vania-janet/multiturn-rag-retrieval-data huggingface dataset:
ibmcloud iam service-policy-create cr-roles-tutorial --service-name container-registry --region <cloud_region> --resource-type namespace --resource namespace_b --roles Writer
5. Create an API key for the service ID by running the following command.

ibmcloud iam service-api-key-create cr-roles-tutorial-apikey cr-roles-tutorial



2. Use Docker to log in with the service ID API key, where <API_Key> is your API key, and interact with the registry.



1. Log in to IBM Cloud Container Registry by running the following command.

docker login -u iamapikey -p <API_Key> <registry_region>.icr.io

IBM Cloud Container Registry supports other clients as well as Docker. To log in by using other clients, see [Accessing your namespaces in automation](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_accessregistry_access_automating).
2. Pull your image by running the following command.

docker pull <registry_region>.icr.io/namespace_a/hello-world
3. Push your image to namespace_a by running the following command.

docker push <registry_region>.icr.io/namespace_a/hello-world

This command doesn't work because the user doesn't have the Writer role in namespace_a.
4. Push your image to namespace_b by running the following command.

docker push <registry_region>.icr.io/namespace_b/hello-world

This command works because the user has the Writer role in namespace_b.



3. Clean up:



1. Log back in to IBM Cloud Container Registry as User A.

ibmcloud cr login

IBM Cloud Container Registry supports other clients as well as Docker.
* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_exemption_add_prereq)
* [Command options](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_exemption_add_option)
* [Examples](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_exemption_add_example)



* [ibmcloud cr exemption-list (ibmcloud cr exemptions)](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_exemption_list)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_exemption_list_prereq)
* [Command options](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_exemption_list_option)
* [Examples](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_exemption_list_example)



* [ibmcloud cr exemption-rm](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_exemption_rm)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_exemption_rm_prereq)
* [Command options](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_exemption_rm_option)
* [Examples](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_exemption_rm_example)
You can use the new region by using the domain name jp.icr.io.

For more information, see [Regions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_regions).





 21 February 2019 

Automating access to your namespaces
: Using tokens to automate pushing and pulling Docker images to and from your namespaces is deprecated. You must now use API keys to automate access to your Container Registry namespaces so that you can push and pull images.

For more information, see [Creating a user API key manually](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_accessregistry_access_user_apikey_create).





 8 January 2019 

End of support for Vulnerability Advisor API version 2
: Vulnerability Advisor’s API version 2 is deprecated and is no longer usable. Use version 3 of the API, see [Vulnerability Advisor for IBM Cloud Container Registry](https://cloud.ibm.com/apidocs/container-registry/va).





 4 October 2018 

Managing user access
: Use IBM Cloud Identity and Access Management (IAM) to control access by users in your account to Container Registry. When IAM access policies are enabled for your account in Container Registry, every user that accesses the service in your account must be assigned an IAM

access policywith an IAM user role defined. That policy determines the role that the user has within the context of the service, and what actions the user can perform.

For more information, see [Managing IAM access with Cloud Identity and Access Management](https://cloud.ibm.com/docs/Registry?topic=Registry-iamiam), [Defining IAM access policies](https://cloud.ibm.com/docs/Registry?topic=Registry-useruser), and [Granting access to Container Registry resources tutorial](https://cloud.ibm.com/docs/Registry?topic=Registry-iam_accessiam_access).





 7 August 2018 

Exemption policies available in Vulnerability Advisor
* Complete the instructions in [Getting started with IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-getting-startedgetting-started).
* Ensure that you have the most recent version of the container-registry CLI plug-in for the IBM Cloud CLI, see [Updating the container-registry CLI plug-in](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespaceregistry_cli_update).
* Ensure that you have a private namespace to push your encrypted image to, see [Set up a namespace](https://cloud.ibm.com/docs/Registry?topic=Registry-getting-startedgs_registry_namespace_add).
* Install [Buildah version 1.15](https://buildah.io/releases/2020/06/27/Buildah-version-v1.15.0.html), or later, so that you can build encrypted images. Buildah works in the Linux® environment only. As an alternative to Linux®, you can use a virtual machine or Docker image to run Buildah to build images.
* Install [Podman](https://podman.io/).







 Step 1: Create the public-private key pair 

Create a public-private key pair by using OpenSSL commands.



1. Create a work directory, for example, <user_keys>, in which to store the keys and change to that directory:

mkdir <user_keys>; cd <user_keys>
2. Use OpenSSL to create a private key, where <user> is the name for your key's identity:

openssl genrsa --out <user>Private.pem
3. Create a public key:

openssl rsa -in <user>Private.pem -pubout -out <user>Pub.pem

To use the private key in production, you must safely store and protect the private key in a suitable store. You might also want to manage the public key in the same way.
Diagram showing deployment



 Segmentation of data 

Segmentation of data within IBM Cloud Container Registry is achieved by using private

namespaces, which are strictly owned by single accounts.

You can control access to [namespaces](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewoverview_elements_namespace) within the account by using Cloud Identity and Access Management (IAM) access policies. Storage in IBM Cloud Object Storage is not segmented, but user accounts do not have direct access to the IBM Cloud Object Storage that contains the image data. For more information, see [Managing IAM access for IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iam).

All traffic to the registry, and from the service to IBM Cloud Container Registry dependencies is encrypted in transit. No additional network level segmentation of traffic is provided. The control plane and data plane are not separated from each other.





 Private connections 

You can decide whether your data plane interactions use private connections. Additionally, you can choose to prohibit public data plane connections for your account.

The flow of all customer data between IBM Cloud Container Registry and its dependencies uses private network connections. For more information about private connections, see [Securing your connection to IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_private).
Then, create an API key and store these registry credentials in an image pull secret for your cluster.

For example, to access images in other IBM Cloud accounts, create an API key that stores the IBM Cloud Container Registry credentials of a user or service ID in that account. Then, in your cluster's account, save the API key credentials in an image pull secret for each cluster and cluster namespace.

The following steps create an API key that stores the credentials of an IBM Cloud IAM service ID. Instead of using a service ID, you might want to create an API key for a user ID that has an IBM Cloud IAM service access policy to IBM Cloud Container Registry. However, make sure that the user is a functional ID or have a plan in case the user leaves so that the cluster can still access the registry.



1. List available Kubernetes namespaces in your cluster, or create a namespace to use where you want to deploy containers from your registry images.

kubectl get namespaces

Example output

default Active 79d
ibm-cert-store Active 79d
ibm-system Active 79d
kube-public Active 79d
kube-system Active 79d

To create a namespace

kubectl create namespace <namespace_name>
2. Create an IBM Cloud IAM service ID for your cluster that is used for the IAM policies and API key credentials in the image pull secret. Be sure to give the service ID a description that helps you retrieve the service ID later, such as including both the cluster and namespace name.

ibmcloud iam service-id-create <cluster_name>-<namespace>-id --description "Service ID for IBM Cloud Container Registry in Kubernetes cluster <cluster_name> namespace <namespace>"
3. Create a custom IBM Cloud IAM policy for your cluster service ID that grants access to IBM Cloud Container Registry.

ibmcloud iam service-policy-create <cluster_service_ID> --roles <service_access_role> --service-name container-registry [--region <IAM_region>] [--resource-type namespace --resource <registry_namespace>]
Also, as part of this change, the IBM Cloud Container Registry service private IP addressees changed, which might require updates to your firewall configuration.

If you use [Calico](https://www.tigera.io/project-calico/), the samples are updated to take account of the change.

You must not remove the IBM Cloud Container Registry private IP addresses from your IAM restricted IP list until an announcement advises you to do so.

You must take the [appropriate actions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_iam_private_networkregistry_notices_iam_pivate_network_action) before this change happens on 23 June 2022, otherwise your requests to Container Registry might fail to be authorized.





 How you benefit from this change 

This change increases security for any IBM Cloud Container Registry users that use private connections and IAM restricted IP address lists. After the change, you must configure the restricted IP address list to allow the private subnet and IP addresses of your own host. This change means that you can ensure Container Registry OAuth requests originate only from hosts that you own.

If you use IBM Cloud Activity Tracker, you can see the true source IP address in any audit logs, where previously you saw a Container Registry owned IP that was private.





 Understanding if you are impacted by this change 

You are impacted if you are accessing Container Registry over the private network.

You are accessing Container Registry over the private network if one of the following statements is true:



* You're using one of the private. domains, for example, private.us.icr.io.
* You're using an IBM Cloud Kubernetes Service cluster in a [configuration](https://cloud.ibm.com/docs/containers?topic=containers-registrycluster_registry_auth_private) that automatically talks to the registry over a private connection.
* You're accessing Container Registry through a virtual private cloud (VPC) virtual private endpoint gateway (VPE gateway).
* You're using the Container Registry private IP addresses for configuring network access, for example, in firewalls or Access Control Lists (ACL).
For more information about working with images in a container image registry, see [Adding access to a private container registry](https://cloud.ibm.com/docs/codeengine?topic=codeengine-add-registry).



2. The container registry quota is exceeded.



* Check for an ImagePullBackOff error by running the [ibmcloud ce jobrun events --jobrun JOBRUN_NAME](https://cloud.ibm.com/docs/codeengine?topic=codeengine-clicli-jobrun-events) command; for example,



ibmcloud ce jobrun events --jobrun myjobrun



* If the error in the system events is similar to the following message, this error indicates that the registry quota is exceeded. Consider upgrading your plan. For information about IBM Cloud® Container Registry service plans and quota limits, see [About IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overview).



403 Forbidden - Server message: denied: You have exceeded your pull traffic quota for the current month. Review your pull traffic quota and pricing plan.
3. The container registry needs authentication.



* If the error in the system events is similar to the following message, this error indicates that access to the registry does not exist or might require authorization. Check that your credentials have appropriate access to the registry.



Failed to pull image "<image_name>": rpc error: code = Unknown desc = failed to pull and unpack image "<image_name:image_tag>": failed to resolve reference <image_name:image_tag>": pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed.
4. Code Engine cannot find your image in your container registry.

In this scenario, your image exists and the registry access works, but Code Engine finds a different image than the image it was expecting for a specific application revision. The container registry image digest does not match the expected digest of the image for an application revision.
Understanding how to authorize your cluster to pull images from a private registry 

To pull images from a registry, your IBM Cloud Kubernetes Service cluster uses a special type of Kubernetes secret, an imagePullSecret. This image pull secret stores the credentials to access a container registry.

The container registry can be:



* A private namespace in your own IBM Cloud Container Registry.
* A private namespace in IBM Cloud Container Registry that belongs to a different IBM Cloud account.
* Any other private registry such as Docker.



However, by default, your cluster is set up to pull images from only your account's namespaces in IBM Cloud Container Registry, and deploy containers from these images to the default Kubernetes namespace in your cluster. If you need to pull images in other namespaces of the cluster or from other container registries, then you must set up your own image pull secrets.



 Default image pull secret setup 

Generally, your IBM Cloud Kubernetes Service cluster is set up to pull images from all IBM Cloud Container Registry icr.io domains from the default Kubernetes namespace only. Review the following FAQs to learn more about how to pull images in other Kubernetes namespaces or accounts, restrict pull access, or why your cluster might not have the default image pull secrets.

How is my cluster set up to pull images from the default Kubernetes namespace?
: When you create a cluster, the cluster has an IBM Cloud IAM service ID that is given an IAM Reader service access role policy to IBM Cloud Container Registry. The service ID credentials are impersonated in a non-expiring API key that is stored in image pull secrets in your cluster. The image pull secrets are added to the default Kubernetes namespace and the list of secrets in the default service account for this Kubernetes namespace. By using image pull secrets, your deployments can pull images (read-only access) from the [global and regional IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_regions) to deploy containers in the default Kubernetes namespace.



* The global registry securely stores public images that are provided by IBM.
Containers <br><br> * [Red Hat® OpenShift® on IBM Cloud®](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-satellite-architecture-aboutservices-containers-openshift)[1]<br> * [IBM Cloud® Container Registry](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-satellite-architecture-aboutservices-containers-registry)<br><br><br> 
 Storage <br><br> * [IBM Cloud® Object Storage](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-satellite-architecture-aboutservices-storage-cos)<br><br><br> 
 Security <br><br> * [IBM Cloud® Hyper Protect Crypto Services](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-satellite-architecture-aboutservices-security-hpcs)<br><br><br> <br><br> * [IBM Cloud® Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-getting-started)<br> * [IBM Cloud® App ID](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-satellite-architecture-aboutservices-security-app-id)<br><br><br> 
 Logging and monitoring <br><br> * [IBM Cloud® Activity Tracker Event Routing](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-satellite-architecture-aboutservices-logging-platform-events)[2]<br> * [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-satellite-architecture-aboutservices-scc)<br><br><br>
For more information, see the storage class [reference](https://cloud.ibm.com/docs/containers?topic=containers-file_storagefile_storageclass_reference).





 27 March 2020 

Tech overview
: Added an [Overview of personal and sensitive data storage and removal options](https://cloud.ibm.com/docs/containers?topic=containers-service-archibm-data).





 25 March 2020 

Ingress ALB change log
: Updated the [nginx-ingress image build to 627](https://cloud.ibm.com/docs/containers?topic=containers-cluster-add-ons-changelogkube_ingress_changelog).





 24 March 2020 

CLI change log
: Updated the IBM Cloud Kubernetes Service CLI plug-in change log page for the [release of version 1.0.15](https://cloud.ibm.com/docs/containers?topic=containers-cs_cli_changelog10).





 18 March 2020 

IAM issuer details
: Added a [reference topic](https://cloud.ibm.com/docs/containers?topic=containers-access_reference) for the IAM issuer details of RBAC users.





 16 March 2020 

New! CLI 1.0
: Updated the IBM Cloud Kubernetes Service CLI plug-in change log page for the [release of version 1.0.0](https://cloud.ibm.com/docs/containers?topic=containers-cs_cli_changelog10). This version contains permanent syntax and behavior changes that are not compatible with earlier versions, so before you update be sure to follow the guidance in [Using version 1.0 of the plug-in](https://cloud.ibm.com/docs/containers?topic=containers-cs_cli_changelogchangelog_beta).

Installing SGX drivers
* [Build Docker images](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes29sep2017_docker)



* [24 August 2017](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-24aug2017)



* [Graphical user interface released](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes24aug2017_gui)



* [27 June 2017](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-27jun2017)



* [Introducing IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes27jun2017_ga)









 Container Registry and Vulnerability Advisor workflow tutorial 

[Container Registry and Vulnerability Advisor workflow tutorial](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_tutorial_workflowregistry_tutorial_workflow)



* [Objectives](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_tutorial_workflowregistry_tutorial_workflow_objectives)
* [Services used](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_tutorial_workflowregistry_tutorial_workflow_services)
* [Before you begin](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_tutorial_workflowregistry_tutorial_workflow_prereqs)
* [From code to a running container](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_tutorial_workflowregistry_tutorial_workflow_code_run)
ibmcloud cr quota-set --traffic 7000 --storage 600







 ibmcloud cr region 

Displays the targeted region and the registry.

ibmcloud cr region

For more information, see [Regions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_regions).



 Prerequisites 

None







 ibmcloud cr region-set 

Set a target region for the IBM Cloud Container Registry commands. To list the available regions, run the command with no options.

ibmcloud cr region-set [REGION]



 Prerequisites 

None





 Command options 

REGION
: (Optional) The name of your target region, for example, us-south. For more information, see [Regions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_regions).





 Example 

Target the US South region.

ibmcloud cr region-set us-south







 ibmcloud cr retention-policy-list 

List the image retention policies for your account. Image retention policies retain the specified number of images for each repository within a namespace in IBM Cloud Container Registry. All other images in the namespace are deleted. You can also see whether the option to retain all untagged images applies to the policy.

Where an image within a repository is referenced by multiple tags, that image is counted only once. Newest images are retained. Age is determined by when the image was created, not when it was pushed to the registry.

ibmcloud cr retention-policy-list



 Prerequisites 

To find out about the required permissions, see [Access roles for using Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iamaccess_roles_using).





 Example 

List the retention policies in your account.

ibmcloud cr retention-policy-list

For more information about how to use the ibmcloud cr retention-policy-list command, see [Retaining images](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_retention).
* [Allowing different IPs to access different API types over the public and private service endpoints](https://cloud.ibm.com/docs/containers?topic=containers-cbr-tutorialcbr-tutorial-scenarios-pub-priv-api-types)









 Managing access control 

[Understanding access control for clusters](https://cloud.ibm.com/docs/containers?topic=containers-access-overviewaccess-overview)



* [Access control checklist](https://cloud.ibm.com/docs/containers?topic=containers-access-overviewaccess-checklist)



* [IBM Cloud access control](https://cloud.ibm.com/docs/containers?topic=containers-access-overviewaccess-checklist-iam)
* [Other types of access control](https://cloud.ibm.com/docs/containers?topic=containers-access-overviewaccess-checklist-other)



* [Understanding IAM access policies and roles](https://cloud.ibm.com/docs/containers?topic=containers-access-overviewaccess_policies)



* [Pick the correct access policy and role for your users](https://cloud.ibm.com/docs/containers?topic=containers-access-overviewaccess_roles)
* [Assign access roles to individual or groups of users in IBM Cloud IAM](https://cloud.ibm.com/docs/containers?topic=containers-access-overviewiam_individuals_groups)
* [Scope user access to cluster instances, namespaces, or resource groups](https://cloud.ibm.com/docs/containers?topic=containers-access-overviewresource_groups)





[Setting up API key credentials so the service can access the infrastructure and other cloud services](https://cloud.ibm.com/docs/containers?topic=containers-access-credsaccess-creds)



* [Setting up the API key for most use cases](https://cloud.ibm.com/docs/containers?topic=containers-access-credsapi_key_most_cases)