vania-janet/multiturn-rag-retrieval-data huggingface dataset:
The namespace must be unique across all IBM Cloud accounts in the same region. Every user in your IBM Cloud account can view and work with images that are stored in your registry namespace.

You can have 100 namespaces in each region.

Namespaces are created in a [resource group](https://cloud.ibm.com/docs/account?topic=account-rgs) that you specify so that you can configure access to resources within the namespace at the resource group level. If you don't specify a resource group, and a resource group isn't targeted, the default resource group is used. If you have an older namespace that is not in a resource group, you can assign it to a resource group and then set permissions for that namespace at the resource group level. For more information about resource groups, see [Assigning existing namespaces to resource groups](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespaceregistry_namespace_assign).

Namespaces that are assigned to a resource group show in the Resource list page of the IBM Cloud console.





 Repository 

A collection of related container images in the container registry that are distinguished by tag or digest only.

Repository is often used interchangeably with container image, but a repository potentially holds multiple tagged variants of a container image.

A repository stores container images, and is itself stored in a registry namespace.





 Tag 

An identifier that is attached to container images within a repository. Tags can be reassigned or deleted from images.

You can use

tagsto distinguish different versions of the same base image within a repository. When you run a Docker command and do not specify the tag of a repository image, then the image tagged latest is used by default.





 Untagged image 

An image that has no

tagis an untagged image. Images that are untagged can be referenced by using the digest reference format <repository>@<digest> as opposed to the tag reference format <repository>:<tag>. Untagged images are typically the result of an image that is pushed with a pre-existing <repository>:<tag> combination.
For more information about resource groups, see [Managing resource groups](https://cloud.ibm.com/docs/account?topic=account-rgs).

Namespaces that are assigned to a resource group show in the Resource list page of the IBM Cloud console.

The namespace must be unique across all IBM Cloud accounts in the same region. Namespaces must have 4 - 30 characters, and contain lowercase letters, numbers, hyphens (-), and underscores (_) only. Namespaces must start and end with a letter or number.

You can now [push Docker images to your namespace in IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_images_registry_images_pushing_namespace) and share these images with other users in your account. To control access to namespaces in IBM Cloud IAM, see [Creating policies](https://cloud.ibm.com/docs/Registry?topic=Registry-usercreate).





 Assigning existing namespaces to resource groups 

Namespaces created in version 0.1.484 of the CLI or earlier and in the IBM Cloud console before 29 July 2020, aren't assigned to resource groups. If you have a namespace that isn't assigned to a resource group, you can assign the namespace to a resource group and then set permissions for that namespace at the resource group level.

You can assign a namespace to a resource group only once. When a namespace is in a resource group, you can't move it to another resource group.

You can assign an existing namespace to a resource group by using the [ibmcloud cr namespace-assign](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcliic_cr_namespace_assign) command. To find out which namespaces are assigned to resource groups and which are unassigned, run the [ibmcloud cr namespace-list](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_namespace_list) command with the -v option.
GET /api/v1/namespaces/details container-registry.namespace.list container-registry.namespace.list 
 Create namespace. PUT /api/v1/namespaces/{namespace} container-registry.namespace.create container-registry.namespace.create 
 Assign namespace. PATCH /api/v1/namespaces/{namespace} container-registry.namespace.create container-registry.namespace.update 
 Delete namespace. DELETE /api/v1/namespaces/{namespace} container-registry.namespace.delete container-registry.namespace.delete 







 Plan API methods 



Table 5. Plans

 Action Method IAM ACTION AT ACTION 

 Get plans for the targeted account. GET /api/v1/plans container-registry.plan.get container-registry.plan.get 
 Update plans for the targeted account. PATCH /api/v1/plans container-registry.plan.set container-registry.plan.set 







 Quota API methods 



Table 6. Quotas

 Action Method IAM ACTION AT ACTION 

 Get quotas for the targeted account. GET /api/v1/quotas container-registry.quota.get container-registry.quota.get 
 Update quotas for the targeted account. PATCH /api/v1/quotas container-registry.quota.set container-registry.quota.set 







 Retention API methods 



Table 7. Retentions

 Action Method IAM ACTION AT ACTION 

 List retention policies for all namespaces in the targeted IBM Cloud account. GET /api/v1/retentions container-registry.retention.list container-registry.retention.list 
 Set the retention policy for the specified namespace. POST /api/v1/retentions container-registry.retention.set container-registry.retention.set 
 Analyze a retention policy, and get a list of what would be deleted by it. POST /api/v1/retentions/analyze container-registry.retention.analyze container-registry.retention.analyze 
 Get the retention policy for the specified namespace.
namespace: <namespace_name>
stringData:
encrypted: <true_or_false>
data
encryptionKey: <encryption_key>

name
: Enter a name for your secret.

namespace
: Enter the namespace where you want to create your secret.

encrypted
: In the parameters, enter true to set up encryption for your Block Storage for Classic volumes.

encryptionKey
: In the parameters, enter the root key CRN of your Key Protect service instance that you want to use to encrypt your Block Storage for Classic volume. To use your root key CRN in a secret, you must first convert it to base64 by running echo -n "<root_key_CRN>" | base64.
6. Follow steps 4-9 in [Adding Block Storage for VPC to your apps](https://cloud.ibm.com/docs/containers?topic=containers-vpc-blockvpc-block-add) to create a PVC with your customized storage class to provision Block Storage for VPC that is configured for encryption with your Key Protect root key. Then, mount this storage to an app pod.

Your app might take a few minutes to mount the storage and get into a Running state.
7. Verify that your data is encrypted. List your Block Storage for Classic volumes and note the ID of the instance that you created. The storage instance Name equals the name of the PV that was automatically created when you created the PVC.

ibmcloud is vols

Example output

ID Name Status Capacity IOPS Profile Attachment type Created Zone Resource group
a395b603-74bf-4703-8fcb-b68e0b4d6960 pvc-479d590f-ca72-4df2-a30a-0941fceeca42 available 10 3000 5iops-tier data 2019-08-17T12:29:18-05:00 us-south-1 a8a12accd63b437bbd6d58fb6a462ca7
8.
If you have a small cluster, a couple dozen users, and resources that are similar (such as different versions of the same software), you probably don't need multiple namespaces. You can use labels instead.





 Set resource quotas so that users in your cluster must use resource requests and limits 

To ensure that every team has the necessary resources to deploy services and run apps in the cluster, you must set up [resource quotas](https://kubernetes.io/docs/concepts/policy/resource-quotas/) for every namespace. Resource quotas determine the deployment constraints for a project, such as the number of Kubernetes resources that you can deploy, and the amount of CPU and memory that can be consumed by those resources. After you set a quota, users must include resource requests and limits in their deployments.





 Organize your Kubernetes objects with labels 

To organize and select your Kubernetes resources such as pods or nodes, [use Kubernetes labels](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/). By default, Red Hat OpenShift on IBM Cloud applies some labels, including arch, os, region, zone, and machine-type.

Example use cases for labels include [limiting network traffic to edge worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-edge), [deploying an app to a GPU machine](https://cloud.ibm.com/docs/containers?topic=containers-deploy_appgpu_app), and [restricting your app workloads](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/) to run on worker nodes that meet certain flavor or SDS capabilities, such as bare metal worker nodes. To see what labels are already applied to a resource, use the oc get command with the --show-labels option.
ibmcloud fn package refresh /NAMESPACE



 Command options 

/NAMESPACE
: A namespace ID, beginning with /. This flag is required. Run ibmcloud fn namespace list to get a list of namespaces to choose from.





 Example 

ibmcloud fn package refresh /user@domain.com_dev







 ibmcloud fn package update 

Update a package designed to contain one or more actions. To add an action in the package, include the package name with the action name when you create or update the action.

When you update parameters for a package or action, you must specify all previously created parameters. Otherwise, the previously created parameters are removed. For packages, any services that were bound to the package are also removed, so after you update other parameters you must [bind services](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-services) to your package again.

ibmcloud fn package update PACKAGE_NAME [--annotation ANNOTATION_KEY ANNOTATION_VALUE] [--annotation-file FILE] [--param KEY VALUE] [--param-file FILE]



 Command options 

PACKAGE_NAME
: The name of the package. This value is required.

--annotationANNOTATION_KEYANNOTATION_VALUE, -aANNOTATION_KEYANNOTATION_VALUE
: Annotations are specified in a KEYVALUE format. To include more than one annotation, specify this option for each annotation. This flag is optional.

--annotation-fileFILE, -AFILE
: A JSON file that contains annotation in a KEYVALUE format. This flag is optional.

--paramKEYVALUE, -pKEYVALUE
: Parameter VALUES in the KEYVALUE format. This flag is optional.

--param-fileFILE, -PFILE
: A JSON file that contains parameter KEYS and VALUES. This flag is optional.

--shared yes|no
* [Setting up domains with IBM Cloud Internet Services](https://cloud.ibm.com/docs/openshift?topic=openshift-ingress-domainsingress-domain-cis)



* [Set up service-to-service authorization](https://cloud.ibm.com/docs/openshift?topic=openshift-ingress-domainsingress-domain-cis-s2s)
* [Create a domain](https://cloud.ibm.com/docs/openshift?topic=openshift-ingress-domainsingress-domain-cis-create)



* [Setting up domains from other external providers](https://cloud.ibm.com/docs/openshift?topic=openshift-ingress-domainsingress-domain-external)



* [Set up credentials for your provider](https://cloud.ibm.com/docs/openshift?topic=openshift-ingress-domainsingress-domains-ext-cred)
* [Create a domain, or add an existing domain](https://cloud.ibm.com/docs/openshift?topic=openshift-ingress-domainsingress-domains-ext-create)



* [Managing domains](https://cloud.ibm.com/docs/openshift?topic=openshift-ingress-domainsingress-domains-manage)



* [Viewing domains in a cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-ingress-domainsingress-domains-manage-view)
* [Removing a domain from a cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-ingress-domainsingress-domains-manage-rm)
* [Updating a domain's IP addresses or hostname](https://cloud.ibm.com/docs/openshift?topic=openshift-ingress-domainsingress-domains-manage-update)
functions.namespace.read Get IAM-based namespace resource information. 
 functions.namespace.migrate Migrate a Cloud Foundry-based namespace to become an IAM-enabled namespace. 
 functions.namespace.update Update IAM-based namespace resource properties, such as the display name or description. 
 functions.namespace.delete Delete a namespace resource. 







 Package events 

The following activities generate package events.



Table 3. Activities that generate package events

 Action Description 

 functions.package.create Create a package. 
 functions.package.read Get package information. 
 functions.package.update Update a package. Note that the event does not include the changes between the initial value and the new value. 
 functions.package.delete Delete a package. 







 Trigger events 

The following activities generate trigger events.



Table 4. Activities that generate trigger events

 Action Description 

 functions.trigger.create Create a trigger. 
 functions.trigger.read Get trigger information. 
 functions.trigger.activate Fire a trigger. Note that this event is logged only when errors occur. 
 functions.trigger.update Update a trigger. Note that the event does not include the changes between the initial value and the new value. 
 functions.trigger.delete Delete a trigger. 







 Rule events 

The following activities generate rule events.



Table 5. Activities that generate rule events

 Action Description 

 functions.rule.create Create a rule. 
 functions.rule.enable Enable a rule. 
 functions.rule.disable Disable a rule. 
 functions.rule.read Get rule information. 
 functions.rule.update Update a rule. Note that the event does not include the changes between the initial value and the new value. 
 functions.rule.delete Delete a rule. 









 Viewing events 

Cloud Functions sends audit logs to the [IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started) service of the same region as the Cloud Functions namespace. For example, audit logs of a Cloud Functions namespace in us-south are sent to a logging instance in us-south.
Prerequisites 

To find out about the required permissions, see [Platform management roles](https://cloud.ibm.com/docs/Registry?topic=Registry-iamplatform_management_roles) and [Access roles for configuring Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iamaccess_roles_configure).





 Command options 

-g (RESOURCE_GROUP_NAME | RESOURCE_GROUP_ID)
: (Optional) Specify the name or ID of the resource group to which you want to assign the namespace. If you don't set this option, the targeted resource group is used.

NAMESPACE
: The namespace that you want to assign to a resource group.





 Example 

Assign a namespace with the name birds to the resource group beaks.

ibmcloud cr namespace-assign -g beaks birds







 ibmcloud cr namespace-list (ibmcloud cr namespaces) 

Displays all

namespacesthat are owned by your IBM Cloud account. You can use this command to list your namespaces so that you can verify which namespaces are assigned toresource groups, and which namespaces are unassigned. Namespaces that are assigned to a resource group also show in the Resource list page of the IBM Cloud console.

ibmcloud cr namespace-list [--verbose | -v]



 Prerequisites 

To find out about the required permissions, see [Access roles for using Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iamaccess_roles_using).





 Command options 

--verbose, -v
: (Optional) List all the namespaces and include information about the resource group and the creation date of the namespace.





 Example 

View a list of all your namespaces, including information about resource groups and creation dates.

ibmcloud cr namespace-list -v







 ibmcloud cr namespace-rm 

Removes a

namespacefrom your IBM Cloud account. Images in this namespace are deleted when the namespace is removed.
2. Give the workspace a name. Choose a short name that reflects your domain content or the purpose of the model. If you need to, you can change the workspace name later.
3. Identify the language of the documents in your workspace. The documents that you add to the workspace, and the dictionaries that you create or upload, must be in the language that you specify.
4. Optional: If you want to change the tokenizer that is used by the application from the default machine learning-based tokenizer, then you can expand the Advanced Options section, and choose Dictionary-based tokenizer.

The default tokenizer is more advanced than the dictionary-based tokenizer; it uses machine learning to identify the tokens in the source documents based on the statistical learning it has done in the language of the source documents. It identifies tokens with more precision because it understands the more natural and nuanced patterns of language. The dictionary-based tokenizer identifies tokens based on language rules. See [Tokenizers](https://cloud.ibm.com/docs/watson-knowledge-studio-data?topic=watson-knowledge-studio-data-create-projectwks_tokenizer) for more details.
5. Optional: If you want to add project managers to the workspace, then expand the Advanced Options section, and select the names of people you want to add as project managers from the list. The administrator can add or remove project managers later by editing the workspace.

Only the names of people that you assigned to the project manager role from the User Account Management page for the instance are displayed. See [Assembling a team](https://cloud.ibm.com/docs/watson-knowledge-studio-data?topic=watson-knowledge-studio-data-team) for more information about adding users.

If you have a Lite plan subscription, skip this step. You cannot add other users, so you cannot assign anyone to the project manager role. You do not need a separate project manager. As an administrator, you can perform all the tasks that a project manager would typically perform.
6. Click Create.







 What to do next
When a namespace is in a resource group, you can't move it to another resource group.

To find out which namespaces are assigned to resource groups and which are unassigned, run the [ibmcloud cr namespace-list](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_namespace_list) command with the -v option. Namespaces that are assigned to a resource group also show in the Resource list page of the IBM Cloud console.

ibmcloud cr namespace-assign -g (RESOURCE_GROUP_NAME | RESOURCE_GROUP_ID) NAMESPACE

For more information about resource groups, see [Creating a resource group](https://cloud.ibm.com/docs/account?topic=account-rgscreate_rgs).



 Prerequisites 

To find out about the required permissions, see [Platform management roles](https://cloud.ibm.com/docs/Registry?topic=Registry-iamplatform_management_roles) and [Access roles for configuring Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iamaccess_roles_configure).





 Command options 

-g (RESOURCE_GROUP_NAME | RESOURCE_GROUP_ID)
: (Optional) Specify the name or ID of the resource group to which you want to assign the namespace. If you don't set this option, the targeted resource group is used.

NAMESPACE
: The namespace that you want to assign to a resource group.





 Example 

Assign a namespace with the name birds to the resource group beaks.

ibmcloud cr namespace-assign -g beaks birds







 ibmcloud cr namespace-list (ibmcloud cr namespaces) 

Displays all

namespacesthat are owned by your IBM Cloud account. You can use this command to list your namespaces so that you can verify which namespaces are assigned toresource groups, and which namespaces are unassigned. Namespaces that are assigned to a resource group also show in the Resource list page of the IBM Cloud console.
namespace: <NAMESPACE>





 Step five: Create the HSM configmap 

Because the console needs to know the configuration settings to use for your HSM, you need to create a Kubernetes [configmap](https://kubernetes.io/docs/concepts/configuration/configmap/) to store these values. The configMap settings depend on whether you configured a daemon for your HSM or not. In that case, the IBM Blockchain Platform operator uses the HSM configuration passed in this configmap to get the details about the HSM client image, such as what image pull secret to use, and the folder mounts that are required. Based on the information provided, when a CA, peer, or ordering node is deployed with HSM enabled, the operator mounts required the files for the HSM client image. If you are using a daemon with your HSM, skip ahead to [Configure the operator to work with an HSM daemon](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-hsm-gemaltodaemon-configmap).

Configure the operator to work with an HSM that does not use a daemon

Copy the following text and save it to a file named ibp-hsm-config.yaml:

version: v1
type: hsm
resources:
limits: {}
requests: {}
securityContext:
privileged: false
runAsNonRoot: false
runAsUser: 0
library:
image: <HSM_IMAGE_URL>
auth:
imagePullSecret: <IMAGE_PULL_SECRET>
filepath: <HSM_LIBRARY_FILE_PATH>
envs:
- name: <ENVIRONMENT_VARIABLE_NAME>
value: <ENVIRONMENT_VARIABLE_VALUE>
mountpaths:
- mountpath: <MOUNTPATH>
name: <MOUNTPATH_NAME>
secret: <HSM_CRYPTO_SECRET>
paths:
- key: <KEY>
path: <PATH>
: (Optional) List only the exemptions that apply to this scope.

To set a namespace, repository, digest, or tag as the scope, enter the value in one of the following formats:



* namespace
* namespace/repository
* namespace/repository:tag
* namespace/repository@digest







 Examples 

List all your exemptions for security issues that apply to images in the birds/bluebird repository. The output includes exemptions that are account-wide, exemptions that are scoped to the birds namespace, and exemptions that are scoped to the birds/bluebird repository. The output doesn't include any exemptions that are scoped to specific tags within the birds/bluebird repository.

ibmcloud cr exemption-list --scope birds/bluebird

List all your exemptions for security issues that apply to images in the birds/bluebird@sha256:101010101010 digest. The output includes exemptions that are account-wide, exemptions that are scoped to the birds namespace, and exemptions that are scoped to the birds/bluebird repository and to the birds/bluebird@sha256:101010101010 digest. The output doesn't include any exemptions that are scoped to specific tags within the birds/bluebird repository.

ibmcloud cr exemption-list --scope birds/bluebird@sha256:101010101010







 ibmcloud cr exemption-rm 

Delete an exemption for a security issue. To view your existing exemptions, run ibmcloud cr exemption-list.

You can identify the images in the scope by using either the [tag](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewoverview_elements_tag) or the [digest](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewoverview_elements_digest). You can reference the image by digest <dns>/<namespace>/<repo>@<digest>, which affects the digest and all its tags in the same repository, or by tag <dns>/<namespace>/<repo>:<tag>.