vania-janet/multiturn-rag-retrieval-data huggingface dataset:
: (Optional) Includes the Vulnerability Advisor security status results in the output. Use this option to ensure that you are ready for [IBM Cloud Container Registry CLI plug-in version 1.0.0](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_lists). You can use the --va option with the --restrict option to receive just the information that you require.





 Example 

Display the images in the birds namespace in the format repository:tag, without truncating the image digests.

ibmcloud cr image-list --restrict birds --quiet --no-trunc







 ibmcloud cr image-prune-untagged 

Delete all [untagged](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewoverview_elements_untagged) images in your IBM Cloud Container Registry account.

ibmcloud cr image-prune-untagged [--force | -f --json]] --restrict RESTRICTION



 Prerequisites 

To find out about the required permissions, see [Access roles for using Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iamaccess_roles_using).





 Command options 

--force, -f
: (Optional) Force the command to run with no user prompts.

--json
: (Optional) Outputs JSON that contains the results of cleaning up your untagged images. This option must be used with --force.

--restrict
: (Optional) Limit the clean up to only untagged images in the specified namespace or repository.





 Example 

Delete all untagged images that are in the birds namespace and output the results in JSON format.

ibmcloud cr image-prune-untagged [--force | -f --json]] --restrict birds







 ibmcloud cr image-restore 

Restore a deleted image from the trash.
Tool Type IBM Cloud Container Registry Repository Latest version Vulnerability Status Vulnerability Description 

 Baseimage icr.io/continuous-delivery/toolchains/devsecops/baseimage 2.83.0_commons-0.32.5 Non-Vulnerable 
 DevSecOps Baseimage icr.io/continuous-delivery/toolchains/devsecops/devsecops-baseimage 2.83.0_commons-0.32.5 Non-Vulnerable 
 OWASP ZAP API Scanner icr.io/continuous-delivery/toolchains/devsecops/owasp-zap-api-scanner 05-06-2023-08-29 Vulnerable 
 OWASP ZAP UI Scanner icr.io/continuous-delivery/toolchains/devsecops/owasp-zap-ui-scanner 04-07-2022-06-47 Vulnerable 
 OWASP ZAP UI Proxy icr.io/continuous-delivery/toolchains/devsecops/owasp-zap-ui-proxy 17-04-2023-03-56 Vulnerable 
 Detect Secrets icr.io/git-defenders/detect-secrets 0.13.1.ibm.60.dss-redhat-ubi Vulnerable 
 Docker In Docker icr.io/continuous-delivery/toolchains/devsecops/docker 20.10.21-dind Vulnerable 
 SonarQube icr.io/continuous-delivery/toolchains/devsecops/sonarqube 10.0.0-community Vulnerable 
 SonarQube Scanner CLI icr.io/continuous-delivery/toolchains/devsecops/sonar-scanner-cli 4.8 Vulnerable
For more information, see [The rate attribute](https://cloud.ibm.com/docs/text-to-speech?topic=text-to-speech-elementsprosody-rate).
* Neural voices now parse the escaped apostrophe character (') properly. Previously, some neural voices were not interpreting the character properly.



Security vulnerability addressed
: The following security vulnerability associated with Apache Log4j has been fixed:



* [Security Bulletin: Vulnerability in Apache Log4j may affect IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2021-4428)](https://www.ibm.com/support/pages/node/6536732)







 20 December 2021 (Version 1.2.x) 

Important: You can no longer install Text to Speech version 1.2.x on IBM Cloud Pak for Data version 3.5
: Important: You can no longer perform new installations of Text to Speech version 1.2.x on IBM Cloud Pak for Data version 3.5. You can install only Text to Speech version 4.0.x on IBM Cloud Pak for Data version 4.x. For more information, see [Installing Watson Text to Speech](https://www.ibm.com/docs/en/cloud-paks/cp-data/4.0?topic=speech-installing-watson-text).

The Speech services for IBM Cloud Pak for Data version 3.5 reach their End of Support date on 30 April 2022. You are encouraged to upgrade to the latest version 4.0.x release of the services at your earliest convenience. For more information, see [Upgrading Watson Text to Speech](https://www.ibm.com/docs/en/cloud-paks/cp-data/4.0?topic=speech-upgrading-watson-text).





 30 November 2021 (Version 4.0.3) 

Version 4.0.3 is now available
: Text to Speech for IBM Cloud Pak for Data version 4.0.3 is now available. This version supports IBM Cloud Pak for Data version 4.x and Red Hat OpenShift versions 4.6 and 4.8.
netapp-trident change log 

Review the version history for the netapp-trident Satellite storage template.



  Version 22.10 



  Revision 1, released 20 February 2023 



*  Resolves the following CVEs: [CVE-2022-47629](https://nvd.nist.gov/vuln/detail/CVE-2022-47629)
*  Updates the UBI to version 8.7-1049.1675784874.
*  Updates Go to version 1.18.9.
*  Initial release.









  Version 22.04 



  Revision 3, released 23 January 2023 



*  Removes the PodSecurityPolicy as Kubernetes v1.25+ does not support PSPs.









  Version 21.04 



  Revision 4, released 23 January 2023 



*  Removes the PodSecurityPolicy as Kubernetes v1.25+ does not support PSPs.
SI-2 (3) - Time to Remediate Flaws / Benchmarks for Corrective Actions 



  Control requirements 

The organization:

SI-2 (3) (a)
:   Measures the time between flaw identification and flaw remediation; and

SI-2 (3) (b)
:   Establishes [Assignment: organization-defined benchmarks] for taking corrective actions.





  NIST supplemental guidance 

This control enhancement requires organizations to determine the current time it takes on the average to correct information system flaws after such flaws have been identified, and subsequently establish organizational benchmarks (i.e., time frames) for taking corrective actions. Benchmarks can be established by type of flaw and/or severity of the potential vulnerability if the flaw can be exploited.
* The alternate Liberty runtime GA version [20.0.0.2](https://openliberty.io/blog/2020/02/14/preview-microprofile-3-3-20002.html) was added.
* The alternate Liberty runtime version 20.0.0.2 includes a fix for the [CVE-2019-12406 security vulnerability](https://www.ibm.com/support/pages/node/1288774).
* The alternate Liberty runtime version 20.0.0.2 includes a fix for the [CVE-2019-4720 security vulnerability](https://www.ibm.com/support/pages/node/1285372).



To use the alternate Liberty runtime set the following environment variables:

ibmcloud cf set-env <appName> JBP_CONFIG_LIBERTY "version: +"
ibmcloud cf set-env <appName> IBM_LIBERTY_MONTHLY true



* The IBM JRE version was updated to 8 SR6FP5.
* The AdoptOpenJDK OpenJ9 alternate JRE was updated to version 11.0.6_10_openj9-0.18.1.







 9 January 2020 

Updated Liberty buildpack v3.40-20200108-1523
: The default Liberty runtime GA version is [19.0.0.12](https://openliberty.io/blog/2019/12/06/microprofile-32-health-metrics-190012.html) release.



* The alternate Liberty runtime GA version [20.0.0.1](https://openliberty.io/blog/2020/01/17/openshift-oauth-server-social-login-liberty-20001.html) was added.
* The IBM JRE version was updated to 8 SR6.







 18 December 2019 

Updated the ASP.NET Core buildpack v2.5-20191209-1920
: This release includes version 2.3.2 of the dotnet-core Cloud Foundry buildpack.
: The alternate Liberty runtime GA version is changed to the [21.0.0.5](https://openliberty.io/blog/2021/05/14/ldap-multipart-21005.html) release.



* The default Liberty runtime GA version remains the same [21.0.0.3](https://openliberty.io/blog/2021/03/19/microprofile-4-21003.html) release.
* The alternate Liberty runtime version [21.0.0.5](https://openliberty.io/blog/2021/05/14/ldap-multipart-21005.html) includes a fix for the [CVE-2021-26296)](https://www.ibm.com/support/pages/node/6441433) security vulnerability.
* To specify the monthly runtime set the following two variables:

ibmcloud cf set-env <yourappname> JBP_CONFIG_LIBERTY "version: +"
ibmcloud cf set-env <yourappname> IBM_LIBERTY_MONTHLY true
* For more information see [Use the monthly runtime](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-using_monthly_runtime)
* The AdoptOpenJDK OpenJ9 alternate JRE (11.0.11_9_openj9-0.26.0) and IBM JRE Version (8 SR6 FP26) remains unchanged







 9 April 2021 

Updated Liberty buildpack v3.56-20210412-1223
: The alternate Liberty runtime GA version is changed to the 21.0.0.4 release.



* The alternate Liberty runtime version 21.0.0.4 includes a fix for the [CVE-2021-26296](https://www.ibm.com/support/pages/node/6441433) security vulnerability.
* To specify the monthly runtime set the following two variables:
* Resolve the undefined Secure Gateway Client fixpack info in gateway panel









 v1.8.0 Fixpack 6 

Published date: 2018-03-06



 Fixes 



* Enhance the logs
* Resolve unexpected behaviour in docker version









 v1.8.0 Fixpack 5 

Published date: 2018-02-13



 Fixes 



* Resolve the corrupted header
* Enhance the error log









 v1.8.0 Fixpack 4 

Published date: 2017-11-10



 Fixes 



* Resolve ACL configuration issue









 v1.8.0 Fixpack 3 

Published date: 2017-10-30



 Fixes 



* Resolve the truncated message
* Resolve the hang connection
* Add option to define timeout on destination









 v1.8.0 Fixpack 2 

Published date: 2017-08-17



 Fixes 



* Resolve issue when the connection closed by the cloud side
* Resolve issue related to the host header









 v1.8.0 Fixpack 1 

Published date: 2017-08-03



 Fixes 



* Resolve Docker version Secure Gateway Client UI issue
* Enhance error log when error occur on server side
* Resolve connection issue between Secure Gateway Client and Secure Gateway Server









 v1.8.0 

Published date: 2017-07-06



 Features 



* Performance improvement
* Add Secure Gateway Client reconnect logic









 v1.7.1 

Published date: 2017-05-23



 Features 



* Resolve Secure Gateway Client UI vulnerability
* Resolve issue related to UDP connections
* Resolve issue related to quality test
* Refactor log generater
* Add the startup option to define the proxy for the 9000 ws connection
* Fixes EADDRINUSE error caused by listeners that do not execute a teardown appropriately when a destination is deleted.
* Resolve issue where service instances bound to an application could not be deleted.









 v1.7.0 

Published date: 2017-03-16



 Features 



* Introduces new service plans: Essentials, Professional, and Enterprise.
* The Secure Gateway Client now supports SOCKS proxy between itself and the on-prem destination.









 v1.6.1
(https://cloud.ibm.com/docs/openshift?topic=openshift-debug_storage_filedebug_storage_file_pvc)
* [Checking and updating the oc CLI version](https://cloud.ibm.com/docs/openshift?topic=openshift-debug_storage_filedebug_storage_file_cli)



[What permissions do I need to manage storage and create PVCs?](https://cloud.ibm.com/docs/openshift?topic=openshift-missing_permissionsmissing_permissions)

[File storage and block storage: Why does my PVC remain in a pending state?](https://cloud.ibm.com/docs/openshift?topic=openshift-file_pvc_pendingfile_pvc_pending)

[Why can't my app access or write to PVCs?](https://cloud.ibm.com/docs/openshift?topic=openshift-file_app_failuresfile_app_failures)

[Why does my app fail with a group ID error for NFS file storage permissions?](https://cloud.ibm.com/docs/openshift?topic=openshift-rootroot)

[Why does my app fail when a non-root user owns the NFS file storage mount path?](https://cloud.ibm.com/docs/openshift?topic=openshift-nonrootnonroot)

[Why can't I add non-root user access to persistent storage?](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_storage_nonrootcs_storage_nonroot)



* [Verifying the read and write permissions for the non-root user](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_storage_nonrootverify-rw-permissions)
The image is created in your private registry. You can run the ibmcloud cr images command to verify that the image was created.

REPOSITORY NAMESPACE TAG DIGEST CREATED SIZE VULNERABILITY STATUS
us.icr.io/namespace/cf-py namespace latest cb03170b2cb2 3 minutes ago 271 MB OK







 Step 3: Deploy a container from your image 

Deploy your app as a container in a Kubernetes cluster.



1. Create a configuration YAML file that is named cf-py.yaml and update <registry_namespace> with the name of your private image registry. This configuration file defines a container deployment from the image that you created in the previous lesson and a service to expose the app to the public.

apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: cf-py
name: cf-py
namespace: default
spec:
selector:
matchLabels:
app: cf-py
replicas: 1
template:
metadata:
labels:
app: cf-py
spec:
containers:
- image: us.icr.io/<registry_namespace>/cf-py:latest
name: cf-py

---
apiVersion: v1
kind: Service
metadata:
name: cf-py-nodeport
labels:
app: cf-py
spec:
selector:
app: cf-py
type: NodePort
ports:
- port: 5000
nodePort: 30872
Show more



Table 2. Understanding the YAML file components

 Parameter Description 

 image In us.icr.io/<registry_namespace>/cf-py:latest, replace <registry_namespace> with the namespace of your private image registry. If you are unsure what your namespace is, run the ibmcloud cr namespaces command to find it. 
 nodePort Expose your app by creating a Kubernetes service of type NodePort.
Osaka (jp-osa) Yes 
 Sydney (au-syd) Yes 
 Tokyo (jp-tok) Yes 





Table 3. The automatic collection of Container Registry service logs in the Europe locations

 Locations in Europe Are platform services logs available? 

 Frankfurt (eu-de) Yes 
 London (eu-gb) Yes 





Table 4. The automatic collection of Container Registry service logs for Global

 Location for Global Are platform services logs available? 

 Global Yes 



For more information about where to see Container Registry service logs, see [Where to look for IBM Log Analysis logs](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_logsregistry_logs_region).

For more information about the locations where IBM Cloud services are enabled to send platform logs to IBM Log Analysis, see [IBM Cloud services that generate IBM Log Analysis logs by location](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-cloud_services_locations).





 Where to look for IBM Log Analysis logs 

The [region](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_regions) in which an IBM Cloud Container Registry or a Vulnerability Advisor log entry is available corresponds to the region of the IBM Cloud Container Registry that generated the log, except for ap-south. Logs for ap-south show in Tokyo (jp-tok).

The following table shows the location of IBM Log Analysis logs.



Table 5. Location of IBM Log Analysis logs

 Region for your account's registry Domain name of your registry Location of IBM Log Analysis logs 

 ap-south au.icr.io Tokyo (jp-tok) 
 ap-north jp.icr.io Tokyo (jp-tok) 
 br-sao br.icr.io Sao Paulo (br-sao) 
 ca-tor ca.icr.io Toronto (ca-tor) 
 eu-central de.icr.io Frankfurt (eu-de) 
 jp-osa jp2.icr.io Osaka (jp-osa) 
 uk-south uk.icr.io London (eu-gb)
: The URL of the Relying Party Trust identifier, for example urn:sharepoint:sample. If unspecified, the following value is used: https://<sharepoint_server>:<port>/_trust/. This feature is available in the 2013, 2016, and 2019 versions.
9. In the Specify what you want to crawl section, add the SharePoint web service URL to the Web Application Url field. For example, https://<host>:<port>.
10. Optional: If you are using a proxy server to access the data source server, then in the Proxy settings section, set the Enable proxy settings switch to On. Add values to the following fields:

Username
: Optional. The proxy server username to authenticate, if the proxy server requires authentication. If you do not know your username, you can obtain it from the administrator of your proxy server.

Password
: Optional. The proxy server password to authenticate, if the proxy server requires authentication. If you do not know your password, you can obtain it from the administrator of your proxy server.

Proxy server host name or IP address
: The hostname or the IP address of the proxy server.

Proxy server port number
: The network port that you want to connect to on the proxy server.
11. Optional: If you want to activate document-level security, in the Security section, set the Enable Document Level Security switch to On.

When this option is enabled, your users can crawl and query the same content that they can access when they are logged in to SharePoint. Complete the [prerequisite steps](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-connector-sharepoint-onprem-cp4dconnector-sharepoint-onprem-cp4d-prereq) to add support.

When you enable this option, you must provide values for the following fields:

LDAP server URL
: The LDAP server URL to connect to, for example ldap://<ldap_server>:<port>.

LDAP binding username
[False positives and PCEs](https://cloud.ibm.com/docs-content/v1/content/5eb88a2575e30e316dbb83829c7f4c8b1ddbc67c/devsecops/images/vuln-uc-3.svg)

Figure 5. False positives and PCEs





 Use case 4: automatically closing fixed issues 

Periodically running the CC pipeline can close issues that are open and have a due date set. Also, the relevant vulnerability cannot be found in scans.

Zoom

![Automatically closing fixed issues](https://cloud.ibm.com/docs-content/v1/content/5eb88a2575e30e316dbb83829c7f4c8b1ddbc67c/devsecops/images/vuln-uc-4.svg)

Figure 6. Automatically closing fixed issues







 Setting the due date for incident issues 

If the incident issues are found in production, the Due Date property might be added to the issue to specify the grace period in which it must be fixed. The duration of the grace period is determined by the severity of the found vulnerability.

For more information about customizing the grace periods, see [Configuring custom grace periods on the CC pipeline](https://cloud.ibm.com/docs/devsecops?topic=devsecops-incident-issuesconfigure-custom-grace-period).





 Labeling incident issues 

Incident issues that are created by the continuous integration (CI) or continuous compliance (CC) pipelines can have default labels.



 Labels for incident issues discovered by Code Risk Analyzer 

Code Risk Analyzer (CRA) detects multiple types of vulnerabilities, like app dependency and image vulnerability.

The type of vulnerability can be of the following: nameos, python, js, golang, or java.

If the type of vulnerability is of type os, an os-vulnerability label is attached to the issue. For any other type of vulnerability, an app-vulnerability label is attached to the issue.





 Labels for incident issues with available fixes
The diagram shows each tool integration in its lifecycle phase in the toolchain.
3. Review the default information for the toolchain settings. The toolchain's name identifies it in IBM Cloud. If you want to use a different name, change the toolchain's name.
4. In the Tool Integrations section, select each tool integration that you want to configure for your toolchain. A few of the tool integrations do not require configuration. For more information about configuring the tool integrations, see [Configuring tool integrations](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-integrations).
5. Click Create. Several steps run automatically to set up your toolchain. For example, when you create a toolchain from an app on IBM Cloud Public, these steps are run:



* The toolchain is created.
* If you configured Delivery Pipeline, the pipelines are created and triggered.
* If you configured GitHub, the sample GitHub repo is cloned into your GitHub account.









 Creating a toolchain with the API 



1. [Obtain an IAM bearer token](https://cloud.ibm.com/apidocs/toolchainauthentication). Alternatively, if you are using an SDK, [obtain an IAM API key](https://cloud.ibm.com/iam/apikeys) and set the client options by using environment variables.

export CD_TOOLCHAIN_AUTH_TYPE=iam && export CD_TOOLCHAIN_APIKEY={iam_api_key} && export CD_TOOLCHAIN_URL={base_url}
2. [Look up the ID of the resource group](https://cloud.ibm.com/apidocs/resource-controller/resource-managerlist-resource-groups) in which you want to create your toolchain.
3. Choose the region in which you want to create your toolchain.
4. Create an instance of the toolchain.
For more information about where to see Container Registry events, see [Where to look for events](https://cloud.ibm.com/docs/Registry?topic=Registry-at_eventsui).

For more information about the locations where IBM Cloud services are enabled to automatically collect events, see [IBM Cloud services that generate Activity Tracker events by location](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-cloud_services_locations).





 Where to look for events 



 IBM Cloud Activity Tracker events 

The [region](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_regions) in which a Container Registry or a Vulnerability Advisor event is available corresponds to the region of the Container Registry that generated the event, except for ap-south. Events for ap-south show in Tokyo (jp-tok).

The following table shows the location of IBM Cloud Activity Tracker events.



Table 5. Location of IBM Cloud Activity Tracker events

 Region for your account's registry Domain name of your registry Location of IBM Cloud Activity Tracker events 

 ap-north jp.icr.io Tokyo (jp-tok) 
 ap-south au.icr.io Tokyo (jp-tok) 
 br-sao br.icr.io Sao Paulo (br-sao) 
 ca-tor ca.icr.io Toronto (ca-tor) 
 eu-central de.icr.io Frankfurt (eu-de) 
 jp-osa jp2.icr.io Osaka (jp-osa) 
 uk-south uk.icr.io London (eu-gb) 
 us-south us.icr.io Dallas (us-south) 



The following table shows the location of global registry IBM Cloud Activity Tracker events.



Table 6. Location of global registry IBM Cloud Activity Tracker events

 Registry Global registry Location of IBM Cloud Activity Tracker events 

 Global icr.io Dallas (us-south) 









 API methods 

The following tables list the API methods that generate an event when they are called.



 Actions that generate events for authorization 



Table 7. Actions that generate events for your authorization

 Action Description Data Event
All other images in the namespace are deleted.

For more information, see [ibmcloud cr retention-run](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_retention_run) and [Retaining images](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_retention).





 25 July 2019 

IBM Cloud Activity Tracker available for Container Registry
: Use the IBM Cloud Activity Tracker service to track how users and applications interact with the Container Registry service in IBM Cloud.

For more information, see [Auditing events for Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-at_events).





 1 July 2019 

ibmcloud cr token-add command is no longer available
: The ibmcloud cr token-add command is discontinued. You can't add registry tokens in either the CLI or the API anymore.





 27 June 2019 

Container Scanner is no longer available
: The Container Scanner is discontinued. Vulnerability Advisor still scans images that are pushed to Container Registry.





 13 June 2019 

Remove tags from images
: Remove a tag, or tags, from each specified image in Container Registry. To remove a specific tag from an image and leave the underlying image and any other tags in place, use the [ibmcloud cr image-untag](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_image_untag) command. If you want to delete the underlying image, and all its tags, use the [ibmcloud cr image-rm](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_image_rm) command instead.

For more information, see [Removing tags from images in your private repository](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_images_registry_images_untag).





 13 May 2019 

End of support for Container Scanner
: Container Scanner is now deprecated and is no longer usable.





 2 April 2019