Tagging Image Pushing image as: mycluster.icp:8500/blockchain-time/op-tools/op-tools:2.0.0-amd64 Processing image: op-tools/op-tools:2.0.0-s390x Tagging Image Pushing image as:  .....< Output truncated for brevity> mycluster.icp:8500/blockchain-time/fluentd:v1.4-2-amd64 Annotating manifest list: mycluster.icp:8500/blockchain-time/fluentd:v1.4-2-s390x Pushing manifest list: mycluster.icp:8500/blockchain-time/fluentd:v1.4-2 Digest: sha256:5f15171e80504fb6d5811885eeee42c6ce034852c470cff8bf25b5bb8e5dcc4d 743 OK Uploading Helm chart(s) Processing chart: charts/ibm-blockchain-platform-prod-2.0.0.tgz Updating chart values.yaml Uploading chart Loaded Helm chart OK Synch charts OK Archive finished processing 4.1.2 Setting up role-based access control (RBAC) roles for blockchain [1x per  cluster only] Note:  This setup needs to be done only once per cluster. After the initial creation, the  cluster administrator merely creates more rolebindings to the cluster roles that are created  in this section. (The administrator can use either the script or manual methods.) Kubernetes grants roles that give users or service accounts the ability to perform a set of  specified actions against specified resources. Running applications have the roles that are  bound to their service account. The IBM Blockchain Platform for Multicloud Console requires  specific roles at both the namespace and cluster level to control the deployment and  monitoring of your blockchain networks.  For the maximum amount of security, using least-privilege is important (in other words, giving  as little access as necessary). This means defining  rolebindings  rather than  clusterrolebindings  wherever possible to get these advantages: GLYPH<SM590000> You limit the privileges that are granted to the namespace scope. GLYPH<SM590000> You always grant privileges to a non-default service account in a non-default namespace  so that only pods explicitly designated to gain these extra privileges will receive them. GLYPH<SM590000> Other users cannot claim cluster-admin-like privileges for themselves. The IBM Blockchain Platform Helm chart requires that the cluster administrator bind specific  security and access policies to the target namespace before installation. We provide YAML  files that define the policies in the following steps. Save these files to your local system, and  then bind them your namespace using the IBM Cloud Private CLI. Follow the steps below  before deploying the IBM Blockchain Platform Helm chart. You have two ways to apply these policies: GLYPH<SM590000> Clone a github repository and apply the files from there. OR  Chapter 4. IBM Blockchain Platform installation and configuration  131