vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Before you target a VPE for Container Registry, you must complete the following tasks.



* Ensure that a Virtual Private Cloud is created, see [Getting started with Virtual Private Cloud](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started).
* Make a plan for your virtual private endpoints, see [Planning for virtual private endpoint gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-considerations).
* Ensure that correct access controls are set for your VPE, see [Configuring ACLs and security groups for use with endpoint gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-configure-acls-sgs-endpoint-gateways).
* Understand the limitations of having a VPE, see [Virtual private endpoint limitations](https://cloud.ibm.com/docs/vpc?topic=vpc-limitations-vpe).
* Understand how to view details about a VPE, see [Viewing details of an endpoint gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-viewing-details-of-an-endpoint-gateway).







 Virtual private endpoints 

The table lists IBM Cloud Container Registry private endpoints that are supported from the following VPC regions:



* Dallas (us-south)
* Frankfurt (eu-de)
* London (eu-gb)
* Osaka (jp-osa)
* Sao Paulo (br-sao)
* Sydney (au-syd)
* Tokyo (jp-tok)
* Toronto (ca-tor)
* Washington (us-east)



You can create a VPE gateway for your local Container Registry service only. For VPE gateways created after 11 November 2022, you can pull images from any other Container Registry region by using the public hostnames, such as uk.icr.io.
The global registry stores IBM-provided public images, and regional registries store your own private or public images.
6. Verify your connection by [listing your container registry namespaces](https://cloud.ibm.com/apidocs/container-registrylist-namespaces).







 Running kubectl commands from behind an allowlist 

If corporate network policies prevent access from your local system to public endpoints via proxies or allowlists, to run kubectl commands, you must allow TCP access for the cluster.

When a cluster is created, the port in the service endpoint URLs is randomly assigned from within 30000-32767. You can either choose to open port range 30000-32767 for any cluster that might get created or you can choose to allow access for a specific existing cluster.

Before you begin, allow access to [run ibmcloud ks commands](https://cloud.ibm.com/docs/containers?topic=containers-firewallfirewall_bx).

To allow access for a specific cluster:



1. Log in to the IBM Cloud CLI. Enter your IBM Cloud credentials when prompted. If you have a federated account, include the --sso option.

ibmcloud login [--sso]
2. If the cluster is in a resource group other than default, target that resource group. To see the resource group that each cluster belongs to, run ibmcloud ks cluster ls. Note: You must have at least the [Viewer role](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-perms) for the resource group.

ibmcloud target -g <resource_group_name>
3. Get the name of your cluster.

ibmcloud ks cluster ls
4. Retrieve the service endpoint URLs for your cluster.



* If only the Public Service Endpoint URL is populated, get this URL. Your authorized cluster users can access the master through this endpoint on the public network.
* If only the Private Service Endpoint URL is populated, get this URL.
* [ibmcloud cr retention-policy-list](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_retention_policy_list)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_retention_policy_list_prereq)
* [Example](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_retention_policy_list_example)



* [ibmcloud cr retention-policy-set](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_retention_policy_set)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_retention_policy_set_prereq)
* [Command options](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_retention_policy_set_option)
* [Examples](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_retention_policy_set_example)



* [ibmcloud cr retention-run](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_retention_run)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_retention_run_prereq)
* [Command options](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_retention_run_option)
* [Example](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_retention_run_example)
You can set an exemption policy by running the [ibmcloud cr exemption-add](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_exemption_add) command, see [Setting organizational exemption policies](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index&interface=uiva_managing_policy).

For more information, see [IBM Cloud Container Registry Is Ending Exemption Synchronization Across Regions](https://www.ibm.com/cloud/blog/announcements/ibm-cloud-container-registry-is-ending-exemption-synchronization-across-regions).





 1 February 2022 

Storage that is used by untagged images is being charged for
: From 1 February 2022, IBM Cloud Container Registry is charging for the storage that is used by [untagged](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewoverview_elements_untagged) images. To reduce the amount that you're charged, you can [clean up your namespaces by deleting untagged images](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_retentionretention_images_untagged). You can also [free up used storage and change service plans or quota limits to stay within given quota limits](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_quotaregistry_quota_freeup).

For more information, see [Starting 1 February 2022, IBM Cloud Container Registry will be billing for the storage that is used by untagged images](https://www.ibm.com/cloud/blog/announcements/ibm-cloud-container-registry-to-bill-for-storage-used-by-untagged-images).





 17 January 2022 

View IBM Cloud Activity Tracker events for Red Hat signing
: You can view Activity Tracker events for [Red Hat Signing](https://www.redhat.com/en/blog/container-image-signing) operations.
* [Apply the 12-factor principles](https://cloud.ibm.com/docs/Registry?topic=Registry-vm-to-containers-and-kubernetesvm-to-containers-and-kubernetes-16)
* [Store credentials in Kubernetes secrets](https://cloud.ibm.com/docs/Registry?topic=Registry-vm-to-containers-and-kubernetesvm-to-containers-and-kubernetes-17)



* [Containerize your app](https://cloud.ibm.com/docs/Registry?topic=Registry-vm-to-containers-and-kubernetesvm-to-containers-and-kubernetes-build_docker_images)
* [Deploy your app to a Kubernetes cluster](https://cloud.ibm.com/docs/Registry?topic=Registry-vm-to-containers-and-kubernetesvm-to-containers-and-kubernetes-deploy_to_kubernetes)



* [Learn how to create a Kubernetes deployment yaml file](https://cloud.ibm.com/docs/Registry?topic=Registry-vm-to-containers-and-kubernetesvm-to-containers-and-kubernetes-20)



* [Summary](https://cloud.ibm.com/docs/Registry?topic=Registry-vm-to-containers-and-kubernetesvm-to-containers-and-kubernetes-summary)
* [Put everything learned to practice, run the JPetStore app in your cluster](https://cloud.ibm.com/docs/Registry?topic=Registry-vm-to-containers-and-kubernetesvm-to-containers-and-kubernetes-runthejpetstore)
* [Related Content](https://cloud.ibm.com/docs/Registry?topic=Registry-vm-to-containers-and-kubernetesvm-to-containers-and-kubernetes-related)
* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_exemption_rm_prereq)
* [Command options](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_exemption_rm_option)
* [Examples](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_exemption_rm_example)



* [ibmcloud cr exemption-types](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_exemption_types)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_exemption_types_prereq)



* [ibmcloud cr iam-policies-enable](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_iam_policies_enable)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_iam_policies_enable_prereq)



* [ibmcloud cr iam-policies-status](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_iam_policies_status)
* [ibmcloud cr image-digests (ibmcloud cr digests)](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_image_digests)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_image_digests_prereq)
* [Command options](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_image_digests_option)
* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcliic_cr_va_version_prereq)



* [ibmcloud cr va-version-set](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcliic_cr_va_version_set)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcliic_cr_va_version_set_prereq)
* [Command options](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcliic_cr_va_version_set_option)
* [Example](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcliic_cr_va_version_set_example)



* [ibmcloud cr vulnerability-assessment (ibmcloud cr va)](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_va)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_va_prereq)
* [Command options](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_va_option)
* [Examples](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_va_example)





[Formatting and filtering the CLI output](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_cli_listregistry_cli_list)



* [Go template options for ibmcloud cr image-digests](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_cli_listregistry_cli_list_imagedigests)
Granting access to Container Registry resources tutorial 

Use this tutorial to find out how to grant access to your resources by configuring IBM Cloud® Identity and Access Management (IAM) for IBM Cloud® Container Registry.

All accounts require IAM access policies. To set up and manage IAM access policies, see [Defining IAM access policies](https://cloud.ibm.com/docs/Registry?topic=Registry-useruser).

For more information about how to use IAM to manage access to your resources, see [Managing access to resources](https://cloud.ibm.com/docs/account?topic=account-assign-access-resources).



 Before you begin 

Before you begin, you must complete the following tasks:



* Complete the instructions in [Getting started with IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-getting-startedgetting-started).
* Ensure that you have the most recent version of the container-registry CLI plug-in for the IBM Cloud CLI, see [Updating the container-registry CLI plug-in](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespaceregistry_cli_update).
* Ensure that you have access to two [IBM Cloud accounts](https://cloud.ibm.com/login) that you can use for this tutorial, one for User A and one for User B, each must use a unique email address. You work in your own account, User A, and invite another user, User B, to use your account. You can choose to create a second IBM Cloud account, or you can work with a colleague that has an IBM Cloud account.
* Ensure that you have the correct access permissions for adding and removingnamespaces, see [Access roles for configuring IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iamaccess_roles_configure).







 Step 1: Authorize a user to configure the registry
[Enabling Flow Logs for VPC cluster components](https://cloud.ibm.com/docs/containers?topic=containers-vpc-flow-logvpc-flow-log)



* [Configuring a flow log collector](https://cloud.ibm.com/docs/containers?topic=containers-vpc-flow-logvpc-flow-log_create)
* [Viewing worker node flow logs](https://cloud.ibm.com/docs/containers?topic=containers-vpc-flow-logvpc-flow-log_view)







 Setting up an image build pipeline 

[Setting up an image registry](https://cloud.ibm.com/docs/containers?topic=containers-registryregistry)



* [Planning image registries](https://cloud.ibm.com/docs/containers?topic=containers-registryplanning_images)
* [Understanding how to authorize your cluster to pull images from a private registry](https://cloud.ibm.com/docs/containers?topic=containers-registrycluster_registry_auth)



* [Default image pull secret setup](https://cloud.ibm.com/docs/containers?topic=containers-registrycluster_registry_auth_default)
* [Private network connection to icr.io registries](https://cloud.ibm.com/docs/containers?topic=containers-registrycluster_registry_auth_private)



* [Updating existing clusters to use the API key image pull secret](https://cloud.ibm.com/docs/containers?topic=containers-registryimagePullSecret_migrate_api_key)



* [Updating your image pull secret](https://cloud.ibm.com/docs/containers?topic=containers-registryupdate-pull-secret)



* [Using an image pull secret to access images in other IBM Cloud accounts or external private registries from non-default Kubernetes namespaces](https://cloud.ibm.com/docs/containers?topic=containers-registryother)
* [Install the CLI](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespacecli_namespace_registry_cli_install) to work with images in your namespace.
* [Set up your own namespace in IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespaceregistry_namespace_setup).
* [Make sure that you can run Docker commands without root permissions](https://docs.docker.com/engine/install/linux-postinstall/). If your Docker client is set up to require root permissions, you must run ibmcloud login, ibmcloud cr login, docker pull, and docker push commands with sudo.

If you change your permissions to run Docker commands without root privileges, you must run the ibmcloud login command again.





1. Download the image, see [Pull an image](https://cloud.ibm.com/docs/Registry?topic=Registry-getting-startedgs_registry_images_pulling) in the Getting Started documentation.

If you get an unauthorized: authentication required or a denied: requested access to the resource is denied message, run the [ibmcloud cr login](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_login) command.



After you pull an image and [tag](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewoverview_elements_tag) it for your [namespace](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewoverview_elements_namespace), you can upload (push) the image from your local computer to your namespace.

If you deploy a workload that pulls an image from Container Registry and your pods fail with an ImagePullBackOff status, see [Why do images fail to pull from registry with ImagePullBackOff or authorization errors?]
(https://cloud.ibm.com/docs/containers?topic=containers-plan_deployapp_plan_logmet_monitor)





[Building containers from images](https://cloud.ibm.com/docs/containers?topic=containers-imagesimages)



* [Deploying containers from an IBM Cloud Container Registry image to the default Kubernetes namespace](https://cloud.ibm.com/docs/containers?topic=containers-imagesnamespace)
* [Referring to the image pull secret in your pod deployment](https://cloud.ibm.com/docs/containers?topic=containers-imagespod_imagePullSecret)
* [Pushing images to IBM Cloud Container Registry](https://cloud.ibm.com/docs/containers?topic=containers-imagespush-images)
* [Managing security of images in IBM Cloud Container Registry with Vulnerability Advisor](https://cloud.ibm.com/docs/containers?topic=containers-imagesva-images)
* [Setting up trusted content for container images](https://cloud.ibm.com/docs/containers?topic=containers-imagestrusted_images)
* [Enabling image security enforcement in your cluster](https://cloud.ibm.com/docs/containers?topic=containers-imagesportieris-image-sec)



* [Enabling or disabling image security enforcement](https://cloud.ibm.com/docs/containers?topic=containers-imagesportieris-enable)
* [Default image policies](https://cloud.ibm.com/docs/containers?topic=containers-imagesportieris-default-policies)





[Developing Kubernetes-native apps](https://cloud.ibm.com/docs/containers?topic=containers-appapp)



* [Specifying your app requirements in your YAML file](https://cloud.ibm.com/docs/containers?topic=containers-appapp_yaml)



* [Basic deployment metadata](https://cloud.ibm.com/docs/containers?topic=containers-appmetadata)
* [10 May 2021](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-10may2021)



* [New region in Canada](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes10may2021_canada)



* [4 May 2021](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-04may2021)



* [The ibmcloud cr ppa-archive-load command is discontinued](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes04may2021_ppa)



* [18 February 2021](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-18feb2021)



* [Increase the performance of the ibmcloud cr image-list and ibmcloud cr image-digests commands by using the --no-va option](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes18feb2021_no-va)



* [15 February 2021](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-15feb2021)



* [New region in Japan](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes15feb2021_japan)



* [19 November 2020](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-19nov2020)



* [You can use Portieris to enforce container image security](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes19nov2020_portieris)



* [21 October 2020](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-21oct2020)
For more information, see [Set up a namespace](https://cloud.ibm.com/docs/Registry?topic=Registry-getting-startedgs_registry_namespace_add) and [ibmcloud cr namespace-add](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_namespace_add).
* Namespaces created in version 0.1.484 of the Container Registry CLI or earlier, or in the IBM Cloud console before 29 July 2020 aren't assigned to resource groups. You can assign an existing namespace to a resource group so that you can configure access to resources within a namespace at the resource group level. For more information, see [Assigning existing namespaces to resource groups](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespaceregistry_namespace_assign) and [ibmcloud cr namespace-assign](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcliic_cr_namespace_assign).
* You can find out which namespaces are assigned to resource groups and which are unassigned by running the [ibmcloud cr namespace-list](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_namespace_list) command with the -v option.







 13 July 2020 

To work with namespaces, you must have the Manager role at the account level
: If you want to add or remove namespaces, you must have the Manager role, see [Access roles for configuring Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iamaccess_roles_configure).





 24 June 2020 

Restoring all tags for a digest in a repository is now an option
: When you want to restore an image, you can restore either by tag or by digest. Restoring by digest restores the digest and all its tags in the repository that aren't already in the live repository.
For information about the locations where the automatic collection of Container Registry service events is enabled, see [Auditing events for IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-at_eventsat_events_locations).

IBM Cloud Kubernetes Service
: For IBM Cloud Kubernetes Service, see [Viewing your cluster events](https://cloud.ibm.com/docs/containers?topic=containers-at_eventsat-ui).

IBM Cloud Satellite
: For IBM Cloud Satellite, see [Viewing events for Satellite](https://cloud.ibm.com/docs/satellite?topic=satellite-at_eventsat_ui).

Red Hat OpenShift on IBM Cloud
: For Red Hat OpenShift on IBM Cloud, see [Viewing your cluster events](https://cloud.ibm.com/docs/openshift?topic=openshift-at_eventsat-ui).





 Observability services 

America

Asia Pacific

Europe



Table 5. Observability services in America's locations

 Service Dallas (us-south) Washington (us-east) Toronto (ca-tor) Sao Paulo (br-sao) 

 IBM Cloud Activity Tracker hosted event search offering ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/checkmark-icon.svg) !
(https://cloud.ibm.com/docs/containers?topic=containers-userswhen-do-i-use-custom-rbac)



* [Creating custom RBAC permissions for users, groups, or service accounts](https://cloud.ibm.com/docs/containers?topic=containers-usersrbac)
* [Extending existing permissions by aggregating cluster roles](https://cloud.ibm.com/docs/containers?topic=containers-usersrbac_aggregate)



* [What are some common operations that I might want to extend permissions for a default cluster role?](https://cloud.ibm.com/docs/containers?topic=containers-userscommon-rbac-operations)



* [Checking user permissions](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-perms)



* [Checking IAM platform and service access roles](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-iam)
* [Checking RBAC roles](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-rbac)
* [Checking infrastructure roles](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-infra)



* [Removing user permissions](https://cloud.ibm.com/docs/containers?topic=containers-usersremoving)



* [Checking if the user's credentials are used for infrastructure permissions](https://cloud.ibm.com/docs/containers?topic=containers-usersremoving_check_infra)
* [Removing a user from your account](https://cloud.ibm.com/docs/containers?topic=containers-usersremove_user)
* [Removing specific permissions](https://cloud.ibm.com/docs/containers?topic=containers-usersremove_permissions)