vania-janet/multiturn-rag-retrieval-data huggingface dataset:
See [Updating existing clusters to use the API key image pull secret](https://cloud.ibm.com/docs/openshift?topic=openshift-registryimagePullSecret_migrate_api_key).

Can I restrict pull access to a certain regional registry?
: Yes, you can [edit the existing IAM policy of the service ID](https://cloud.ibm.com/docs/account?topic=account-serviceidsupdate_serviceid) that restricts the Reader service access role to that regional registry or a registry resource such as a namespace. Before you can customize registry IAM policies, you must [enable IBM Cloud IAM policies for IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-useruser).

Want to make your registry credentials even more secured Ask your cluster admin to [enable a key management service provider](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionkeyprotect) in your cluster to encrypt Kubernetes secrets in your cluster, such as the image pull secret that stores your registry credentials.

Can I pull images in a Red Hat OpenShift project other than default?
: Not by default. By using the default cluster setup, you can deploy containers from any image that is stored in your IBM Cloud Container Registry namespace into the default Red Hat OpenShift project of your cluster. To use these images in any other Red Hat OpenShift projects or other IBM Cloud accounts, [you have the option to copy or create your own image pull secrets](https://cloud.ibm.com/docs/openshift?topic=openshift-registryother).

Can I pull images from a different IBM Cloud account?
: Yes, create an API key in the IBM Cloud account that you want to use. Then, in each project of each cluster that you want to pull images from the IBM Cloud account, create a secret that holds the API key.
If corporate network policies prevent access from your local system to public endpoints via proxies or allowlists, to run ibmcloud, ibmcloud oc and ibmcloud cr commands, you must allow TCP access for IBM Cloud, Red Hat OpenShift on IBM Cloud, and IBM Cloud Container Registry.



1. Allow access to cloud.ibm.com on port 443 in your allowlist.
2. Verify your connection by logging in to IBM Cloud through this API endpoint.

ibmcloud login -a https://cloud.ibm.com/
3. Allow access to containers.cloud.ibm.com on port 443 in your allowlist.
4. Verify your connection. If access is configured correctly, zones are displayed in the output.

curl https://containers.cloud.ibm.com/v1/zones

Example output

[{"id":"mon01","metro":""},{"id":"tor01","metro":""},{"id":"wdc04","metro":"Washington D.C."},{"id":"wdc06","metro":"Washington D.C."},{"id":"wdc07","metro":"Washington D.C."}]
5. Allow access to the [IBM Cloud Container Registry regions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_regions) that you plan to use on port 443 in your allowlist. The global registry stores IBM-provided public images, and regional registries store your own private or public images.
6. Verify your connection by [listing your container registry namespaces](https://cloud.ibm.com/apidocs/container-registrylist-namespaces).







 Running oc commands from behind an allowlist 

If corporate network policies prevent access from your local system to public endpoints via proxies or allowlists, to run oc commands, you must allow TCP access for the cluster.
Enter a name for the application; for example, helloapp. Use a name for your application that is unique within the project.
5. Select a project from the list of available projects. You can also [create a new one](https://cloud.ibm.com/docs/codeengine?topic=codeengine-manage-projectcreate-a-project). You must have a selected project to deploy an app.
6. Select Container image and click Configure image.
7. Enter docker.io for Registry server.
8. For Registry access secret, select Create registry access secret.
9. From the Create registry access secret page, choose your registry source. For example, Docker Hub.
10. Enter a username. For Docker Hub, it is your Docker ID.
11. Enter the password. For Docker Hub, you can use your Docker Hub password or an access token. For more information about access tokens and Docker Hub, see [Managing access tokens](https://docs.docker.com/docker-hub/access-tokens/).
12. Click Create to add a registry access secret for Code Engine.
13. From the Configure image page, the registry access secret that was added is listed. Select the registry access secret for your image.
14. Select the namespace and name of the image in Docker Hub for the Code Engine app to reference. For example, select mynamespace and select the image hello_repo in that namespace.
15. Select a value for Tag; for example, latest.
16. Click Done. You selected your image in the registry to reference from your app.
17. Modify any runtime settings or environment variables for your app.
* [IBM Cloud Kubernetes Service user access permissions](https://cloud.ibm.com/docs/containers?topic=containers-access_reference)



5. To change or assign new access policies, see [Assigning IBM Cloud Kubernetes Service roles](https://cloud.ibm.com/docs/containers?topic=containers-usersadd_users_cli).









 Checking RBAC roles 

Verify your custom RBAC or synchronized IAM service access to RBAC roles in your IBM Cloud Kubernetes Service cluster.



 Checking RBAC roles from the UI 



1. Log in to the [Kubernetes clusters console](https://cloud.ibm.com/kubernetes/clusters).
2. Click the cluster with the RBAC roles that you want to check.
3. Click the Kubernetes Dashboard.

If you have a private network only cluster, you might not be able to open the dashboard unless you are on a VPN. See [Accessing clusters through the private cloud service endpoint](https://cloud.ibm.com/docs/containers?topic=containers-access_clusteraccess_private_se).
4. From the Cluster section, review the Cluster Role Bindings, Cluster Roles, Role Bindings, and Roles.







 Checking RBAC roles with the CLI 



1. [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)
2. Check that the user is added to the RBAC role. Users are not added to a role binding if they have a higher permission. For example, if users have a cluster role and are in a cluster role binding, they are not added to each individual namespace role binding as well.

You must be a cluster administrator (Manager service access role in all namespaces) to check role bindings and cluster role bindings.



* Reader:

kubectl get rolebinding ibm-view -o yaml -n <namespace>
Deploying app workloads from images in IBM Cloud Container Registry 

Deploy your app with Code Engine that uses an image in IBM Cloud® Container Registry. You can create an app from the console or with the CLI.

Before you begin



* You must have an image in IBM Cloud® Container Registry. For more information, see [Getting started with Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-getting-startedgetting-started). Or, you can build an image from [repository source](https://cloud.ibm.com/docs/codeengine?topic=codeengine-app-source-code) or from [local source](https://cloud.ibm.com/docs/codeengine?topic=codeengine-app-local-source-code).
* Verify that you can access the registry. See [Setting up authorities for container registries](https://cloud.ibm.com/docs/codeengine?topic=codeengine-add-registryauthorities-registry).



Interested in configuring your project such that all users of the project can store and access images in Container Registry without having to manually create registry secrets? With sufficient permissions, you can configure this default registry access on a per location (region) basis. If you don't have sufficient permissions to perform these actions, you can use this page to help you understand the required permissions. See [Configuring project-wide settings](https://cloud.ibm.com/docs/codeengine?topic=codeengine-project-integrations).



 Deploying an app that references an image in Container Registry with the console 

Deploy an application that uses an image in Container Registry by using the Code Engine console.

Code Engine can automatically pull images from a Container Registry namespace in your account. To pull images from a different Container Registry account or from a private Docker Hub account, see [Deploying application workloads from images in a private registry](https://cloud.ibm.com/docs/codeengine?topic=codeengine-deploy-app-private).



1.
To allow users to bind services to the cluster or to view logs that are forwarded from cluster logging configurations, [grant users Cloud Foundry roles](https://cloud.ibm.com/docs/account?topic=account-mngcf) for the org and space that the services are deployed to or where logs are collected.
5. If you use Kubernetes namespaces to isolate resources within the cluster, grant access to namespaces by [assigning users IBM Cloud IAM service access roles for the namespaces](https://cloud.ibm.com/docs/openshift?topic=openshift-userschecking-perms).
6. For any automation tooling such as in your CI/CD pipeline, set up service accounts and [assign the service accounts Kubernetes RBAC permissions](https://cloud.ibm.com/docs/openshift?topic=openshift-usersrbac)).



For more information about setting up your account and resources, try out this tutorial about the [best practices for organizing users, teams, and applications](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-users-teams-applications).





 Other types of access control 

Besides IBM Cloud IAM access control policies that you set up, you might explore the additional ways to control how your cluster can be accessed.



 Cluster network setup 



* Cloud service endpoints: You might consider creating a cluster with only a private cloud service endpoint for communication to the cluster's API server. You can also [create an allowlist for the private cloud service endpoint](https://cloud.ibm.com/docs/containers?topic=containers-access_clusterprivate-se-allowlist) to limit access to your cluster from only the allowed subnets. For more information, see the different service architecture setups for [classic](https://cloud.ibm.com/docs/containers?topic=containers-service-archarchitecture_classic) or [VPC](https://cloud.ibm.com/docs/containers?topic=containers-service-archarchitecture_vpc) clusters.
3. [Add the image pull secret to the service account for this Kubernetes namespace](https://cloud.ibm.com/docs/containers?topic=containers-registrystore_imagePullSecret) so that all pods in the namespace can use the image pull secret credentials.



5. If image pull secrets are listed in the pod, determine what type of credentials you use to access IBM Cloud Container Registry.



* If the secret has icr in the name, you use an API key to authenticate with the icr.io domain names. Continue with [Troubleshooting image pull secrets that use API keys](https://cloud.ibm.com/docs/containers?topic=containers-ts-app-image-pullimg-pull-api-key).
* If you have both types of secrets, then you use both authentication methods. Going forward, use the icr.io domain names in your deployment YAMLs for the container image. Continue with [Troubleshooting image pull secrets that use API keys](https://cloud.ibm.com/docs/containers?topic=containers-ts-app-image-pullimg-pull-api-key).







 Troubleshooting image pull secrets that use API keys 

If your pod configuration has an image pull secret that uses an API key, check that the API key credentials are set up correctly.

The following steps assume that the API key stores the credentials of a service ID. If you set up your image pull secret to use an API key of an individual user, you must verify that user's IBM Cloud IAM permissions and credentials.



1. Find the service ID that API key uses for the image pull secret by reviewing the Description. The service ID that is created with the cluster is named cluster-<cluster_ID> and is used in the default Kubernetes namespace. If you created another service ID such as to access a different Kubernetes namespace or to modify IBM Cloud IAM permissions, you customized the description.

ibmcloud iam service-ids

Example output

UUID Name Created At Last Updated Description Locked
ServiceId-aa11...
Why can't I add a namespace? 

Setting up a namespace fails in IBM Cloud® Container Registry.

  What’s happening 

When you run ibmcloud cr namespace-add, you're unable to set your entered value as the namespace.

  Why it’s happening 

The following alternatives are possible causes:



*  You entered a namespace value that is already being used by another IBM Cloud organization.
*  A namespace was recently deleted and you're reusing its name. If the namespace that was deleted contained many resources, the deletion might not yet be fully processed by Container Registry.
*  You used invalid characters in the namespace value.



  How to fix it 

You can fix this problem in the following ways:



*  Follow any instructions that are in the returned error message.
*  Check that you entered a valid namespace:



*  Your namespace must be unique across all IBM Cloud accounts in the same region.
*  Your namespace must be 4 - 30 characters long.
*  Your namespace must start and end with a letter or number.
*  Your namespace must contain lowercase letters, numbers, hyphens (-), and underscores (_) only.



*  Choose a different value for your namespace.
*  If you're re-creating a namespace that was deleted, and it contained many images, try again later.
* [Creating an IAM-based namespace from the console](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-namespacescreate_iam_ui)
* [Creating an IAM-based namespace with the CLI](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-namespacesnamespaces_create)
* [Creating a namespace with the API](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-namespacesnamespaces_create_api)
* [Optional workflow: Creating namespaces for staging and production deployments](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-namespacesnamespaces_create_stage_prod)



* [Targeting namespaces](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-namespacestargeting-namespaces)



* [Accessing other resources from a namespace](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-namespacesnamespace-access)



* [Next steps for namespaces](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-namespacesnamespaces_next)







 Deploying quick start templates 

[Deploying quick start templates](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-templatestemplates)



* [Available quick start templates](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-templatesavailable-templates)
* [Deploying the IBM Cloudant Events template](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-templatescloudant-template)
ibmcloud fn namespace create <namespace_name> [--description <"description of your namespace">]

| <namespace_name> | The display name for the IAM-based namespace. | | -n <description> | Optional: Add a description to the namespace, such as which kind of actions or packages you plan to create. If your description is longer than one word, it must be in quotations. | | --description <description> | Optional: Add a description to the namespace, such as which kind of actions or packages you plan to create. If your description is longer than one word, it must be in quotations. |

The following example shows sample output from the namespace create command.

ok: created namespace myNamespace
3. Verify that your new namespace is created.

ibmcloud fn namespace get <namespace_name_or_id> --properties

The following example shows sample output from the namespace get command.

Details of namespace: myNamespace
Description: short description
Resource Plan Id: functions-base-plan
Location: jp-tok
ID: 05bae599-ead6-4ccb-9ca3-94ce8c8b3e43

You can also list all namespaces, including IAM-based and Cloud Foundry-based namespaces:

ibmcloud fn namespace list
4. Before you can create entities in the namespace, you must set your CLI context to the namespace by targeting it.

ibmcloud fn property set --namespace <namespace_name_or_id>



After you set a property, such as the --namespace property, it is retained until you manually unset it. If you want to switch between IAM namespaces or between Cloud Foundry and IAM namespaces, you must unset the namespace property and then reset it.
| | -n <resource_group_id> | The ID of the resource group that you want to create the namespace in. To see resource group IDs, run ibmcloud resource groups. | | -n <resource_plan_id> | The ID of the resource plan, such as functions-base-plan | | -n <description> | Optional: Add a description to the namespace, such as which kind of actions or packages it will contain. |

The following example shows sample output from the previous command.

{
"description": "My new namespace for packages X, Y, and Z.",
"id": "12345678-1234-abcd-1234-123456789abc",
"location": "jp-tok",
"crn": "crn:v1:functions:jp-tok:a/1a22bb3c44dd1a22bb3c44dd1a22:12345678-1234-abcd-1234-123456789abc::",
"name": "mynamespace",
"resource_group_id": "1a22bb3c44dd1a22bb3c44dd1a22",
"resource_plan_id": "functions-base-plan"
}
2. Verify that your new namespace is created.

curl --request GET --url 'https://us-south.functions.cloud.ibm.com/api/servicebroker/api/v1/namespaces/{id} --header 'accept: application/json' --header 'authorization: <IAM_token>'

You can also list all namespaces, including IAM-based and Cloud Foundry-based namespaces:

curl --request GET --url 'https://jp-tok.functions.cloud.ibm.com/api/v1/namespaces?limit=0&offset=0' --header 'accept: application/json' --header 'authorization: <IAM_token>'
(https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-iamiam_namespace_policies).



 Creating an IAM-based namespace from the console 

Create your IAM-based namespace by using the console.



1. From the [Cloud Functions console](https://cloud.ibm.com/functions) namespace menu, select Create namespace.
2. Enter a display name for the namespace and a short description, such as the actions or packages that you plan to create in this namespace.
3. Choose the resource group where you want to create the namespace and a location to deploy the namespace resource.
4. Click Create.
5. To view the service instance for the namespace resource, go to your [IBM Cloud dashboard](https://cloud.ibm.com/resources) and find your namespace name in Functions namespaces.



You can update the name or description of the namespace from the Namespace settings page in the Cloud Functions console.





 Creating an IAM-based namespace with the CLI 

You can create an IAM-managed namespace with the CLI.



1. Target the resource group where you want to create the namespace. If you haven't created a [resource group](https://cloud.ibm.com/docs/account?topic=account-rgs) yet, you can target the default group.

ibmcloud target -g default
2. Create an IAM-enabled namespace. Optional: Include a description for your namespace by using the -n or --description flag. If your description is longer than one word, it must be in quotations.

ibmcloud fn namespace create <namespace_name> [--description <"description of your namespace">]

| <namespace_name> | The display name for the IAM-based namespace. | | -n <description> | Optional: Add a description to the namespace, such as which kind of actions or packages you plan to create. If your description is longer than one word, it must be in quotations.
For more information about resource groups, see [Assigning existing namespaces to resource groups](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespaceregistry_namespace_assign).

Namespaces that are assigned to a resource group show in the Resource list page of the IBM Cloud console.

You can set up multiple namespaces, for example, to have separate repositories for your production and staging environments. If you want to use the registry in multiple IBM Cloud regions, you must set up a namespace for each region. Namespace names are unique within regions. You can use the same namespace name for each region, unless someone else already has a namespace with that name in that region.

You can have 100 namespaces in each region.

To work with the IBM-provided public images only, you do not need to set up a namespace.

If you're unsure whether a namespace is already set for your account, run the ibmcloud cr namespace-list command with the -v option to retrieve existing namespace information.

Consider the following rules when you choose a namespace:



* Your namespace must be unique across all IBM Cloud accounts in the same region.
* Your namespace must have 4 - 30 characters.
* Your namespace must start and end with a letter or number.
* Your namespace must contain lowercase letters, numbers, hyphens (-), and underscores (_) only.



Do not put personal information in your namespace names.

After you set your first namespace, you are assigned to the free IBM Cloud Container Registry service plan unless you [upgrade your plan](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_plan_upgrade).



 User permissions for working with namespaces 

You can control which users can work with namespaces by using IAM roles.
ibmcloud cr namespace-add <my namespace>

Alternatively, you can create a namespace on the [Container Registry](https://cloud.ibm.com/registry/namespaces) page. For more information about creating a namespace in this location, see [IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-getting-startedgetting-started) service.





 Related content 



* [Getting started with Continuous Delivery](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-getting-started)
* [Getting started with toolchains](https://cloud.ibm.com/devops/getting-started)
* [Getting started with IBM Cloud® Code Engine](https://cloud.ibm.com/docs/codeengine?topic=codeengine-getting-started)
* [Tutorials library for IBM Cloud® Code Engine](https://cloud.ibm.com/docs?tab=tutorials&tags=codeengine&page=1&pageSize=20)









 Step 1: Create the toolchain 

In this step, you create a Develop a Code Engine App toolchain. The target Code Engine project is configured during the toolchain setup by using your IBM Cloud API key and your Code Engine project name. You can change these settings later by updating the Delivery Pipeline configuration. Any code that is merged into the target Git repo branch is automatically built, validated, and deployed into the Code Engine project.

To create a Develop a Code Engine App toolchain, click

[!
Create a [namespace](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewoverview_elements_namespace). The namespace is created in the [resource group](https://cloud.ibm.com/docs/account?topic=account-rgs) that you specify so that you can configure access to resources within the namespace at the resource group level. If you don't specify a resource group, and you don't target a resource group, the default resource group is used. Namespaces that are assigned to a resource group show in the Resource list page of the IBM Cloud console.



1. Log in to IBM Cloud.

ibmcloud login

If you have a federated ID, use ibmcloud login --sso to log in. Enter your username and use the provided URL in your CLI output to retrieve your one-time passcode. If you have a federated ID, the login fails without the --sso and succeeds with the --sso option.

You don't need to log in to Container Registry until you want to push an image, see [Step 5: Push images to your namespace](https://cloud.ibm.com/docs/Registry?topic=Registry-getting-startedgs_registry_images_pushing).
2. Add a namespace to create your own image [repository](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewoverview_elements_repository). Replace <my_namespace> with your preferred namespace.

The namespace must be unique across all IBM Cloud accounts in the same region. Namespaces must have 4 - 30 characters, and contain lowercase letters, numbers, hyphens (-), and underscores (_) only. Namespaces must start and end with a letter or number.

ibmcloud cr namespace-add <my_namespace>

You can put the namespace in a resource group of your choice by using one of the following options.