vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Changes to Container Registry VPE gateways from 11 November 2022 

If you're using an IBM Cloud® Container Registry virtual private endpoint (VPE) gateway that was created before 11 November 2022, you must re-create your VPE gateway before 15 December 2022. If you use Cloud Identity and Access Management restricted IP address lists and Container Registry VPE gateways, you must also update your restricted IP address lists.



 What you need to know about this change 

On 11 November 2022, virtual private endpoints (VPEs) for IBM Cloud Container Registry are being updated and the existing VPE version is being deprecated on 15 December 2022. If you use Container Registry VPE gateways, you must create new VPE gateways and remove your VPE gateways that were created before 11 November 2022 at the earliest opportunity so that you pick up these changes. VPE gateways that were created before 11 November 2022 are deprecated and will not work after 15 December 2022.

If you create a new Container Registry VPE gateway after 11 November 2022 and also use Cloud Identity and Access Management (IAM) [restricted IP address lists](https://cloud.ibm.com/docs/account?topic=account-ips&interface=ui), you must ensure that your restricted IP address list contains the Cloud Service Endpoint (CSE) source IP addresses of the VPCs in which your Container Registry VPE gateways exist. This requirement is related to a previous change to how Container Registry works over the private network that the new VPE version also uses, see [Container Registry private IP addresses changed on 5 July 2022](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_iam_private_network).





 How you benefit from this change 

Container Registry VPEs are being updated so that they can access all Container Registry service regions by using a single VPE gateway. Previously, a Container Registry VPE gateway provided access to Container Registry only in the region in which the VPC and VPE gateway existed. If a user wanted to access another Container Registry region, they had to use the private registry domain names (for example, private.us.icr.io) and required extra VPC configuration for these domains.
* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_namespace_add_prereq)
* [Command options](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_namespace_add_option)
* [Example](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_namespace_add_example)



* [ibmcloud cr namespace-assign](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcliic_cr_namespace_assign)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcliic_cr_namespace_assign_prereq)
* [Command options](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcliic_cr_namespace_assign_option)
* [Example](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcliic_cr_namespace_assign_example)



* [ibmcloud cr namespace-list (ibmcloud cr namespaces)](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_namespace_list)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_namespace_list_prereq)
* [Command options](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_namespace_list_option)
* [Example](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_namespace_list_example)
: Administrator platform access role for IBM Cloud Container Registry at the account level
: Super User role for IBM Cloud infrastructure

Command options:

--hardware HARDWARE
: The level of hardware isolation for your worker node. Use dedicated so that available physical resources are dedicated to you only, or shared to allow physical resources to be shared with other IBM customers. The default is shared. This value is optional for VM standard clusters and is not available for free clusters. For bare metal flavors, specify dedicated.

--zone ZONE
: The zone where you want to create the cluster. This value is required for standard clusters. Free clusters can be created in the region that you target with the ibmcloud ks init command, but you can't specify the zone.
: Review available [classic](https://cloud.ibm.com/docs/containers?topic=containers-regions-and-zoneszones-mz) or [VPC](https://cloud.ibm.com/docs/containers?topic=containers-regions-and-zoneszones-vpc) zones. When you select a zone that is located outside your country, keep in mind that you might require legal authorization before data can be physically stored in a foreign country.

--flavor FLAVOR
: Choose a flavor, or machine type, for your worker nodes. You can deploy your worker nodes as virtual machines on shared or dedicated hardware, or as physical machines on bare metal. Available physical and virtual flavors vary by the zone in which you deploy the cluster. For more information, see the documentation for the ibmcloud ks flavors (machine-types)[command](https://cloud.ibm.com/docs/cli?topic=cli-kubernetes-service-clics_machine_types). This value is required for standard clusters and is not available for free clusters. In gateway-enabled classic clusters, you can choose the flavor for compute worker nodes only. Gateway worker nodes are created with the u3c.2x4 flavor by default.

--name NAME
: Required: The name for the cluster. The name must start with a letter, can contain letters, numbers, periods (.)
--resource-type namespace --resource <registry_namespace>
: Optional. If you want to limit access to only images in certain [IBM Cloud Container Registry namespaces](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespaceregistry_setup_cli_namespace_plan), enter namespace for the resource type and specify the <registry_namespace>. To list registry namespaces, run ibmcloud cr namespaces.
4. Create an API key for the service ID. Name the API key similar to your service ID, and include the service ID that you previously created, <cluster_name>-<kube_namespace>-id. Be sure to give the API key a description that helps you retrieve the key later.

ibmcloud iam service-api-key-create <cluster_name>-<namespace>-key <cluster_name>-<namespace>-id --description "API key for service ID <service_id> in Kubernetes cluster <cluster_name> namespace <namespace>"
5. Retrieve your API Key value from the output of the previous command.

Please preserve the API key! It can't be retrieved after it's created.

Name <cluster_name>-<kube_namespace>-key
Description key_for_registry_for_serviceid_for_kubernetes_cluster_multizone_namespace_test
Bound To crn:v1:bluemix:public:iam-identity::a/1bb222bb2b33333ddd3d3333ee4ee444::serviceid:ServiceId-ff55555f-5fff-6666-g6g6-777777h7h7hh
Created At 2019-02-01T19:06+0000
API Key i-8i88ii8jjjj9jjj99kkkkkkkkk_k9-llllll11mmm1
Locked false
.242.242, 169.47.70.10, 169.47.71.138, 169.48.110.250, 169.48.143.218, 169.48.161.242, 169.48.226.2, 169.48.230.146, 169.48.244.66, 169.57.100.18, 169.57.13.10, 169.57.147.58, 169.57.151.10, 169.57.154.98, 169.59.219.90, 169.59.223.194, 169.59.230.98, 169.60.128.2, 169.60.170.234, 169.61.175.106, 169.61.177.2, 169.61.187.58, 169.61.228.138, 169.61.28.66, 169.61.29.194, 169.61.60.130, 169.62.166.98, 169.62.189.26, 169.62.206.234, 169.62.230.114, 169.62.82.197, 169.62.87.170, 169.62.97.218, 169.63.39.66, 169.63.47.250 







 Allow worker nodes to communicate with IBM Cloud Container Registry 

To permit worker nodes to communicate with IBM Cloud Container Registry, allow outgoing network traffic from the worker nodes to IBM Cloud Container Registry [regions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_regions).

Previously Registry subnets (IP addresses) were published in the following table. As of 17 August 2021, the Registry subnets are no longer published. When you access IBM Cloud Container Registry over the public internet, you must not have any allowlist restrictions that are based on IP addresses in place. If you have any concerns about opening your allowlist, you can configure private access to IBM Cloud Container Registry by using the private IBM Cloud network, see [Securing your connection to Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_private).
{"kubernetes":[{"major":1,"minor":19,"patch":16,"default":false,"end_of_service":""},{"major":1,"minor":20,"patch":13,"default":false,"end_of_service":""},{"major":1,"minor":21,"patch":7,"default":true,"end_of_service":""},{"major":1,"minor":22,"patch":4,"default":false,"end_of_service":""}],"openshift":[{"major":3,"minor":11,"patch":542,"default":false,"end_of_service":"2022-06-06T12:00:00+0000"},{"major":4,"minor":6,"patch":47,"default":false,"end_of_service":""},{"major":4,"minor":7,"patch":37,"default":false,"end_of_service":""},{"major":4,"minor":8,"patch":21,"default":true,"end_of_service":""}]}
5. Allow access to the [IBM Cloud Container Registry regions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_regions) that you plan to use on port 443 in your allowlist. The global registry stores IBM-provided public images, and regional registries store your own private or public images. If your allowlist is IP-based, you can see which IP addresses are opened when you allow access to the IBM Cloud Container Registry regional service endpoints by reviewing [this table](https://cloud.ibm.com/docs/openshift?topic=openshift-firewallfirewall_registry).
6. Verify your connection.
12345678 {"plugin":"ibmcloud-block-storage-plugin-689df949d6-4n9qg","region":"us-south","cluster":"aa1a11a1a11b2b2bb22b22222c3c3333","type":"Endurance","ns":"default","pvc":"block-storage-pvc","pv":"pvc-d979977d-d79d-77d9-9d7d-d7d97ddd99d7","storageclass":"ibmc-block-silver","reclaim":"Delete"}

Understanding the Notes field information:

"plugin":"ibm-file-plugin-5b55b7b77b-55bb7"
: The storage plug-in that the cluster uses.

"region":"us-south"
: The region that your cluster is in.

"cluster":"aa1a11a1a11b2b2bb22b22222c3c3333"
: The cluster ID that is associated with the storage instance.

"type":"Endurance"
: The type of file or block storage, either Endurance or Performance.

"ns":"default"
: The namespace that the storage instance is deployed to.

"pvc":"block-storage-pvc"
: The name of the PVC that is associated with the storage instance.

"pv":"pvc-d979977d-d79d-77d9-9d7d-d7d97ddd99d7"
: The PV that is associated with the storage instance.

"storageclass":"ibmc-file-gold"
: The type of storage class: bronze, silver, gold, or custom.
11. Remove the physical storage instance.

ibmcloud sl block volume-cancel <classic_block_id>
12. Verify that the physical storage instance is removed.
* [Verifying your Block Storage for VPC file system](https://cloud.ibm.com/docs/containers?topic=containers-vpc-blockvpc-block-fs-verify)
* [Storing your custom PVC settings in a Kubernetes secret](https://cloud.ibm.com/docs/containers?topic=containers-vpc-blockvpc-block-storageclass-secret)
* [Enabling every user to customize the default PVC settings](https://cloud.ibm.com/docs/containers?topic=containers-vpc-blockcustomize-with-secret)
* [Enforcing base64 encoding for the Key Protect root key CRN](https://cloud.ibm.com/docs/containers?topic=containers-vpc-blockstatic-secret)



* [Setting up volume expansion](https://cloud.ibm.com/docs/containers?topic=containers-vpc-blockvpc-block-volume-expand)



* [Manually expanding volumes before add-on version 4.2](https://cloud.ibm.com/docs/containers?topic=containers-vpc-blockexpanding-existing-volumes)



* [Backing up and restoring data](https://cloud.ibm.com/docs/containers?topic=containers-vpc-blockvpc-block-backup-restore)
* [Storage class reference](https://cloud.ibm.com/docs/containers?topic=containers-vpc-blockvpc-block-reference)



* [10 IOPs tier](https://cloud.ibm.com/docs/containers?topic=containers-vpc-block10iops-sc-vpc-block)
* [5 IOPs tier](https://cloud.ibm.com/docs/containers?topic=containers-vpc-block5iops-sc-vpc-block)
* [Custom](https://cloud.ibm.com/docs/containers?topic=containers-vpc-blockcustom-sc-vpc-block)
Why can't I push or pull a Docker image? 

When you're using IBM Cloud® Container Registry, pushing or pulling a Docker image fails. You might receive various messages, for example, about being over quota or invalid credentials.

 What’s happening 

When you run commands to push or pull Docker images, you receive an error message. The error message varies depending on the root cause. The following error messages are potential error messages that you might receive:

You have exceeded your storage quota. Delete one or more images,
or review your storage quota and pricing plan

You have exceeded your pull traffic quota for the current month.
Review your pull traffic quota and pricing plan

unauthorized: authentication required

denied: requested access to the resource is denied

unauthorized: The login credentials are not valid, or your IBM Cloud account is not active.

 Why it’s happening 

The following alternatives are possible causes:



* Docker is not installed.
* The Docker client is not logged in to IBM Cloud Container Registry.
* Your IBM Cloudaccess tokenexpired.
* You exceeded the quota limit for storage or pull traffic that is set for your IBM Cloud account.
* You're on a free plan and you need to upgrade to a standard plan.



 How to fix it 

You can fix this problem in the following ways:



* [Ensure that Docker is installed on your computer](https://cloud.ibm.com/docs/Registry?topic=Registry-getting-startedgs_registry_cli_install).
* Check your Docker installation path.
* Log in to IBM Cloud by running ibmcloud login. Then, log in to the IBM Cloud Container Registry CLI by running [ibmcloud cr login](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_login).
* [Review quota limits and usage](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_quotaregistry_quota_get).
container-registry 1.0.1 true
container-service[kubernetes-service/ks] 1.0.454 false
cra 1.0.2 false
doi 0.3.9 false
schematics 1.12.2 true

 ibmcloud dev --version
ibmcloud dev version 2.14.0

 java -version
openjdk version "17.0.3" 2022-04-19
IBM Semeru Runtime Open Edition 17.0.3.0 (build 17.0.3+7)
Eclipse OpenJ9 VM 17.0.3.0 (build openj9-0.32.0, JRE 17 Linux amd64-64-Bit Compressed References 20220422_184 (JIT enabled, AOT enabled)
OpenJ9 - 9a84ec34e
OMR - ab24b6666
JCL - dc07fd49b92 based on jdk-17.0.3+7)

 ant -version
Apache Ant(TM) version 1.10.12 compiled on October 13 2021

 mvn -version
Apache Maven 3.8.6 (84538c9988a25aec085021c365c560670ad80f63)
Maven home: /opt/IBM/maven
Java version: 17.0.3, vendor: IBM Corporation, runtime: /usr/local/jdk17
Default locale: en_US, platform encoding: UTF-8
OS name: "linux", version: "5.10.124-linuxkit", arch: "amd64", family: "unix"

 gradle -version

Welcome to Gradle 7.5.1!

Here are the highlights of this release:
- Support for Java 18
- Support for building with Groovy 4
- Much more responsive continuous builds
- Improved diagnostics for dependency resolution

For more details see https://docs.gradle.org/7.5.1/release-notes.html
: For the IBM Hyper Protect Container Runtime image version ibm-hyper-protect-container-runtime-1-0-s390x-8, new certificates are available.



* [Attestation certificate](https://cloud.ibm.com/media/docs/downloads/hyper-protect-container-runtime/ibm-hyper-protect-container-runtime-1-0-s390x-8-attestation.crt)
* [Encryption certificate](https://cloud.ibm.com/media/docs/downloads/hyper-protect-container-runtime/ibm-hyper-protect-container-runtime-1-0-s390x-8-encrypt.crt)
* [Intermediate certificate](https://cloud.ibm.com/media/docs/downloads/hyper-protect-container-runtime/ibm-hyper-protect-container-runtime-1-0-s390x-8-intermediate.crt)



Using Hyper Protect Virtual Servers for VPC in a private network



* You can use your Hyper Protect Virtual Servers for VPC instance in private-only network configurations, in which the VPC doesn't have a public gateway, and the virtual server instance doesn't have a floating IP. You can connect to private endpoints of other services, including container registry and [IBM Log Analysis](https://cloud.ibm.com/docs/vpc?topic=vpc-logging-for-hyper-protect-virtual-servers-for-vpc). The prerequisite is that you need a DNS server that is attached to your virtual server instance. You don't need to do any extra configurations.



Security enhancement to disk encryption verification



* To address Denial-of-Service attacks, the requests to [verify disk encryption status](https://cloud.ibm.com/docs/vpc?topic=vpc-hpvs-disks-encryption-validate) are throttled at three per five minutes.







 27 January 2023 

Context-based restrictions
: Context-based restrictions are now available for IBM Cloud VPC resources. With context-based restrictions, account owners and administrators can define and enforce network access policies.
* [Granting access if you are using a public network](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_iam_ipregistry_iam_ip_public)
* [Granting access if you are using a private network](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_iam_ipregistry_iam_ip_private)



[Enforcing container image security by using Portieris](https://cloud.ibm.com/docs/Registry?topic=Registry-security_enforce_portierissecurity_enforce_portieris)



* [Installing Portieris in your cluster](https://cloud.ibm.com/docs/Registry?topic=Registry-security_enforce_portierissec_enforce_install_portieris)
* [Portieris policies](https://cloud.ibm.com/docs/Registry?topic=Registry-security_enforce_portierispolicies_portieris)
* [Uninstalling Portieris](https://cloud.ibm.com/docs/Registry?topic=Registry-security_enforce_portierisuninstall_portieris)







 Observability 

[Monitoring metrics](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_monitorregistry_monitor)



* [Enabling metrics for Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_monitorregistry_enable_platform_metrics)
* [Locations of platform metrics](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_monitorregistry_monitor_locations)
* [Where to look for metrics](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_monitorregistry_monitor_ui)



* [Monitoring metrics](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_monitorregistry_monitor_ui_at)
[Accessing container registries](https://cloud.ibm.com/docs/codeengine?topic=codeengine-add-registryadd-registry)



* [Types of image registries](https://cloud.ibm.com/docs/codeengine?topic=codeengine-add-registrytypes-registries)
* [Types of registry secrets](https://cloud.ibm.com/docs/codeengine?topic=codeengine-add-registrytypes-registryaccesssecrets)
* [Setting up authorities for image registries](https://cloud.ibm.com/docs/codeengine?topic=codeengine-add-registryauthorities-registry)
* [Accessing images from a public account](https://cloud.ibm.com/docs/codeengine?topic=codeengine-add-registryimages-public-account)
* [Accessing images in your own account from console](https://cloud.ibm.com/docs/codeengine?topic=codeengine-add-registryimages-your-account)
* [Accessing images from your account with an API key](https://cloud.ibm.com/docs/codeengine?topic=codeengine-add-registryimages-your-account-api-key)



* [Creating an API key from the console](https://cloud.ibm.com/docs/codeengine?topic=codeengine-add-registryaccess-registry-account-console)
* [Creating an API key with the CLI](https://cloud.ibm.com/docs/codeengine?topic=codeengine-add-registryaccess-registry-account-cli)



* [Accessing images in a shared account](https://cloud.ibm.com/docs/codeengine?topic=codeengine-add-registryimages-shared-account)
* [Scope user access to cluster instances, namespaces, or resource groups](https://cloud.ibm.com/docs/containers?topic=containers-access-overviewresource_groups)





[Setting up API key credentials so the service can access the infrastructure and other cloud services](https://cloud.ibm.com/docs/containers?topic=containers-access-credsaccess-creds)



* [Setting up the API key for most use cases](https://cloud.ibm.com/docs/containers?topic=containers-access-credsapi_key_most_cases)
* [Understanding other options than the API key](https://cloud.ibm.com/docs/containers?topic=containers-access-credsapi_key_other)
* [Understanding how the API key works](https://cloud.ibm.com/docs/containers?topic=containers-access-credsapi_key_about)



* [What is the API key used for?](https://cloud.ibm.com/docs/containers?topic=containers-access-credsapi-key-uses)
* [How many API keys do I need?](https://cloud.ibm.com/docs/containers?topic=containers-access-credshow-many-apikeys)
* [How do I set up the API key?](https://cloud.ibm.com/docs/containers?topic=containers-access-credshowto-api-key-setup)
* [What permissions does the user who sets the API key need? How do I give the user these permissions?](https://cloud.ibm.com/docs/containers?topic=containers-access-credswhat-perms-api-key)
* [How do I limit which commands a user can run?](https://cloud.ibm.com/docs/containers?topic=containers-access-credslimit-apikey-scopes)
You can set up your IBM Cloud Kubernetes Service cluster to pull entitled software, which is a collection of protected container images that are packaged in Helm charts that you are licensed to use by IBM. Entitled software is stored in a special IBM Cloud Container Registry cp.icr.io domain. To access this domain, you must create an image pull secret with an entitlement key for your cluster and add this image pull secret to the Kubernetes service account of each namespace where you want to deploy this entitled software.

Before you begin: [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)



1. Get the entitlement key for your entitled software library.



1. Log in to [MyIBM.com](https://myibm.ibm.com) and scroll to the Container software library section. Click View library.
2. From the Access your container software > Entitlement keys page, click Copy key. This key authorizes access to all the entitled software in your container software library.



2. In the namespace that you want to deploy your entitled containers, create an image pull secret so that you can access the cp.icr.io entitled registry. Use the entitlement key that you previously retrieved as the --docker-password value. For more information, see [Accessing images that are stored in other private registries](https://cloud.ibm.com/docs/containers?topic=containers-registryprivate_images).

kubectl create secret docker-registry entitled-cp-icr-io --docker-server=cp.icr.io --docker-username=cp --docker-password=<entitlement_key> --docker-email=<docker_email> -n <namespace>
3. Add the image pull secret to the service account of the namespace so that any container in the namespace can use the entitlement key to pull entitled images.
* [24 March 2022](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-mar2422)



* IBM Cloud Object Storage plug-in
* Block Storage for VPC add-on.
* ALB OAuth Proxy add-on



* [22 March 2022](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-mar2222)



* Hong Kong (HKG02) and Seoul (SEO01) are deprecated and become unsupported later this year.
* Ingress ALB change log updates
* Istio add-on



* [21 March 2022](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-mar2122)



* CLI change log update



* [17 March 2022](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-mar1722)



* Block Storage for VPC add-on.



* [16 March 2022](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-mar1622)



* Cluster autoscaler add-on



* [15 March 2022](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-mar1522)



* Version 1.19 unsupported



* [14 March 2022](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-mar1422)



* Worker node fix pack update.



* [11 March 2022](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-mar1122)



* IBM Cloud Object Storage plug-in