19 is available.

  • 26 July 2022

    • Master fix pack update

  • 22 July 2022

    • Cluster autoscaler add-on

  • 19 July 2022

    • Ingress ALB change log updates

    • Cluster autoscaler add-on

  • 18 July 2022

    • Block Storage for VPC add-on.

    • Worker node fix pack

  • 15 July 2022

    • CLI change log update

    • Cluster autoscaler add-on

  • 14 July 2022

    • Cross-account encryption

    • IBM Cloud Object Storage plug-in

    • Block Storage for VPC add-on.

  • 13 July 2022

    • CLI change log update

  • 7 July 2022

    • ALB OAuth Proxy add-on

  • 5 July 2022

    • Worker node fix pack

    • Ingress ALB change log updates

• June 2022

  • 30 June 2022

    • Cluster autoscaler add-on

  • 28 June 2022

    • IBM Cloud Object Storage plug-in

  • 27 June 2022

    • Block Storage for VPC

  • 24 June 2022

    • Block Storage for VPC

    • Block Storage for VPC add-on.

  • 22 June 2022

    • New! Portworx Cloud Drive support

  • 21 June 2022

    • Istio add-on

  • 20 June 2022

    • Worker node fix pack

  • 17 June 2022

    • Block Storage for VPC add-on.

  • 16 June 2022

    • Certified Kubernetes

    • Version 1.20 is unsupported as of 19 June 2022

    • Istio add-on

  • 15 June 2022

    • IBM Cloud Monitoring metrics and label updates

    • Block Storage for VPC add-on.

  • 13 June 2022

    • Block Storage for VPC add-on.

  • 10 June 2022

    • Log Analysis and IBM Cloud Activity Tracker changes

    • Ingress ALB change log updates

    • Block Storage for VPC add-on.

  • 9 June 2022

    • New! Kubernetes 1.24

    • Deprecated and unsupported Kubernetes versions

  • 7 June 2022

    • CLI change log update

  • 6 June 2022

    • Worker node fix pack

  • 3 June 2022

    • Master fix pack update

  • 1 June 2022

    • Istio add-on

• May 2022

  • 26 May 2022

    • CLI change log update

  • 25 May 2022

    • IBM Cloud Object Storage plug-in

    • Block Storage for VPC add-on.

    • Block Storage for VPC add-on.

  • 20 May 2022

    • Worker node fix pack

  • 19 May 2022

    • Istio add-on

    • Ingress ALB change log updates

  • 16 May 2022

    • Cluster autoscaler add-on

    • ALB OAuth Proxy add-on

  • 12 May 2022

    • Block Storage for VPC add-on.

  • 9 May 2022

    • Worker node fix pack

  • 6 May 2022

    • IBM Cloud Object Storage plug-in

  • 4 May 2022

    • ALB OAuth Proxy add-on

    • Ingress ALB change log updates

  • 3 May 2022

    • Istio add-on

• April 2022

  • 28 April 2022

    • CLI change log update

    • Cluster security groups

  • 26 April 2022

    • Ingress ALB change log updates

    • CLI change log update

  • 25 April 2022

    • Worker node fix pack

  • 21 April 2022

    • Ingress ALB change log updates

  • 19 April 2022

    • Istio add-on

  • 13 April 2022

    • IBM Cloud Object Storage plug-in

  • 12 April 2022

    • Create and manage dedicated hosts in VPC Gen 2.

  • 11 April 2022

    • New! IBM Cloud® Secrets Manager

    • Block Storage for VPC add-on.

    • Worker node fix pack

  • 7 April 2022

    • IBM Cloud Kubernetes Service clusters in Mexico City (MEX01) are deprecated and become unsupported later this year.

    • Ingress ALB change log updates

    • CLI change log update

  • 6 April 2022

    • Master fix pack update

• March 2022

  • 30 March 2022

    • Cluster autoscaler add-on

    • Kubernetes Service 1.20 end of support date change

    • Master fix pack update

  • 28 March 2022

    • Worker node fix pack update.

  • 24 March 2022

    • IBM Cloud Object Storage plug-in

    • Block Storage for VPC add-on.

    • ALB OAuth Proxy add-on

  • 22 March 2022

    • Hong Kong (HKG02) and Seoul (SEO01) are deprecated and become unsupported later this year.

    • Ingress ALB change log updates

    • Istio add-on

  • 21 March 2022

    • CLI change log update

  • 17 March 2022

    • Block Storage for VPC add-on.

  • 16 March 2022

    • Cluster autoscaler add-on

  • 15 March 2022

    • Version 1.19 unsupported

  • 14 March 2022

    • Worker node fix pack update.

  • 11 March 2022

    • IBM Cloud Object Storage plug-in

  • 9 March 2022

    • Istio add-on

  • 8 March 2022

    • Master fix pack update.

    • Istio add-on

  • 3 March 2022

    • Kubernetes Service default version update.

    • Maintenance Windows for Kubernetes Service ALBs

• February 2022

  • 28 February 2022

    • Block Storage for VPC add-on.

    • Cluster autoscaler

    • ALB OAuth Proxy add-on

    • Worker node fix pack

  • 24 February 2022

    • Container service CLI

    • Kubernetes Ingress image

  • 23 February 2022

    • Cluster autoscaler

    • Istio add-on

  • 18 February 2022

    • Container service CLI

  • 17 February 2022

    • IBM Cloud Object Storage plug-in

  • 15 February 2022

    • Istio add-on

  • 14 February 2022

    • Worker node fix pack

    • IBM Cloud Object Storage doc restructuring.

    • Block Storage for VPC add-on.

  • 10 February 2022

    • Certified Kubernetes

    • ALB OAuth Proxy add-on

  • 9 February 2022

    • New! Kubernetes 1.23

    • Deprecated and unsupported Kubernetes versions

  • 3 February 2022

    • Istio add-on

• January 2022

  • 31 January 2022

    • Version change log

    • New! Worker node flavor reference

  • 27 January 2022

    • Block Storage for VPC add-on.

    • New! Gathering Ingress logs

  • 26 January 2022

    • ALB OAuth Proxy add-on

  • 25 January 2022

    • Kubernetes Ingress image

    • Kubernetes Ingress annotations

  • 24 January 2022

    • IBM Cloud Object Storage plug-in

  • 20 January 2022

    • Cluster autoscaler add-on.

    • Block Storage for VPC add-on.

    • OpenShift Data Foundation

  • 18 January 2022

    • Review the release notes for January 2022.

    • New! IBM Cloud Kubernetes Service CLI Map

    • Kubernetes Service 1.19, 1.20, 1.21, and 1.22 unsupported date change

    • Worker node fix pack update.

  • 17 January 2022

    • IBM Cloud Object Storage plug-in

  • 13 January 2022

    • Istio add-on

  • 06 January 2022

    • Block Storage for VPC add-on.

    • Kubernetes Service 1.20 end of support date change

  • 4 January 2022

    • Worker node fix pack update

• December 2021

  • Review the release notes for December 2021.

  • 20 December 2021

    • Deprecated and unsupported Kubernetes versions

  • 14 December 2021

    • Istio add-on

  • 7 December 2021

    • Istio add-on

    • Master fix pack update

  • 6 December 2021

    • Worker node fix pack update

  • 2 December 2021

    • Kubernetes Service default version update.

• November 2021

  • Review the release notes for November 2021.

  • 29 November 2021

    • Container service CLI

  • 22 November 2021

    • Worker node fix pack update

    • Block Storage for VPC add-on.

    • Cluster autoscaler add-on.

  • 19 November 2021

    • ALB OAuth Proxy add-on

    • Kubernetes Ingress image

  • 18 November 2021

    • IBM Cloud Activity Tracker and IBM Cloud Activity Tracker

    • IBM Cloud Object Storage

  • 17 November 2021

    • Worker node fix pack update

  • 15 November 2021

    • CLI change log

  • 12 November 2021

    • Master fix pack updates

  • 10 November 2021

    • Worker node fix pack update

  • 8 November 2021

    • Update commands to use docker build

  • 4 November 2021

    • IAM trusted profiles for pod authorization

  • 2 November 2021

    • Istio add-on change log

• October 2021

  • Review the release notes for October 2021.

  • 28 October 2021

    • Istio add-on change log

  • 26 October 2021

    • CLI change log

  • 25 October 2021

    • Worker node fix pack update

  • 22 October 2021

    • IBM Cloud Object Storage plug-in.

  • 19 October 2021

    • Ingress ALB change log updates

  • 18 October 2021

    • New troubleshooting topic

  • 13 October 2021

    • CLI change log

  • 11 October 2021

    • Unsupported Kubernetes version 1.18

    • Worker node fix pack update

  • 7 October 2021

    • Istio add-on change log

    • Cluster autoscaler add-on.

  • 6 October 2021

    • Block Storage for VPC add-on.

  • 5 October 2021

    • Updated supported, deprecated, and unsupported versions for strongSwan Helm chart.

    • IBM Cloud Object Storage plug-in.

• September 2021

  • Review the release notes for September 2021.

  • 29 September 2021

    • New! Kubernetes 1.22

    • Deprecated and unsupported Kubernetes versions

    • Master fix pack and worker node fix pack update

  • 27 September 2021

    • Master fix pack update

    • Worker node fix pack update

  • 23 September 2021

    • Review the release notes for 23 September 2021.

    • Istio add-on change log

  • 22 September 2021

    • Review the release notes for 22 September 2021.

    • Ingress ALB version change log

  • 16 September 2021

    • Block Storage for VPC add-on

  • 14 September 2021

    • Review the release notes for 14 September 2021.

    • Ingress ALB version change log

    • Istio add-on change log

  • 13 September 2021

    • Worker node fix pack update

  • 9 September 2021

    • Ingress ALB change log

  • 1 September 2021

    • Review the release notes for 1 September 2021.

    • Block Storage for VPC add-on

    • IBM Cloud Object Storage plug-in

• August 2021

  • Review the release notes for August 2021.

  • 31 August 2021

    • Review the release notes for 31 August 2021.

    • Istio add-on change log

    • New! Sao Paulo multizone region

  • 30 August 2021

    • Review the release notes for 30 August 2021.

    • Worker node fix pack update

  • 25 August 2021

    • New! Create a cluster with a template

    • IBM Cloud Object Storage plug-in

    • Master fix pack update change log documentation

  • 23 August 2021

    • Registry token update

    • Ingress change logs

    • ALB OAuth Proxy

  • 16 August 2021

    • Worker node versions

  • 12 August 2021

    • Istio add-on change log

  • 10 August 2021

    • Ingress change logs

    • ALB OAuth Proxy

  • 9 August 2021

    • CLI change log

  • 2 August 2021

    • Ingress change logs

    • Worker node versions

• July 2021

  • 27 July 2021

    • New! IAM trusted profile support

    • Master versions

  • 22 July 2021

    • Istio add-on change log

  • 19 July 2021

    • Worker node versions

  • 15 July 2021

    • Istio add-on change log

  • 12 July 2021

    • Snapshots

  • 6 July 2021

    • Ingress change logs

    • Worker node versions

  • 2 July 2021

    • Unsupported Kubernetes version 1.17

• June 2021

  • From 07 to 31 July 2021, the DNS provider is changed from Cloudflare to Akamai for all containers.appdomain.cloud, containers.mybluemix.net, and containers.cloud.ibm.com domains for all clusters in IBM Cloud Kubernetes Service. Review the following actions that you must make to your Ingress setup.

  • • If you currently allow inbound traffic to your classic cluster from the Cloudflare source IP addresses, you must also allow inbound traffic from the Akamai source IP addresses before 07 July. After the migration completes on 31 July, you can remove the Cloudflare IP address rules.
  • • The Akamai health check does not support verification of the body of the health check response. Update any custom health check rules that you configured for Cloudflare that use verification of the body of the health check responses.
  • • Cluster subdomains that were health checked in Cloudflare are now registered in the Akamai DNS as CNAME records. These CNAME records point to an Akamai Global Traffic Management domain that health checks the subdomains. When a client runs a DNS query for a health checked subdomain, a CNAME record is returned to the client, as opposed to Cloudflare, in which an A record was returned. If your client expects an A record for a subdomain that was health checked in Cloudflare, update your logic to accept a CNAME record.
  • • During the migration, an Akamai Global Traffic Management (GTM) health check was automatically created for any subdomains that had a Cloudflare health check. If you previously created a Cloudflare health check for a subdomain, and you create an Akamai health check for the subdomain after the migration, the two Akamai health checks might conflict. Note that Akamai GTM configurations don't support nested subdomains. In these cases, you can use the ibmcloud ks nlb-dns monitor disable command to disable the Akamai health check that the migration automatically configured for your subdomain.

  • 28 June 2021

    • Master versions

  • 24 June 2021

    • CLI change log

  • 23 June 2021

    • Cluster autoscaler add-on

  • 22 June 2021

    • IBM Cloud Object Storage plug-in

    • Worker node versions

  • 21 June 2021

    • Ingress change logs

    • New! The addon options command is now available

  • 17 June 2021

    • ALB OAuth Proxy

  • 15 June 2021

    • New! Private VPC NLB

  • 10 June 2021

    • Ingress change logs

  • 9 June 2021

    • New! Kubernetes 1.21

    • Deprecated Kubernetes 1.18

    • Expanded Troubleshooting

  • 07 June 2021

    • Worker node versions

  • 3 June 2021

    • IBM Cloud Object Storage plug-in

  • 2 June 2021

    • End of support for custom IBM Ingress image

• May 2021

  • 27 May 2021

    • Istio add-on change log

  • 26 May 2021

    • CLI change log

    • Version 0.45.0 of the Kubernetes Ingress image

  • 24 May 2021

    • Master versions

    • Worker node versions

  • 17 May 2021

    • Deprecated: Kubernetes web terminal.

    • Istio add-on

    • Deprecated Ubuntu 16 end of support date

  • 11 May 2021

    • VPC cluster healthchecks

  • 10 May 2021

    • New! Portworx Backup is now available

    • Calico KDD update in 1.19

    • Cluster autoscaler add-on

    • IBM Cloud Object Storage plug-in

    • Worker node versions

  • 4 May 2021

    • Master versions

• April 2021

  • 29 April 2021

    • Custom IOPs for Istio

    • Istio add-on change log

  • 28 April 2021

    • Default version

  • 27 April 2021

    • Master versions

  • 26 April 2021

    • CLI change log

    • VPC NLB

    • Worker node versions

  • 23 April 2021

    • Ingress change logs

  • 20 April 2021

    • New! Toronto multizone region for VPC

  • 19 April 2021

    • add-on change logs

    • Cluster autoscaler add-on

    • IBM Cloud Object Storage plug-in

    • Ingress change logs

  • 16 April 2021

    • New fields and events for Activity Tracker

  • 15 April 2021

    • Accessing VPC clusters

  • 12 April 2021

    • Worker node versions

    • Ingress change logs

  • 5 April 2021

    • Deprecated data centers for classic clusters

  • 2 April 2021

    • Istio add-on

  • 1 April 2021

    • Cluster autoscaler add-on

    • Block Storage for VPC add-on

    • Block Storage for VPC driver

    • New! image security add-on

• March 2021

  • 30 March 2021

    • add-on change logs

    • Master versions

  • 29 March 2021

    • Worker node versions

  • 25 March 2021

    • Certificate Manager instances

  • 23 March 2021

    • Istio add-on

  • 22 March 2021

    • Ingress ALB change log

  • 17 March 2021

    • Deprecated events to be replaced for Activity Tracker

    • Deprecated fields across events

  • 16 March 2021

    • Ingress ALB change log

  • 12 March 2021

    • Worker node versions

  • 10 March 2021

    • Istio add-on

  • 9 March 2021

    • Cluster autoscaler add-on

  • 5 March 2021

    • Trusted images

  • 1 March 2021

    • CLI change log

    • Istio add-on

    • Worker node versions

• February 2021

  • 27 February 2021

    • Master versions

  • 26 February 2021

    • Block Storage for VPC add-on

    • End of service of VPC Gen 1

  • 25 February 2021

    • CLI change log

  • 24 February 2021

    • Default version

  • 23 February 2021

    • VPE

  • 22 February 2021

    • Master versions

  • 20 February 2021

    • Certified Kubernetes

  • 17 February 2021

    • New! Kubernetes 1.20

    • Deprecated Kubernetes 1.17

  • 15 February 2021

    • New! Osaka multizone region

    • Worker node versions

  • 12 February 2021

    • Gateway firewalls and Calico policies

  • 10 February 2021

    • Ingress ALB change log

    • Gateway firewalls and Calico policies

  • 8 February 2021

    • CLI change log

    • Istio add-on

  • 4 February 2021

    • Worker node modifications

  • 3 February 2021

    • Worker node versions

  • 1 February 2021

    • Unsupported: Kubernetes version 1.16

    • Worker node versions

• January 2021

  • 27 January 2021

    • Block Storage for VPC add-on

    • Reminder: VPC Gen 1 deprecation

  • 25 January 2021

    • Istio add-on

    • New! Private service endpoint allowlists

    • Private Kubernetes Ingress

  • 19 January 2021

    • Ingress ALB change log

    • Master versions

  • 18 January 2021

    • Knative add-on is unsupported

    • Worker node versions

  • 14 January 2021

    • Cluster autoscaler

  • 12 January 2021

    • Ingress resources

    • Kubernetes benchmarks

    • Removal of data center support

  • 7 January 2021

    • Ingress ALB change log

  • 6 January 2021

    • Master versions

• December 2020

  • 21 December 2020

    • Gateway firewalls and Calico policies

    • Worker node versions

  • 18 December 2020

    • CLI change log

    • IBM Cloud Object Storage plug-in

  • 17 December 2020

    • Audit documentation

    • Back up and restore

    • Ingress ALB change log

  • 16 December 2020

    • Istio add-on

  • 15 December 2020

    • Cluster autoscaler

  • 14 December 2020

    • Ingress ALB change log

    • Master versions

  • 11 December 2020

    • Storage add-ons

    • strongSwan versions

    • Worker node versions

  • 9 December 2020

    • Accessing clusters

    • CLI change log

    • Proxy protocol for Ingress

    • Helm version 2 unsupported

    • Istio add-on

  • 7 December 2020

    • Key Protect enhancements

    • Worker node versions

  • 3 December 2020

    • Cluster autoscaler add-on

    • Istio add-on

  • 1 December 2020

    • Default Kubernetes Ingress image

• November 2020

  • 24 November 2020

    • New! Reservations to reduce classic worker node costs

  • 23 November 2020

    • Worker node versions

  • 20 November 2020

    • New! Portieris for image security enforcement

  • 19 November 2020

    • Ingress ALB change log

  • 18 November 2020

    • CLI change log

    • Knative add-on deprecation

    • New! Block Storage for VPC change log

  • 16 November 2020

    • GPU worker nodes

    • Master versions

  • 13 November 2020

    • IBM Cloud Activity Tracker and IAM events

  • 9 November 2020

    • Worker node versions

  • 5 November 2020

    • Block Storage for VPC

    • Classic-enabled VPCs

    • Gateway firewalls and Calico policies

    • Istio add-on

  • 2 November 2020

    • General availability of Kubernetes Ingress support

    • Persistent storage

• October 2020

  • 26 October 2020

    • Master versions

    • Worker node versions

  • 22 October 2020

    • API key

    • Benchmark for Kubernetes 1.19

    • Huge pages

    • Istio add-on

  • 16 October 2020

    • Gateway firewalls and Calico policies

    • Ingress classes

    • Object Storage

  • 13 October 2020

    • New! Certified Kubernetes version 1.19

    • Deprecated: Kubernetes version 1.16

    • New! Network load balancer for VPC

    • Version change logs

    • VPC load balancer

    • VPC security groups

    • Object Storage in VPC Gen 2

  • 12 October 2020

    • Versions

  • 8 October 2020

    • Ingress ALB change log

  • 6 October 2020

    • CLI change log

    • Ingress secret expiration synchronization

    • Istio add-on

  • 1 October 2020

    • Default version

    • Ingress ALB change log

• September 2020

  • 29 September 2020

    • Gateway firewalls and Calico policies

  • 26 September 2020

    • Versions

  • 24 September 2020

    • CLI change log

  • 23 September 2020

    • Ingress ALB change log

    • Istio add-on

  • 22 September 2020

    • Unsupported: Kubernetes version 1.15

  • 21 September 2020

    • Versions

    • Versions

    • Istio add-on

    • VPC load balancer

  • 4 September 2020

    • New! CIS Kubernetes Benchmark

  • 3 September 2020

    • CA certificate rotation

  • 2 September 2020

    • Istio add-on

  • 1 September 2020

    • Deprecation of VPC Gen 1 compute

    • Istio add-on

Tutorials library for Kubernetes Service

Tutorials library for Kubernetes Service

Setting up your first cluster in your Virtual Private Cloud (VPC)

Setting up your first cluster in your Virtual Private Cloud (VPC)

• Audience

• Objectives

• What you'll get

• Prerequisites

• Create a cluster in VPC

• Deploy a privately available app

• Set up a Load Balancer for VPC to expose your app publicly

• What's next?

Planning your cluster environment

Creating a cluster environment strategy

• Decide how many clusters to create

• Select a cluster type

• Define a cluster naming strategy

• Decide how many worker nodes for each cluster

• Select worker node flavors

• Determine worker node capacity for the resources

• Choose how many namespaces to create within the cluster

• Establish resource requests and limits for the namespaces

Planning your cluster for high availability

• High availability at different levels

• Resource distribution for high availability

• Single zone clusters

• Multizone clusters

  • Multizone cluster FAQ

• Multiple public clusters connected with a global load balancer

  • Why do I need 3 clusters in three zones?

  • What if I want to set up multiple clusters across regions?

  • What options do I have to load balance workloads across multiple clusters?

  • What if I want to load balance workloads on the private network?

Planning your worker node setup

• Worker node FAQs

  • What hardware options are available to me?

  • Which operating systems are available?

  • Can I combine different flavors in a cluster?

  • How can I change worker node flavors?

  • Are the worker nodes encrypted?

  • How do I manage my worker nodes?

  • What storage options are available on worker nodes?

  • What limitations do I need to be aware of?

  • What operations are blocked if my worker node is running an unsupported operating system?

• Virtual machines

  • Planning considerations for VMs

  • Available flavors for VMs

• Physical machines (bare metal)

  • Planning considerations for bare metal

  • Available flavors for bare metal

• Software-defined storage (SDS) machines

  • Planning considerations for SDS

  • Available flavors for SDS

• Worker node resource reserves

Understanding VPC cluster networking

• Worker-to-worker communication using VPC subnets

• Worker-to-master and user-to-master communication using Virtual private endpoints or cloud service endpoints

• Worker-to-master communication in VPC clusters

• User-to-master communication in VPC clusters

• Worker communication to other services or networks

• Communication with other IBM Cloud services over the private or public network

• Communication with resources in on-premises data centers

  • Communication with resources in other VPCs

  • Communication with IBM Cloud classic resources

• External communication to apps that run on worker nodes

• Private traffic to cluster apps

• Public traffic to cluster apps

• Example scenarios for VPC cluster network setups

  • Scenario: Run internet-facing app workloads in a VPC cluster

  • Worker-to-worker communication

  • Worker-to-master and user-to-master communication

  • Worker communication to other services or networks

  • External communication to apps that run on worker nodes

• Scenario: Run internet-facing app workloads in a VPC cluster with limited public egress

  • Worker-to-worker communication

  • Worker-to-master and user-to-master communication

  • Worker communication to other services or networks

  • External communication to apps that run on worker nodes

• Extend your on-premises data center to a VPC cluster

  • Worker-to-worker communication

  • Worker-to-master and user-to-master communication

  • Worker communication to other services or networks

  • External communication to apps that run on worker nodes

Understanding Classic cluster networking

• Worker-to-worker communication: classic VLANs and subnets

  • VLAN connections for worker nodes

  • Worker node communication across subnets and VLANs

• Worker-to-master and user-to-master communication: Service endpoints

  • Public service endpoint only

  • Public and private cloud service endpoints

  • Private service endpoint only

• Worker communication to other IBM Cloud services or on-premises networks

  • Communication with other IBM Cloud services over the private or public network

  • IBM Cloud® Direct Link for communication over the private network with resources in on-premises data centers

  • strongSwan IPSec VPN connection for communication over the public network with resources in on-premises data centers

• External communication to apps that run on worker nodes

  • Private traffic to cluster apps

  • Public traffic to cluster apps

• Scenario: Running internet-facing app workloads in a classic cluster

  • Worker-to-worker communication in classic clusters with internet-facing workloads

  • Worker-to-master and user-to-master communication in classic clusters with internet-facing workloads

  • Worker communication to other services or networks with internet-facing workloads

  • External communication to apps that run on worker nodes with internet-facing workloads

• Scenario: Allow limited public connectivity with a gateway appliance

  • Worker-to-worker communication, worker-to-master and user-to-master communication with a gateway appliance

  • Worker communication to other services or networks with a gateway appliance

  • External communication to apps that run on worker nodes with a gateway appliance

• Scenario: Extend your on-premises data center to a classic cluster

  • Worker-to-worker communication for private clusters

  • Worker-to-master and user-to-master communication for private clusters

  • Worker communication to other services or networks for private clusters

  • External communication to apps that run on worker nodes for private clusters

Encryption overview

• Control plane

• Worker node disks

• Cluster secrets

• Persistent storage

• Worker-to-worker traffic

• Next steps

IBM Cloud Kubernetes Service storage overview

• Non-persistent storage options

• Single zone clusters

• Multizone clusters

Documenting your environment architecture

• Step 1: Understanding your app and architecture

  • Example 1: A basic app running in a single OpenShift cluster

  • Example 2: A multi-cluster architecture with a global load balancer and Cloudant service

  • Example 3: A VSI client contacting a VPC network load balancer with an external service backend

• Step 2: Choose a tool

• Step 3: Create the diagram

Preparing your account

Preparing your account to create clusters

• Create or upgrade your account

• Setting user permissions

• Plan your resource groups

• Cluster-specific account setup

• Next steps

IAM roles and actions

• Kubernetes Service

• Permissions to create a cluster

• Example custom IAM roles

Installing the CLI

Installing the CLI

• Understanding the CLI tools

• Run the installation command

• Verify the installation

• Install CLI plug-ins and tools

• Install the Kubernetes CLI

Updating the CLI

• Updating the IBM Cloud CLI

• Updating installed plug-ins

Uninstalling the stand-alone IBM Cloud CLI

• Uninstalling on Windows

• Uninstalling on Linux and macOS

Setting up the API

Setting up the API

• About the API

• Automating cluster deployments with the API

• Working with your cluster by using the Kubernetes API

• Refreshing IAM access tokens and obtaining new refresh tokens with the API

• Refreshing IBM Cloud IAM access tokens and obtaining new refresh tokens with the CLI

Creating clusters

Creating classic clusters

• Prerequisites

• Creating a classic cluster in the console

• Creating a classic cluster in the CLI

• Example commands to create classic clusters

• Creating a single-zone classic cluster with Terraform

• Next steps for Classic clusters

Creating VPC clusters

• Prerequisites and notes

• Creating a VPC cluster in the console

• Creating VPC clusters from the CLI

• Example commands to create VPC clusters

• Creating a VPC cluster with Terraform

• Next steps for VPC clusters

Creating clusters on dedicated hosts for VPC

Accessing clusters

Accessing clusters

• Prerequisites

• Accessing clusters through the public cloud service endpoint

• Accessing clusters through the private cloud service endpoint

  • Accessing VPC clusters through the private cloud service endpoint

  • Accessing classic clusters through the private cloud service endpoint

  • Creating an allowlist for the private cloud service endpoint

• Accessing VPC clusters through the Virtual Private Endpoint Gateway

Accessing the cluster master with admission controllers and webhooks

• What are the default admission controllers in my cluster?

• Can I create my own admission controllers?

• What are the best practices for using webhooks?

• What other types of apps use admission controllers?

  • Setting up admission controller webhooks

• I need help with a broken webhook. What can I do?

Accessing private clusters

Adding worker nodes

Adding worker nodes to Classic clusters

• Creating a new worker pool

• Resizing a worker pool

• Adding a zone to a worker pool

Adding worker nodes to VPC clusters

• Resizing a worker pool

• Creating a new worker pool

• Adding a zone to a worker pool

Managing the cluster and worker node lifecycle

Checking your cluster version, operating system, and Kubernetes server version

• Checking your cluster master version, worker node version, and worker node operating system in the console

• Checking your cluster master version in the CLI

• Checking your worker node version in the CLI

• Checking a cluster's Kubernetes server version in the CLI

• Checking your worker node operating system in the CLI

Updating clusters, worker nodes, and cluster components

• Updating the master

  • Steps to update the cluster master

• Updating classic worker nodes

  • Prerequisites

  • Updating classic worker nodes in the CLI with a configmap

  • Updating classic worker nodes in the console

• Updating VPC worker nodes

  • Prerequisites

  • Updating VPC worker nodes in the CLI

  • Updating VPC worker nodes in the console

• Updating flavors (machine types)

• How are worker pools scaled down?

• Updating cluster components

  • Managing automatic updates for Fluentd

  • Managing automatic updates for Ingress ALBs

• Updating managed add-ons

Creating and managing dedicated hosts on VPC Gen 2 infrastructure

• Setting up dedicated hosts in the CLI

• Removing worker nodes from a dedicated host in the CLI

• Removing dedicated hosts in the CLI

• Removing dedicated hosts pools in the CLI

Preparing for host maintenance updates

• Identifying your affected workers

• Actions to take before the maintenance period

  • Workers in Classic clusters

  • Workers in VPC clusters

Setting the cluster credentials

• Resetting the cluster API key

Rotating CA certificates in your cluster

Migrating to a new Ubuntu version

• Prerequisites

• Migration steps

• Removing your old worker pools

Adding tags and labels to clusters

• Adding tags to clusters with the console

• Adding tags to clusters with the CLI

• Adding labels to existing worker pools

Setting up encryption

Setting up a key management service (KMS) provider

• Rotating your KMS root key

Setting up cluster secret encryption

• Enabling secret encryption from the CLI

• Enabling secret encryption from the console

• Rotating the root key for your cluster

• Verifying secret encryption

Setting up worker node disk encryption for VPC clusters

Encrypting worker-to-worker traffic with WireGuard

• Enabling WireGuard encryption

• Disabling WireGuard encryption

Enhancing security

Security for IBM Cloud Kubernetes Service

• Overview of security threats for your cluster

• Kubernetes API server and etcd

  • How is access to my API server granted?

  • What does IBM Cloud Kubernetes Service do to secure my API server and etcd data store?

  • What else can I do to secure my API server?

• Worker node

  • Who owns the worker node and am I responsible to secure it?

  • How does my worker node setup look?

• Network

  • Network segmentation and privacy for classic clusters

  • What network traffic is allowed for my Classic cluster by default?

  • What is network segmentation and how can I set it up for a Classic cluster?

  • What else can I do to reduce the surface for external attacks for Classic clusters?

  • What if I want to connect my cluster to an on-prem data center?

  • Network segmentation and privacy for VPC clusters

  • What network traffic is allowed for my VPC cluster by default?

  • What is network segmentation and how can I set it up for a VPC cluster?

  • What else can I do to reduce the surface for external attacks for VPC clusters?

  • Securely expose apps with LoadBalancer and Ingress services

  • Can I use security groups to manage my cluster's network traffic?

  • How can I secure the source IP within the cluster?

  • How can I do TLS termination with LoadBalancer and Ingress services?

• Persistent storage

• Monitoring and logging

• Image and registry

• Container isolation and security

  • Should I set up a single-tenant or a multi-tenant cluster?

• Storing personal information

• Kubernetes security bulletins

Architecture and dependencies of the service

• Classic cluster

  • Non-VRF or VRF-enabled account with public cloud service endpoint only

  • VRF-enabled account with private and public cloud service endpoints

  • Kubernetes master components

  • Worker node components

  • kube-system namespace

  • ibm-system namespace

  • default namespace

• VPC cluster

Overview of personal and sensitive data storage and removal options

• What information is stored with IBM when using IBM Cloud Kubernetes Service?

• How is my information stored and encrypted?

• Where is my information stored?

• How can I remove my information?

Protecting cluster resources with context-based restrictions

• How IBM Cloud Kubernetes Service integrates with context-based restrictions

  • Protecting cluster resources

  • Protecting specific APIs

  • Allowing IBM Cloud Kubernetes Service to access other IBM Cloud resources by using CBR

• Creating network zones

  • Creating network zones from the API

  • Creating network zones from the CLI

  • Creating network zones from the console

• Creating rules

  • Creating rules by using the API

  • Creating rules from the CLI

  • Creating rules from the console

• Limitations

Example context-based restrictions scenarios

• Understanding the scenario

• Prerequisites

• Creating your network zone

• Creating your CBR rule

• Testing your context-based restrictions

• Additional scenarios

  • Allowing different IPs to access the public and private service endpoints

  • Allowing different IPs to access different API types over the public and private service endpoints

Managing access control

Understanding access control for clusters

• Access control checklist

  • IBM Cloud access control

  • Assign access roles to individual or groups of users in IBM Cloud IAM

  • Scope user access to cluster instances, namespaces, or resource groups

Understanding Classic infrastructure credentials

• Accessing a different classic infrastructure account

Understanding RBAC permissions

• What are the types of RBAC roles?

• What are RBAC role bindings and cluster role bindings?

• What do these roles look like in my cluster?

• Can I create custom roles or cluster roles?

• When do I need to use custom cluster role bindings and role bindings?

• Creating custom RBAC permissions for users, groups, or service accounts

• Extending existing permissions by aggregating cluster roles

  • What are some common operations that I might want to extend permissions for a default cluster role?

• Checking RBAC roles

  • Checking RBAC roles from the UI

  • Checking RBAC roles with the CLI

• Kubernetes service access roles and corresponding RBAC roles

  • Kubernetes resource permissions per RBAC role

  • IBM Cloud IAM issuer details for RBAC users

Authorizing pods in your cluster to IBM Cloud services with IAM trusted profiles

• Prerequisites

• Creating an IAM trusted profile for your cluster in the API

• Creating an IAM trusted profile for your cluster in the UI

• Configure your application pods to authenticate with IBM Cloud services

Assigning cluster access by using Terraform for IBM Cloud Kubernetes Service

• Creating a Kubernetes Service cluster by using Terraform

• Assigning IAM user access to Kubernetes Service clusters

Removing users

• Checking whether the user's credentials are used for infrastructure permissions

• Removing IBM Cloud IAM platform permissions and the associated pre-defined RBAC permissions

  • Removing custom RBAC permissions

Securing cluster workloads

Configuring pod security policies

• FAQs

  • Why do I set pod security policies?

  • Are any policies set by default? What can I add?

  • How does policy authorization work?

  • Why can I still create privileged pods when I am not part of the privileged-psp-user cluster role binding?

• Customizing pod security policies

  • Modifying the RBAC resources

  • Deleting RBAC resources

  • Creating your own pod security policy

• Understanding default resources for IBM cluster management

Setting pod priority

• Understanding default priority classes

• Creating a priority class

• Assigning priority to your pods

Setting Kubernetes API priority and fairness

• Reviewing default flow schema and priority levels

  • Viewing IBM Cloud Kubernetes Service created priority level configurations

Pod security admission

• Understanding security profiles

• What if Pod Security Admission isn't the right choice for me?

• Configuring Pod Security admission namespace labels

• Default Pod Security Admission plug-in configuration

• Customizing the Pod Security Admission plug-in configuration

Migrating from PSPs to Pod Security Admission

• Upgrade requirements

  • Step 1: Check that all pods run under the ibm-privileged-psp PSP

  • Step 2: Verify the privileged-psp-user cluster role binding uses the default configuration

  • Step 3: Verify the restricted-psp-user cluster role binding uses the default configuration

  • Step 4: Checking for non-IBM PSPs

• Migration steps

  • Step 1: Enable Pod Security admission in your 1.24 cluster

  • Step 2: Review namespace permissions

  • Step 3: Simplify and standardize PSPs

  • Step 4: Update the namespaces in your cluster

  • Step 5: Review the namespace creation process

  • Step 6: Optional. Disable the PSP feature in the cluster

  • Step 7: Optional. Upgrade your cluster

• References

Restricting network traffic to edge worker nodes

Restricting network traffic to edge worker nodes

• Isolating NLB workloads to edge nodes

• Isolating ALB workloads to edge worker nodes

• Preventing app workloads from running on edge worker nodes

• Deploying the Sysdig agent on edge worker nodes

Controlling network traffic in Classic clusters

Using Calico network policies to control traffic on Classic clusters

• Objectives

• Audience

• Prerequisites

• Deploy an app and expose it by using an NLB

• Block all incoming traffic to all node ports

• Allow incoming traffic from a specific IP to the NLB

• Deny incoming traffic from specific IPs to the NLB

• Logging blocked traffic from specific IPs to the NLB

• What's next?

Controlling traffic with network policies

• Default Calico and Kubernetes network policies

• Installing and configuring the Calico CLI

• Viewing network policies

• Adding network policies

• Controlling inbound traffic to NLB or NodePort services

• Example Calico policies to restrict public or private network traffic

  • Applying public network policies

  • Applying private network policies

• Controlling traffic between pods

• Logging denied traffic

Opening required ports and IP addresses in your allowlist

• Opening ports in a corporate allowlist

  • Running ibmcloud, ibmcloud ks, and ibmcloud cr commands from behind an allowlist

  • Running kubectl commands from behind an allowlist

  • Running calicoctl commands from behind an allowlist

• Opening ports in gateway appliance allowlists

  • Opening required ports in a public allowlist

  • Opening required ports in a private allowlist

  • Opening ports in a public or private allowlist for inbound traffic

• Allowing the cluster to access resources through Calico network policies

• Allowing traffic from your cluster in other services' allowlists or in on-premises allowlists

• Updating IAM allowlists for Kubernetes Service IP addresses

  • Getting your Kubernetes Service subnet IP addresses

Configuring classic subnets and IP addresses

• Overview of classic networking in IBM Cloud Kubernetes Service

  • VLANs

  • Subnets and IP addresses

  • Finding subnets provisioned in your account

  • Network segmentation

• Using existing subnets to create a cluster

• Managing existing portable IP addresses

  • Viewing available portable public IP addresses

  • Freeing up used IP addresses

• Adding portable IP addresses

  • Adding portable IPs by ordering more subnets

  • Adding portable IPs by adding existing subnets to your cluster

• Managing subnet routing

  • Enabling routing between primary subnets on the same VLAN

  • Managing subnet routing for gateway appliances

• Removing subnets from a cluster

Changing service endpoints or VLAN connections

• Setting up the private cloud service endpoint

• Setting up the public cloud service endpoint

  • Steps to enable the public cloud service endpoint

  • Steps to disable the public cloud service endpoint

• Switching from the public cloud service endpoint to the private cloud service endpoint

• Changing your worker node VLAN connections

Setting up classic VPN connectivity

• Using the strongSwan IPSec VPN service Helm chart

• strongSwan VPN service considerations

• Configuring the strongSwan VPN in a multizone cluster

  • Configuring a single outbound VPN connection from a multizone cluster

  • Configuring a single inbound VPN connection to a multizone cluster

  • Configuring an inbound VPN connection in each zone of a multizone cluster

• Configuring the strongSwan Helm chart

  • Step 1: Get the strongSwan Helm chart

  • Step 2: Configure basic IPSec settings

  • Step 3: Select inbound or outbound VPN connection

  • Step 4: Access cluster resources over the VPN connection

  • Step 5: Access remote network resources over the VPN connection

  • Step 6 (optional): Enable monitoring with the Slack webhook integration

  • Step 7: Deploy the Helm chart

• Testing and verifying strongSwan VPN connectivity

• Limiting strongSwan VPN traffic by namespace or worker node

  • Limiting strongSwan VPN traffic by namespace

  • Limiting strongSwan VPN traffic by worker node

• Upgrading or disabling the strongSwan Helm chart

• Using a Virtual Router Appliance

Controlling network traffic in VPC clusters

Understanding VPC security groups

• Virtual private endpoint (VPE) gateways

• Managed security groups

  • Security groups applied to cluster workers

  • Security groups applied to VPE gateways and VPC ALBs

• Minimum inbound and outbound requirements

  • Required inbound and outbound rules for cluster workers

  • Required rules for VPCs with a cluster that runs at version 1.28 or later

  • Required inbound and outbound rules for VPC ALBs

• Allow worker nodes to connect to the Ingress LoadBalancer

Creating and managing VPC security groups

• Adding security groups during cluster creation

  • If you only want the default security groups

  • If you want the cluster security group and your own additional security groups

  • If you only want your own security groups

• Adding security groups to worker pools during creation

  • If you do not want to attach additional security groups to the worker pool

  • If you want to attach additional security groups to the worker pool

• Viewing security groups

• Viewing security groups in the console

• Creating security group rules in the console

• Creating security group rules in the command line

• Allow worker nodes to connect to the Ingress LoadBalancer

Controlling traffic with ACLs

• Creating ACLs from the console

  • Creating ACLs with the CLI

  • Required rules for VPCs with a cluster that runs at version 1.28 or later

Controlling traffic between pods with Kubernetes policies

• Isolate app services within a namespace

• Isolate app services between namespaces

  • Required policy rules for VPCs with a cluster that runs at version 1.28 or later

Opening required ports and IP addresses in other network allowlists

• Opening ports in a corporate allowlist

  • Running ibmcloud, ibmcloud ks, and ibmcloud cr commands from behind an allowlist

  • Running kubectl commands from behind an allowlist

  • Running calicoctl commands from behind an allowlist

• Allowing traffic from your cluster in other services' allowlists or in on-premises allowlists

  • Allowing ingress from a cluster to another service

  • Allowing egress to a cluster from another service

Configuring VPC subnets

• Overview of VPC networking in IBM Cloud Kubernetes Service

  • Subnets

  • Public gateways

  • Virtual private endpoints (VPE)

  • Network segmentation

  • VPC networking limitations

• Creating a VPC subnet and attaching a public gateway

  • Creating a VPC subnet in the console

  • Creating a VPC subnet in the CLI

• Creating VPC subnets for classic access

  • Creating VPC subnets for classic access in the console

  • Creating VPC subnets for classic access from the CLI

• Restricting public network traffic to a subnet with a public gateway

Setting up VPC VPN connectivity

• Communication with resources in on-premises data centers

  • IBM Cloud VPC VPN

  • Direct Link

• Communication with resources in other VPCs

  • IBM Cloud VPC VPN

  • IBM Cloud Transit Gateway

• Communication with IBM Cloud classic resources

  • Create a classic-access VPC

  • Use IBM Cloud Transit Gateway

Adding static routes to worker nodes

Adding static routes to worker nodes

• About static routes

• Enabling the static route add-on

  • Enabling the static route add-on from the console

  • Enabling the static route add-on with the CLI

• Creating static routes

Configuring the cluster DNS provider

Configuring the cluster DNS provider

• Autoscaling the cluster DNS provider

• Customizing the cluster DNS provider

• Setting up NodeLocal DNS cache

  • Enable NodeLocal DNS cache

  • Disable NodeLocal DNS cache

• Customizing NodeLocal DNS cache

  • Editing the node-local-dns ConfigMap for general configuration updates

  • Editing the node-local-dns-config ConfigMap to extend with stub domains or upstream servers

• Setting up zone-aware DNS

  • Setting up zone-aware DNS

  • Disabling and deleting zone-aware DNS

Setting up the cluster autoscaler

Preparing classic and VPC clusters for autoscaling

• Understanding scale-up and scale-down

• Following scalable deployment practices

  • Can I autoscale multiple worker pools at once?

  • How can I make sure that the cluster autoscaler responds to what resources my app needs?

  • Can I scale down a worker pool to zero (0) nodes?

  • Can I optimize my deployments for autoscaling?

  • Can I use taints and tolerations with autoscaled worker pools?

• Rebalancing or resizing autoscaled worker pools

• Preparing classic or VPC Gen 2 clusters for autoscaling

Enabling the cluster autoscaler add-on in your cluster

• Enabling the cluster autoscaler add-on from the console

• Enabling the cluster autoscaler add-on from the CLI

• Updating the cluster autoscaler add-on

• Removing the cluster autoscaler add-on from the console

• Removing the cluster autoscaler add-on from the CLI

Setting up autoscaling for your worker pools

• Customizing the cluster autoscaler configuration values

• Cluster autoscaler configmap reference

Deploying apps to worker pools where autoscaling is enabled

• Scaling up worker nodes before the worker pool has insufficient resources

• Pause pods

• Horizontal pod autoscaling (HPA)

Logging and monitoring

Logging for clusters

• Choosing a logging solution

• Forwarding cluster and app logs to IBM Log Analysis

• Forwarding cluster and app logs to an external server

  • Understanding log forwarding to an external server

  • Forwarding cluster and app logs

  • Forwarding logs to your own server over the udp or tcp protocols

  • Forwarding logs to your own server over the tls protocol

  • Filtering logs that are forwarded

  • Verifying, updating, and deleting log forwarding

Monitoring cluster health

• Choosing a monitoring solution

• Forwarding cluster and app metrics to IBM Cloud Monitoring

• Viewing cluster states

  • Master states

• Setting up IBM Cloud® Monitoring alerts

  • App alerts

  • Worker node alerts

  • Zone alerts

  • Cluster alerts

  • Account alerts

  • Block Storage for VPC alerts

• Monitoring worker node health in with Autorecovery

  • Understanding the configmap components

  • Understanding the individual components of health checks

Reviewing service, API server, and worker node logs

• Kubernetes API server audit logs

  • Considerations and prerequisites

  • Forwarding Kubernetes API audit logs to Log Analysis

  • Forwarding Kubernetes API audit logs to a resource in the IBM Cloud private network

  • Forwarding Kubernetes API audit logs to an external server on the public Internet

  • Managing API server log forwarding

• Service audit logs

Enabling Flow Logs for VPC cluster components

• Configuring a flow log collector

• Viewing worker node flow logs

Setting up an image registry

Setting up an image registry

• Planning image registries

• Understanding how to authorize your cluster to pull images from a private registry

  • Default image pull secret setup

  • Private network connection to icr.io registries

• Updating existing clusters to use the API key image pull secret

  • Updating your image pull secret

• Using an image pull secret to access images in other IBM Cloud accounts or external private registries from non-default Kubernetes namespaces

  • Copying an existing image pull secret

  • Creating an image pull secret with different IAM API key credentials

  • Accessing images that are stored in other private registries

• Using the image pull secret to deploy containers

  • Storing the image pull secret in the Kubernetes service account for the selected namespace

• Setting up a cluster to pull entitled software

• Updating an IBM Cloud Kubernetes Service containerd custom registry configuration

  • Example daemonset to update a containerd custom registry configuration

Continuous integration and delivery for app development and deployment

Continuous integration and delivery for app development and deployment

• Before you begin

• Creating a toolchain with Delivery Pipeline

• Other resources for automating your pipeline

Developing and deploying apps

Planning app deployments

• Moving workloads to IBM Cloud Kubernetes Service

  • What kind of apps can I run in IBM Cloud Kubernetes Service?

  • What are some guidelines for developing stateless, cloud-native apps?

  • What about serverless apps?

  • I already have an app. How can I migrate it to IBM Cloud Kubernetes Service?

• Understanding Kubernetes objects for apps

  • I thought that I needed to put my app in a container. Now what's all this stuff about pods?

  • So if I can use a pod, why do I need all these different types of objects?

  • What type of Kubernetes objects can I make for my app?

  • What if I want my app configuration to use variables? How do I add these variables to the YAML?

  • How can I make sure that my app has the correct resources?

  • How can I add capabilities to my app configuration?

  • How can I add IBM services to my app, such as Watson?

• Planning highly available deployments

  • How can I increase the availability of my app?

  • How can I scale my app?

• Versioning and updating apps

  • How can I organize my deployments to make them easier to update and manage?

  • What app update strategies can I use?

  • How can I automate my app deployment?

• Setting up service discovery

  • How can I make sure that my services are connected to the correct deployments and ready to go?

  • How can I expose my services on the Internet?

• Securing apps

• Managing access and monitoring app health

  • How can I control who has access to my app deployments?

  • After I deploy my app, how can I monitor its health?

Building images for your apps

• Deploying containers from an IBM Cloud Container Registry image to the default Kubernetes namespace

• Referring to the image pull secret in your pod deployment

• Pushing images to IBM Cloud Container Registry

• Managing security of images in IBM Cloud Container Registry with Vulnerability Advisor

• Setting up trusted content for container images

• Enabling image security enforcement in your cluster

  • Enabling or disabling image security enforcement

  • Default image policies

Developing apps

• Specifying your app requirements in your YAML file

  • Basic deployment metadata

  • Replica set

  • Labels

  • Affinity

  • Container image

  • Port for the app's service

  • Resource requests and limits

  • Liveness and readiness probes

  • Pod Disruption Budget

  • Exposing the app service

  • Configmaps for container environment variables

  • Secrets for container environment variables

  • Persistent volumes for container storage

• Complete example deployment YAML

Deploying Kubernetes-native apps in clusters

• Launching the Kubernetes dashboard

  • Launching the Kubernetes dashboard from the IBM Cloud console

  • Launching the Kubernetes dashboard from the CLI

• Deploying apps with the Kubernetes dashboard

• Deploying apps with the CLI

• Deploying apps to specific worker nodes by using labels

• Deploying an app on a GPU machine

  • Prerequisites

  • Deploying a workload

Testing access to apps with NodePorts

• About NodePorts

• Enabling access to an app by using a NodePort service

Managing the app lifecycle

• Update strategies

• Scaling apps

• Managing rolling deployments to update your apps

• Setting up continuous integration and delivery

• Copying deployments to another cluster

Packaging apps for reuse in multiple environments with Kustomize

Setting up a service mesh with Istio

Getting started with Istio

• Step 1: Enable the Istio add-on

• Step 2: Set up the BookInfo sample app

• Step 3: Simulate a phased rollout of BookInfo

• Step 4: Monitor BookInfo with IBM Cloud Monitoring

• Step 5: Secure in-cluster traffic by enabling mTLS

About the managed Istio add-on

• What is Istio?

• What is Istio on IBM Cloud Kubernetes Service?

  • What does this look like in my cluster?

  • How does the update process work?

• What comes with the Istio add-on?

• Limitations

Setting up Istio

• Setting up the Istio managed add-on

  • Installing the Istio add-on

  • Updating the Istio add-on

  • Customizing the Istio installation

  • Uninstalling the Istio add-on

  • Uninstalling other Istio installations in your cluster

  • Troubleshooting the Istio add-on

• Installing the istioctl CLI

• Migrating from Istio add-on 1.21 to community Istio 1.21

  • Step 1: Disabling the Istio add-on from the console

  • Step 1: Disabling the Istio add-ons from the CLI

  • Step 2: Removing the Istio operator

  • Step 3: Saving resources

  • Step 4: Changing the installer of the IOPs

  • Step 5: Removing the ConfigMap

Managing and exposing apps in the service mesh

• Understanding the BookInfo sample app

• Setting up the BookInfo sample app

• Publicly accessing BookInfo

  • Creating a gateway URL in Classic clusters

  • Creating a gateway URL in VPC clusters

  • Viewing the BookInfo web page in a browser

  • Exposing BookInfo by using an IBM-provided subdomain without TLS

  • Exposing BookInfo by using an IBM-provided subdomain with TLS

  • Configuring the bookinfo-gateway to use TLS termination

  • Understanding what happened

• Including apps in the Istio service mesh by setting up sidecar injection

  • Enabling automatic sidecar injection

  • Manually injecting sidecars

• Enabling or disabling public Istio load balancers

• Exposing the Istio ingress gateway with DNS

  • Exposing the Istio ingress gateway with DNS without TLS termination

  • Exposing the Istio ingress gateway with DNS with TLS termination

• Securing in-cluster traffic by enabling mTLS

Deploying custom Istio gateways

• Considerations

• Creating a custom ingress gateway for public traffic

  • Set up the BookInfo sample

  • Exposing BookInfo by using an IBM-provided subdomain with TLS

• Creating a custom ingress gateway for private network traffic

• Controlling custom gateway updates and versions

• Additional gateway customizations

• Creating a custom egress gateway

• Disabling the default gateways

Observing Istio traffic

• Enabling access logs for the entire mesh

• Enabling access logs for individual containers

• Setting up logging with IBM Log Analysis

• Setting up monitoring with IBM Cloud Monitoring

• Launching the ControlZ component inspection and Envoy sidecar dashboards

  • ControlZ

  • Envoy

Exposing apps

Choosing an app exposure service

• Understanding load balancing for apps through Kubernetes service discovery

• Understanding Kubernetes service types

  • ClusterIP

  • NodePort

  • LoadBalancer

  • Ingress

• Planning public external load balancing

  • Choosing a deployment pattern for classic clusters

  • Choosing a deployment pattern for VPC clusters

• Planning private external load balancing

  • Choosing a deployment pattern for classic clusters

  • Choosing a deployment pattern for VPC clusters

Setting up Block Storage for Classic

Setting up Block Storage for Classic

• Quick start for IBM Cloud Block Storage for Classic

• Installing the IBM Cloud Block Storage for Classic plug-in in your cluster

  • Updating the IBM Cloud Block Storage plug-in

  • Removing the IBM Cloud Block Storage plug-in

• Deciding on the block storage configuration

• Setting up encryption for Block Storage for Classic

  • Encrypting volume data by using a custom storage class

  • Create a PVC that references your Block Storage for Classic secret

  • Verifying the encryption of your Block Storage for Classic volumes

• Adding block storage to apps

• Using existing block storage in your cluster

  • Retrieving the information of your existing block storage

  • Creating a persistent volume (PV) and a matching persistent volume claim (PVC)

• Using block storage in a stateful set

  • Creating the PVC by using dynamic provisioning when you create a stateful set

  • Static provisioning by using existing PVCs with a stateful set

• Changing the size and IOPS of your existing storage device

• Backing up and restoring data

  • Setting up periodic snapshots

  • Replicating snapshots to another zone

  • Duplicating storage

  • Backing up data to IBM Cloud® Object Storage

  • Copying data to and from pods and containers

• Storage class reference

  • Bronze

  • Silver

  • Gold

  • Custom

• Sample customized storage classes

  • Creating topology-aware storage

  • Specifying the zone and region

  • Mounting block storage with an XFS file system

• Removing persistent storage from a cluster

  • Understanding your storage removal options

  • Cleaning up persistent storage

• Setting up monitoring for limited connectivity PVs

Setting up Block Storage for VPC

Setting up Block Storage for VPC

• Quick start for IBM Cloud Block Storage for VPC

• Adding Block Storage for VPC to your apps

• Using an existing Block Storage for VPC instance

• Updating the Block Storage for VPC add-on

  • Recreating custom storage classes after updating to version 4.2

• Setting up encryption for Block Storage for VPC

• Customizing the default storage settings

  • Changing the default storage class

  • Creating a custom storage class

  • Verifying your Block Storage for VPC file system

  • Updating the VolumeAttachLimit

  • Storing your custom PVC settings in a Kubernetes secret

  • Enabling every user to customize the default PVC settings

  • Enforcing base64 encoding for the Key Protect root key CRN

• Setting up volume expansion

  • Manually expanding volumes before add-on version 4.2

• Backing up and restoring data

• Storage class reference

  • 10 IOPs tier

  • 5 IOPs tier

  • Custom

  • General purpose

Setting up snapshots with the Block Storage for VPC add-on

• Creating an app deployment

• Creating a volume snapshot

• Restoring from a volume snapshot

• Turning off snapshots

• Next steps

• Troubleshooting snapshots

Customizing the Block Storage for VPC configmap

• Block Storage for VPC configmap reference

Setting up trusted profiles for the Block Storage for VPC add-on

• Enabling the Block Storage for VPC add-on

• Setting up trusted profiles

  • Automatically creating a secret by using a Shell script

Setting up Block Storage for VPC for unmanaged clusters

• Prerequisites

  • Labeling your worker nodes

  • Retrieving IAM and VPC details

• Creating the image pull secret in your cluster

• Creating the Block Storage for VPC driver deployment

• Deploying a stateful set that uses Block Storage for VPC

• Removing the Block Storage for VPC driver

• Config map reference

  • RHEL or CentOS ConfigMap

  • Ubuntu ConfigMap

Removing Block Storage for VPC from your cluster

• Cleaning up Block Storage for VPC

Setting up File Storage for Classic

Setting up File Storage for Classic

• Quick start for File Storage for Classic

• Deciding on the File Storage for Classic configuration

  • File storage types

  • IOPS

  • Reclaim policy

  • Billing type

• Adding File Storage for Classic to apps

• Using existing File Storage for Classic in your cluster

  • Preparing your existing storage

  • Creating a persistent volume and a persistent volume claim

• Using File Storage for Classic in a stateful set

  • Creating the PVC when you create a stateful set by using dynamic provisioning

  • Static provisioning: Using an existing PVC with your stateful set

• Changing the size and IOPS of your existing storage device

• Changing the default NFS version

  • Creating a customized storage class with a specific NFS version

  • Changing your existing PV to use a different NFS version

• Scaling down the default File Storage for Classic plug-in

• Backing up and restoring data

  • Setting up periodic snapshots

  • Replicating snapshots to another zone

  • Duplicating storage

  • Backing up data to IBM Cloud® Object Storage

  • Copying data to and from pods and containers

• Storage class reference

• Sample customized storage classes

  • Creating topology-aware storage

  • Specifying the zone for multizone clusters

  • Changing the default NFS version

• Removing persistent storage from a cluster

  • Understanding your storage removal options

  • Cleaning up persistent storage

Setting up File Storage for VPC

Enabling the IBM Cloud File Storage for VPC add-on

• Prerequisites

Adding File Storage for VPC to apps

• Quick start for File Storage for VPC with dynamic provisioning

• Attaching existing file storage to an app

• Deploying an app that runs as non-root

• Creating a custom storage class

• Limiting file share access by worker node, zone, or worker pool

  • Prerequisites

  • Limiting file share access to pods on one worker node

  • Limiting file share access to pods on worker nodes in a single zone

  • Limiting file share access to pods on worker nodes in a single worker pool

  • Limiting file share access to pods on worker nodes in multiple worker pools

Managing IBM Cloud File Storage for VPC

• Updating the File Storage for VPC add-on

• Understanding your storage removal options

• Cleaning up persistent storage

Storage class reference

Setting up Object Storage

Setting up IBM Cloud Object Storage

• Creating your object storage service instance

• Creating IBM Cloud Object Storage service credentials

• Creating a secret for the object storage service credentials

• Limitations

Installing the IBM Cloud Object Storage plug-in

• Updating the IBM Cloud Object Storage plug-in

• Removing the IBM Cloud Object Storage plug-in

• Deciding on the object storage configuration

• Verifying your installation

Adding object storage to apps

• Creating a deployment

• Using object storage in a stateful set

Setting capacity quotas for apps that use IBM Cloud Object Storage

• Objectives

• Prerequisites

• Creating a set of service credentials

• Creating a secret to store your credentials

• Installing the plug-in

• Dynamically provisioning a bucket with a quota

• Uploading a file to your bucket

• Creating an app that mounts the bucket

• Review

• Next steps

VPC: Setting up authorized IP addresses for IBM Cloud Object Storage

Storage class reference

Setting up Portworx

About Portworx

• What is software-defined storage (SDS)?

• What are the benefits of Portworx?

• How does Portworx work?

• What are the requirements to run Portworx?

• How can I make sure that my data is stored highly available?

• What volume topology offers the best performance for my pods?

• Can I install Portworx in a private cluster?

• Can I install Autopilot while using Portworx?

• How do I get support?

• What's next?

• Exploring other Portworx features

Planning your Portworx setup

• Limitations

• Overview of the Portworx lifecycle

• Creating a secret to store the KMS credentials

Preparing your cluster for Portworx

• Classic clusters

• VPC clusters

• Satellite clusters

Setting up the Portworx key-value store

• Setting up a key-value store for Portworx metadata

• Using the Portworx key-value database

  • Optional: Setting up a Databases for etcd service instance

Understanding encryption for Portworx

• Encryption overview

• Decryption overview

• Setting up volume encryption

  • Getting your KMS instance and credentials

Installing Portworx in your cluster

• Creating a Portworx volume

• Mounting the volume to your app

Installing Autopilot for Portworx

• Prerequisites

• Installing Autopilot

• Creating Rules

Updating Portworx in your cluster

• VPC: Updating worker nodes with Portworx volumes

Setting up disaster recovery with Portworx

Backing up and restoring apps and data with Portworx Backup

• Installing Portworx Backup

• Verifying your Portworx Backup installation

• Logging in to the Portworx Backup console

• Adding a backup location to your Portworx Backup service

• Adding IBM Cloud Kubernetes Service clusters to your Portworx Backup service

• Installing Stork on a non-Portworx cluster

• Creating a backup with the kmpd command

• Backing up and restoring cluster data with PX-Backup

  • Upgrading PX-Backup

Removing Portworx

• Removing Portworx volumes from apps

• Removing a worker node from your Portworx cluster or the entire Portworx cluster

• Removing the Portworx DaemonSet

• Removing Portworx from your cluster

Getting help and support

• Gathering logs

Backing up and restoring storage data

Backing up and restoring storage data

IBM Cloud storage utilities

IBM Cloud storage utilities

• Classic: Installing the IBM Cloud Block Storage Attacher plug-in (beta)

  • Updating the IBM Cloud Block Storage Attacher plug-in

  • Removing the IBM Cloud Block Volume Attacher plug-in

• Classic: Manually adding block storage to specific worker nodes

• Classic: Attaching raw block storage to non-SDS worker nodes

• VPC: Adding raw Block Storage for VPC to VPC worker nodes by using the API

  • Detaching raw and unformatted Block Storage for Classic from a worker node in a VPC cluster by using the API

  • Reviewing volume attachment details for a VPC worker node by using the API

• VPC: Attaching raw Block Storage for VPC to VPC worker nodes by using the CLI

  • Removing raw Block Storage for VPC from VPC worker nodes by using the CLI

• Backing up and restoring PVC data for file and block storage

  • Setting up an IBM Cloud Object Storage service instance

  • Using IBM Cloud Object Storage to back up and restore PVC data

• Setting up IBM Cloud Monitoring for storage volumes

  • Troubleshooting persistent storage when an IBM Cloud Monitoring alert is triggered

Enhancing cluster capabilities with integrations

IBM Cloud services and third-party integrations

• IBM Cloud services

  • IBM Cloud platform services

  • IBM Cloud classic infrastructure services

  • IBM Cloud VPC infrastructure services

• Kubernetes community and open source integrations

  • Integrations operated in partnership

  • Managed add-ons

  • Other third-party integrations

  • Extending Kubernetes API and software with CRDs and Operators

Adding services by using managed add-ons

• Adding managed add-ons

• Updating managed add-ons

• Reviewing add-on states and statuses

Adding services by using Helm charts

• About Helm in IBM Cloud Kubernetes Service

  • What is Helm and how do I use it?

  • What Helm charts are supported in IBM Cloud Kubernetes Service?

• Installing Helm v3 in your cluster

Adding services by using IBM Cloud service binding

• About service binding

  • What types of services can I bind to my cluster?

  • What is IBM Cloud service binding?

  • I already have an IBM Cloud service. Can I still use IBM Cloud service binding?

  • What if I want to use service credentials that use the private cloud service endpoint?

  • Can I use all IBM Cloud services in my cluster?

  • Can I bind multiple IBM Cloud services to multiple clusters at once?

• Adding IBM Cloud services to clusters

• Accessing service credentials from your apps

  • Mounting the secret as a volume to your pod

  • Referencing the secret in environment variables

• Removing a service from a cluster

Installing SGX drivers and platform software on SGX-capable worker nodes

• Installing with a script

Managing cluster costs

Understanding costs for your clusters

• Understanding costs by component

  • Worker nodes

  • What is the difference between virtual and physical machines?

  • Public bandwidth

  • Subnet IP addresses

  • Multizone load balancer

  • Storage

  • IBM Cloud services

  • Operators and other third-party integrations

  • VPC worker nodes

• Estimating costs

• Managing costs

Using reservations to reduce classic worker node costs

• Understanding reservations

  • Reservation usage and lifecycle

  • Billing and discounts

• Creating a reservation

• Using a reservation in a cluster

• Reviewing reservation usage

Tuning performance

Tuning performance

• Default worker node settings

  • Customizing the operating system

  • Hardware changes

• Modifying worker node settings to optimize performance

• Optimizing pod performance

• Optimizing network keepalive sysctl settings

• Adjusting cluster metrics provider resources

  • Modify the metrics-server-config config map

  • Determining which resources to tune

• Enabling huge pages

• Changing the Calico maximum transmission unit (MTU)

  • Updating the Calico ConfigMap in Kubernetes version 1.28 and earlier

  • Updating the Calico installation in Kubernetes version 1.29 and later

• Disabling the port map plug-in

  • Disabling the port map plug-in in Kubernetes version 1.29 and later

  • Disabling the port map plug-in in Kubernetes version 1.28 and earlier

Removing clusters

Removing clusters

• Removing Satellite worker nodes or clusters

• Next steps

API reference

IBM Cloud Kubernetes Service API

IBM Cloud Kubernetes Service API JSON

IBM Cloud Container Registry API

IBM Cloud Vulnerability Advisor API

Community Kubernetes API

CLI plug-in reference

IBM Cloud Kubernetes Service CLI Map

• ibmcloud ks cluster

• ibmcloud ks worker

• ibmcloud ks worker-pool

• ibmcloud ks zone

• ibmcloud ks ingress

• ibmcloud ks logging

• ibmcloud ks nlb-dns

• ibmcloud ks webhook-create

• ibmcloud ks api-key

• ibmcloud ks credential

• ibmcloud ks infra-permissions

• ibmcloud ks kms

• ibmcloud ks quota

• ibmcloud ks subnets

• ibmcloud ks vlan

• ibmcloud ks vpcs

• ibmcloud ks flavors

• ibmcloud ks locations

• ibmcloud ks messages

• ibmcloud ks versions

• ibmcloud ks api

• ibmcloud ks init

• ibmcloud ks script

• ibmcloud ks security-group

• ibmcloud ks storage