vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Referencing secrets and configmaps as mounted files (CLI) 

In Code Engine, after you create secrets and configmaps, the information that is stored as key-value pairs can be consumed by your job or application as a mounted file.

Working with secrets and configmaps as mounted files is similar to working with secrets and configmaps as environment variables.

When you work with secrets, data is saved as an encoded string. The data is not encoded when it is added to the environment as an environment variable or as a mounted file.



 Referencing a secret as a mounted file with the CLI 

In this scenario, create a secret and then reference the secret as a mounted file when you run an application, which uses the icr.io/codeengine/ce-secret-vol image.

The sample image, icr.io/codeengine/ce-secret-vol, reads each file in the /mysecrets directory and prints the name of the file and its contents to standard output for each request so that the output is contained in the app logs. For more information about this sample application, see the [secrets as volumes (secrets-vol) sample in the IBM Cloud Code Engine GitHub repo](https://github.com/IBM/CodeEngine/tree/main/secrets-vol).

While this scenario uses a secret, you can use the same steps to reference a configmap as a mounted file by substituting configmap for secret in the commands.



1. Create a secret, named mysecret, and specify the key-value pairs for the secret by using the --from-literal option; for example,

ibmcloud ce secret create -n mysecret --from-literal apikey=abcdefgh
2. Create the myapp application that uses the icr.io/codeengine/ce-secret-vol image. Use the --mount-secret option to mount or add the contents of the mysecret secret to the app in the /mysecrets directory. By specifying the --min-scale=1 option, the app always has an instance that is running and does not scale to zero.
"secret_id": "184408d6-8264-5ff3-c308-6922ed04ad88",
"secret_version_alias": "current",
"secret_version_id": "f2b68dbb-c291-87df-6026-7611c324c823"
}
],
"locks_total": 2
},
"wrap_info": null,
"warnings": null,
"auth": null
}







 Lock a secret version 

[Create one or more locks](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-secret-locks) on a specified version of a secret. To specify a version, use the {version_id} path parameter to provide the unique ID of the current or previous version of your secret. The aliases current or previous are also allowed.

A lock can be used to prevent a secret from being deleted or modified while it's in use by your applications. A successful request attaches a new lock to your secret, or replaces a lock of the same name if it already exists. Additionally, you can use this method to clear any matching locks on a secret by using an optional lock mode.



* lock_exclusive: Removes any other locks with matching names if they are found in the previous version of the secret.
* lock_exclusive_delete: Same as lock_exclusive, but also permanently deletes the data of the previous secret version if no locks are found.





Table 9. Lock secret request parameters

 Request parameters Description 

 name A human-readable name to assign to your secret lock. Names are unique per secret version. /n Note: Creating a lock with an existing name replaces the lock and overrides its attributes. 
 description An extended description of your secret lock. 
 attributes Optional information to associate with a lock, such as resources CRNs to be used by automation. 





 Example request 

Create a lock on the specified version of a secret in the default secret group.

curl -X POST "https://{instance_id}.
Index: 2

Hello My big literal secret from:
. ___ __ ____ ____
./ __)/ ( ( __)
( (__( O )) D ( ) _)
.___)__/(____/(____)
.____ __ _ ___ __ __ _ ____
( __)( ( / __)( )( ( ( __)
.) _) / /( (_ )( / / ) _)
(____)_)__) ___/(__)_)__)(____)

Some Env Vars:
--------------
HOME=/root
HOSTNAME=myjobrun-2-0
JOB_INDEX=2
KUBERNETES_PORT=tcp://172.21.0.1:443
KUBERNETES_PORT_443_TCP=tcp://172.21.0.1:443
KUBERNETES_PORT_443_TCP_ADDR=172.21.0.1
KUBERNETES_PORT_443_TCP_PORT=443
KUBERNETES_PORT_443_TCP_PROTO=tcp
KUBERNETES_SERVICE_HOST=172.21.0.1
KUBERNETES_SERVICE_PORT=443
KUBERNETES_SERVICE_PORT_HTTPS=443
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
PWD=/
SHLVL=1
TARGET=My big literal secret

myjobrun-3-0/myjob:
Hello from helloworld! I'm a batch job! Index: 3

Hello My big literal secret from:
.
"crn": "crn:v1:bluemix:public:secrets-manager:us-south:a/a5ebf2570dcaedf18d7ed78e216c263a:0f4c764e-dc3d-44d1-bd60-a2f7cd91e0c0:secret:ea1907c8-8c8e-6b83-3c20-05f2015b80d8",
"description": "Updated description for my secret.",
"expiration_date": "2030-04-01T09:30:00Z",
"id": "ea1907c8-8c8e-6b83-3c20-05f2015b80d8",
"labels": [
"dev",
"us-south"
],
"last_update_date": "2021-06-05T02:55:40Z",
"name": "updated-arbitrary-secret",
"secret_type": "arbitrary",
"state": 1,
"state_description": "Active"
},
"wrap_info": null,
"warnings": null,
"auth": null
}







 Rotate a secret 

Create a new version of a secret. The secret retains its identifying information, such as its name and ID. To set an automatic rotation policy for a secret, see [Set secret policies](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-vault-apivault-set-secret-policies).



Table 8. Rotate secret request parameters

 Request parameters Description 

 payload The new secret data to assign to an arbitrary or a kv secret. 
 password The new password to assign to a username_password secret. 
 certificate The new certificate to assign to an imported_cert secret. 
 private_key The new private key to assign to an imported_cert secret.
* Do not store credentials in Git repos. Depending on the repo settings, files within a repo might be visible to other members of your organization, other IBM Cloud users, or the public internet.
* Do not include user credentials in Delivery Pipeline definitions because they might be visible to other users. Specifically, do not place user credentials within Delivery Pipeline Classic job definition scripts, Delivery Pipeline Tekton yaml files, or scripts that are started by delivery pipelines.
* Do not publish user credentials in log files that are created when a pipeline runs because these files might be shared.



IBM Cloud provides several options that you can use for secure key storage and secrets.



* [Classic pipeline secure environment properties](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-deliverypipeline_about)
* [Tekton pipeline secure environment properties](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-tekton-pipelines)
* [IBM® Key Protect for IBM Cloud®](https://cloud.ibm.com/docs/key-protect?topic=key-protect-getting-started-tutorial)
* [HashiCorp Vault](https://www.vaultproject.io/)



For more information about secure DevOps best practices, see [DevOps Security](https://www.ibm.com/cloud/learn/devops-a-complete-guide?mhsrc=ibmsearch_a&mhq=Secure%20DevOpstoc-security-j2-0639C).





 Protecting your data when you use third-party tool integrations 

When you configure a tool integration for a toolchain, you explicitly enable data sharing between the Continuous Delivery service and the tool integration. The kind of data that is shared, and whether data is sent to the tool, received from the tool, or both, varies depending on the type of tool integration.

Before you configure a tool integration, make sure you understand what data is shared.
A successful response returns the ID value for the secret, along with other metadata. For more information about the required and optional request parameters, check out the [API docs](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2update-secret).





 Rotating key-value secrets 

You can rotate key-value secrets by calling the Secrets Manager API.

The following example request creates a new version of your secret. When you call the API, replace the ID variables and IAM token with the values that are specific to your Secrets Manager instance.

You can store metadata that are relevant to the needs of your organization with the custom_metadata and version_custom_metadata request parameters. Values of the version_custom_metadata are returned only for the versions of a secret. The custom metadata of your secret is stored as all other metadata, for up to 50 versions, and you must not include confidential data.

curl -X POST -H "Authorization: Bearer ${iam_token}" -H "Accept: application/json" -H "Content-Type: application/json" -d '{
"custom_metadata": {
"metadata_custom_key": "metadata_custom_value"
},
"data": {
"key1": "val2"
},
"version_custom_metadata": {
"custom_version_key": "custom_version_value"
}
}' 
"https://{instance_ID}.{region}.secrets-manager.appdomain.cloud/api/v2/secrets/{id}/versions"

A successful response returns the ID value for the secret, along with other metadata. For more information about the required and optional request parameters, check out the [API docs](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2update-secret).





 Rotating user credentials 

You can rotate secrets by calling the Secrets Manager API.

The following example request creates a new version of your secret.
In part 1 of this tutorial series, you learned how to set up Secrets Manager and Event Notifications to route events to a test webhook URL. In part 2, you replace your test webhook with a Cloud Function webhook URL, and more.



* [Part 2: Create a GitHub issue when a secret is about to expire](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-tutorial-expiring-secrets-part-2)
* [Part 3: Send your notifications to a Slack channel](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-tutorial-expiring-secrets-part-3)
(15 unchanged attributes hidden)

 (1 unchanged block hidden)
}
Unless you have made equivalent changes to your configuration, or ignored the relevant attributes using ignore_changes, the following plan may include actions to undo
Hi or respond to these changes.



3. Applying the Terraform plan syncs the user credentials password field in Terraform with the new version value.



A successful response returns the ID value for the secret, along with other metadata. For more information about the required and optional request parameters, check out the [API reference](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2create-secret).
},
"limit" : 50,
"next" : {
"href" : "https://us-south.secrets-maanger.cloud.ibm.com/88b75b20-aa21-4174-85c9-1feb3cc93c9a/api/v2/secrets?offset=150&limit=50"
},
"offset" : 100,
"secrets" : [ {
"alt_names" : "s1.example.com", ".s2.example.com" ],
"common_name" : "example.com",
"created_at" : "2020-10-05T21:33:11Z",
"created_by" : "iam-ServiceId-e4a2f0a4-3c76-4bef-b1f2-fbeae11c0f21",
"crn" : "crn:v1:bluemix:public:secrets-manager:us-south:a/a5ebf2570dcaedf18d7ed78e216c263a:f1bc94a6-64aa-4c55-b00f-f6cd70e4b2ce:secret:a931192f-b6a9-43d6-a59a-834f3003af7b",
"custom_metadata" : {
"metadata_custom_key" : "metadata_custom_value"
},
"description" : "Extended description for this secret.",
"downloaded" : false,
"expiration_date" : "2023-10-05T11:49:42Z",
"id" : "a931192f-b6a9-43d6-a59a-834f3003af7b",
"intermediate_included" : true,
"issuer" : "DigiCert",
"key_algorithm" : "RSA2048",
"labels" : "dev", "us-south" ],
For more information, see [Avoid application outages by locking your secrets](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-best-practices-rotate-secretsbest-practices-lock-secrets).







 Set up alerts for expiring secrets 

Connect to the Event Notifications service so that Secrets Manager can notify you in advance when your secrets or certificates are about to expire.



1. Set up alerts for your instance by enabling event notifications. To connect your instance to the Event Notifications service, go to the Secrets Manager UI > Settings > Event Notifications.
2. Create topics and subscriptions in Event Notifications so that alerts can be forwarded and delivered to your [selected destinations](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-event-notificationsevent-notifications-destinations), for example Slack or email.

Looking for examples? Check out our [tutorial series](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-tutorial-expiring-secrets-part-1) that guides you through sending notifications to GitHub and Slack.







 Enable automatic rotation for secrets 

Simplify the process of rotating secrets in your instance by enabling automatic rotation.



1. Use automatic rotation to limit how long your secrets remain active.

By scheduling automatic rotation of secrets at regular intervals, you reduce the likelihood of compromised credentials. When it's time to rotate the secret based on the rotation interval that you specify, Secrets Manager automatically creates a new version of your secret. For more information, see [Automatically rotating your secrets](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-automatic-rotation).
2. Schedule automatic rotation to take place before your secrets are set to expire.

To avoid interruptions to your applications, it's recommended that you set the minimum interval between automatic rotation and expiration date to 30 days.







 Avoid application outages by locking your secrets 

Use locks to plan for periodic rotation of secrets.
{region}.secrets-manager.appdomain.cloud/api/v2/secrets"

A successful response returns the ID value of the secret, along with other metadata. For more information about the required and optional request parameters, check out the [API reference](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2create-secret).



 Reusing the same API key until the lease expires 

IAM credentials consist of a service ID and an API key. By default, the service ID and API key are single-use, ephemeral values that are generated and deleted each time that an IAM credentials secret is read or accessed.

If you'd like to use those credentials through the end of the lease of your secret, you can use the reuse_api_key field. If set to true, your secret retains its current service ID and API key values and reuses them on each read while the secret remains valid. For example, the following example command creates IAM credentials that can be reused until they expire.

You can store metadata that are relevant to the needs of your organization with the custom_metadata and version_custom_metadata request parameters. Values of the version_custom_metadata are returned only for the versions of a secret. The custom metadata of your secret is stored as all other metadata, for up to 50 versions, and you must not include confidential data.

curl -X POST
-H "Authorization: Bearer {iam_token}" -H "Accept: application/json" -H "Content-Type: application/json" -d '{
{
"name": "example-iam-credentials-secret",
"description": "Description of my IAM Credentials secret",
"secret_type": "iam_credentials",
"secret_group_id": "bfc0a4a9-3d58-4fda-945b-76756af516aa",
"labels": [
"dev",
"us-south"
],
"ttl": "30m",
"access_groups": [
ibmcloud secrets-manager secret-version-lock 

Create a lock on the specified version of a secret.

A lock can be used to prevent a secret from being deleted or modified while it's in use by your applications. A successful request attaches a new lock to the specified version, or replaces a lock of the same name if it already exists. Additionally, you can use this method to clear any matching locks on a secret version by using one of the following optional lock modes:



* exclusive: Removes any other locks with matching names if they are found in the previous version of the secret.
* exclusive_delete: Same as exclusive, but also permanently deletes the data of the previous secret version if it doesn't have any locks.



For more information about locking secrets, check out the [docs](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-secret-locks).

ibmcloud secrets-manager secret-version-lock --secret-type SECRET-TYPE --id ID --version-id VERSION-ID [--locks LOCKS] [--mode MODE]



 Command options 

--secret-type (string)
: The secret type. Required.

Allowable values are: arbitrary, iam_credentials, imported_cert, public_cert, private_cert, username_password, kv.

--id (string)
: The v4 UUID that uniquely identifies the secret. Required.

The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--version-id (string)
: The v4 UUID that uniquely identifies the secret version. You can also use previous to retrieve the previous version.

Note: To find the version ID of a secret, use the Get secret metadata method and check the response details. Required.
"revocation_time_seconds" : 1667982994
}









 Secret locks 

Secure your secret data by attaching a lock to a secret version and preventing any modification or deletion.



 ibmcloud secrets-manager secrets-locks 

List the secrets and their locks in your Secrets Manager instance. Note: If the --all-pages option is not set, the command will only retrieve a single page of the collection.

ibmcloud secrets-manager secrets-locks [--offset OFFSET] [--limit LIMIT] [--search SEARCH] [--groups GROUPS]



 Command options 

--offset (int64)
: The number of secrets to skip. By specifying offset, you retrieve a subset of items that starts with the offset value. Use offset with limit to page through your available resources.

Usage: If you have 100 secrets in your instance, and you want to retrieve secrets 26 through 50, use ..?offset=25&limit=25.

The minimum value is 0.

--limit (int64)
: The number of secrets to list.

The maximum value is 1000. The minimum value is 1.

--search (string)
: Filter locks that contain the specified string in the field "name".

The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /(.?)/.

--groups ([]string)
: Filter secrets by groups.

The list items must match regular expression /^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|default)$/. The maximum length is 201 items. The minimum length is 0 items.

--all-pages (bool)
: Invoke multiple requests to display all pages of the collection for secrets-locks.





 Example 

ibmcloud secrets-manager secrets-locks --offset=0 --limit=10 --search=example --groups=default





 Example output
Secret created com.ibm.cloud.secrets-manager.secret_created One time ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) 
 Secret creation failed com.ibm.cloud.secrets-manager.secret_creation_failed One time ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) 
 Secret rotated com.ibm.cloud.secrets-manager.secret_rotated One time ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) 
 Secret rotation failed com.ibm.cloud.secrets-manager.secret_rotation_failed One time ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg)
Secret rotation blocked com.ibm.cloud.secrets-manager.secret_rotation_blocked One time<br><br>[3]<br><br> <br>Daily <br><br>[4] ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) !
The value must match regular expression /^[0-9]+[s,m,h,d]{0,1}$/.

--rotation ([RotationPolicy](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-cli-plugin-secrets-manager-clicli-rotation-policy-example-schema))
: This field indicates whether Secrets Manager rotates your secrets automatically.





 Example 

ibmcloud secrets-manager secret-metadata-update --id=0b5571f7-21e6-42b7-91c5-3f5ac9793a46 --name=updated-arbitrary-secret-name --description='updated Arbitrary Secret description' --labels=dev,us-south --custom-metadata='{"anyKey": "anyValue"}' --expiration-date=2033-04-12T23:20:50.520Z







 ibmcloud secrets-manager secret-action-create 

Create a secret action. This operation supports the following actions:.

ibmcloud secrets-manager secret-action-create --id ID --secret-action-prototype SECRET-ACTION-PROTOTYPE



 Command options 

--id (string)
: The ID of the secret. Required.

The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--secret-action-prototype ([SecretActionPrototype](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-cli-plugin-secrets-manager-clicli-secret-action-prototype-example-schema))
: The request body to specify the properties for your secret action. Required.
"secret_id": "184408d6-8264-5ff3-c308-6922ed04ad88",
"versions": [
{
"alias": "current",
"id": "f2b68dbb-c291-87df-6026-7611c324c823",
"locks":
"lock-for-app-1"
],
"payload_available": true
}
]
},
"wrap_info": null,
"warnings": null,
"auth": null
}









 Policies 



 Set secret policies 

Creates or updates an [automatic rotation policy](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-automatic-rotation) for a secret. Supported secret types include: username_password



Table 9. Set secret policy request parameters

 Request parameters Description 

 interval The length of the secret rotation time interval. 
 unit The units for the secret rotation time interval. Allowable values are: day, month 





 Example request 

Set a rotation policy on an username_password secret in the default secret group.

curl -X PUT "https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/arbitrary/secrets/{secret_id}/policies" -H 'X-Vault-Token: {Vault-Token}' -H 'Content-Type: application/json' --data-raw '{
"policies": [
{
"rotation": {
"interval": 10,
"unit": "day"
},
"type": "application/vnd.ibm.secrets-manager.secret.policy+json"
}
]
}'

Set a rotation policy on a username_password secret in an existing secret group.

curl -X PUT "https://{instance_id}.
"secrets": [
{
"domains": "domain1.com",
"event_time": "2022-01-04T00:00:00Z",
"event_triggered_by": "SecretsManager",
"secret_expiration": "2022-01-14T00:00:00Z",
"secret_group_id": "default",
"secret_id": "crn:v1:bluemix:public:secrets-manager:<region>:a/<account_id>:<instance_id>:secret:<secret_id>",
"secret_name": "my-certificate-1",
"serial_number": "1:2:3:4"
},
{
"domains": "domain2.com, domain3.com",
"event_time": "2022-01-04T00:00:00Z",
"event_triggered_by": "SecretsManager",
"secret_expiration": "2022-01-14T00:00:00Z",
"secret_group_id": "default",
"secret_id": "crn:v1:bluemix:public:secrets-manager:<region>:a/<account_id>:<instance_id>:secret:<secret_id>",
"secret_name": "my-certificate-2",
"serial_number": "1:2:3:4"
},
],
"source_instance_api_private_url": "https://<instance_id>.private.<region>.secrets-manager.appdomain.cloud/api",
"source_instance_api_public_url": "https://<instance_id>.<region>.secrets-manager.appdomain.cloud/api",