vania-janet/multiturn-rag-retrieval-data huggingface dataset:
If so, you can use the [image mutation option](https://github.com/IBM/portieris/blob/main/README.mdimage-mutation-option) and [policy](https://github.com/IBM/portieris/blob/main/POLICIES.mdimage-mutation-option) to change the default behavior.



 Enabling or disabling image security enforcement 

You can enable or disable image security enforcement for your cluster from the CLI or console. For earlier versions, see the [Portieris documentation](https://github.com/IBM/portieris).



 Enabling or disabling image security enforcement with the CLI 

See the following commands.



* [ibmcloud ks cluster image-security enable](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics-image-security-enable)
* [ibmcloud ks cluster image-security disable](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics-image-security-disable)







 Enabling or disabling image security enforcement from the console 



1. From the [Kubernetes clusters console](https://cloud.ibm.com/kubernetes/clusters), select your cluster.
2. From the Overview tab, in the Summary pane, find the Image security enforcement field and click Enable or Disable.









 Default image policies 

When you enable image security enforcement, IBM Cloud Kubernetes Service automatically creates certain image policies in your cluster. When you disable the feature, the underlying ClusterImagePolicy CRD is removed, which removes all the default image policies and any custom images policies that you created.



* Image policies with the name ibm-signed-image-enforcement restrict the images that are run in the namespace to IBM Cloud Kubernetes Service images only. Do not modify these image policies. Any changes that you make are overwritten within a few minutes.
Using granular RBAC permissions for custom images 

The VPC image service allows the [creation of custom images](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-images). These images are only visible and usable within a single account. Custom images are assigned to a [Resource group](https://cloud.ibm.com/docs/account?topic=account-rgs) when they are created. Users can have multiple resource groups to host custom images with different access control privileges or assign permissions directly to an image, restricting their access to specific users. These access privileges are referred to as role-based access control, or RBAC.

The custom resource group that hosts the images can contain a set of images. The resource group can control either a single image or multiple images. It's common for a family of images to be hosted within a resource group. This hosting can make management of the control of the images easier because the access rules are attached to the resource group.

The process that is described here is for the console. However, this function can also be carried out with the [API](https://cloud.ibm.com/apidocs/iam-identity-token-api) and from the [CLI](https://cloud.ibm.com/docs/account?topic=account-rgsrgs_cli).



 Creating a custom resource group for image access controls 

You can use an existing Resource group or create a new one.

To create a new Resource group, follow these steps:



1. Go to Manage> Account> Account Resources> Resource groups.
2. Enter a name for your resource group and click Create.







 Adding role based access control to the Resource group 

[Create an access group](https://cloud.ibm.com/docs/account?topic=account-access-getstartedcreate-access-group) within the resource group that gives privileges to create images in your resource group.



1. Go to Manage > Access (IAM)> Access Groups and click Create.
2. Enter the name and description for your access group and click Create.





 Assigning permissions
Creating and updating images 



1. Reserve a target VM.



* You can reserve your target VM from “Reservations”. Basic Reservation and Imaging Reservation (privilege required) are both fine. The different is Imaging Reservation is using Administrator account, and Basic Reservation is using your account in VM) or “Manage Images”.





![reservation](https://cloud.ibm.com/docs-content/v1/content/b6c5dbb443b797203b2824b05472cac5ae8635da/cloud-for-education/images/reservation.png)



2. If the image has several versions, you need to select the version you would like to choose, otherwise, system will choose the version in production.



![version](https://cloud.ibm.com/docs-content/v1/content/b6c5dbb443b797203b2824b05472cac5ae8635da/cloud-for-education/images/chooseversion.png)



3. After login the VM and performing operations (you need to login the VM to see the button refreshed on website), you can click End Reservation & Create Image (privilege required).



![create](https://cloud.ibm.com/docs-content/v1/content/b6c5dbb443b797203b2824b05472cac5ae8635da/cloud-for-education/images/createUpdate1.png)



4. You can choose Creating new image or Update Existing Image (Need to be the owner of this image.).



* If you create new image, the new image will be independent from the old one. You can configure image for different name, description, memory size, and etc. You can also assign the new image to different user group to use.
* If you update the image, the image will be considered as different version of current image.
On the Objects page of your IBM Cloud Object Storage bucket, click Upload. You can use the Aspera high-speed transfer plug-in to upload images larger than 200 MB.







 Setting up your key management service and keys 

To import an encrypted custom image to IBM Cloud VPC, you need a key management service provisioned. You also need a customer root key (CRK) and a wrapped data encryption key (WDEK). The WDEK is the passphrase that you used to encrypt your image wrapped with your CRK so that your passphrase remains known only to you. The WDEK is used to access the encrypted image when a virtual server instance that uses the encrypted image is started.

The following list is a summary of the key management prerequisites:



* Provision a supported key management service, either [Key Protect](https://cloud.ibm.com/docs/key-protect/concepts?topic=key-protect-getting-started-tutorial) or [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-get-started).
* Import a customer root key (CRK) to the key management service or create one in the key management service.
* Wrap (protect) the passphrase that you used to encrypt your image with your customer root key to create a wrapped data encryption key (WDEK).



The following example steps are specific to Key Protect, but the general flow also applies to Hyper Protect Crypto Services. If you're using Hyper Protect Crypto Services, see the [Hyper Protect Crypto Services information](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-get-started) for corresponding instructions.



1. Provision the [Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-provision) service.

Provisioning a new Key Protect service instance ensures that it includes the most recent updates that are required for customer-managed encryption.
2.
As a result, you will no longer be able to create an IKE/IPsec policy or VPN connection that includes a weak cipher, but you can still [upgrade weak cipher suites](https://cloud.ibm.com/docs/vpc?topic=vpc-upgrading-weak-ciphers&interface=ui) on an existing policy or connection. For more information, see [Upgrading weak cipher suites on a VPN gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-upgrading-weak-ciphers&interface=api).







 2 May 2023 



 For all version dates 

Exporting custom images. You can now [export custom images](https://cloud.ibm.com/apidocs/vpc-betacreate-image-export-job) to an authorized IBM Cloud Object Storage bucket. Specify the target storage_bucket to export the image to. The image will be exported as qcow2 unless you specify another value using the format property. For more information, see [Exporting a custom image to IBM Cloud Object Storage](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-custom-images&interface=apicustom-image-export-to-cos-api), or start using the new [export jobs](https://cloud.ibm.com/apidocs/vpc-betalist-image-export-jobs) methods.







 18 April 2023 



 For all version dates 

Resource suspension for bare metal servers. The [list all bare metal servers](https://cloud.ibm.com/apidocs/vpc/latestlist-bare-metal-servers) and [retrieve a bare metal server](https://cloud.ibm.com/apidocs/vpc/latestget-bare-metal-server) methods now provide lifecycle_reasons and lifecycle_state properties. A bare metal server that violates IBM Cloud’s [Acceptable Use Policy](https://www.ibm.com/services/us/imc/html/aup1.html) will now have its lifecycle_state property set to suspended.
You must provide the "Fingerprint" and the "Path to the public key" that you used when you signed the image by using Red Hat signing when you run the hpvs registration-create command, and are prompted for the "Fingerprint", and the "Path to the file containing the image public key".

Complete the following steps to sign the images:



1. Create a batch file and add the following content to it:

Key-Type: RSA
Key-Length: 4096
Subkey-Type: RSA
Subkey-Length: 4096
Name-Real: latestnewkey
Name-Email: latestnewkey@example.com
Expire-Date: 472
2. Create the keys.

gpg --pinentry-mode loopback --passphrase="" --generate-key --batch <batchfile>
3. Export the public key.

gpg --armor --export <name> > <filename>.pub
4. Sign the image using skopeo and push the image to ICR.

copy docker-daemon:us.icr.io/<namespace>/nginx1:latest docker://us.icr.io/<namespace>/nginx1:latest --sign-by E8C9E90........D9F3 --dest-creds=iamapikey:

Getting image source signatures
Copying blob 226117031573 done
.........
Writing manifest to image destination
Signing manifest using simple signing
Storing signatures



The "docker-daemon" parameter is used when the image is present locally. The "docker" parameter is used when the image is present in a registry. In the skopeo copy example shown above, the image that is present locally is tagged with "xx.icr.io/yournamespace/hello-world:base_signed". It is signed and pushed to the destination "docker://xx.icr.io/yournamespace/hello-world:base_signed".
Signing images for trusted content 

IBM Cloud® Container Registry provides trusted content technology so that you can sign images to ensure the integrity of images in your registry namespace.

By pulling and pushing signed images, you can verify that your images were pushed by the correct party, such as your continuous integration (CI) tools.

You can use Red Hat® signatures to sign your images.



 Signing images by using Red Hat signatures 

You can use various tools to create [Red Hat signatures](https://www.redhat.com/en/blog/container-image-signing) for your images. You can store your signed images for trusted content by using the Red Hat signatures extension API, which is supported by IBM Cloud Container Registry.

You can use the following tools to create Red Hat signatures:



* [Skopeo](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_trustedcontentregistry_trustedcontent_red_hat_sig_skopeo)
* [Podman](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_trustedcontentregistry_trustedcontent_red_hat_sig_podman)
* [Red Hat OpenShift CLI](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_trustedcontentregistry_trustedcontent_red_hat_sig_oc)





 Using Skopeo to sign images 

To use [Skopeo](https://github.com/containers/skopeo) to sign your images, you must create a private [GNU Privacy Guard (GnuPG or GPG)](https://gnupg.org/) identity and then run the skopeo command.

The following example doesn't include Skopeo authentication.



1. To create a GnuPG identity, run the following command.

gpg --generate-key
2. Push and sign the image at the same time by using the GnuPG identity to sign the image.
Compress and encrypt the folder, as the compose subsection requires this for the archive value. Use the following command to obtain the base64 encoded archive as a file named compose.b64. Use the raw content of compose.b64 for the value of archive under the compose subsection.

tar czvf - -C <COMPOSE_FOLDER> . | base64 -w0 > compose.b64
5. Run the encrypt-basic.sh script to obtain the encrypted workload section of the contract.

cat workload.yaml | ./encrypt-basic.sh hpcr.crt
6. Complete the user-data.yaml with the output of Step 2 and 5. Refer to the sample user-data.yaml for the correct schema. Note the hyper-protect-basic token approach to implement hybrid encryption, as it's used throughout IBM Cloud Hyper Protect Virtual Server for VPC.







 Create your Hyper Protect Virtual Server instance 

With the contract (user data) available, we go ahead to create an instance.

The quickest way is to use the [UI](https://cloud.ibm.com/docs/vpc?topic=vpc-about-se&interface=uicreate-hyper-protect-virtual-servers-for-vpc-instance). For Operating system, choose [IBM Hyper Protect](https://cloud.ibm.com/docs/vpc?topic=vpc-vsabout-imageshyper-protect-runtime) to create a Hyper Protect Virtual Server for VPC instance. Paste your user data in the User data box. Click Create virtual server instance when you are ready.





 Decrypt log messages 

Monitor the serial console. When the virtual server instance is up and running, go to the Log Analysis instance that you provisioned. Open the dashboard and find the ciphertext, which is your encrypted log message.

Use decrypt-basic.sh along with the private key that you generated to decipher the encrypted log message.

echo hyper-protect-basic.rdf...EqM | decrypt-basic.sh logging
The image that we use is the official Ubuntu image from [DockerHub](https://hub.docker.com/_/ubuntu).
2. Within the Docker Compose file, there is a command: instruction to tell Docker to run a Shell script that prints a line of plain text, and a line of encrypted message to the standard output. This example.sh file exists in the /compose/bin directory.
3. A public key logging.pub is required for encrypting the log message. This file must exist in the /compose folder. This tutorial will show an example of generating a key pair encrypted via AES with a passphrase using openssl.
4. The volumes: instruction tells Docker to mount the compose volume with the public key and the simple logging application to /var/logging inside the container. The Ubuntu image will start as a container later and run example.sh as its main application.



The [contract](https://cloud.ibm.com/docs/vpc?topic=vpc-about-contract_se) is a YAML file to specify the Hyper Protect Virtual Server for VPC instance that you want to create. In this tutorial, a dedicated public and private key pair is used to encrypt and decrypt the selected log messages.



* The private key is kept by you to decrypt the downloaded logs later.
* The public key must be embedded into the contract, which is a special approach for our case. The public key logging.pub is stored under the /example-files folder along with the docker-compose.yml file. As mentioned in the preparation of the [workload section](https://cloud.ibm.com/docs/vpc?topic=vpc-about-contract_sehpcr_contract_workload) of the contract, the archive subsection contains the base64 encoded TGZ file archive of docker-compose.yml. The logging.pub file in our example will undergo the same encoding and compression since it's stored in the same folder. As a result, the created instance will acquire the public key for subsequent log encryption.
On the Import custom image page, select Virtual server instance boot volume (default).

To create an image of the boot volume associated with an instance, the virtual server instance must be stopped.
2. Optionally, stop a running instance by clicking the overflow menu (ellipsis) and click Stop.
3. Select an instance from the list. You're selecting the boot volume of the instance.
4. Select the encryption type, either customer-managed encryption or IBM-managed encryption (see [Table 2](https://cloud.ibm.com/docs/vpc?topic=vpc-create-ifvencrypt-custom-images)).
5. On the side panel, click Create custom image.







 Create an image from the list of boot volumes 

When you select Block storage boot volume as the source of your custom image, a list of block storage volumes displays.

To create an image from the volume:



1. On the Import custom image page, select Block storage boot volume.

A list of block storage volumes shows attached Boot and Data volumes. Unattached volumes appear with a dash (-). To create an image from a volume:



* The volume must be a boot volume
* The volume must have an available status
* The volume must be attached to a virtual server instance
* The instance must be stopped



2. Optionally, stop a running instance by clicking the overflow menu (ellipsis) and click Stop attached instance. Click refresh and select the volume.
3. Select the volume from the list.
4. Select the encryption type, either customer-managed encryption or IBM-managed encryption (see [Table 2](https://cloud.ibm.com/docs/vpc?topic=vpc-create-ifvencrypt-custom-images)).
5. On the side panel, click Create custom image.







 Select the encryption type 

To complete your image from volume, select either IBM-managed encryption or customer-managed encryption. Table 2 describes these options as they appear in the UI.



Table 2. Encryption types

 Field Value
From IBM Cloud Identity and Access Management (IAM), [authorize access](https://cloud.ibm.com/docs/account?topic=account-serviceauthserviceauth) between Cloud Block Storage or Cloud File Storage (source service) and Key Protect(target service) for volumes. For custom images, authorize between Image Service for VPC (source service) and IBM Cloud Object Storage (target service). Specify reader access for the role.

You might need to upgrade your account to a Pay-as-you-go account to complete this set. For more information, see[Upgrading to a Pay-As-You-Go account](https://cloud.ibm.com/docs/account?topic=account-upgrading-accountupgrade-paygo).







 Encrypted custom image prerequisites 

If you plan to import an encrypted custom image, you need to complete several prerequisites in addition to setting up your KMS and authorizations. For more information, see [Setting up your key management service and keys](https://cloud.ibm.com/docs/vpc?topic=vpc-create-encrypted-custom-imagekms-prereqs).







 Next Steps 



* [Create virtual server instances with customer-managed encrypted volumes](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-instances-byok).
* [Create stand-alone volumes with customer-managed encryption](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-vpc-encryption).
* [Create custom encrypted images](https://cloud.ibm.com/docs/vpc?topic=vpc-create-encrypted-custom-image).
* [Create encrypted file shares](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-encryption).
Deploy containers from an encrypted image to your cluster by using the Image Key Synchronizer cluster add-on.

In clusters that run Red Hat OpenShift 4.5 or later, [the CRI-O container runtime supports using encrypted container images](https://github.com/cri-o/cri-o/blob/main/tutorials/decryption.md). Encrypted container images are Open Container Initiative (OCI) images that contain encrypted layer contents. Instead of securing an image for individual developers, such as a developer using image pull secrets to pull images from a registry, you can enable image encryption for a specific cluster. In this way, you can ensure that encrypted images are run only in those specific clusters that have the image decryption key.

To run an app by using an encrypted image, you must share the key for decrypting the image with the container runtime on the worker nodes in the cluster. When you enable the Image Key Synchronizer add-on in your cluster, the synchronizer daemon set is deployed in the image-key-synchronizer project. You can then create Kubernetes secrets that contain the image decryption keys in that project. The add-on adds the keys to a specific directory on the worker nodes where the container runtime can access and use the keys to decrypt container images. Note that the Image Key Synchronizer add-on also supports private keys that are first [wrapped by a root key that is stored in an IBM® Key Protect instance](https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryption).

Before you begin



1. Download and install the CLI clients for the following open source tools:



* [OpenSSL](https://www.openssl.org/source/), to generate an RSA key pair.
* [Docker Engine CLI](https://www.docker.com/products/container-runtime//download), to locally pull images from an image registry.
Using your own image 

Use your own Linux-based OCI image to create a new Hyper Protect Virtual Server. This feature is available by using the IBM Cloud® CLI.

The IBM Cloud® CLI can be used only on the officially supported operating systems or architectures. It is recommended that you use the IBM Cloud® Shell if your system is not supported.

Trial of the schema file. See [json schema](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-schema.md).

If you want to use IBM Cloud® Hyper Protect Virtual Servers Secure Build Server to provision a server, refer to [Protecting your image build](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-imagebuild).

Do not use personal information, for example, your name, as the instance name or as part of the instance name. The data that you provide when you provision an instance or interact with the hpvs cli is not considered to be personal data or credentials. Learn more about IBM Cloud Hyper Protect Virtual Servers' Data usage and Certifications [here](https://www.ibm.com/software/reports/compatibility/clarity-reports/report/html/softwareReqsForProduct?deliverableId=165C6EF0FFDA11E8BABD512A6952EE1F).

Before you provision a new server, check the [prerequisites](https://cloud.ibm.com/docs/services/hp-virtual-servers?topic=hp-virtual-servers-byoibyoi_pre), then complete the following steps:



1. [Create a custom image](https://cloud.ibm.com/docs/services/hp-virtual-servers?topic=hp-virtual-servers-byoibyoi_create).
2. [Creating a registration definition file by using the CLI](https://cloud.ibm.com/docs/services/hp-virtual-servers?topic=hp-virtual-servers-byoibyoi_regdef_cli).
The Share image to private catalog action is not available for the following images:



* The image is already shared with a private catalog. An image in a private catalog can exist in only one version within one product offering in one private catalog. You must remove the image from the version it is in first before that image can be shared in a different version.
* The image is encrypted.
* The image is not an x86 image.



To share a custom image to a private catalog, complete the following steps.



1. In [IBM Cloud console](https://cloud.ibm.com/login), go to Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/icons/icon_hamburger.svg) > VPC Infrastructure > Compute > Images.
2. On the Custom images tab, click the Actions icon ![More Actions icon](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/icons/action-menu-icon.svg) and select Share to catalog.
3. On the Share image to private catalog page, select a Private catalog from the list of available private catalogs.
4. Enter a version number in Software version.
5. Click Create catalog offering to share the image to the private catalog.
6. After the image is created, click Validate image.



This process shares only the custom image to the private catalog. The validation process occurs within the private catalog.