vania-janet/multiturn-rag-retrieval-data huggingface dataset:
To learn more about working with secrets in Code Engine, see [Working with secrets](https://cloud.ibm.com/docs/codeengine?topic=codeengine-secret).



 ibmcloud ce registry create 

Create an image registry access secret.

ibmcloud ce registry create --name NAME (--password PASSWORD | --password-from-file PASSWORD_FILE | --password-from-json-file) [--email EMAIL] [--output OUTPUT] [--quiet] [--server SERVER] [--username USERNAME]



 Command Options 

-n, --name
: The name of the image registry access secret. Use a name that is unique within the project.



* The name must begin and end with a lowercase alphanumeric character.
* The name must be 253 characters or fewer and can contain lowercase letters, numbers, periods (.), and hyphens (-).



This value is required.

--email, -e
: The email address to access the registry server. This value is optional.

--output, -o
: Specifies the format of the command output. Valid values are json, yaml, jsonpath=JSONPATH_EXPRESSION, and jsonpath-as-json=JSONPATH_EXPRESSION. Use jsonpath to specify the path to an element of the JSON output. This value is optional.

--password, -p
: The password to access the registry server. If neither --password, nor --password-from-file, nor --password-from-json-file option is specified, then you are prompted for the password. This value is optional.

--password-from-file, --pf
: The path to a file containing the password to access the registry server. The first line of the file is used for the password. If neither --password, nor --password-from-file, nor --password-from-json-file option is specified, then you are prompted for the password. This value is optional.
ibmcloud tke cryptounit-cp-eddsa
4. (Optional) To confirm that the EdDSA feature is enabled, run the ibmcloud tke cryptounit-compare command again, and make sure that XCP_CPB_ALG_EC_25519 is marked as Set for all crypto units in the output.









 Enabling the Schnorr algorithm 

The Schnorr algorithm can be used as a signing scheme to generate digital signatures. It is proposed as an alternative algorithm to the Elliptic Curve Digital Signature Algorithm (ECDSA) for cryptographic signatures in the Bitcoin system. The Schnorr signature is known for the simplicity and efficiency.

To enable the Schnorr algorithm, follow these steps:



 Step 1: Verify the Schnorr algorithm enablement 

To check whether the Schnorr algorithm is already enabled in your service instance, perform the following steps:

Before you perform the steps, make sure you have [provisioned a service instance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-provision) and initialized the service instance with either [the Trusted Key Entry (TKE) command-line interface (CLI) plug-in](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm) or [the Management Utilities](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm-management-utilities).



1. In the CLI, update the TKE CLI plug-in to the latest version with the following command:

ibmcloud plugin update tke
2. To check whether the Schnorr algorithm is enabled, run the following command:

ibmcloud tke cryptounit-compare

The following output is an example of what is to be displayed. If the Schnorr algorithm is enabled, the XCP_CPB_ECDSA_OTHER column is specified as Set in the CONTROL POINTS section:

CONTROL POINTS
For more information, see [Granting access to IBM Cloud Object Storage to import images](https://cloud.ibm.com/docs/vpc?topic=vpc-object-storage-prereq&interface=cli).







 Custom image lifecycle 

You can use the UI, CLI, API, and Terraform to manage the lifecycle of your custom images with three statuses. You can move the image back and forth through all the statuses and set dates to automatically change an image status. All status changes are tracked as an Activity Tracker event. You can filter your list of images based on status to aid in clean-up or tracking of your images. For more information about making status changes, see [Managing custom images](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-custom-images&interface=ui).



Table 1. Image lifecycle status

 Image status Description 

 available You can use the image to create an instance. 
 deprecated You can use the image to create an instance. Using the deprecated status can discourage use of the image before changing the status to obsolete. 
 obsolete You can't use the image to create an instance. If you try to use an obsolete image to create an instance, you receive a message that states that you can't use the image to create an instance. This status allows a reversible disabling of an image before you delete the image. 



Any image that is in deprecated or obsolete status is still billed. If you don't want to be billed for the image, you must delete it.

IBM Cloud VPC managed images can be managed only this way. Custom images that are published to a private catalog must be in available status and their statuses are maintained in the private catalog. If you try to change or schedule a change to their status in IBM Cloud VPC, the attempt fails. If a custom image is removed from a private catalog, that image retains its original private catalog status until the status is changed in IBM Cloud VPC.



Table 2. Catalog image lifecycle status and the corresponding VPC status

 Private catalog image status Corresponding VPC image status 

 published/verified available
If you are deploying a shared dedicated control plane, the ratio of memory to cpu is locked for all control plane virtual server instances based on the dedicated host profile that you select.









 Step 6 - Images, profiles, and identity volume encryption for Machine Catalog 



1. Indicate whether you want to use a custom image to build the base image for your machine catalog.



* Select the version for the custom image. For Windows images, you can select provider images or custom OS images.
* Select the virtual server profile for the custom image to provision your virtual server instances in post provisioning. [3]



2. Select your SSH key or create a new one.
3. Specify the size for your boot volume. The default is 100GB. If you require a larger boot volume size, you can specify 100-250GB inclusive. If you specify greater than 100GB, you must make the additional disk space accessible in post-provisioning. For more information, see [Step 6: Make additional boot volume space accessible](https://cloud.ibm.com/docs/citrix-daas?topic=citrix-daas-post-provisioning-citrix-daas-vpccitrix-daas-post-prov-vpc-boot-vol) in the post-provisioning steps for Citrix DaaS on Virtual Private Cloud.
4. Select how you want your identity volume encryption managed. The default is provider managed. For customer managed encryption, select Key Protect or Hyper Protect Crypto Services. You must also provide:



* Encryption service instance
* Key name



For more information on encryption key set up, see the [Key Protect Getting started tutorial](https://cloud.ibm.com/docs/key-protect?topic=key-protect-getting-started-tutorial) or [Getting started with IBM Cloud Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-get-started).

Customer managed encryption for custom image instances is not currently implemented in the Citrix DaaS order form.
To enforce a policy so that only signed images can be used to build containers in your cluster, [install the open source Portieris project](https://cloud.ibm.com/docs/containers?topic=containers-imagesportieris-image-sec).
3. Cluster users can deploy apps that are built from trusted images.



1. [Deploy to the default Kubernetes namespace](https://cloud.ibm.com/docs/containers?topic=containers-imagesnamespace).
2. [Deploy to a different Kubernetes namespace, or from a different IBM Cloud region or account](https://cloud.ibm.com/docs/containers?topic=containers-registryother).









 Enabling image security enforcement in your cluster 

When you enable image security enforcement in your cluster, you install the open-source Portieris Kubernetes project. Then, you can create image policies to prevent pods that don't meet the policies, such as unsigned images, from running in your cluster.

For more information, see the [Portieris documentation](https://github.com/IBM/portieris).

Mutated images: By default, Portieris uses the MutatingAdmissionWebhook admission controller to mutate your image to refer to the image by a digest instead of a tag. However, you might have some deployment technology that rejects a mutated image. If so, you can use the [image mutation option](https://github.com/IBM/portieris/blob/main/README.mdimage-mutation-option) and [policy](https://github.com/IBM/portieris/blob/main/POLICIES.mdimage-mutation-option) to change the default behavior.



 Enabling or disabling image security enforcement 

You can enable or disable image security enforcement for your cluster from the CLI or console. For earlier versions, see the [Portieris documentation](https://github.com/IBM/portieris).



 Enabling or disabling image security enforcement with the CLI 

See the following commands.
With customer-managed encryption, you can bring your own customer root key (CRK) to the cloud or have a [key management service](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-aboutkms-for-byok) (KMS) generate a key for you. Root keys are used to encrypt volume, file share, and custom image passphrases with [envelope encryption](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-aboutvpc-envelope-encryption-byok), a process that wraps a key with another key.

Supported key management services are Key Protect and Hyper Protect Crypto Services (Hyper Protect Crypto Services). After the key management service is provisioned, you must authorize access between the source service (for example, Cloud Block Storage, Cloud File Storage) and the KMS. For custom images, authorize between Image Service for VPC (source service) and IBM Cloud Object Storage (target service). This authorization is required so that the image service has authority to import custom images from the Object Storage bucket that contains your custom image.

When you use customer-managed encryption, you can use root keys to encrypt resources across regions. You can encrypt resources with a key that is stored in your regional KMS instance, and you can use root keys from another region. For best performance and security, colocate your KMS instance, root keys, and your encrypted resources in the same region. For more information, see [Root key regional and cross-regional considerations](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-aboutbyok-cross-region-keys).

You can share root keys across accounts by linking accounts. Root keys in a primary account can be accessed and used to encrypt new volumes and file shares that are created in a secondary account. For more information, see [Cross-account encryption for file storage resources](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-byok-cross-acct-key-file).
Where KEY_ID is the ID of the root key that you want to use for wrapping, INSTANCE_ID is the instance ID that identifies your Key Protect service instance, and PLAINTEXT is your encoded passphrase. For example, YWJjMTIz.

For this example, you'd see a response similar to the following output:

Wrapping key...
SUCCESS
Ciphertext
eyJjaXBoZXJ0ZXh0IjoiKzhjbHVqcUNP ...<redacted>... NmY3MTJjNGViIn0=
4. Save, or persist to storage, the ciphertext for the WDEK. You must specify the WDEK ciphertext when you import your encrypted image to IBM Cloud VPC.









 IAM authorization prerequisites 

Make sure that you created the required authorizations in IBM Cloud Identity and Access Management.



1. From IBM Cloud Identity and Access Management (IAM), [create an authorization](https://cloud.ibm.com/docs/account?topic=account-serviceauth) between Cloud Block Storage (source service) and your key management service (target service). The authorization permits the IBM Cloud backplane services to use your WDEK for data encryption.
2. Make sure that you created an IAM authorization between the Image Service for VPC and IBM Cloud Object Storage. Specify Infrastructure Services as the source service. Specify Image Service for VPC as the resource type. Specify IBM Cloud Object Storage as the target service. The authorization is so that the Image Service for VPC can access images in IBM Cloud Object Storage. For more information, see [Granting access to IBM Cloud Object Storage to import images](https://cloud.ibm.com/docs/vpc?topic=vpc-object-storage-prereq).







 Next steps
[02].[03]
2. If any of the crypto units are not selected, run the following command and follow the prompts to add the crypto units to the selected list:

ibmcloud tke cryptounit-add
3. To enable the Schnorr algorithm, run the following command:

ibmcloud tke cryptounit-cp-sig-other
4. (Optional) To confirm that the Schnorr algorithm is enabled, run the ibmcloud tke cryptounit-compare command again, and make sure that XCP_CPB_ECDSA_OTHER is marked as Set for all crypto units in the output.









 What's next 

You can now start using

[the PKCS #11 API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-pkcs11-api-ref) or [the GREP11 API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-grep11-api) to perform cryptographic operations and protect deterministic wallets.



* For more information about the TKE CLI commands, check out the [TKE CLI reference](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-cli-plugin-hpcs-cli-plugintke-cli-plugin).
* For more information about the PKCS #11 API, check out

[Introducing PKCS #11](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-pkcs11-intro) and

[PKCS #11 API reference](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-pkcs11-api-ref).
[Navigate to COS](https://cloud.ibm.com/docs-content/v1/content/63322f2f3a72050206eb05ba7f590fdcb741105c/cloud-object-storage/images/kp-tut-1.png)
3. Select Custom bucket. ![Navigate to COS](https://cloud.ibm.com/docs-content/v1/content/63322f2f3a72050206eb05ba7f590fdcb741105c/cloud-object-storage/images/kp-tut-2.png)
4. Enter a bucket name, select the Regional resiliency, and choose a location and storage class. ![Navigate to COS](https://cloud.ibm.com/docs-content/v1/content/63322f2f3a72050206eb05ba7f590fdcb741105c/cloud-object-storage/images/kp-tut-3.png)



You can choose to use Key Protect to manage encryption for a bucket only at the time of creation. It isn't possible to change an existing bucket to use Key Protect.





 Step 2: Choose KP encryption 



1. Scroll down to Service integrations (optional), toggle Key management disabled to enable encryption key management and click on Create new instance. ![Navigate to COS](https://cloud.ibm.com/docs-content/v1/content/63322f2f3a72050206eb05ba7f590fdcb741105c/cloud-object-storage/images/kp-tut-4.png)
2. Choose a region that corresponds with the bucket, give it a memorable name, and click Create and continue. !
For more information about using Red Hat signing, see [Using your own image](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-byoi), and [Deploying the Secure Build Server as a Hyper Protect Virtual Server](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-imagebuilddeploysecurebuild).

Updated: SUSE registry support
: You can pull images from the SUSE registry when you deploy a SUSE Linux Enterprise (SLE) base container image, or building your applications securely based on one.





 30 September 2022 

Updated: Secure Build Server version
: The Secure Build Server image is updated to 1.3.0.7. For more information, see [Deploying the Secure Build Server as a Hyper Protect Virtual Server](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-imagebuilddeploysecurebuild), and [Tutorial: Using Secure Build Server with a digital wallet](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-tutorial_secure_build_server).





 30 June 2022 

Updated: Secure Build Server version
: The Secure Build Server image is updated to 1.3.0.6. For more information, see [Deploying the Secure Build Server as a Hyper Protect Virtual Server](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-imagebuilddeploysecurebuild), and [Tutorial: Using Secure Build Server with a digital wallet](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-tutorial_secure_build_server).





 31 March 2022 

Updated: Tutorial on setting up the secure network
: The secure network is updated to version 2.0.0. You can now use the CLI tool as an IBM Cloud® CLI plugin.
Managing security and compliance for Container Registry 

IBM Cloud® Container Registry is integrated with the Security and Compliance Center to help you manage security and compliance for your organization.

For more information about managing security and compliance, see [Getting started with Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).
IBM Cloud Container Registry architecture and workload 

IBM Cloud® Container Registry is a multi-tenant, highly available, scalable, and encrypted private image

registrythat is hosted and managed by IBM.

Both the control plane (management of images and configuration) and data plane (pushing and pulling your images) are multi-tenant. All parts of the service are hosted in an IBM service account, which is not shared with users or other services.

In each regional instance of the [registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewoverview_elements_registry), the service runs in three physically separate data centers to ensure availability. All data and the configuration for each instance of the registry is retained within the region in which it is hosted. The global instance is also hosted in physically separate data centers. The data centers might not be in the same region as each other. For more information about regions, see [Regions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_regions).

IBM Cloud Container Registry runs in IBM Cloud Kubernetes Service clusters, and uses IBM Cloud Object Storage to store images. Image data in IBM Cloud Object Storage is encrypted at rest.

Zoom

![Diagram showing deployment.](https://cloud.ibm.com/docs-content/v1/content/cbb80bf851fb762a838129cba09d5674f8bfffda/Registry/images/container_registry_architecture_mul.svg)

Figure 1. Diagram showing deployment



 Segmentation of data 

Segmentation of data within IBM Cloud Container Registry is achieved by using private

namespaces, which are strictly owned by single accounts.

You can control access to [namespaces](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewoverview_elements_namespace) within the account by using Cloud Identity and Access Management (IAM) access policies.
About Container Registry 

Use IBM Cloud® Container Registry to store and access private container images in a highly available and scalable architecture.

IBM Cloud Container Registry provides a multi-tenant, highly available, scalable, and encrypted private image

registrythat is hosted and managed by IBM. You can use Container Registry by setting up your own imagenamespaceand pushing container images to your namespace.

Zoom

![Diagram showing how you can interact with IBM Cloud Container Registry.](https://cloud.ibm.com/docs-content/v1/content/cbb80bf851fb762a838129cba09d5674f8bfffda/Registry/images/about_container_registry_v2.svg)

Figure 1. How Container Registry interacts with your images

A Docker image is the basis for every container that you create. An image is created from a

Dockerfile, which is a file that contains instructions to build the image. A Dockerfile might reference build artifacts in its instructions that are stored separately, such as an app, the configuration of the app, and its dependencies. Images are typically stored in a registry that can either be accessible by the public (public registry) or set up with limited access for a small group of users (private registry). By using Container Registry, only users with access to your IBM Cloud account can access your images.

When you push images to Container Registry, you benefit from the built-in Vulnerability Advisor features that scan for potential security issues and vulnerabilities. Vulnerability Advisor checks for vulnerable packages in specific Docker base images, and known vulnerabilities in app configuration settings. When vulnerabilities are found, information about the vulnerability is provided. You can use this information to resolve security issues so that containers are not deployed from vulnerable images.

Review the following table to find an overview of benefits of using Container Registry.



Table 1. Container Registry benefits

 Benefit Description 

 Highly available and scalable private registry.
Combined with an intuitive user experience, built-in security and isolation, and advanced tools to secure, manage, and monitor your cluster workloads, you can rapidly deliver highly available and secure containerized apps in the public cloud.





 IBM Cloud Container Registry 

Use [Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overview) to store and access private container images. Container Registry provides a multi-tenant, highly available, scalable, and encrypted private image registry that is hosted and managed by IBM®. You can use Container Registry by setting up your own image namespace and pushing container images to your namespace. This service is required if using Red Hat OpenShift on IBM Cloud.







 Storage 



 IBM Cloud Object Storage 

[Object Storage](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-about-cloud-object-storage) stores encrypted and dispersed data across multiple geographic locations. Object Storage is available with three types of resiliency: Cross Region, Regional, and Single Data Center. Cross Region provides higher durability and availability than using a single region at the cost of slightly higher latency. Regional service reverses those tradeoffs, and distributes objects across multiple availability zones within a single region. If a given region or availability zone is unavailable, the object store continues to function without impediment. Single Data Center distributes objects across multiple machines within the same physical location.

Users of Object Storage refer to their binary data, such as files, images, media, archives, or even entire databases as objects. Objects are stored in a bucket, the container for their unstructured data. Buckets contain both inherent and user-defined metadata. Finally, objects are defined by a globally unique combination of the bucket name and the object key, or name.







 Security 



 IBM Cloud Hyper Protect Crypto Services 

[Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-overview) is a dedicated key management service and hardware security module (HSM) based on IBM Cloud.