vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* IBM Cloud Kubernetes Service plug-in (ibmcloud ks)
* IBM Cloud Container Registry plug-in (ibmcloud cr)
* IBM Cloud Kubernetes Service observability plug-in (ibmcloud ob)



* [Install the Kubernetes CLI (kubectl)](https://cloud.ibm.com/docs/containers?topic=containers-cs_cli_installkubectl)

Make sure that the kubectl version is compatible with your cluster version. If the kubectl version is not compatible, you can get an error such as kubectl create clusterrolebinding failed!. You can use kubectl version --short to check versions of your cluster and your kubectl client.
* [Create a cluster](https://cloud.ibm.com/docs/containers?topic=containers-clustersclusters) or use an existing IBM Cloud Kubernetes Service cluster.
* Make sure that your user ID is assigned the following IBM Cloud® Identity and Access Management policies:





Table 1. List of IAM policies required to complete the tutorial

 Resource Scope of the access policy Role Region Information 

 Resource group default Resource group Viewer US-south This policy is required to allow the user to see service instances in the Default resource group. 
 IBM Cloud Monitoring service Resource group Editor Us-south This policy is required to allow the user to provision and administer the IBM Cloud Monitoring service in the default resource group. 
 Kubernetes cluster instance Resource Editor Us-south This policy is required to configure the secret and the monitoring agent in the Kubernetes cluster. 



For more information about the IBM Cloud® Kubernetes Service IAM roles, see [User access permissions](https://cloud.ibm.com/docs/containers?topic=containers-access_referenceaccess_reference).





 Step 1: Provision an IBM Cloud Monitoring instance 

In this getting tutorial, instructions are provided to provision an instance of the IBM Cloud Monitoring in the US-South region.
- name: <secret_name>

To access an IBM Cloud public image,

apiVersion: v1
kind: Pod
metadata:
name: mypod
spec:
containers:
- name: <container_name>
image: icr.io/<image_name>:<tag>
imagePullSecrets:
- name: <secret_name>

container_name>
: The name of the container to deploy to your cluster. namespace_name>
: The registry namespace where the image is stored. To list available namespaces, run ibmcloud cr namespace-list. image_name>
: The name of the image to use. To list available images in an IBM Cloud account, run ibmcloud cr image-list. tag>
: The version of the image that you want to use. If no tag is specified, the image that is tagged latest is used by default. <secret_name>
: The name of the image pull secret that you created earlier.
3. Save your changes.
4. Create the deployment in your cluster.

oc apply -f mypod.yaml







 Pushing images to IBM Cloud Container Registry 

After the cluster administrator [sets up an image registry with IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-getting-startedgetting-started), you can securely store and share Docker images with other users by adding images to your namespace.

For example, you might pull an image from any private or public registry source, and then tag it for later use in IBM Cloud Container Registry. Or, you might push a Docker image that you work with to your namespace so that other users can access the image. To get started, see [Adding images to your namespace](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_images_).





 Managing security of images in IBM Cloud Container Registry with Vulnerability Advisor 

Vulnerability Advisor checks the security status of container images that are provided by IBM, third parties, or added to your organization's IBM Cloud Container Registry namespace.
ca-tor ca.icr.io private.ca.icr.io Not applicable 
 eu-central de.icr.io private.de.icr.io registry.eu-de.bluemix.net 
 jp-osa jp2.icr.io private.jp2.icr.io Not applicable 
 uk-south uk.icr.io private.uk.icr.io registry.eu-gb.bluemix.net 
 us-south us.icr.io private.us.icr.io registry.ng.bluemix.net 



To learn about connecting to Container Registry by using the private domain names, see [Using private network connections](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_privateregistry_private_images).

The existing bluemix.net domain names are deprecated, but you can continue to use them for the moment. An end of support date is not available yet.



 Targeting a local region 

If you want to use a region other than your local region, you can target the region that you want to access by running the [ibmcloud cr region-set](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_region_set) command. You can run the command with no options to get a list of available regions, or you can specify the region as an option.



1. To run the command with options, replace <region> with the name of the [region](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_regions_local).

ibmcloud cr region-set <region>

For example, to target the eu-central region, run the following command.

ibmcloud cr region-set eu-central
2. To log your local Docker daemon into the registry so that you can push or pull images, run the [ibmcloud cr login](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_login) command.

Container Registry supports other clients as well as Docker.
* [21 March 2018](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-21mar2018)



* [Container Scanner](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes21mar2018_cs)



* [16 March 2018](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-16mar2018)



* [Container Image Security Enforcement beta](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes16mar2018_cise)



* [20 February 2018](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-20feb2018)



* [Trusted content](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes20feb2018_tc)



* [6 November 2017](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-6nov2017)



* [Global registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes6nov2017_global)



* [29 September 2017](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-29sep2017)



* [Build Docker images](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes29sep2017_docker)



* [24 August 2017](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-24aug2017)



* [Graphical user interface released](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes24aug2017_gui)
Why do commands fail saying they’re not registered? 

You can't run any IBM Cloud® Container Registry ibmcloud cr commands. The commands are failing with the message: 'cr' is not a registered command. See 'ibmcloud help'.

  What’s happening 

You're trying to run an ibmcloud cr command, but you receive an error message similar to one of the following error messages:

ibmcloud cr login
'cr' is not a registered command. See 'ibmcloud help'.

ibmcloud cr namespace
'cr' is not a registered command. See 'ibmcloud help'.

  Why it’s happening 

The container-registry CLI plug-in is not installed.

  How to fix it 

Install the container-registry CLI plug-in, see [Installing the container-registry CLI plug-in](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespacecli_namespace_registry_cli_install).
* [Labels](https://cloud.ibm.com/docs/containers?topic=containers-applabel)
* [Affinity](https://cloud.ibm.com/docs/containers?topic=containers-appaffinity)
* [Image policies](https://cloud.ibm.com/docs/containers?topic=containers-appimage)
* [Ports](https://cloud.ibm.com/docs/containers?topic=containers-appport)
* [Resource requests and limits](https://cloud.ibm.com/docs/containers?topic=containers-appresourcereq)
* [Liveness and readiness probes](https://cloud.ibm.com/docs/containers?topic=containers-appprobe)
* [Services](https://cloud.ibm.com/docs/containers?topic=containers-appapp-service) to expose the app service on a port.
* [Configmaps](https://cloud.ibm.com/docs/containers?topic=containers-appconfigmap) to set container environment variables.
* [Secrets](https://cloud.ibm.com/docs/containers?topic=containers-appsecret) to set container environment variables.
* [Persistent volumes](https://cloud.ibm.com/docs/containers?topic=containers-apppv) that are mounted to the container for storage.







 How can I add IBM services to my app, such as Watson? 

See [Adding services to apps](https://cloud.ibm.com/docs/containers?topic=containers-service-bindingadding_app).







 Planning highly available deployments 

The more widely you distribute your setup across multiple worker nodes and clusters, the less likely your users are to experience downtime with your app.

Review the following potential app setups that are ordered with increasing degrees of availability.

Zoom

!
[Debugging your Portworx installation](https://cloud.ibm.com/docs/containers?topic=containers-debug-portworxdebug-portworx)



* [Step 1: Verifying the IBM Cloud catalog information](https://cloud.ibm.com/docs/containers?topic=containers-debug-portworxpx-verify-catalog)
* [Step 2: Verifying the cluster setup](https://cloud.ibm.com/docs/containers?topic=containers-debug-portworxpx-verify-cluster)
* [Step 3: Reach out to Portworx and IBM](https://cloud.ibm.com/docs/containers?topic=containers-debug-portworxpx-support)



[Why does encryption fail with an invalid KMS endpoint?](https://cloud.ibm.com/docs/containers?topic=containers-px-kms-endpointpx-kms-endpoint)







 Service limitations 

[Service limitations](https://cloud.ibm.com/docs/containers?topic=containers-limitationslimitations)



* [Service and quota limitations](https://cloud.ibm.com/docs/containers?topic=containers-limitationstech_limits)
* [Classic cluster limitations](https://cloud.ibm.com/docs/containers?topic=containers-limitationsclassic_limits)



* [Compute](https://cloud.ibm.com/docs/containers?topic=containers-limitationsclassic_compute_limit)
* [Networking](https://cloud.ibm.com/docs/containers?topic=containers-limitationsclassic_networking_limit)
* [Storage](https://cloud.ibm.com/docs/containers?topic=containers-limitationsclassic_storage_limit)



* [VPC cluster limitations](https://cloud.ibm.com/docs/containers?topic=containers-limitationsks_vpc_gen2_limits)
* [Using a reservation in a cluster](https://cloud.ibm.com/docs/containers?topic=containers-reservationsri-use)
* [Reviewing reservation usage](https://cloud.ibm.com/docs/containers?topic=containers-reservationsri-review)







 Enhancing security 

[Security for IBM Cloud Kubernetes Service](https://cloud.ibm.com/docs/containers?topic=containers-securitysecurity)



* [Overview of security threats for your cluster](https://cloud.ibm.com/docs/containers?topic=containers-securitythreats)
* [Kubernetes API server and etcd](https://cloud.ibm.com/docs/containers?topic=containers-securityapiserver)



* [How is access to my API server granted?](https://cloud.ibm.com/docs/containers?topic=containers-securityapi-server-access)
* [What does IBM Cloud Kubernetes Service do to secure my API server and etcd data store?](https://cloud.ibm.com/docs/containers?topic=containers-securitysecure-api-server)
* [What else can I do to secure my API server?](https://cloud.ibm.com/docs/containers?topic=containers-securityapi-server-what-else)
* [Rotating CA certificates in your cluster](https://cloud.ibm.com/docs/containers?topic=containers-securitycert-rotate)



* [Worker node](https://cloud.ibm.com/docs/containers?topic=containers-securityworkernodes)



* [Who owns the worker node and am I responsible to secure it?](https://cloud.ibm.com/docs/containers?topic=containers-securityworker-node-owner)
* [How does my worker node setup look?](https://cloud.ibm.com/docs/containers?topic=containers-securityworker-node-setup)
* [Change to virtual private endpoints](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes11nov2022_vpe)



* [2 November 2022](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-2nov2022)



* [Changes to private IP addresses from 15 December 2022](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes2nov2022_ip)



* [15 September 2022](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-15sep2022)



* [Container Registry plug-in 1.0.0 is available](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes15sep2022_v1)
* [All releases of Container Registry plug-in 0.1 are deprecated](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes15sep2022_v0)
* [Vulnerability Advisor 4 is available from Container Registry plug-in 1.0.0](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes15sep2022_va_version_4)
* [New commands for setting and checking the Vulnerability Advisor version are available from Container Registry plug-in 1.0.0](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes15sep2022_va_version_commands)



* [3 August 2022](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-03aug2022)



* [The CLI stops returning security status results in lists by default from version 1.0.0](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes03aug2022_list)
Container Registry VPEs are being updated so that they can access all Container Registry service regions by using a single VPE gateway. Previously, a Container Registry VPE gateway provided access to Container Registry only in the region in which the VPC and VPE gateway existed. If a user wanted to access another Container Registry region, they had to use the private registry domain names (for example, private.us.icr.io) and required extra VPC configuration for these domains.

With the new VPE version, VPC users can privately access all Container Registry regions by using a single Container Registry VPE gateway that uses a public domain name (for example, us.icr.io) regardless of the region in which the VPE gateway exists and without having to provide extra configuration.

Additionally, the new version of the VPE is in line with previous changes to private networking within Container Registry where the real source IP addresses of requests to the Container Registry are now maintained.

Previously, when connections came in over private networks, including through VPE gateways, the source IP addresses that you saw in IBM Cloud Activity Tracker and that were configured for IAM restricted IP address lists, were documented Container Registry IP addresses, see [Permit worker nodes to communicate with IBM Cloud Container Registry](https://cloud.ibm.com/docs/containers?topic=containers-firewallfirewall_private_container_registry).

When you connect to Container Registry now, the real IP address of your VPC [Cloud service endpoint source addresses](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-behind-the-curtaincse-source-addresses) is maintained in a request, which means that IAM restricted IP lists can be configured to specifically allow requests from your VPC, which improves security.





 Understanding if you are impacted by this change 

You are affected by this change if you are using a Container Registry VPE gateway that was created before 11 November 2022. VPE gateways created before this date can be identified by differences in their target CRN.
* [What does the benchmark cover?](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmarkbenchmark-scope)
* [What do the benchmark recommendations mean?](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmarkbenchmark-meaning)
* [What parts of the benchmark am I responsible for?](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmarkbencmark-resp)
* [What if some part of the service fails to comply with a recommendation?](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmarkbencmark-service-compliance)
* [What else can I do to increase the security and compliance of my cluster?](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmarkbenchmark-what-else)



* [Running the worker node CIS Kubernetes benchmark](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmarkcis-worker-test)





 Version 1.27 

[1.27 version information and update actions](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_127cs_versions_127)



* [Release timeline](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_127release_timeline_127)
* [Preparing to update](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_127prep-up-127)



* [Update before master](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_127before_127)





[Kubernetes version 1.27 change log](https://cloud.ibm.com/docs/containers?topic=containers-changelog_127changelog_127)
For more information about plans, see [Registry plans](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_plans).



 Prerequisites 

To find out about the required permissions, see [Access roles for configuring Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iamaccess_roles_configure).





 Command options 

PLAN
: (Optional) The name of the pricing plan that you want to upgrade to. If PLAN is not specified, the default is standard.





 Example 

Upgrade to the standard pricing plan.

ibmcloud cr plan-upgrade standard







 ibmcloud cr platform-metrics 

You can use the command to enable and disable platform metrics. You can also use it to find out whether you have platform metrics set up on your account for the registry region that you're targeting.

If you want to view the platform metrics for IBM Cloud Container Registry, you must opt in by running the ibmcloud cr platform-metrics command.

You must specify one of the command options or the command fails with an error.

ibmcloud cr platform-metrics --enable | --disable | --status

For more information about the platform metrics that you can view in Container Registry, see [Monitoring metrics for IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_monitor).



 Prerequisites 



* You must set up IBM Cloud Monitoring, see [Getting started tutorial for IBM Cloud Monitoring](https://cloud.ibm.com/docs/monitoring?topic=monitoring-getting-started).
* [Enable your IBM Cloud Monitoring instance for platform metrics](https://cloud.ibm.com/docs/monitoring?topic=monitoring-platform_metrics_enabling).
* To find out about the required permissions, see [Access roles for configuring Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iamaccess_roles_configure).







 Command options
Changes to private IP addresses from 15 December 2022 

The IBM Cloud® Container Registry private IP addresses that were replaced on 5 July 2022 are being decommissioned on 15 December 2022.



 What you need to know about this change 

IP addresses for accessing Container Registry over the private network changed on 5 July 2022, see [Container Registry private IP addresses changed on 5 July 2022](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_iam_private_network). You continue to be able to use these old IP addresses, but they are due to be decommissioned on 15 December 2022. After this date, you will not be able to access Container Registry by using these IP addresses.

IBM Cloud Kubernetes Service cluster workers are configured so that you can access Container Registry over the private network even when the public domain is used. This process caches the DNS result on worker startup and is not refreshed until a cluster worker is reloaded, replaced, or rebooted. If the cluster workers have not been reloaded, replaced, or rebooted since 5 July 2022, it is likely that they still refer to the old Container Registry private IP addresses. If these workers are not reloaded or replaced, they will not function correctly after the old Container Registry IP addresses are decommissioned.

If you have any other custom configuration that uses the old Container Registry private IP addresses and you do not update your configuration to use the new Container Registry IP addresses, see [Permit worker nodes to communicate with IBM Cloud Container Registry](https://cloud.ibm.com/docs/containers?topic=containers-firewallfirewall_private_container_registry), you might have a problem with accessing Container Registry over the private network.





 What actions you need to take 

You must ensure that any cluster workers that have not been reloaded, replaced, or rebooted since 5 July 2022 are reloaded or replaced before 15 December 2022. For more information about how to reload workers for classic clusters, see [ibmcloud ks worker reload](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_worker_reload).
: Kubernetes [1.23.3_1519](https://cloud.ibm.com/docs/containers?topic=containers-changelog_1231233_1519), [1.22.6_1539](https://cloud.ibm.com/docs/containers?topic=containers-changelog_1221226_1539), [1.21.9_1549](https://cloud.ibm.com/docs/containers?topic=containers-changelog_1211219_1549), [1.20.15_1570](https://cloud.ibm.com/docs/containers?topic=containers-changelog_12012015_1570), and [1.19.16_1577](https://cloud.ibm.com/docs/containers?topic=containers-changelog_11911916_1577).

IBM Cloud Object Storage doc restructuring.
: For more information, see [Setting up IBM Cloud Object Storage](https://cloud.ibm.com/docs/containers?topic=containers-storage-cos-understand), [Installing the IBM Cloud Object Storage plug-in](https://cloud.ibm.com/docs/containers?topic=containers-storage_cos_install), [Setting up authorized IP addresses for IBM Cloud Object Storage](https://cloud.ibm.com/docs/containers?topic=containers-storage_cos_vpc_ip), [Adding IBM Cloud Object Storage storage to apps](https://cloud.ibm.com/docs/containers?topic=containers-storage_cos_apps), and [Storage class reference](https://cloud.ibm.com/docs/containers?topic=containers-storage_cos_reference).

Block Storage for VPC add-on.
: [Version 4.1.3_846](https://cloud.ibm.com/docs/containers?topic=containers-vpc_bs_changelog) is released.





 10 February 2022 

Certified Kubernetes
* [Setup Slack notifications](https://cloud.ibm.com/docs/Registry?topic=Registry-continuous-deployment-to-kubernetescontinuous-deployment-to-kubernetes-setup_slack)
* [Remove resources](https://cloud.ibm.com/docs/Registry?topic=Registry-continuous-deployment-to-kubernetescontinuous-deployment-to-kubernetes-removeresources)
* [Expand the Tutorial](https://cloud.ibm.com/docs/Registry?topic=Registry-continuous-deployment-to-kubernetescontinuous-deployment-to-kubernetes-expandTutorial)
* [Related Content](https://cloud.ibm.com/docs/Registry?topic=Registry-continuous-deployment-to-kubernetescontinuous-deployment-to-kubernetes-related)







 Setting up the Container Registry CLI and namespace 

[Setting up the Container Registry CLI and namespace](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespaceregistry_setup_cli_namespace)



* [Installing the container-registry CLI plug-in](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespacecli_namespace_registry_cli_install)
* [Updating the container-registry CLI plug-in](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespaceregistry_cli_update)



* [Updating container-registry CLI plug-in version 1.0](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespaceregistry_cli_update_v1)