vania-janet/multiturn-rag-retrieval-data huggingface dataset:
If you have active containers that are running [untagged](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewoverview_elements_untagged) images, you must retain the untagged images. If you delete untagged images that are in use, you can cause problems with scaling or automated restarts. Deleting untagged images might cause a problem in the following circumstances:



* The image was deployed by referencing the image by using the digest.
* The image reference was mutated by a webhook service, such as [Portieris](https://cloud.ibm.com/docs/Registry?topic=Registry-security_enforce_portieris).







 What are eligible images? 

If you are cleaning up images by using retention policies, only eligible images are cleaned up. Images that are always retained are distroless images that do not set a created time, such as Google distroless images and manifest lists. Images that are always retained are not eligible images.

The images that are not eligible are still displayed, but they do not count toward the total number of images that is set in the retention policy and are not removed.





 What regions are available? 

To find out about the regions that are available for IBM Cloud Container Registry, see [Regions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_regions).







 Frequently asked questions about Vulnerability Advisor 



 How much does Vulnerability Advisor cost? 

The cost of Vulnerability Advisor is built into the pricing for IBM Cloud Container Registry. For more information, see [Billing for storage and pull traffic](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_billing_traffic).





 Can images from other registries be scanned? 

Vulnerability Advisor scans images from IBM Cloud Container Registry only.





 How is a Vulnerability Advisor scan triggered? 

For more information about how the scanning of an image is triggered, see [Vulnerable packages](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index&interface=uipackages).
If the image is present in ICR, path to the gpg public key that is used to sign the image should be mandatorily provided. It is optional for DCT signed image in Docker Hub.

--registration-key-public-path PRIVATE-KEY-PATH
: The path for the public key from the registration key pair. You must save these keys in a safe and secure location for future use.

--registration-key-private-path PUBLIC-KEY-PATH
: The path for the private key from the registration key pair. You must save these keys in a safe and secure location for future use.

--gpg-passphrase-path PASS-PHRASE
: The path for the gpg pass phrase used for the private part of the registration key. The passphrase must consist of at least 6 characters. To make sure that a new line is not appended, use echo with -n or cat with EOF.

--cap-add CAPABILITIES
: The Linux capabilities to be enabled are specified as a comma separated list.

--isv-secrets ISV-SECRETS
: The Linux secrets to be used in BYOI. The secrets are added in the /isv_secrets/secrets.json file, within the container.

The ISV secrets is a key value pair that is separated by a colon, and you can specify a list secrets that are separated by a comma. Avoid adding spaces after the comma when you are specifying multiple secrets. If the size of the secret is large, it is recommended that you specify it by using the --isv-secrets command parameter. To update ISV secrets, you must create a new registration definition file with the updated ISV secrets and use the same registration definition file when running the hpvs instance-update command to update the instance.

--no-isv-secrets
: If the image does not require any isv secrets, this parameter can be set. You need not provide the isv-secrets parameter, and if you do, it will be ignored.







 Using your OCI Image to provision a Hyper Protect Virtual Server
up from the environment-properties configmap

 Eg. if there's a prop: my-config entry in the environment properties,
 then my-config is going to be used for $prop
configmap: $prop

 the mechanism described works for secrets as well!
secret: $my-secrets

 the script is executed inside the checked out app repo
script: 
!/bin/sh
...

 test runs after setup, but before building the docker image
test:
image: ibmcom/pipeline-base-image:2.7
script: 
!/bin/sh
...

 static-scan runs after test, but before building the docker image
static-scan:
image: ibmcom/pipeline-base-image:2.12
script: 
!/bin/sh
...

 deploy runs after building the docker image
deploy:
image: ibmcom/pipeline-base-image:2.7

 the script has access to the built docker image, which is available at /config/image
script: 
!/bin/sh

cat /config/image

 dynamic-scan runs after deploy, but before the acceptance test run
dynamic-scan:
image: ibmcom/pipeline-base-image:2.12
script: 
!/bin/sh
...

 acceptance-test runs after deploy
acceptance-test:
image: ibmcom/pipeline-base-image:2.7
script: 
!/bin/sh
...
Show more
* Added security fix related to image signing
* Updates the storage-secret-sidecar image to v1.1.11
* Resolves [CVE-2022-1271](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1271)







 Change log for version 4.3.0_1163, released 25 May 2022 



* Resolves the following CVEs: [CVE-2021-3634](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3634), [CVE-2021-3737](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737), [CVE-2021-4189][https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4189](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4189)){: external}.
* Updates the storage-secret-sidecar image to v1.1.10
* Fixes Volume provisioning failure when in StorageClass Region is provided without zone info
* Fixes an issue where volume creation fails if only failure-domain.beta.kubernetes.io/zone is given in allowedTopologies
* Region support is now DEPRECATED in the storage class. Providing "region" detail in storage classes is deprecated in this release, this will not cause any issues with either existing PVC or new PVC. For now the default behavior is to get the region detail from the node label only which is now mandatory for all cases.









 Version 4.2 



 Change log for version 4.2.6_1161, released 12 May 2022 



* Updates armada-storage-secret to v1.1.10
* [Configure drill-through to reveal detailed data](https://www.ibm.com/docs/planning-analytics/2.0.0?topic=mipaw-configure-drill-through-reveal-detailed-data)

You can associate a cube cell with extra data, which can provide underlying detail for the cell or other information relevant to the cell. When you complete the configuration that is required to establish this association, users can drill through to the additional data directly from an Exploration view.
* [Object security](https://www.ibm.com/docs/planning-analytics/2.0.0?topic=mipaw-object-security)

Modelers manage the security for cubes, dimensions, and processes in the settings editor, and security for dimension members in the security view in the dimension editor. You can assign security to these objects for any non-administrative user group in Planning Analytics Workspace.
* [TurboIntegrator processes](https://www.ibm.com/docs/planning-analytics/2.0.0?topic=mipaw-turbointegrator-processes)

Planning Analytics with Watson provides the ability to create, edit, and execute TurboIntegrator processes.
* [TurboIntegrator chores](https://www.ibm.com/docs/planning-analytics/2.0.0?topic=mipaw-turbointegrator-processes)

You can create a chore to execute one or more TurboIntegrator processes in a specified sequence and at defined intervals.
* [Translate a model](https://www.ibm.com/docs/planning-analytics/2.0.0?topic=mipaw-translate-model)

You can translate a model in Planning Analytics with Watson by creating translated values for attributes. You can translate dimensions, members, cubes, attributes, views, processes, and public sets.
Key Management Service provider v2.3.0 v2.3.3 Updated to use Go version 1.15.11 and for [CVE-2021-3449](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3449), [CVE-2021-3450](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3450), and [CVE-2021-20305](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20305). 
 Red Hat OpenShift 4.6.22 4.6.23 See the [Red Hat OpenShift release notes](https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.htmlocp-4-6-23). 
 OpenVPN client 2.4.6-r3-IKS-301 2.4.6-r3-IKS-386 Updated image to implement additional IBM security controls. 
 OpenVPN Operator image v1.2.0 v1.3.0 Added OpenVPN support to the Red Hat OpenShift API server to support webhooks. Updated image to implement additional IBM security controls and for [CVE-2021-3449](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3449), [CVE-2021-3450](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3450), and [CVE-2021-20305](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20305).
Release notes for Container Registry 

Learn about the changes to IBM Cloud® Container Registry and Vulnerability Advisor. The changes are grouped by date.



 19 June 2023 

Vulnerability Advisor version 3 is deprecated from 19 June 2023
: For more information about how to update to version 4, see [Update Vulnerability Advisor to version 4 by 19 June 2023](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_va_v4&interface=ui).





 19 May 2023 

Update Vulnerability Advisor to version 4 by 19 June 2023
: The Vulnerability Advisor component of IBM Cloud® Container Registry is being updated.

Vulnerability Advisor version 3 is being deprecated as the default on 19 June 2023. From 19 June 2023, the default will be Vulnerability Advisor version 4. If you have version 3 set as the default, you can continue to use version 3 until the end of support date. An end of support date is not available yet.

For more information, see [Update Vulnerability Advisor to version 4 by 19 June 2023](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_va_v4).





 26 April 2023 

Using Portieris to block the deployment of images with issues is deprecated.
: The use of Portieris to block the deployment of images with issues that are found by Vulnerability Advisor is deprecated.





 11 November 2022 

Change to virtual private endpoints
: Virtual private endpoints are changing.

On 11 November 2022, virtual private endpoints (VPEs) for IBM Cloud Container Registry are being updated and the existing VPE version is being deprecated on 15 December 2022. If you use Container Registry VPE gateways, you must create new VPE gateways and remove your VPE gateways that were created before 11 November 2022 at the earliest opportunity so that you pick up these changes. VPE gateways that were created before 11 November 2022 are deprecated and will not work after 15 December 2022.
If the size of the secret is large, it is recommended that you specify it by using the --isv-secrets command parameter. To update ISV secrets, you must create a new registration definition file with the updated ISV secrets and use the same registration definition file when running the hpvs instance-update command to update the instance.

--no-isv-secrets
: If the image does not require any isv secrets, this parameter can be set. You need not provide the isv-secrets parameter, and if you do, it will be ignored.

If you do not use the same private and public keys (--registration-key-public-path PRIVATE-KEY-PATH and --registration-key-private-path PUBLIC-KEY-PATH) that you had used when you first created the virtual server instance, then command execution fails.

Example output

ibmcloud hpvs registration-create
Repository name> us.icr.io/yournamespace/nginx1
Container registry API key>
Secrets to be passed into BYOI registration file>
Allowed environment variables as comma separated list>
Fingerprint> E8C9E...........61A927D9F3
Path to the file containing the image public key> new.pub
Path to the file containing public part of the registration key> byoifeb21.public
Allowed Linux capabilities to be enabled as comma separated list> ALL
Path to the file containing the private part of the registration key> byoifeb21.private
Gpg pass phrase for the private part of the registration key>
OK
The registration file was successfully created in the current working directory: registration.json.asc
Complete command executed:
[CVE-2019-20454](https://nvd.nist.gov/vuln/detail/CVE-2019-20454), [CVE-2019-19956](https://nvd.nist.gov/vuln/detail/CVE-2019-19956), [CVE-2019-20388](https://nvd.nist.gov/vuln/detail/CVE-2019-20388), [CVE-2020-7595](https://nvd.nist.gov/vuln/detail/CVE-2020-7595), [CVE-2019-13627](https://nvd.nist.gov/vuln/detail/CVE-2019-13627), [CVE-2018-20843](https://nvd.nist.gov/vuln/detail/CVE-2018-20843), [CVE-2019-15903](https://nvd.nist.gov/vuln/detail/CVE-2019-15903), and [CVE-2019-20387](https://nvd.nist.gov/vuln/detail/CVE-2019-20387). 
 IBM Cloud Controller Manager v1.17.13-1 v1.17.14-1 Updated to support the Kubernetes 1.17.14 release. Updated image for [DLA-2424-1](https://www.debian.org/lts/security/2020/dla-2424). 
 IBM Cloud File Storage for Classic plug-in and monitor 378 379 Updated to use the universal base image (UBI) and to use Go version 1.15.2. 
 Key Management Service provider v1.0.3 v1.0.4 Updated image for [DLA-2424-1](https://www.debian.org/lts/security/2020/dla-2424).
collect-evidence --tool-type "sonarqube" --evidence-type "com.ibm.static_scan" --asset-type "repo" --asset-key "app-repo" --status "success" --attachment ./sonarqube-result-1.json --attachment ./sonarqube-result-2.json --meta environment=staging







 Supported tool formats 

The current implementation currently supports the following tools (provided as the --tool-type parameter):



* cra IBM Code Risk Analyzer
* va Vulnerability Advisor for IBM Cloud Container Registry
* gosec GoLang Security Scanner
* xray JFrog Xray - Vulnerability Scanning & Container Security
* owasp-zap OWASP Zed Attack Proxy (ZAP)
* owasp-zap-ui OWASP Zed Attack Proxy UI (ZAP UI)
* sonarqube 'SonarQube scan



If the collect-evidence script is called with a tool type that is not supported, the script doesn't attempt to process the attachments. Additionally, the issue handling is skipped, and the evidence collection is not stopped.

If your script provides an attachment from a supported tool, but the attachment cannot be processed, the issue handling is skipped, and the evidence collection is not stopped.





 Evidence type 

You can set the evidence type by using the --evidence-type parameter. You can set any type, but the IBM Cloud® Security and Compliance Center supports the following evidence types:



* com.ibm.unit_tests
* com.ibm.detect_secrets
* com.ibm.branch_protection
* com.ibm.static_scan
* com.ibm.code_vulnerability_scan
* com.ibm.code_bom_check
* com.ibm.code_cis_check
* com.ibm.cloud.image_vulnerability_scan
* com.ibm.cloud.image_signing
* com.ibm.dynamic_scan
* com.ibm.acceptance_tests
* com.ibm.prod_change_request
* com.ibm.close_change_reques





 Asset requirements
* Level 3: Provides a high probability of detecting and responding to attempts at physical access, use, or modification of the cryptographic module. The physical security mechanisms can include the use of strong enclosures and tamper-detection and response circuitry that zeroizes all plain text CSPs when the removable covers or doors of the cryptographic module are opened. Security Level 3 requires identity-based authentication mechanisms, enhancing the security provided by the role-based authentication mechanisms specified for Security Level 2.
* Level 4: The highest level of security. At this security level, the physical security mechanisms provide a complete envelope of protection around the cryptographic module with the intent of detecting and responding to all unauthorized attempts at physical access. Penetration of the cryptographic module enclosure from any direction has a high probability of being detected, resulting in the immediate zeroization of all plain text CSPs.

Security Level 4 cryptographic modules are useful for operation in physically unprotected environments. Security Level 4 also protects a cryptographic module against a security compromise because of environmental conditions or fluctuations outside of the module's normal operating ranges for voltage and temperature. Intentional excursions beyond the normal operating ranges can be used by an attacker to prevent a cryptographic module's defenses.

A cryptographic module is required to either include special environmental protection features designed to detect fluctuations and delete CSPs, or to undergo environmental failure testing to ensure that the module will not be affected by fluctuations outside of the normal operating range in a manner that can compromise the security of the module. At this security level, the physical security mechanisms provide a complete envelope of protection around the cryptographic module with the intent of detecting and responding to all unauthorized attempts at physical access.

Hyper Protect Crypto Services is the only cloud HSM in the public cloud market that is built on an HSM designed to meet FIPS 140-2 Level 4 certification requirements. The certification is listed on the [Cryptographic Module Validation Program (CVMP) Validated Modules List](https://csrc.nist.gov/Projects/cryptographic-module-validation-program/Validated-Modules).



* How to understand the key hierarchy for Hyper Protect Crypto Services KYOK?

The following table lists the keys that are needed for Hyper Protect Crypto Services Keep Your Own Key (KYOK) functionality.



Table 1.
Trusted compute agent 5f3d092 a02f765 Updated image for [CVE-2018-10779](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10779), [CVE-2018-12900](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12900), [CVE-2018-17000](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17000), [CVE-2018-19210](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19210), [CVE-2019-6128](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6128), and [CVE-2019-7663](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7663). 







 Change log for 1.12.6_1541, released 4 March 2019 

The following table shows the changes that are in the patch 1.12.6_1541.



Changes since version 1.12.5_1540

 Component Previous Current Description 

 Cluster DNS provider N/A N/A Increased Kubernetes DNS and CoreDNS pod memory limit from 170Mi to 400Mi to handle more cluster services. 
 GPU device plug-in and installer eb3a259 e32d51c Updated images for [CVE-2019-6454](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6454). 
 IBM Cloud Provider v1.12.5-137 v1.12.6-157 Updated to support the Kubernetes 1.12.6 release.
For more information, see [Viewing keys in Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-keysview-keys) or [Viewing keys in Hyper Protect Crypto](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-keysview-keys). 







 Next Steps 

After the import begins, the system locates the image file in the IBM Cloud Object Storage service instance in the specified bucket. The image file is imported as an image template that is then accessible on the Image Templates page. After the import completes, the image can be used to order a new device or to start an existing device. Additionally, you can delete an image template at any time. Image import times vary based on file size, but generally take several minutes to an hour.

The information that you provided to import encrypted image files from IBM Cloud Object Storage is stored along with the image file. Your information is then used to create an encrypted image template that you can use when you order a new device. You don't need to reenter this information when you order new devices from encrypted image templates.

After an image is imported into the image template repository, you can delete it from IBM Cloud Object Storage. You can continue accessing the image template from your Image Templates page and by using it to provision virtual server instances.
When you develop a confidential computing application, you must design it in a way that you can segment the information that needs to be encrypted. At runtime, the segmented information is kept confidential through attestation. When a request for information from the segmented code or app data is received, the enclave verifies that the request comes from the part of the application that exists outside of the enclave within the same application before sharing any information. Through the attestation process, information is kept confidential and data leakage is prevented.



 Installing with a script 

Before you begin, [create a worker pool](https://cloud.ibm.com/docs/containers?topic=containers-add_workersadd_pool) with SGX-capable worker nodes. To work with Intel SGX, you must use one of the following machine types: mb2c.4x32 and ms2c.4x32.1.9tb.ssd.



1. [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)
2. Create a daemon set to install the drivers and platform software on your SGX-capable worker nodes.

kubectl create -f https://raw.githubusercontent.com/ibm-cloud-security/data-shield-reference-apps/master/scripts/sgx-driver-psw/install_sgx/deployment_install_sgx_iks.yaml
3. Verify that the drivers and platform software were installed by running the following command to check for a pod that begins with sgx-installer.

kubectl get pods
4. Get the logs for your sgx-installer pod to verify that you see the messages SGX driver installed and PSW installed.

kubectl logs <name_of_SGX_installer_pod>
5. Now that the drivers and platform software are installed, remove the daemon set.

kubectl delete daemonset sgx-installer
IBM Cloud Controller Manager v1.17.11-1 v1.17.12-1 Updated to support the Kubernetes 1.17.12 release. 
 IBM Cloud File Storage for Classic plug-in and monitor 377 378 Updated Go version for [CVE-2020-16845](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16845). 
 IBM Cloud RBAC Operator d80b738 4b47693 Updated Go version for [CVE-2020-16845](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16845) and image for [CVE-2020-14352](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14352). 
 Red Hat OpenShift Control Plane Operator v4.3.0-20200709 v4.3.0-20200821 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.3.0+20200821). 
 Red Hat OpenShift 4.3.31 4.3.35 See the [Red Hat OpenShift release notes](https://docs.openshift.com/container-platform/4.3/release_notes/ocp-4-3-release-notes.htmlocp-4-3-35). 
 OpenVPN Operator image v1.0.7 v1.0.8 Updated image for [CVE-2020-14352](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14352).