vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* AttacherKubeAPIQPS: "5.0": The number of requests per second sent by a Kubernetes client to the Kubernetes API server.



* Disables the handle-volume-inuse-error option as this is applies to CSI drivers that support offline expansion only.







 Change log for version 5.0.4-beta_1566, released 14 July 2022 



* Updates the storage-secret-sidecar image to v1.1.12.
* Updates Golang to version 1.18.3.
* Updates UBI image to version 8.6-854.
* Pushes community images to icr.io.
* Fixes a bug for user_tags and service_tags data types.
* Changes the volumesnapshotclass name.
* Fixes for format errors and mount failures.
* Resolves the following CVEs:



* [CVE-2022-29824](https://nvd.nist.gov/vuln/detail/CVE-2022-29824)
* [CVE-2021-40528](https://nvd.nist.gov/vuln/detail/CVE-2021-40528)
* [CVE-2022-22576](https://nvd.nist.gov/vuln/detail/CVE-2022-22576)
* [CVE-2022-27774](https://nvd.nist.gov/vuln/detail/CVE-2022-27774)
* [CVE-2022-27776](https://nvd.nist.gov/vuln/detail/CVE-2022-27776)
* [CVE-2022-27782](https://nvd.nist.gov/vuln/detail/CVE-2022-27782)
* [CVE-2022-25313](https://nvd.nist.gov/vuln/detail/CVE-2022-25313)
To find out whether you have any [untagged](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewoverview_elements_untagged) images, list your images by running the [ibmcloud cr image-digests](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_image_digests) command. Untagged images have a hyphen (-) in the Tags column.
* Do I need untagged images?

 Do I need untagged images? 

If you have active containers that are running [untagged](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewoverview_elements_untagged) images, you must retain the untagged images. If you delete untagged images that are in use, you can cause problems with scaling or automated restarts. Deleting untagged images might cause a problem in the following circumstances:



* The image was deployed by referencing the image by using the digest.
* The image reference was mutated by a webhook service, such as [Portieris](https://cloud.ibm.com/docs/Registry?topic=Registry-security_enforce_portieris).



* What are eligible images?

 What are eligible images? 

If you are cleaning up images by using retention policies, only eligible images are cleaned up. Images that are always retained are distroless images that do not set a created time, such as Google distroless images and manifest lists. Images that are always retained are not eligible images.

The images that are not eligible are still displayed, but they do not count toward the total number of images that is set in the retention policy and are not removed.
* What regions are available?

 What regions are available? 

To find out about the regions that are available for IBM Cloud Container Registry, see [Regions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_regions).
* How much does Vulnerability Advisor cost?

 How much does Vulnerability Advisor cost?
(https://cloud.ibm.com/docs/Registry?topic=Registry-registry_faqfaq_va_new_scan_error)
* [How often are the security notices updated?](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_faqfaq_va_update_security_notice)
* [Why can I see a vulnerability in Vulnerability Advisor v4 but not in v3?](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_faqfaq_va_v3_v4)
* [Which version of a package is installed in my image?](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_faqfaq_va_package_version)



* [Alpine package manager commands](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_faqfaq_va_package_version_alpine)
* [Debian and Ubuntu package manager commands](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_faqfaq_va_package_version_debian_ubuntu)
* [Red Hat and CentOS package manager commands](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_faqfaq_va_package_version_redhat_centos)



* [Does Vulnerability Advisor have versions?](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_faqfaq_va_versions)









 Getting help and support for Container Registry 

[Getting help and support for Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-help-and-supporthelp-and-support)
* [About Vulnerability Advisor](https://cloud.ibm.com/docs/Registry?topic=Registry-va_indexabout)



* [Data protection](https://cloud.ibm.com/docs/Registry?topic=Registry-va_indexabout_data_protection)



* [Types of vulnerabilities](https://cloud.ibm.com/docs/Registry?topic=Registry-va_indextypes)



* [Vulnerable packages](https://cloud.ibm.com/docs/Registry?topic=Registry-va_indexpackages)
* [Configuration issues - version 3 only](https://cloud.ibm.com/docs/Registry?topic=Registry-va_indexapp_configurations)



* [Setting the Vulnerability Advisor version](https://cloud.ibm.com/docs/Registry?topic=Registry-va_indexva_set_version)
* [Reviewing a vulnerability report](https://cloud.ibm.com/docs/Registry?topic=Registry-va_indexva_reviewing)



* [Reviewing a vulnerability report by using the console - version 3 only](https://cloud.ibm.com/docs/Registry?topic=Registry-va_indexva_reviewing_gui)
* [Reviewing a vulnerability report by using the CLI](https://cloud.ibm.com/docs/Registry?topic=Registry-va_indexva_registry_cli)



* [Setting organizational exemption policies](https://cloud.ibm.com/docs/Registry?topic=Registry-va_indexva_managing_policy)



* [Setting exemption policies by using the console](https://cloud.ibm.com/docs/Registry?topic=Registry-va_indexva_managing_policy_gui)
* [Setting exemption policies by using the CLI](https://cloud.ibm.com/docs/Registry?topic=Registry-va_indexva_managing_policy_cli)









 Setting up Terraform for Container Registry
echo Nrfen98EpMxF2B+wdgLfagzrqvgUZfMK4vL2T0NsT20ihrsNC9pUUHtizF6218pze8RLCgQ6kwxuE58IWLzgDA== | base64 -d - > aes512.dek
5. Use the following command to verify the keyfiles that you created in the previous step:

vhd-util key -C -k <keyfile_name>

Example command with output:

vhd-util key -C -k aes512.dek
vhd_util_read_key: using keyfile aes512.dek, Size (bytes) 64
21681bba94f04b33b112f5f90a0faa885a6d1dbf1bd68ed16c5b995143088eda

The first line of the output from the previous example command indicates that the keyfile named aes512.dek contains a 64-byte key. While the numbers that are listed on the second line are the SHA256 hashes or security hashes for the respective encryption keys. Output for files that contain an AES 256-bit encryption key indicates a 32 byte key.
6. Use the following command to create encrypted copies of your VHD files. target_vhd represents the name of the file that contains the encrypted version of source_vhd.

vhd-util copy -n <source_vhd> -N <target_vhd> -k <keyfile_name>

Example command:

vhd-util copy -n debian8-ne.vhd -N debian8-aes512.vhd -k aes512.dek
7. Verify that the VHD files are encrypted by using the following command.

vhd-util key -p -n <vhd_filename>

Example command with output:

vhd-util key -p -n debian8-aes512.vhd
* Resolves [CVE-2022-28327](https://nvd.nist.gov/vuln/detail/CVE-2022-28327), [CVE-2022-24675](https://nvd.nist.gov/vuln/detail/CVE-2022-24675), and [CVE-2022-27536](https://nvd.nist.gov/vuln/detail/CVE-2022-27536).
* Ignores label ibm-cloud.kubernetes.io/vpc-instance-id for zone balancing in satellite environments.
* Adds experimental option balancingIgnoreLabelsFlag. This option defines a node label that should be ignored when considering node group similarity. One label can be defined per option occurrence.







 Change log for patch update 1.1.0_475, released 30 March 2022 



* Image tags: 1.19.1-12, 1.20.0-12, 1.21.0-8, 1.22.0-6, 1.23.0-3
* Resolves [CVE-2022-24921](https://nvd.nist.gov/vuln/detail/CVE-2022-24921).
* Adds permissions for cluster-autoscaler to watch namespaces.







 Change log for patch update 1.1.0_429, released 16 March 2022 



* Image tags: 1.19.1-11, 1.20.0-11, 1.21.0-7, 1.22.0-5, 1.23.0-2
* Adds Beta support for Satellite clusters in allowlisted accounts.









 Version 1.0.9 



 Change log for patch update 1.0.9_44, released 22 June 2023 



* Adds support for cluster version 1.27.
* Adds the scaleDownUnreadyEnabled, maxNodesPerScaleup, maxNodegroupBinpackingDuration, kubeClientBurst, and kubeClientQPS parameters.
* Updates the storage-secret-sidecar image to v1.2.24.
Before you call the Code Risk Analyzer CLI, set the IBMCLOUD_TRACE environment variable to true to turn on the debug log.

export IBMCLOUD_TRACE=true

Observe the API calls and the responses that are shown in the log to determine the exact reason for failure.





 How can I debug a BOM command that fails to pull a base image from a private registry. 

Make sure that you are authenticated with the registry where the base image resides by using the ibmcloud cr login command or the docker login command.





 How can I debug a BOM command that is failing to analyze a Dockerfile? 



* Verify that the Dockerfile does not have any issues by running the docker build command and making sure that it passes.
* If your Dockerfile requires ARG to be passed, make sure that the ARG is set as an environment variable. You can also use the DOCKERBUILDFLAG environment variable.
* Authenticate with the registry that contains the base images.
* Resolves [CVE-2022-28327](https://nvd.nist.gov/vuln/detail/CVE-2022-28327), [CVE-2022-24675](https://nvd.nist.gov/vuln/detail/CVE-2022-24675), and [CVE-2022-27536](https://nvd.nist.gov/vuln/detail/CVE-2022-27536).
* Ignores label ibm-cloud.kubernetes.io/vpc-instance-id for zone balancing in satellite environments.
* Adds experimental option balancingIgnoreLabelsFlag. This option defines a node label that should be ignored when considering node group similarity. One label can be defined per option occurrence.







 Change log for patch update 1.0.5_415, released 28 February 2022 

Image tags: 1.19.1 9, 1.20.0 9, 1.21.0 5, 1.22.0 3 Adds support for Kubernetes 1.23







 Version 1.0.4 

Review the changes included in version 1.0.4 of the managed cluster autoscaler add-on.



 Change log for patch update 1.0.4_410, released 23 February 2022 

Image tags: 1.19.1 9, 1.20.0 9, 1.21.0 5, 1.22.0 3 Resolves the following CVEs: [CVE-2022-23772](https://nvd.nist.gov/vuln/detail/CVE-2022-23772), [CVE-2022-23773](https://nvd.nist.gov/vuln/detail/CVE-2022-23773), and [CVE-2022-23806](https://nvd.nist.gov/vuln/detail/CVE-2022-23806).





 Change log for patch update 1.0.4_403, released 20 January 2022 

Review the changes in version 1.0.4_403 of the cluster autoscaler add-on.
By default, App ID does not expect the response to be encrypted. To configure encryption, set the encryptResponse parameter to true by using [the API](https://us-south.appid.cloud.ibm.com/swagger-ui//Management%20API%20-%20Identity%20Providers/mgmt.set_saml_idp).

If you receive error message 2, ensure that your certificate is correct. You can obtain the signing certificate from the App ID metadata XML file. Be sure that you use the key with <KeyDescriptor use="signing">. Verify that your identity provider is configured to use \ as the signature signing algorithm.





 Unsupported authentication request 

 What’s happening 

You receive a message about an unsupported authentication request.

 Why it’s happening 

When App ID generates an authentication request, it can use the authentication context to request the quality of the authentication and SAML assertions.

 How to fix it 

To resolve the issue, you can update your authentication context. By default, App ID uses the authentication class urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport and comparison exact. You can update the context parameter to fit your use case by using the APIs.





 SAML request signing failure 

 What’s happening 

You receive an error that states that an authentication request cannot be verified.

 Why it’s happening 

App ID can be configured to sign the SAML authentication request (AuthNRequest), but your identity provider must be configured to expect the corresponding configuration.

 How to fix it 

To resolve the issue:



* Verify that IBM Cloud is configured to sign the authentication request by setting the signRequest parameter to true by using the [set SAML IdP API](https://us-south.appid.cloud.ibm.com/swagger-ui//Management%20API%20-%20Identity%20Providers/mgmt.set_saml_idp). You can check to see whether your authentication request is signed by looking at the request URL.
Exceptions are either configured in CR VA, or you can submit the Incident or CVE for an exemption approval. If approved, you can edit the Incident issue (setting Excempt: true), and link to the approved request.

Currently supported scan result files:



* Container Registry VA scan (option --type va)
* CRA Vulnerability scan (option --type cra)
* Xray (option --type xray)
* OWASP ZAP (option --type owasp-zap)
* OWASP ZAP UI (option --type owasp-zap-ui)
* Twistlock (option --type twistlock)



For more information on Container Registry VA and result format, see [Vulnerability Advisor for IBM Cloud Container Registry](https://cloud.ibm.com/apidocs/container-registry/va). For more information on the CRA Vulnerability scanner, see the [Configuring Code Risk Analyzer](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-cd-configure-cra-repos)documentation.

Usage:

$ cocoa incident process <options> <path to result file>

Options:

--type (Required) Scan type [cra | va]
--subject (Required) Subject of scans (repo, or image name)
--drilldown-url (Required) URL to the point where the incident was found (can be a pipelien run, a commit hash or an image URL with digest)
--set-grace-period Should the created incidents have Grace period set
--git-provider Git service provider [github] Default is "github"
--org The incident issue repository org
--repo The incident issue repository name
--label Label(s) to add to the incident issue (optional) e.g: --label=foo --label=bar
--assignee (Optional) Assignee(s) for the incident issue (github username) e.g: --assigne=jane-doe --assignee=john-smith
For more information about setting up the custom script, see [Example custom scripts for DevSecOps](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-cd-configure-cra-reposdevsecops-custom-script-examples).

FAILED
Error executing docker build cmd for stage-0: exit status 1
...
COPY file-to-copy.js file-to-copy.js:
------
failed to compute cache key: "/file-to-copy.js" not found: not found

By default, the Code Risk Analyzer bom-generate command builds the Dockerfiles from the context of the location of the Dockerfile itself. If you want to build the Dockerfiles from the context of the root project directory, use the cra-docker-build-context parameter to allow the Code Risk Analyzer to build the Dockerfiles from this context.







 Removing stored Code Risk Analyzer data 

The Code Risk Analyzer plug-in does not store any client data in its databases. However, earlier versions of Code Risk Analyzer Tekton tasks securely stored the results of vulnerability scans in its database.

To request the removal of any client data that might be stored in the Code Risk Analyzer, contact [IBM Support](https://cloud.ibm.com/unifiedsupport/supportcenter).





 FAQs 

Get answers to frequently asked questions about using the Code Risk Analyzer CLI.



 How can I determine why the CLI failed? 

Before you call the Code Risk Analyzer CLI, set the IBMCLOUD_TRACE environment variable to true to turn on the debug log.

export IBMCLOUD_TRACE=true

Observe the API calls and the responses that are shown in the log to determine the exact reason for failure.





 How can I debug a BOM command that fails to pull a base image from a private registry. 

Make sure that you are authenticated with the registry where the base image resides by using the ibmcloud cr login command or the docker login command.
--name, -n
: The name of the image registry access secret. This value is required.

--decode, -d
: Show the Data output as decoded in the details. If this option is not specified, the Data details are base64-encoded. This value is optional. The default value is false.

--output, -o
: Specifies the format of the command output. Valid values are json, yaml, jsonpath=JSONPATH_EXPRESSION, and jsonpath-as-json=JSONPATH_EXPRESSION. Use jsonpath to specify the path to an element of the JSON output. This value is optional.

--quiet, -q
: Specify this option to reduce the output of the command. This value is optional. The default value is false.





 Example 

ibmcloud ce registry get --name myregistry





 Example output 

Getting image registry access secret myregistry...
OK

Name: myregistry
Project: myproject
Project ID: 01234567-abcd-abcd-abcd-abcdabcd1111
Created: 2021-02-23T09:10:01-05:00
Data:
---
.dockerconfigjson: abcdabcdabcdabcdabcdnVzZXJuYW1lIjoiaWFtYXBpa2V5IiwicGFzc3dvcmQiOiJoQllTSTc5Uk8yQUIxSDV3RUs2UzhScV9uNzE4NkQ1eWt1M1FOUk85aFpfaCIsImVtYWlsIjoiYUBiLmMiLCabcdabcdabcdabcdabcdT21oQ1dWTkpOemxTVHpKQlFqRklOWGRGU3paVE9GSnhYMjQzTVRnMlJEVjabcdabcdabcdabcdabcdbG9XbDlvIn19fQ==







 ibmcloud ce registry list 

List all image registry access secrets in a project.

ibmcloud ce registry list [--output OUTPUT] [--quiet] [--sort-by SORT_BY]



 Command Options 

--output, -o
: Specifies the format of the command output. Valid values are json, yaml, jsonpath=JSONPATH_EXPRESSION, and jsonpath-as-json=JSONPATH_EXPRESSION. Use jsonpath to specify the path to an element of the JSON output. This value is optional.

--quiet, -q
: Specify this option to reduce the output of the command. This value is optional. The default value is false.

--sort-by, -s
The volume's active and busy property value must be false, and the volume attached instance must be in stopped status.
* --encryption-key-volume: A reference to the root key to that is used to wrap the system-generated data encryption key for the image. If this property is not provided, the root key from source volume is used.
* --resource-group-id: ID of the resource group. This ID is mutually exclusive with --resource-group-name.
* --resource-group-name: Name of the resource group. This name is mutually exclusive with --resource-group-id.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is image-update 

Update an image.

ibmcloud is image-update IMAGE --name NEW_NAME [--output JSON] [-q, --quiet]



 Command example 



* ibmcloud is image-update 72251a2e-d6c5-42b4-97b0-b5f8e8d1f479 --name my-image







 Command options 



* IMAGE: ID or name of the image.
* --name: New name of the image.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is image-delete 

Delete one or more images.

ibmcloud is image-delete (IMAGE1 IMAGE2 ...) [--output JSON] [-f, --force] [-q, --quiet]



 Command options 



* IMAGE1: ID or name of the image.
* IMAGE2: ID or name of the image.
* --output: Specify output format, only JSON is supported. One of: JSON.
responseData.status String The following values for the overall vulnerability assessment status are available:<br><br>OK<br><br>WARN<br><br>FAIL<br><br>UNSUPPORTED<br><br>INCOMPLETE<br><br>UNSCANNED<br><br>For more information about these status codes, see [Vulnerability report status codes](https://cloud.ibm.com/apidocs/container-registry/vavulnerability-report-status-codes) in the API documentation. 



For more information, see [Get vulnerability assessment status](https://cloud.ibm.com/apidocs/container-registry/vaimagereportquerypath) in the API documentation.





 Request and response data for the vulnerability status 

Get the overall vulnerability status (container-registry.image-vulnerability-status.read) for a registry image.

The following table lists the fields that are available through the requestData and responseData fields in events with the action container-registry.image-vulnerability-status.read.



Table 21. Custom event fields for Container Registry image vulnerability status read

 Custom Event Fields Type Description 

 requestData.RequestParameters.name String The name of the image. For example, us.icr.io/namespace/repository:tag.<br><br>The following constraint applies: The value must match the regular expression .. 
 responseData.status String The following values for the overall vulnerability assessment status are available:<br><br>OK<br><br>WARN<br><br>FAIL<br><br>UNSUPPORTED<br><br>INCOMPLETE<br><br>UNSCANNED<br><br>For more information about these status codes, see [Vulnerability report status codes](https://cloud.ibm.com/apidocs/container-registry/vavulnerability-report-status-codes) in the API documentation. 



For more information, see [Get vulnerability status](https://cloud.ibm.com/apidocs/container-registry/vaimagestatusquerypath) in the API documentation.







 Request data for image signing events
* [CVE-2021-41772](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41772)







 Version 0.49.3_1745_iks, released on 20 October 2021 

As of 14 Sept 2021, this is the only image supported for Kubernetes version 1.18 clusters.







 Version 0.48.0 

For the community changes for this version of the Kubernetes Ingress image, see the [community Kubernetes change log for ingress-nginx](https://github.com/kubernetes/ingress-nginx/blob/main/Changelog.md0480). Refer to the following table for a summary of changes for each build of version 0.48.0 of the Kubernetes Ingress image that IBM Cloud Kubernetes Service releases.



 Version 0.48.1_1698_iks, released on 22 September 2021 

This image is no longer available.



* [CVE-2021-22945](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22945)
* [CVE-2021-22946](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22946)
* [CVE-2021-22947](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22947)







 Version 0.48.1_1613_iks, released on 09 September 2021 



* [CVE-2021-3711](https://nvd.nist.gov/vuln/detail/CVE-2021-3711)
* [CVE-2021-3712](https://nvd.nist.gov/vuln/detail/CVE-2021-3712)







 Version 0.48.1_1579_iks, released on 01 September 2021
* Logs user actions, container activity, and command arguments.
* Enforces security policies and blocks attacks.







 Provides posture management for a distributed environment 



* Schedules customized benchmark tests to run across cloud, hosts, services, or clusters.
* Controls compliance at cloud, orchestrator, and container level.
* Tracks and optimizes cloud users permissions and entitlements.
* Exports results to SIEM, logging clusters, or other tools.







 Provides runtime detection and data enrichment 



* Identifies and blocks threats in real-time, based on application, container, and network activity.
* Instruments Kernel to track all app, container, host, and network system calls.
* Views security policy violations based on orchestrated services.
* Manages multi-cloud events by using single and multiple accounts.







 Supports incident response and forensics 



* Protects distributed, dynamic, and ephemeral services with a single-service policy with no manual configuration.
* Creates detailed system captures for any policy violation or incident, so you can respond to malicious activity.
* Drills-down from policy violations into captures of pre- and post-attack activity.
* Views SCAP files to see all system activity before, during, and after any security event.
* Creates detailed system captures for any policy violation or incident so you can respond to on malicious activity.
* Integrates alerting and incident response.