vania-janet/multiturn-rag-retrieval-data huggingface dataset:
[2019-04-18 16:01:54,357] [backup : 129] [INFO] Full backup completed
[2019-04-18 16:01:54,357] [backup : 130] [INFO] Local and Remote metadata are synchronized, no sync needed.
Last full backup date: none
--------------[ Backup Statistics ]--------------
StartTime 1555603313.31 (Thu Apr 18 16:01:53 2019)
EndTime 1555603313.32 (Thu Apr 18 16:01:53 2019)
ElapsedTime 0.01 (0.01 seconds)
SourceFiles 3
SourceFileSize 20495 (20.0 KB)
NewFiles 3
NewFileSize 20495 (20.0 KB)
DeletedFiles 0
ChangedFiles 0
ChangedFileSize 0 (0 bytes)
ChangedDeltaSize 0 (0 bytes)
DeltaEntries 3
RawDeltaSize 15 (15 bytes)
TotalDestinationSizeChange 183 (183 bytes)
Errors 0
-------------------------------------------------

[2019-04-18 16:01:54,357] [backup : 162] [INFO] Scheduling backup as per configurations, please don't stop this program or run this in background !!!
[2019-04-18 16:01:54,358] [backup : 166] [INFO] Schedule info is: ['daily']
[2019-04-18 16:01:54,358] [backup : 172] [INFO] Scheduled for daily!!!



7. Verify that your data is successfully backed up or restored.



* Backup:



1. Find your IBM Cloud Object Storage service instance in the [IBM Cloud resource list](https://cloud.ibm.com/resources).
2.
If you don't assign a key ring, the key will be added to the default key ring. For more information about key rings, see [Managing key rings](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-managing-key-rings). 
 Key material The base64 encoded key material, such as an existing key-wrapping key, that you want to store and manage in the service. For more information, see [Base64 encoding your key material](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-import-root-keysencode-key-material-root-key). Ensure that the key material meets the following requirements:<br><br><br><br> * The key must be 16, 24, or 32 bytes long, corresponding to 128, 192, or 256 bits.<br> * The key must be base64-encoded.<br><br><br> 
 Expiration date (Optional) Set the date and time when the key gets expired. After the expiration date, the key moves into the Deactivated state. For more information about key state, see [Monitoring the lifecycle of encryption keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-key-states). 
 Description (Optional) Add an extended description for your key. It needs to be two to 240 characters in length. 



6. When you finish filling out the key's details, click Import key to confirm.







 Importing root keys with the API 

Import symmetric keys to Hyper Protect Crypto Services by making a POST call to the following endpoint.

https://api.<region>.hs-crypto.cloud.ibm.com:<port>/api/v2/keys



1. [Retrieve your service and authentication credentials to work with keys in the service](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-kms-api).
2.
$ ibmcloud kp key restore $KEY_ID -k $ENCRYPTED_KEY -n $ENCRYPTED_NONCE -v $IV --output json

{
"id": "c42c6f2c-8b67-4016-b2c3-99fba9490f5d",
"name": "my-imported-root-key",
"type": "application/vnd.ibm.kms.key+json",
"extractable": false,
"state": 1,
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:a192d603-0b8d-452f-aac3-f9e1f95e7411:key:c42c6f2c-8b67-4016-b2c3-99fba9490f5d"
}

 list keys - verify the key was restored
$ ibmcloud kp keys

Retrieving keys...
OK
Key ID Key Name
c42c6f2c-8b67-4016-b2c3-99fba9490f5d my-imported-root-key







 Required parameters 

KEY_ID
: The ID of the key that you want to restore.





 Optional parameters 

-n, --encrypted-nonce
: Verify a request to import a key by providing an encrypted nonce.

For more information, see [kp import-token nonce-encrypt](#kp-import-token-nonce-encrypt).







 kp key rotate 

[Rotate a root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-rotate-keys) that is stored in your Key Protect service.

When you rotate your root key, you replace the key with a new key material.
When you see the ... backup completed message in the event logs, your backup completed successfully.

oc logs ibm-storage-backup

Example output for daily backups.

[2019-04-18 16:01:51,157] [utilities : 151] [INFO] Start logging to ./Backup.log
[2019-04-18 16:01:51,158] [backup : 48] [INFO] Starting backup:
[2019-04-18 16:01:51,158] [configureOS : 66] [INFO] Configuring duplicity with IBM CloudObjectStorage i.e s3.
[2019-04-18 16:01:51,158] [backup : 62] [INFO] Configuration done!!!
[2019-04-18 16:01:51,158] [backup : 78] [INFO] Got all required input from config file!!
[2019-04-18 16:01:52,366] [backup : 119] [WARNING] Incremental backup was not created
[2019-04-18 16:01:52,366] [backup : 120] [INFO] duplicity --no-encryption incremental /myvol s3://s3.us-south.cloud-object-storage.appdomain.cloud/mybucket/helm-backup command failed due to Fatal Error: Unable to start incremental backup. Old signatures not found and incremental specified

[2019-04-18 16:01:52,367] [backup : 121] [INFO] A full backup is required before incremental backups can begin. Creating a one-time full backup and will run incremental backups for scheduled backups.
[2019-04-18 16:01:54,357] [backup : 129] [INFO] Full backup completed
[2019-04-18 16:01:54,357] [backup : 130] [INFO] Local and Remote metadata are synchronized, no sync needed.
Last full backup date: none
--------------[ Backup Statistics ]--------------
"created_at": "2022-03-09T11:37:24Z",
"updated_at": "2022-03-09T11:37:27Z",
"created_by": "IBMid-1308197YB4",
"updated_by": "IBMid-1308197YB4",
"referenced_keystores": ],
"instances":
{
"id": "3235c1b2-c62b-46e8-a5ce-acd7a8b2c52e",
"label_in_keystore": "AZURE-EXAMPLE-KEY",
"keystore": {
"group": "Production",
"type": "azure_key_vault"
}
}
],
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/managed_keys/8cacc6c9-a4ac-43b7-88c0-cf94765f4bf9"
},
{
"id": "3dab42dc-6941-4841-8d27-4dabcc5aa09e",
"vault": {
"id": "5295ad47-2ce9-43c3-b9e7-e5a9482c362b",
"name": "Test Vault Name",
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/vaults/5295ad47-2ce9-43c3-b9e7-e5a9482c362b"
},
"template": {
"id": "93777bca-baef-4070-b9b5-a2e6079df1b4",
"name": "IBM-CLOUD-EXAMPLE-TEMPLATE"
* hs-crypto.keystore.listkeystoresbyids
* hs-crypto.keystore.listkeysbyids



For instructions on creating custom roles, see [Creating custom roles](https://cloud.ibm.com/docs/account?topic=account-custom-roles).



 Viewing EP11 certificate list 

To view a list of created EP11 certificates, on the Hyper Protect Crypto Services dashboard, select the EP11 certificates tab in the side menu.

An EP11 certificate table is displayed with the following details.

To customize how the table is to be presented, click the Settings icon![Settings icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/settings.svg) and check the columns to be displayed.



Table 1. The properties displayed in the EP11 certificates table

 Property Description 

 Common name A human-readable alias for easy identification of your certificate. The certificate name might not be unique. You can assign multiple certificates with the same name. 
 Organization The organization that the certificate belongs to. 
 Organizational unit The organization unit that the certificate belongs to. 
 Country The country where the certificate locates. 
 State or province The state or province where the certificate locates. 
 Locality The specific location where the certificate locates. 
 Serial number The serial number of the certificate. 
 Certificate type The type of the certificate. Three certificate types are available: X.509 public key certificate, WTLS public key certificate, and X.509 attribute certificate. 
 Certificate category The category of the certificate. Available certificate categories are: user certificate, CA certificate, and other end-entity certificate. By default, the category is unspecified. 
 Issue date The date when the certificate is issued. 
 Expiration date The expiration date of the certificate. If the certificate is expired, an error icon is displayed. 
 Issuer The issuer of the certificate. 
 Label The description of the certificate. 
 Version The version number of the certificate. 
 Keystore The keystore ID where the certificate is stored.
Depending on [the method that you use to load the master key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-instance-mode), the master key is stored in different locations. 
 Root key 256-bit AES Root keys are primary resources in Hyper Protect Crypto Services and are protected by the master key. They are symmetric key-wrapping keys that are used as roots of trust for wrapping (encrypting) and unwrapping (decrypting) other data encryption keys (DEKs) that are stored in a data service. This practice of root key encryption is also called envelope encryption. For more information, see [Protecting your data with envelope encryption](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-envelope-encryption). 
 Data encryption key (DEK) Controlled by the data service Data encryption keys are used to encrypt data that is stored and managed by other customer-owned applications or data services. Root keys that you manage in Hyper Protect Crypto Services serve as wrapping keys to protect DEKs. For services that support the integration of Hyper Protect Crypto Services for envelope encryption, see [Integrating IBM Cloud services with Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-integrate-services). 



* How does EP11 differ from PKCS #11?

Enterprise PKCS #11 (EP11) is aligned with PKCS #11 in terms of concepts and functions. An experienced PKCS #11 developer can easily start using EP11 functions. However, they have the following major differences:



* EP11 is built to allow high availability and scalability by design.
* EP11 is a stateless protocol, whereas PKCS #11 is stateful. The stateless design of EP11 allows for the use of external keystores as well as scaling to multiple backends.
* EP11 over gRPC (GREP11) defines a network protocol that can be directly used in cloud applications.



For more information, see
FAQs 



 How can I tell which of my File Storage for Classic volumes are encrypted? 

Look at your list of File Storage for Classic in the customer portal. You can see a lock icon next to the volume name for the volumes that are encrypted.





 If I purchased nonencrypted File Storage for Classic in a data center that was upgraded for encryption, can I encrypt my File Storage for Classic? 

File Storage for Classic that was provisioned before a data center upgrade can't be encrypted. New File Storage for Classic that was provisioned in upgraded data centers is automatically encrypted. It's automatic, not a provisioning setting that can be selected or left out. Data on nonencrypted storage can be encrypted by creating a new volume, then copying the data to the new encrypted volume with host-based migration. For more information, see [Migrating File Storage for Classic](https://cloud.ibm.com/docs/FileStorage?topic=FileStorage-migratestorage).





 How do I know whether I'm provisioning File Storage for Classic in an upgraded data center? 

In the File Storage for Classic order form, all upgraded data centers are denoted with an asterisk (). During the ordering process, you're given an indication that you're provisioning storage with encryption. When the storage is provisioned, you can see an icon in the storage list that shows that volume as encrypted.

All encrypted volumes and file shares are provisioned in upgraded data centers only. You can find a full list of upgraded data centers and available features [here](https://cloud.ibm.com/docs/FileStorage?topic=FileStorage-selectDC).





 How can I find the correct mount point for my File Storage for Classic? 

All encrypted File Storage for Classic volumes that are provisioned in the enhanced data centers have a different mount point than nonencrypted volumes. To ensure that you're using the correct mount point, view the mount point information in the Volume Details page in the UI.
* disk_encryption_key_crn - The CRN of a KMS key (for example, [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-get-started) or [Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-about)), which is then used for disk encryption. A KMS key CRN is in the format crn:v1:<...>:key:<id>.
* backup_encryption_key_crn - The CRN of a KMS key (for example, [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-get-started) or [Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-about)), which is then used for backup encryption. A KMS key CRN is in the format crn:v1:<...>:key:<id>.

To use a key for your backups, you must first [enable the service-to-service delegation](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protectbyok-for-backups).
* members_memory_allocation_mb - Total amount of memory to be shared between the database members within the database. For example, if the value is "6144", and there are three database members, then the deployment gets 6 GB of RAM total, giving 2 GB of RAM per member. If omitted, the default value is used for the database type is used.
* members_disk_allocation_mb - Total amount of disk to be shared between the database members within the database. For example, if the value is "30720", and there are three members, then the deployment gets 30 GB of disk total, giving 10 GB of disk per member. If omitted, the default value for the database type is used.
* members_cpu_allocation_count - Enables and allocates the number of specified dedicated cores to your deployment.
Depending on [the method that you use to load the master key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-instance-mode), the master key is stored in different locations. 
 Root key 256-bit AES Root keys are primary resources in Hyper Protect Crypto Services and are protected by the master key. They are symmetric key-wrapping keys that are used as roots of trust for wrapping (encrypting) and unwrapping (decrypting) other data encryption keys (DEKs) that are stored in a data service. This practice of root key encryption is also called envelope encryption. For more information, see [Protecting your data with envelope encryption](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-envelope-encryption). 
 Data encryption key (DEK) Controlled by the data service Data encryption keys are used to encrypt data that is stored and managed by other customer-owned applications or data services. Root keys that you manage in Hyper Protect Crypto Services serve as wrapping keys to protect DEKs. For services that support the integration of Hyper Protect Crypto Services for envelope encryption, see [Integrating IBM Cloud services with Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-integrate-services). 







 How does EP11 differ from PKCS 11? 

Enterprise PKCS #11 (EP11) is aligned with PKCS #11 in terms of concepts and functions. An experienced PKCS #11 developer can easily start using EP11 functions. However, they have the following major differences:



* EP11 is built to allow high availability and scalability by design.
* EP11 is a stateless protocol, whereas PKCS #11 is stateful. The stateless design of EP11 allows for the use of external keystores as well as scaling to multiple backends.
* EP11 over gRPC (GREP11) defines a network protocol that can be directly used in cloud applications.



For more information, see
Warning hs-crypto.managed-keys.write<br><br>Note that when this event is triggered to change the key state to destroyed, the severity level is Critical instead of Warning. 
 Normal hs-crypto.managed-keys.list<br><br>hs-crypto.managed-keys.read<br><br>hs-crypto.target-keystores.write<br><br>hs-crypto.target-keystores.list<br><br>hs-crypto.target-keystores.read<br><br>hs-crypto.vaults.list<br><br>hs-crypto.vaults.write<br><br>hs-crypto.vaults.read<br><br>hs-crypto.keystore.createkeystore<br><br>hs-crypto.keystore.listkeysbyattributes<br><br>hs-crypto.keystore.listkeysbyids<br><br>hs-crypto.keystore.listkeystoresbyattributes<br><br>hs-crypto.keystore.listkeystoresbyids<br><br>hs-crypto.keystore.storenewkey<br><br>hs-crypto.ep11.use 



The following table lists the status codes that are associated with each severity level.



Table 18. Severity level for Hyper Protect Crypto Services response status codes

 Severity Status code 

 Critical 400 (For TKE events only), 401, 403, 500, 503, 507 
 Warning 400, 409, 424, 502, 504, 505
"lastRotateDate": "2020-03-12T03:49:01Z",
"keyVersion": {
"id": "2291e4ae-a14c-4af9-88f0-27c0cb2739e2",
"creationDate": "2020-03-12T03:50:12Z"
},
"dualAuthDelete": {
"enabled": false
},
"deleted": false
}
]
}

The keyVersion attribute contains identifying information that describes the latest version of the root key.

You can also list the versions that are available for the key by using the Hyper Protect Crypto Services key management service API. To learn more, see [Viewing key versions](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-key-versions).





 Using an import token to rotate a key 

If you initially imported a root key by using an import token, you can rotate the key by making a POST call to the following endpoint.

https://api.<region>.hs-crypto.cloud.ibm.com:<port>/api/v2/keys/<key_ID>/actions/rotate



1. [Retrieve your authentication credentials to work with keys in the service](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-kms-api).

To rotate a key, you must be assigned a Writer or Manager access policy for the instance or key. To learn how IAM roles map to Hyper Protect Crypto Services service actions, check out [Service access roles](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-accessservice-access-roles).
2. Retrieve the ID of the key that you want to rotate.

You can retrieve the ID for a specified key by making a GET /v2/keys request, or by viewing your keys in the IBM Cloud console.
3.
To secure your envelope encryption workflow, [rewrap your DEKs](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rewrap-keys) after you rotate a root key so that your at-rest data is protected by the newest root key. Alternatively if Hyper Protect Crypto Services detects that you're using retired root key material to unwrap a DEK, the service automatically reencrypts the DEK and returns a wrapped data encryption key (WDEK) that's based on the latest root key. Store and use the new WDEK for future unwrap operations that the DEKs are protected with the newest root key material.

To learn how to use the Hyper Protect Crypto Services key management service API to rewrap data encryption keys, see [Rewrapping keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rewrap-keys).







 Frequency of root key rotation 

After you generate a root key in Hyper Protect Crypto Services, you decide the frequency of the rotation. You might want to rotate your keys due to personnel turnover, process malfunction, or according to your organization's internal key expiration policy.

Rotate your keys regularly, for example every 30 days, to meet cryptographic best practices.



Table 2. Rotation frequency options for rotating keys in Hyper Protect Crypto Services

 Rotation type Frequency Description 

 [Policy-based root key rotation](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-rotation-policy) Every 1 - 12 months Choose a rotation interval between 1 - 12 months for your key based on your on-going security needs. After you set a rotation policy for a key, the clock starts immediately based on the initial creation date for the key. For example, if you set a monthly rotation policy for a key that you created on 2019/02/01, Hyper Protect Crypto Services automatically rotates the key on 2019/03/01.
These statuses also appear in the CLI and UI. For more information, see [Disabling root keys](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managingbyok-disable-root-keys) and [Deleting root keys](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managingbyok-delete-root-keys). For information on key states and resource statuses, see [User actions that impact root key states and resource status](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managingbyok-root-key-states).
: The Washington D.C. multi-zone region will be enabled in January 2021. This feature is available in all other multi-zone regions.





 18 December 2020 

Bring you own license (Beta)
: You can now bring your own license (BYOL) when you import a custom image to IBM Cloud VPC. This is a Beta feature that is available for evaluation and testing purposes. Contact your IBM Sales representative if you are interested in getting access. For more information, see [Bring your own license (Beta)](https://cloud.ibm.com/docs/vpc?topic=vpc-byol-vpc-about).





 17 December 2020 

Checksum (SHA256) for imported images (Beta)
: Now when you import a custom image, you can view the checksum that's generated for the image when it is imported to IBM Cloud VPC. If you generate a checksum locally for your image before importing it, you can compare the two checksums to ensure that they are identical. For more information, see [Validating a custom image after importing (Beta)](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-imagesvalidate-custom).

UI enhancements
: Default boot volume names are now appended with a millisecond timestamp.





 11 December 2020 

VPN logging and auditing
ibmcloud hpcs uko vault-update 
--id=06ce6d7e-9edb-431b-8a96-e88e8a4b266b 
--if-match=2022-05-11T14:58:26Z 
--description='Updated description of the vault' 
--name="Jakub's Vault" 
--output json
* Output

The command returns the output similar to the following example:

ETag
2022-05-20T15:27:01Z
{
"id": "5295ad47-2ce9-43c3-b9e7-e5a9482c362b",
"name": "Test Vault Name",
"description": "'Test Vault Name' description.",
"created_at": "2022-03-09T10:57:43Z",
"updated_at": "2022-03-09T10:57:43Z",
"created_by": "IBMid-1308197YB4",
"updated_by": "IBMid-1308197YB4",
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/vaults/5295ad47-2ce9-43c3-b9e7-e5a9482c362b"
}









 Unified Key Orchestrator CLI plug-in commands schema examples 

The following schema examples represent the data that you need to specify for some command options. These examples show the data structure and include placeholder values for the expected value types. When you run a command, replace these values with the values that apply to your environment as appropriate.



 KeyProperties 

The following example shows the format of the KeyProperties object.

{
"size" : "256",
"algorithm" : "aes",
encrypt the nonce
$ ibmcloud kp import-token nonce-encrypt -k $KEY_MATERIAL -n $NONCE

Encrypted Nonce IV
nrrCczvYXvc6T7J2G+EOLjHZO1cpPyu/nhsIlA== N6oLJnUqaKF3v5Sd

 capture the encrypted nonce and the initialization vector (IV)
$ ENCRYPTED_NONCE=nrrCczvYXvc6T7J2G+EOLjHZO1cpPyu/nhsIlA==
$ IV=N6oLJnUqaKF3v5Sd

 restore the deleted key
$ ibmcloud kp key restore $KEY_ID -k $ENCRYPTED_KEY -n $ENCRYPTED_NONCE -v $IV --output json

{
"id": "c42c6f2c-8b67-4016-b2c3-99fba9490f5d",
"name": "my-imported-root-key",
"type": "application/vnd.ibm.kms.key+json",
"extractable": false,
"state": 1,
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:a192d603-0b8d-452f-aac3-f9e1f95e7411:key:c42c6f2c-8b67-4016-b2c3-99fba9490f5d"
}

 list keys - verify the key was restored
$ ibmcloud kp keys

Retrieving keys...
OK
Key ID Key Name
c42c6f2c-8b67-4016-b2c3-99fba9490f5d my-imported-root-key







 Required parameters