Your responsibilities with using IBM Cloud Kubernetes Service

• Deploy a fully managed, highly available dedicated master in a secured, IBM-owned infrastructure account for each cluster.
• Provision worker nodes in your IBM Cloud infrastructure account.
• Ensure that worker nodes successfully provision when the user account and permissions are correctly set up, and sufficient quota exists.
• Fulfill requests for more infrastructure, such as adding, reloading, updating, and removing worker nodes.
• Provide tools, such as the cluster autoscaler, to extend your cluster infrastructure.
• Integrate ordered infrastructure resources to work automatically with your cluster architecture and become available to your deployed apps and workloads.
• Fulfill automation requests to help recover worker nodes.

• Use the provided API, CLI, or console tools to adjust compute and storage capacity to meet the needs of your workload.
• Use the provided API, CLI, or console tools to request that worker nodes are rebooted, reloaded, or replaced, and troubleshoot issues such as when the worker nodes are in an unhealthy state.

• Set up cluster management components, such as public or private cloud service endpoints, VLANs, and load balancers.
• Fulfill requests for more infrastructure, such as attaching worker nodes to existing VLANs or subnets upon resizing a worker pool.
• Create clusters with subnet IP addresses reserved to use to expose apps externally.
• Set up a Konnectivity connection between the master and worker nodes when the cluster is created.
• Provide the ability to set up a VPN connection with on-premises resources such as through the strongSwan IPSec VPN service or the IBM Cloud VPC VPN.
• Provide the ability to isolate network traffic with edge nodes.

• Use the provided API, CLI, or console tools to adjust cluster networking configuration to meet the needs of your workload, such as configuring service endpoints, adding VLANs to provide IP addresses for more worker nodes, setting up a VPN connection, or edge node worker pools.

• Set up a public application load balancer (ALB) that is multizone, if applicable. Provide the ability to set up private ALBs and public or private network load balancers (NLBs).
• Support native Kubernetes public and private load balancers and Ingress routes for exposing services externally.
• Install Calico as the container networking interface, and set up default Calico network policies to control basic cluster traffic.

• Set up any additional app networking capabilities that are needed, such as private ALBs, public or private NLBs, or additional Calico network policies.

• Provide Log Analysis and Monitoring as managed add-ons to enable observability of your cluster and container environments. Maintenance is simplified for you because IBM provides the installation and updates for the managed add-ons.
• Provide cluster integration with Activity Tracker and send IBM Cloud Kubernetes Service API events for auditability.

• Set up and monitor the health of your container logs and cluster metrics.
• Set up and, if applicable, configure kube-audit logs to be sent to Activity Tracker.

• Provide worker node patch operating system (OS), version, and security updates.
• Fulfill automation requests to update and recover worker nodes.

• Use the API, CLI, or console tools to apply the provided worker node updates that include operating system patches; or to request that worker nodes are rebooted, reloaded, or replaced.

• Provide a suite of tools to automate cluster management, such as the IBM Cloud Kubernetes Service API, CLI plug-in, and console.
• Automatically apply Kubernetes master patch OS, version, and security updates.
• Make major and minor updates for master nodes available for you to apply.
• Provide worker node major, minor, and patch OS, version, and security updates.
• Fulfill automation requests to update cluster master and worker nodes.

• Use the API, CLI, or console tools to apply the provided major and minor Kubernetes master updates and major, minor, and patch worker node updates.

• Provide the ability to integrate IBM Cloud Activity Tracker with your cluster to audit the actions that users take in the cluster.

• Set up IBM Cloud Activity Tracker or other capabilities to track user activity in the cluster.

• Maintain controls commensurate to various industry compliance standards, such as PCI DSS. Compliance to industry standards varies depending on the infrastructure provider of the cluster, such as classic or VPC.
• Monitor, isolate, and recover the cluster master.
• Provide highly available replicas of the Kubernetes master API server, etcd, scheduler, and controller manager components to protect against a master outage.
• Provide options for cluster network connectivity, such as public and private cloud service endpoints.
• Provide options for compute isolation, such as dedicated virtual machines or bare metal.
• Integrate Kubernetes role-based access control (RBAC) with IBM Cloud Identity and Access Management (IAM).

• Set up and maintain security and regulation compliance for your apps and data. For example, choose how to set up your classic cluster networking or VPC cluster networking, protect sensitive information such as with IBM Key Protect encryption, and configure further security settings to meet your workload's security and compliance needs. If applicable, configure your firewall.

• Monitor and report the health of the master and worker nodes in the various interfaces.
• Automatically apply master security patch updates, and provide worker node security patch updates.
• Enable certain security settings, such as encrypted disks on worker nodes
• Disable certain insecure actions for worker nodes, such as not permitting users to SSH into the host.
• Encrypt communication between the master and worker nodes with TLS.
• Provide CIS-compliant Linux images for worker node operating systems.
• Continuously monitor master and worker node images to detect vulnerability and security compliance issues.
• Provider-managed encryption is enabled by default on all volumes.

As part of your incident and operations management responsibilities for the worker nodes, apply the provided security patch updates.

• Optionally configure bring your own key encryption for worker node volumes.

• Maintain service availability across worldwide locations so that customers can deploy clusters across zones and regions for higher DR tolerance.
• Provision clusters with three replicas of master components for high availability.
• In multizone regions, automatically spread the master replicas across zones.
• Continuously monitor to work to ensure the reliability and availability of the service environment by site reliability engineers.
• Update and recover operational IBM Cloud Kubernetes Service and Kubernetes components within the cluster, such as the Ingress application load balancer and file storage plug-in.
• Back up and recover data in etcd, such as your Kubernetes workload configuration files
• Provide the optional worker node Autorecovery.
• Provide the ability to integrate with other IBM Cloud services such as storage providers so that data can be backed up and restored.

• Set up and maintain disaster recovery capabilities for your apps and data. For example, to prepare your cluster for HA/DR scenarios, follow the guidance in High availability for IBM Cloud Kubernetes Service. Note that persistent storage of data such as application logs and cluster metrics are not set up by default.

• Provision clusters with Kubernetes components installed so that you can access the Kubernetes API to deploy and manage your containerized apps.
• Provide a number of managed add-ons to extend your app's capabilities, such as Istio or the Diagnostics and Debug Tool. Maintenance is simplified for you because IBM provides the installation and updates for the managed add-ons.
• Provide cluster integration with select third-party partnership technologies, such as Log Analysis, Monitoring, and Portworx.
• Provide automation to enable service binding to other IBM Cloud services.
• Create clusters with image pull secrets so that your deployments in the default Kubernetes namespace can pull images from IBM Cloud Container Registry.
• Provide access to Kubernetes APIs that you can use to set up Operators to add community, third-party, and your own services to your cluster. Note that Operators might not work without manual adjustments such as changes in cluster security policies.
• Provide storage classes and plug-ins to support persistent volumes for use with your apps.
• Automatically configure security settings to prevent insecure access, such as disabling SSH into the worker node compute hosts.
• Automatically integrate IBM Cloud IAM service access roles with Kubernetes RBAC roles in the cluster.
• Generate an API key that is used to access infrastructure permissions for each resource group and region.

• Maintain responsibility for your apps, data, and their complete lifecycle.
• If you add community, third-party, your own, or other services to your cluster such as by using Operators, you are responsible for these services and for working with the appropriate provider to troubleshoot any issues.
• Use the provided tools and features to configure and deploy; keep up-to-date; set up resource requests and limits; size your worker pool to have enough resources to run your apps; set up permissions; integrate with other services; externally serve; save, back up, and restore data; and otherwise manage your highly available and resilient workloads.

• Maintain platform-level standards so that your data can be stored with controls commensurate to leading international security compliance standards.
• Provision clusters with Kubernetes components installed so that you can access the Kubernetes API to help manage your app data, such as with secrets and configmaps.
• Integrate with IBM Cloud services that you can use to store and manage your data, such as IBM Cloud Databases or Object Storage.
• Integrate with IBM Watson services that you can use to maximize the insights and use of your data with the latest artificial intelligence technology.

• Maintain responsibility for your data and how your apps consume the data.