vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Run [ibmcloud fn namespace create](https://cloud.ibm.com/docs/openwhisk?topic=cloud-functions-cli-plugin-functions-clicli_namespace_create) to create more namespaces under your account such as "staging" and "production":



* Create a staging namespace.

ibmcloud fn namespace create staging
* Create a production namespace.

ibmcloud fn namespace create production



Cloud Functions has restrictions on namespace names. For more information, see the [System details and Limits](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-limits) documentation.







 Targeting namespaces 

Before you can work in Cloud Functions, you must target a namespace. You can target IAM namespaces or Cloud Foundry namespaces.

To target a namespace, use the [ibmcloud fn namespace target](https://cloud.ibm.com/docs/openwhisk?topic=cloud-functions-cli-plugin-functions-clicli_namespace_target) command.

For example, to target an IAM namespace called playground,

ibmcloud fn namespace target playground



 Accessing other resources from a namespace 

Actions typically call other IBM Cloud resources and services that require appropriate authentication. If these services are IAM-enabled and accept IAM tokens, you can leverage the namespace functional ID for outbound communication.

As described in [Managing IAM access](https://cloud.ibm.com/docs/account?topic=account-userroles), for each namespace, a service ID is created that represents the namespace. You can grant access to other services and resources for this service ID by assigning the appropriate roles by using IAM policy management. For more information about creating service IDs to access other IAM-enabled services, see [Creating and working with service IDs](https://cloud.ibm.com/docs/account?topic=account-serviceids).
The namespace must be unique across all IBM Cloud accounts in the same region. Namespaces must have 4 - 30 characters, and contain lowercase letters, numbers, hyphens (-), and underscores (_) only. Namespaces must start and end with a letter or number.

Do not put personal information in your namespace names.

-g (RESOURCE_GROUP_NAME | RESOURCE_GROUP_ID)
: (Optional) Specify the name or ID of the resource group to which you want to add the namespace. If you don't set this option, the targeted resource group is used. If you don't set this option and a resource group is not targeted, the default resource group for the account is used.





 Example 

Create a namespace with the name birds and add it to the resource group beaks.

ibmcloud cr namespace-add -g beaks birds







 ibmcloud cr namespace-assign 

Namespacescreated in version 0.1.484 of the Container Registry CLI or earlier, or in the IBM Cloud console before 29 July 2020 are not assigned toresource groups. You can assign an unassigned namespace to a resource group for your IBM Cloud account. If you assign a namespace to a resource group, you can configure access to resources within the namespace at the [resource group](https://cloud.ibm.com/docs/account?topic=account-rgs) level. If you don't specify a resource group, and a resource group isn't targeted, the command fails.

You can assign a namespace to a resource group only once. When a namespace is in a resource group, you can't move it to another resource group.

To find out which namespaces are assigned to resource groups and which are unassigned, run the [ibmcloud cr namespace-list](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_namespace_list) command with the -v option. Namespaces that are assigned to a resource group also show in the Resource list page of the IBM Cloud console.
curl --request GET --url 'https://us-south.functions.cloud.ibm.com/api/servicebroker/api/v1/namespaces/{id} --header 'accept: application/json' --header 'authorization: <IAM_token>'

You can also list all namespaces, including IAM-based and Cloud Foundry-based namespaces:

curl --request GET --url 'https://jp-tok.functions.cloud.ibm.com/api/v1/namespaces?limit=0&offset=0' --header 'accept: application/json' --header 'authorization: <IAM_token>'

The following example shows sample output from the previous command.

{
"limit": 10,
"offset": 0,
"total_Count": 2,
"namespaces": [
{
"id": "12345678-1234-abcd-1234-123456789abc",
"location": "jp-tok"
},
{
"id": "BobsOrg_dev",
"classic_type": 1,
"location": "jp-tok"
}
]
}



For more information about working with HTTP REST, check out the [Cloud Functions API Docs](https://cloud.ibm.com/apidocs/functions).





 Optional workflow: Creating namespaces for staging and production deployments 

You can create IAM-enabled namespaces to handle your pre-production (staging) and production Cloud Functions deployments by creating namespaces for each. Run [ibmcloud fn namespace create](https://cloud.ibm.com/docs/openwhisk?topic=cloud-functions-cli-plugin-functions-clicli_namespace_create) to create more namespaces under your account such as "staging" and "production":



* Create a staging namespace.

ibmcloud fn namespace create staging
* Create a production namespace.
* [How do I set IAM policies so that others can work with my namespace?](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-iamiam_namespace_policies)
* [How do I set IAM policies so that others can create namespaces in my account?](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-iamiam_namespace_create)
* [How do I know which access policies have set for me?](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-iamiam_set_policies_me)
* [Platform management roles](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-iamiam_platform_roles)
* [Service-specific roles](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-iamservice_specific_roles)
* [Setting access policies for a service ID](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-iamservice-id-set-policy)



* [Setting access policies for a service ID in the console](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-iamservice-id-set-ui)
* [Setting an access policy for your Cloud Functions service ID through the CLI](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-iamcli-set)









 Integrating serverless apps 

[Binding IBM Cloud services to Cloud Functions entities](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-servicesservices)



* [Binding a service to an action or package](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-servicesservices_bind)
<region>.icr.io/<my_namespace>/<repo_name>:<tag>

To find your namespace, run the ibmcloud cr namespace-list command.
4. Take note of the path to the directory that contains your Dockerfile. If you run the commands in the following steps while your working directory is set to where your build context is stored, you can replace <directory> with a period (.).
5. Build and test your image locally before you push it to IBM Cloud.



1. Build the image from your Dockerfile on your local computer and tag it with your image name, where <image_name> is the name of your image and <directory> is the path to the directory.

docker build -t <image_name> <directory>
2. Optional: Test your image on your local computer before you push it to your namespace.

docker run <image_name>

Replace <image_name> with the name of your image.
3. After you create your image and tag it for your namespace, [you can push your image to your namespace in IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_images_registry_images_pushing_namespace).





To use Vulnerability Advisor to check the security of your image, see [Managing image security with Vulnerability Advisor](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index&interface=ui).





 Pushing images by using an API key 

Create a service ID that uses an

API keyto push images to IBM Cloud Container Registry.

Complete the following steps:



1. Create a service ID, see [Creating and working with service IDs](https://cloud.ibm.com/docs/account?topic=account-serviceidsserviceids).
2.
To set a namespace, repository, digest, or tag as the scope, enter the value in one of the following formats:



* namespace
* namespace/repository
* namespace/repository:tag
* namespace/repository@digest



--issue-type ISSUE_TYPE
: The issue type of the exemption for the security issue that you want to remove. To find the issue types for your exemptions, run ibmcloud cr exemption-list.

--issue-id ISSUE_ID
: The ID of the exemption for the security issue that you want to remove. To find the issue IDs for your exemptions, run ibmcloud cr exemption-list.





 Examples 

Delete a CVE exemption for CVE with ID CVE-2018-17929 for all images in the us.icr.io/birds/bluebird repository.

ibmcloud cr exemption-rm --scope us.icr.io/birds/bluebird --issue-type cve --issue-id CVE-2018-17929

Delete an account-wide CVE exemption for CVE with ID CVE-2018-17929.

ibmcloud cr exemption-rm --scope "" --issue-type cve --issue-id CVE-2018-17929

Delete a configuration issue exemption for issue application_configuration:nginx.ssl_protocols for a single image with the tag us.icr.io/birds/bluebird:1.

ibmcloud cr exemption-rm --scope us.icr.io/birds/bluebird:1 --issue-type configuration --issue-id application_configuration:nginx.ssl_protocols

Delete a configuration issue exemption for issue application_configuration:nginx.ssl_protocols for a single image with the digest us.icr.io/birds/bluebird@sha256:101010101010.

ibmcloud cr exemption-rm --scope us.icr.io/birds/bluebird@sha256:101010101010 --issue-type configuration --issue-id application_configuration:nginx.ssl_protocols







 ibmcloud cr exemption-types
For more information, see [Specifying an alternative host for an API](https://www.ibm.com/support/knowledgecenter/en/SSFS6T/com.ibm.apic.toolkit.doc/task_apionprem_creating_apis.htmltask_tq2_11r_xt__enforce_step).
* Hostname for Developer Portal API Calls: In the Port API Endpoint window area, enter a host name for Developer Portal API calls. The host name that you enter can be the host name of your Management service. To access the Developer Portal API within the context of a Developer Portal, you must configure the base host name for the Developer Portal API calls. This action allows API Manager to map your host name to the provider organization and Catalog of the Developer Portal API calls instead of requiring you to look it up and include them in your calls.





7. Click the Save icon.







 Partitioning a Catalog 

To use the syndication feature in API Connect, you must enable Spaces in any Catalog in which you require syndication capabilities.

To enable Spaces in a Catalog, complete the following steps:



1. On the Dashboard of the API Manager UI, select the Catalog that you want to work with.
2. Click Settings > Overview, and click the Spaces slider control.
3. In the Enable Spaces window, click Enable, then click ![Save icon](https://cloud.ibm.com/docs-content/v1/content/78bb71851d95d7580503eb9ba10cf3ae31490ade/apiconnect/images/icon_save.png). A Manage spaces link is displayed beneath the Spaces slider control, and a Spaces link is added to the navigation list. You can manage your Spaces by clicking either of these links.

Spaces are enabled for your Catalog, and a default Space, called New Space is created.
--namespaceNAMESPACE
: An IAM namespace name or ID. This flag cannot be set for Cloud Foundry namespaces. This flag is optional.





 Example 

ibmcloud fn property set --namespace myNamespace

Output

ok: whisk namespace set to myNamespace







 ibmcloud fn property unset 

Unset a property for the wsk CLI. At least one flag is required.

If properties are retained after running the property unset command, you can delete the config.json file located at <home_dir>/.bluemix/plugins/cloud-functions/config.json to remove all properties.

ibmcloud fn property unset [--apihost HOST] [--apiversion VERSION] [--auth KEY] [--cert STRING] [--key STRING] [--namespace NAMESPACE]



 Command options 

--apihostHOST
: The wsk API host. This flag is optional.

--apiversionVERSION
: The wsk API version. This flag is optional.

--authKEY, -u
: The wsk authorization KEY. This flag is optional.

--certSTRING
: The wsk client certificate. This flag is optional.

--keySTRING
: The wsk client KEY. This flag is optional.

--namespaceNAMESPACE
: An IAM namespace name or ID. This flag cannot be set for Cloud Foundry namespaces. This flag is optional.





 Example 

ibmcloud fn property unset --namespace









 Rule commands 

Create, delete, enable, disable, update, and find information about rules.

To see CLI help for the rule command, run ibmcloud fn rule.



 ibmcloud fn rule create 

Create a rule to associate a trigger with an action. Before you can create a rule, create a trigger and an action first.

ibmcloud fn rule create RULE_NAME TRIGGER_NAME ACTION_NAME



 Example
You can assign an existing namespace to a resource group by using the [ibmcloud cr namespace-assign](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcliic_cr_namespace_assign) command. To find out which namespaces are assigned to resource groups and which are unassigned, run the [ibmcloud cr namespace-list](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_namespace_list) command with the -v option.

Namespaces that are assigned to a resource group show in the Resource list page of the IBM Cloud console.

If the namespaces don't all show in the Resource list page, see [Why don't all my namespaces show in the Resource list?](https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-namespace-resource-list) for assistance.

For more information about resource groups, see [Creating a resource group](https://cloud.ibm.com/docs/account?topic=account-rgscreate_rgs).

To assign an existing namespace to a resource group, complete the following steps:



1. Log in to IBM Cloud.

ibmcloud login
2. To find the namespace, list the available namespaces.

ibmcloud cr namespace-list -v
3. Assign the namespace to a resource group.

Replace <my_resource_group> with the name or ID of the resource group and <my_namespace> with the name of the namespace.

ibmcloud cr namespace-assign -g <my_resource_group> <my_namespace>







 Removing namespaces 

If you no longer require a registry namespace, you can remove the namespace from your IBM Cloud account.



1. Log in to IBM Cloud.

ibmcloud login
2. List available namespaces.

ibmcloud cr namespace-list
3. Remove a namespace.
(https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-namespaceswhat_is_namespace)



* [What happens when I create a namespace?](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-namespaceswhat_happens_create_namespace)
* [Are there any limitations for namespaces?](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-namespacesnamespace_limitations)
* [What do I do if I have a Cloud Foundry-based namespace?](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-namespacescf_namespace)
* [How do I see a list of my Cloud Functions namespaces?](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-namespaceshow_list_namespace)
* [How do I see the Cloud Functions entities in my namespace?](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-namespaceshow_find_iam_namespace)



* [Creating an IAM-based namespace](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-namespacescreate_iam_namespace)



* [Creating an IAM-based namespace from the console](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-namespacescreate_iam_ui)
* [Creating an IAM-based namespace with the CLI](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-namespacesnamespaces_create)
Actions that generate events for namespaces 



Table 9. Actions that generate events for namespaces

 Action Description Data Event 

 container-registry.namespace.create Create a namespace in Container Registry.<br><br>Assign a Container Registry namespace to a resource group. 
 container-registry.namespace.delete Delete a namespace from Container Registry. 
 container-registry.namespace.list List the Container Registry namespaces in your IBM account. 







 Actions that generate events for plans 



Table 10. Actions that generate events for plans

 Action Description Data Event 

 container-registry.plan.get Display information about the current pricing plan. 
 container-registry.plan.set Upgrade to the standard plan. 







 Actions that generate events for quotas 



Table 11. Actions that generate events for quotas

 Action Description Data Event 

 container-registry.quota.get Display the current quotas for traffic and storage, and the usage information against those quotas. 
 container-registry.quota.set Modify the quotas. Quota settings must be managed separately for your account in each registry instance. You can set quota limits for storage in your free or standard plan. 







 Actions that generate events for retention policies 



Table 12. Actions that generate events for retention policies

 Action Description Data Event 

 container-registry.retention.analyze List the images that are deleted if you apply a specific retention policy. 
 container-registry.retention.list List the image retention policies for your account. 
 container-registry.retention.set Set a policy to retain images in a namespace in Container Registry by applying specified criteria. 







 Actions that generate events for settings 



Table 13. Actions that generate events for settings

 Action Description Data Event 

 container-registry.settings.get Get registry service settings for the targeted account, such as whether platform metrics are enabled. 
 container-registry.settings.set Update registry service settings for the targeted account, such as enabling platform metrics. 







 Actions that generate events for signing images 



Table 14. Actions that generate events for signing images

 Action Description Data Event 

 container-registry.signature.delete Delete a signature from an image in Container Registry. True
[Network policies](https://docs.tigera.io/calico/latest/reference/resources/networkpolicy) are scoped to specific namespaces:

calicoctl get NetworkPolicy --all-namespaces -o wide

[Global network policies](https://docs.tigera.io/calico/latest/reference/resources/globalnetworkpolicy) are not scoped to specific namespaces:

calicoctl get GlobalNetworkPolicy -o wide
3. View details for a network policy.

calicoctl get NetworkPolicy -o yaml <policy_name> --namespace <policy_namespace>
4. View the details of all global network policies for the cluster.

calicoctl get GlobalNetworkPolicy -o yaml







 Adding network policies 

Usually, the default policies don't require changes. Only advanced scenarios might require changes. If you find that you must make changes, you can create your own network policies.

To create Kubernetes network policies, see the [Kubernetes network policy documentation](https://kubernetes.io/docs/concepts/services-networking/network-policies/).

To create Calico policies, use the following steps. Before you begin, [install and configure the Calico CLI, and set the context for your cluster to run Calico commands](https://cloud.ibm.com/docs/openshift?topic=openshift-network_policiescli_install).



1. Define your Calico [network policy](https://docs.tigera.io/calico/latest/reference/resources/networkpolicy) or [global network policy](https://docs.tigera.io/calico/latest/reference/resources/globalnetworkpolicy) by creating a configuration script (.yaml) with Calico v3 policy syntax. These configuration files include the selectors that describe what pods, namespaces, or hosts that these policies apply to.
2. Apply the policies to the cluster.
Create a namespace with the name birds and add it to the resource group beaks.

ibmcloud cr namespace-add -g beaks birds







 ibmcloud cr namespace-assign 

Namespacescreated in version 0.1.484 of the Container Registry CLI or earlier, or in the IBM Cloud console before 29 July 2020 are not assigned toresource groups. You can assign an unassigned namespace to a resource group for your IBM Cloud account. If you assign a namespace to a resource group, you can configure access to resources within the namespace at the [resource group](https://cloud.ibm.com/docs/account?topic=account-rgs) level. If you don't specify a resource group, and a resource group isn't targeted, the command fails.

You can assign a namespace to a resource group only once. When a namespace is in a resource group, you can't move it to another resource group.

To find out which namespaces are assigned to resource groups and which are unassigned, run the [ibmcloud cr namespace-list](https://cloud.ibm.com/docs/cli?topic=cli-containerregclibx_cr_namespace_list) command with the -v option. Namespaces that are assigned to a resource group also show in the Resource list page of the IBM Cloud console.

ibmcloud cr namespace-assign -g (RESOURCE_GROUP_NAME | RESOURCE_GROUP_ID) NAMESPACE

For more information about resource groups, see [Creating a resource group](https://cloud.ibm.com/docs/account?topic=account-rgscreate_rgs).



 Prerequisites 

To find out about the required permissions, see [Platform management roles](https://cloud.ibm.com/docs/Registry?topic=Registry-iamplatform_management_roles) and [Access roles for configuring Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iamaccess_roles_configure).





 Command options
* [Set up your own namespace in IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespaceregistry_namespace_setup).
* Install the latest release of [Helm CLI](https://github.com/helm/helm/releases) to work with charts.





1. Download the Helm chart to your local computer.



* Download the Helm chart from the OCI registry:

helm pull oci://<registry/<my_namespace>/<chart_name> --version <chart_version>

Example, where <registry> is localhost:5000, my_namespace is helm-charts, chart_name is mychart, and <chart_version> is 0.1.0:

helm pull oci://localhost:5000/helm-charts/mychart --version 0.1.0
* Download the Helm chart from a Helm repository:

helm pull <chart URL | repo/chartname> --version <chart_version>

Example, where <repo/chartname> is ibm-charts/ibm-istio and <chart_version> is 1.2.2.

You can add the repo alias by using the [helm repo add](https://helm.sh/docs/helm/helm_repo_add/) command.

helm pull ibm-charts/ibm-istio --version 1.2.2



If you get an unauthorized: authentication required or a denied: requested access to the resource is denied message, run the [ibmcloud cr login](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_login) command.



After you pull a chart for your [namespace](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewoverview_elements_namespace), you can upload (push) the chart from your local computer to your namespace.





 Pushing Helm charts to your namespace