vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* [ibmcloud cr retention-run command is available](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes01aug2019_retention)



* [25 July 2019](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-25jul2019)



* [IBM Cloud Activity Tracker available for Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes25jul2019_at)



* [1 July 2019](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-1jul2019)



* [ibmcloud cr token-add command is no longer available](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes1jul2019_token_add)



* [27 June 2019](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-27jun2019)



* [Container Scanner is no longer available](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes27jun2019_cs)



* [13 June 2019](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-13jun2019)



* [Remove tags from images](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes13jun2019_tags)



* [13 May 2019](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-13may2019)



* [End of support for Container Scanner](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes13may2019_cs)
* IBM Cloud Container Registry plug-in (ibmcloud cr)
* IBM Cloud Kubernetes Service observability plug-in (ibmcloud ob)



* [Create a cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-clusters) or use an existing Red Hat OpenShift on IBM Cloud cluster.
* Make sure that your user ID is assigned the following IBM Cloud® Identity and Access Management policies:





Table 1. List of IAM policies required to complete the tutorial

 Resource Scope of the access policy Role Region Information 

 Resource group default Resource group Viewer us-south This policy is required to allow the user to see service instances in the Default resource group. 
 IBM Cloud Monitoring service Resource group Editor us-south This policy is required to allow the user to provision and administer the IBM Cloud Monitoring service in the default resource group. 
 Red Hat OpenShift cluster instance Resource Editor us-south This policy is required to configure the secret and the monitoring agent in the Red Hat OpenShift on IBM Cloud cluster. 



For more information about the IBM Cloud® Kubernetes Service IAM roles, see [User access permissions](https://cloud.ibm.com/docs/containers?topic=containers-access_referenceaccess_reference).





 Step 1: Step 1. Provision an IBM Cloud Monitoring instance 

In this getting started tutorial, instructions are provided to provision an instance of the IBM Cloud Monitoring in the us-south region. For more information about supported regions, see [Regions](https://cloud.ibm.com/docs/monitoring?topic=monitoring-endpoints).

To provision an instance of IBM Cloud Monitoring, complete the following steps:



1. [Log in to your IBM Cloud account](https://cloud.ibm.com/login).

After you log in with your user ID and password, the IBM Cloud UI opens.
2. Click Catalog. The list of the services that are available in IBM Cloud opens.
3. To filter the list of services that is displayed, select the Logging and monitoring category.
4. Click the IBM Cloud Monitoring tile.
5.
Aqua Security As a supplement to [Vulnerability Advisor](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index), you can use [Aqua Security](https://www.aquasec.com/) to improve the security of container deployments by reducing what your app is allowed to do. For more information, see [Securing container deployments on IBM Cloud with Aqua Security](https://blog.aquasec.com/securing-container-deployments-on-bluemix-with-aqua-security). Yes Yes 
 IBM Cloud Container Registry Set up your own secured Docker image repository where you can safely store and share images between cluster users. For more information, see the [IBM Cloud® Container Registry documentation](https://cloud.ibm.com/docs/Registry?topic=Registry-getting-started). Yes Yes 
 IBM Key Protect for IBM Cloud Encrypt the Kubernetes secrets that are in your cluster by [enabling a key management service (KMS) provider](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkms). Encrypting your Kubernetes secrets prevents unauthorized users from accessing sensitive cluster information. Yes Yes 
 NeuVector Protect containers with a cloud-native firewall by using [NeuVector](https://neuvector.com/). For more information, see [NeuVector Container Security](https://cloud.ibm.com/catalog/services/neuvector-container-security-platform). Yes Yes 
 IBM Cloud Secrets Manager Ingress secrets and certificates You can use Secrets Manager to store and manage your Ingress secrets and certificates. For more information, see [Setting up Secrets Manager in your Kubernetes Service cluster](https://cloud.ibm.com/docs/containers?topic=containers-secrets-mgr). Yes
* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_retention_run_prereq)
* [Command options](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_retention_run_option)
* [Example](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_retention_run_example)



* [ibmcloud cr trash-list](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_trash_list)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_trash_list_prereq)
* [Command options](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_trash_list_option)
* [Example](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_trash_list_example)



* [ibmcloud cr va-version](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcliic_cr_va_version)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcliic_cr_va_version_prereq)



* [ibmcloud cr va-version-set](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcliic_cr_va_version_set)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcliic_cr_va_version_set_prereq)
[Copy an image pull secret](https://cloud.ibm.com/docs/containers?topic=containers-registrycopy_imagePullSecret) for the regional registry domain name.
5. Log in to the registry from your local machine by using the username and password from your image pull secret. If you can't log in, you might need to fix the service ID.

docker login -u iamapikey -p <password_string> <region>.icr.io



1. Re-create the cluster service ID, IBM Cloud IAM policies, API key, and image pull secrets for containers that run in the default Kubernetes namespace.

ibmcloud ks cluster pull-secret apply --cluster <cluster_name_or_ID>
2. Re-create your deployment in the default Kubernetes namespace. If you still see an authorization error message, repeat Steps 1-5 with the new image pull secrets. If you still can't log in, [open an IBM Cloud Support case](https://cloud.ibm.com/docs/containers?topic=containers-get-help).



6. If the login succeeds, pull an image locally. If the command fails with an access denied error, the registry account is in a different IBM Cloud account than the one your cluster is in. [Create an image pull secret to access images in the other account](https://cloud.ibm.com/docs/containers?topic=containers-registryother_registry_accounts). If you can pull an image to your local machine, then your API key has correct permissions, but the API setup in your cluster is not correct.

docker pull <region>icr.io/<namespace>/<image>:<tag>
7. Check that the pull secret is either referenced directly from the deployment or from the service account that the deployment uses. If you still can't resolve the issue, [contact support](https://cloud.ibm.com/docs/containers?topic=containers-get-help).
container-registry.namespace.delete [ibmcloud cr namespace-rm](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_namespace_rm) Remove a namespace. Manager 
 container-registry.plan.get [ibmcloud cr plan](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_plan) Display your pricing plan. Manager 
 container-registry.plan.set [ibmcloud cr plan-upgrade](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_plan_upgrade) Upgrade to the standard plan. Manager 
 container-registry.quota.get [ibmcloud cr quota](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_quota) Display your current quotas for traffic and storage, and usage information against those quotas. Reader, Writer, Manager 
 container-registry.quota.set [ibmcloud cr quota-set](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_quota_set) Modify the specified quota. Manager 
 container-registry.settings.get [ibmcloud cr platform-metrics](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcliic_cr_platform_metrics) Get registry service settings for the targeted account, such as whether platform metrics are enabled. Reader, Writer, Manager 
 container-registry.settings.set [ibmcloud cr platform-metrics](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcliic_cr_platform_metrics) Update registry service settings for the targeted account, such as enabling platform metrics. Manager 







 Access roles for using Container Registry 

To grant a user permission to access Container Registry content in your account, you must create a policy that grants one or more of the roles in the following table.
* [ibmcloud cr image-restore](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_image_restore)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_image_restore_prereq)
* [Command options](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_image_restore_option)
* [Example](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_image_restore_example)



* [ibmcloud cr image-rm](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_image_rm)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_image_rm_prereq)
* [Command options](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_image_rm_option)
* [Example](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_image_rm_example)



* [ibmcloud cr image-tag](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_image_tag)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_image_tag_prereq)
* [Command options](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_image_tag_option)
* [Examples](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_image_tag_example)
Using a dynamic registry reference 

The documentation walks you through how to use a dynamic registry reference in the [contract](https://cloud.ibm.com/docs/vpc?topic=vpc-about-contract_se).



 Explicit registry reference 

Typically, the docker registry is referenced via the full docker URL in the compose file. For example,

services:
helloworld:
image: docker.io/library/hello-world@sha256:53f1bbee2f52c39e41682ee1d388285290c5c8a76cc92b42687eecf38e0af3f0

In the example, docker.io/library/ is the registry prefix, hello-world is the identifier of the OCI image in that registry, and sha256:53f1bbee2f52c39e41682ee1d388285290c5c8a76cc92b42687eecf38e0af3f0 is the unique identifier of the version of the image.

In such a case, the role that decides about the registry (and the associated pull credentials) is the workload provider, since both the registry reference as well as the pull credentials are part of the workload section of the contract.





 Dynamic registry reference 

There exist usecases in which the registry is not known when the workload section is pre-encrypted, for example, when the workload provider wants to allow the deployer to use a registry mirror or a private container registry.

In such a case, it's possible to dynamically override the registry as well as the pull credentials. This is a coordinated effort between the workload provider and the deployer.

The templating approach only works for a [compose](https://cloud.ibm.com/docs/vpc?topic=vpc-about-contract_sehpcr_contract_compose)-based workload and also only for images referenced via a digest (no support for DCT-based workloads).



 Workload provider
* To view and analyze namespaces, you must have the Reader or Manager role in the IBM Cloud Container Registry service, see [Access roles for using IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iamaccess_roles_using).



For more information about user roles, [Defining IAM access policies](https://cloud.ibm.com/docs/Registry?topic=Registry-useruser).







 Setting up a namespace 

You must create a namespace to store your Docker images in IBM Cloud Container Registry.

Before you begin, complete the following tasks:



* [Install the IBM Cloud CLI and the container-registry CLI plug-in](https://cloud.ibm.com/docs/Registry?topic=Registry-getting-startedgs_registry_cli_install).
* [Plan how to use and name your registry namespaces](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespaceregistry_setup_cli_namespace_plan).



To create a namespace, see [Set up a namespace](https://cloud.ibm.com/docs/Registry?topic=Registry-getting-startedgs_registry_namespace_add). Namespaces are created in the resource group that you specify so that you can configure access to resources within the namespace at the resource group level. If you don't specify a resource group, and a resource group isn't targeted, the default resource group is used. For more information about resource groups, see [Managing resource groups](https://cloud.ibm.com/docs/account?topic=account-rgs).

Namespaces that are assigned to a resource group show in the Resource list page of the IBM Cloud console.

The namespace must be unique across all IBM Cloud accounts in the same region. Namespaces must have 4 - 30 characters, and contain lowercase letters, numbers, hyphens (-), and underscores (_) only. Namespaces must start and end with a letter or number.
* [Report API methods](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_at_iamregistry_at_iam_vuln_report)
* [Exemption API methods](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_at_iamregistry_at_iam_vuln_exempt)









 Container Registry CLI 

[IBM Cloud Container Registry CLI](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclicontainerregcli)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclicontainerregcli_prereq)



* [Notes](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclicontainerregcli_prereq_notes)



* [ibmcloud cr api](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_api)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_api_prereq)



* [ibmcloud cr exemption-add](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_exemption_add)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_exemption_add_prereq)
* [Command options](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_exemption_add_option)
* [Examples](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_exemption_add_example)
: For more information, see [Setting up IBM Cloud Object Storage](https://cloud.ibm.com/docs/containers?topic=containers-storage-cos-understand), [Installing the IBM Cloud Object Storage plug-in](https://cloud.ibm.com/docs/containers?topic=containers-storage_cos_install), [Setting up authorized IP addresses for IBM Cloud Object Storage](https://cloud.ibm.com/docs/containers?topic=containers-storage_cos_vpc_ip), [Adding IBM Cloud Object Storage storage to apps](https://cloud.ibm.com/docs/containers?topic=containers-storage_cos_apps), and [Storage class reference](https://cloud.ibm.com/docs/containers?topic=containers-storage_cos_reference).

Block Storage for VPC add-on.
: [Version 4.1.3_846](https://cloud.ibm.com/docs/containers?topic=containers-vpc_bs_changelog) is released.





 10 February 2022 

Certified Kubernetes
: Version [1.23](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_123) release is now certified.

ALB OAuth Proxy add-on
: Version 2.0.0_981 of the [ALB OAuth Proxy add-on](https://cloud.ibm.com/docs/containers?topic=containers-alb-oauth-proxy-changelog) is released.





 9 February 2022 

New! Kubernetes 1.23
: You can create or [update clusters to Kubernetes version 1.23](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_123). With Kubernetes 1.23, you get the latest stable enhancements from the Kubernetes community as well as enhancements to the IBM Cloud product.

Deprecated and unsupported Kubernetes versions
For example, to target the eu-central region, run the following command.

ibmcloud cr region-set eu-central
2. To log your local Docker daemon into the registry so that you can push or pull images, run the [ibmcloud cr login](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_login) command.

Container Registry supports other clients as well as Docker. To log in by using other clients, see [Accessing your namespaces interactively](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_accessregistry_access_interactive).











 Supported clients 



 Support for Docker 

IBM Cloud Container Registry supports versions of Docker Engine that Docker supports.

Docker is required only if you want to push or pull images.

Docker V2 schema 2 images are supported. Manifest lists are also supported. For more information, see [Docker: Image Manifest Version 2, schema 2](https://docs.docker.com/registry/spec/manifest-v2-2/).

Docker V2 schema 1 images are discontinued and you can't push them to Container Registry anymore.





 Support for other clients 

IBM Cloud Container Registry supports supported versions of clients that are compliant with the OCI Distribution spec version 1, or later, such as Buildah, Podman, and Skopeo.
When you create your policy, you must not specify a resource type or resource. Policies for configuring Container Registry must not be set at a resource group level.

For example, run the following ibmcloud iam user-policy-create command. Where <user_email> is the user's email address, <region> is the region, and <roles> is the role, or roles, that you want the user to have.

ibmcloud iam user-policy-create <user_email> --service-name container-registry --region <region> --roles <roles>

The following table details actions that are mapped to operations on the service and to the service access roles for configuring Container Registry.



Table 4. Service actions and operations for configuring Container Registry

 Action Operation on service Role 

 container-registry.auth.get [ibmcloud cr private-only](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcliic_cr_private_only) Check whether the use of public connections is prevented for image pushes or pulls in your account. Manager 
 container-registry.auth.set [ibmcloud cr iam-policies-enable](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_iam_policies_enable) Enable IAM access policy enforcement.<br><br>[ibmcloud cr private-only](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcliic_cr_private_only) Prevent or allow image pulls or pushes over public network connections for your account. Manager 
 container-registry.exemption.list [ibmcloud cr exemption-list](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_exemption_list) List your Vulnerability Advisor exemption policies for security issues.<br><br>[ibmcloud cr exemption-types](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_exemption_types) List the types of security issues that you can exempt.
* [Kubernetes API server and etcd data store](https://cloud.ibm.com/docs/containers?topic=containers-securityapiserver)
* [Worker nodes](https://cloud.ibm.com/docs/containers?topic=containers-securityworkernodes)
* [Network](https://cloud.ibm.com/docs/containers?topic=containers-securitynetwork)
* [Persistent storage](https://cloud.ibm.com/docs/containers?topic=containers-securitystorage)
* [Monitoring and Logging](https://cloud.ibm.com/docs/containers?topic=containers-securitymonitoring_logging)
* [Container images and registry](https://cloud.ibm.com/docs/containers?topic=containers-securityimages_registry)
* [Container isolation and security](https://cloud.ibm.com/docs/containers?topic=containers-securitycontainer)
* [Personal information](https://cloud.ibm.com/docs/containers?topic=containers-securitypi)







 Kubernetes API server and etcd 

The Kubernetes API server and etcd data store are the most sensitive components that run in your Kubernetes master. You want to prevent unauthorized access to these components because they set and store the configurations for all the resources that run in your cluster, including some security settings of your applications.

Kubernetes provides security controls and limits access to protect these components and reduce the risk of cyber attacks.



 How is access to my API server granted? 

By default, Kubernetes requires every request to go through several stages before access to the API server is granted.

Authentication
: Validates the identity of a registered user or service account.

Authorization
: Limits the permissions of authenticated users and service accounts to ensure that they can access and operate only the cluster components that you want them to.

Admission control
: Validates or mutates requests before they are processed by the Kubernetes API server. Many Kubernetes features require admission controllers to properly function.
* [Command options](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_quota_set_option)
* [Example](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_quota_set_example)



* [ibmcloud cr region](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_region)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_region_prereq)



* [ibmcloud cr region-set](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_region_set)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_region_set_prereq)
* [Command options](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_region_set_option)
* [Example](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_region_set_example)



* [ibmcloud cr retention-policy-list](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_retention_policy_list)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_retention_policy_list_prereq)
* [Example](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_retention_policy_list_example)