vania-janet/multiturn-rag-retrieval-data huggingface dataset:
{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/arbitrary/secrets/groups/{group_id}/{secret_id}/metadata" -H 'Accept: application/json' -H 'X-Vault-Token: {Vault-Token}'

Get metadata for a kv secret. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-vault-manage-kv).

curl -X GET 'https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/kv/secrets/{secret_id}/metadata' -H 'Accept: application/json' -H 'X-Vault-Token: {Vault-Token}'

Get metadata for a kv secret in an existing secret group.

curl -X GET 'https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/kv/secrets/groups/{group_id}/{secret_id}/metadata' -H 'Accept: application/json' -H 'X-Vault-Token: {Vault-Token}'





 Example responses 

A request to retrieve the metadata of an arbitrary secret returns the following response:

{
"request_id": "372645c0-9d97-5f6b-0755-99145eacdb93",
"lease_id": "",
"renewable": false,
"lease_duration": 0,
"data": {
"created_by": "iam-ServiceId-c0c7cfa4-b24e-4917-ad74-278f2fee5ba0",
"creation_date": "2021-06-04T02:55:40Z",
LANGUAGE: en
Show more





 Secrets for container environment variables 

Secrets provide sensitive configuration information such as passwords for your deployment workloads.

The following example shows how you can reference values from your secret as environment variables in the container spec section of your deployment YAML. You can also mount the secret as a volume. By referencing values from your secret, you can decouple this configuration information from your deployment to keep your containerized app portable.



* [Help me decide whether to use a Kubernetes ConfigMap or Secret object for variables](https://cloud.ibm.com/docs/openshift?topic=openshift-plan_deployvariables).
* To create a secret, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/secret/).



For centralized management of all your secrets across clusters and injection at application runtime, try [IBM Cloud Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-tutorial-kubernetes-secrets).

apiVersion: apps/v1
kind: Deployment
metadata:
name: wasliberty
spec:
replicas: 3
template:
...
spec:
...
containers:
- name: wasliberty
...
env:
- name: username
valueFrom:
secretKeyRef:
name: wasliberty
key: username
- name: password
valueFrom:
secretKeyRef:
name: wasliberty
key: password
...
---
apiVersion: v1
kind: Secret
metadata:
name: wasliberty
labels:
app: wasliberty
type: Opaque
data:
username: dXNlcm5hbWU=
password: cGFzc3dvcmQ=
Show more





 Persistent volumes for container storage
"version_id" : "7bf3814d-58f8-4df8-9cbd-f6860e4ca973",
"version_alias" : "current",
"locks" : "lock-3", "lock-4" ],
"payload_available" : true
}, {
"version_id" : "5bf89b0c-df55-c8d5-7ad6-8816951c6784",
"version_alias" : "previous",
"locks" : "lock-example-1", "lock-example-2" ],
"payload_available" : true
} ]
}







 ibmcloud secrets-manager secret-locks-bulk-delete 

Delete all the locks or a subset of the locks that are associated with a version of a secret.

To delete only a subset of the locks, add a query param with a comma to separate the list of lock names:

Example: ?name=lock-example-1,lock-example-2.

Note: A secret is considered unlocked and able to be deleted only after you remove all of its locks. To determine whether a secret contains locks, check the locks_total field that is returned as part of the metadata of your secret.

ibmcloud secrets-manager secret-locks-bulk-delete --id ID [--name NAME]



 Command options 

--id (string)
: The ID of the secret. Required.

The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--name ([]string)
: Specify the names of the secret locks to be deleted.

The list items must match regular expression /^[a-zA-Z]{1}[a-zA-Z0-9-_.]
,
"secret_group_id": "bc656587-8fda-4d05-9ad8-b1de1ec7e712",
"labels":
"dev","us-south"
],
"dns": "dns_provider",
"common_name": "cert_common_name"
"alt_names":
"alt_name1", "alt_name2"
],
"algorithm": "sha256WithRSAEncryption",
"key_algorithm": "rsaEncryption 2048 bit",
"rotation": {
"enabled": false,
"rotate_keys":false
},
"custom_metadata" : {
"anyKey" : "anyValue"
},
"version_custom_metadata" : {
"anyKey" : "anyValue"
},
"expiration_date" : "2030-01-01T00:00:00Z",
}
]

The command outputs the ID value of the secret, along with other metadata. For more information about the command options, see [ibmcloud secrets-manager secret-create](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-cli-plugin-secrets-manager-clisecrets-manager-cli-secret-create-command).





 Ordering public certificates with integrated DNS providers by using the API 

You can order certificates programmatically by calling the Secrets Manager API.

The following example shows a query that you can use to order a certificate. When you call the API, replace the ID variables and IAM token with the values that are specific to your Secrets Manager instance.

You can store metadata that are relevant to the needs of your organization with the custom_metadata and version_custom_metadata request parameters. Values of the version_custom_metadata are returned only for the versions of a secret. The custom metadata of your secret is stored as all other metadata, for up to 50 versions, and you must not include confidential data.
After the records are propagated, call the Secrets Manager [Invoke an action on a secret](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2update-secret) API to request Let's Encrypt to validate the challenges to your domain and create a public certificate.

curl -X POST
--header "Authorization: Bearer {iam_token}"
--header "Accept: application/json"
--header "Content-Type: application/json"
--data '{
"action_type": "public_cert_action_validate_dns_challenge"
}'
"https://{instance_ID}.{region}.secrets-manager.appdomain.cloud/api/v2/secrets/{id}/actions"

If you need to update your certificate later, you can use the [Invoke an action on a secret](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2update-secret) API but with the action rotate. However, you can't automatically rotate manual DNS provider certificates in Secrets Manager.
6. When your certificate is issued, clean up and remove the TXT records from the domains in your DNS provider account.



Want to automate the creation of your public certificates? If your domains are configured through a DNS provider, you can create a script to complete the challenges. Some DNS providers offer an API that checks whether the new records are fully transmitted. If your DNS provider doesn't offer this option, you can configure your client to wait for a specified amount of time, sometimes up to an hour. In Secrets Manager, after you call validate-dns-challenges, you can check the status of the certificate issuance by obtaining your certificate metadata. When the IssuanceInfo.State field that is returned changes to active, the certificate is issued.





 Ordering public certificates with your own DNS provider by using the CLI
{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/public_cert/config/dns_providers' -H 'X-Vault-Token: {Vault-Token}' -H 'Content-Type: application/json' -d'{
"name": "my-cis-instance",
"type": "cis",
"config": {
"cis_crn": "crn:v1:bluemix:public:internet-svcs:global:a/a5ebf2570dcaedf18d7ed78e216c263a:0f4c764e-dc3d-44d1-bd60-a2f7cd91e0c0::",
"cis_apikey": "<API_KEY>"
}
}'





 Example response 

A request to add a DNS provider configuration for the public_cert secrets engine returns the following response:

{
"request_id": "3c891ae8-18d3-f38e-5b98-dc1db2874f16",
"lease_id": "",
"renewable": false,
"lease_duration": 0,
"data": {
"config": {
"cis_apikey": "mGjiCelas...(redacted)",
"cis_crn": "crn:v1:bluemix:public:internet-svcs:global:a/a5ebf2570dcaedf18d7ed78e216c263a:0f4c764e-dc3d-44d1-bd60-a2f7cd91e0c0::"
},
"name": "my-cis-instance",
"type": "cis"
},
"wrap_info": null,
"warnings": null,
"auth": null
}







 Delete a configuration
-H 'Content-Type: application/json' -D '{
"locks": [
{
"name": "lock-for-app-1",
"description": "Test lock for secret in a custom secret group.",
"attributes": {
"key": "value"
}
},
{
"name": "lock-for-app-2",
"description": "Test lock for secret in a custom secret group.",
"attributes": {
"key": "value"
}
}
]
}'
Show more

Create a lock on the previous version of a secret in an existing secret group.

curl -X POST "https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/{secret_type}/locks/groups/{group_id}/{secret_id}/versions/previous/lock" -H 'X-Vault-Token: {Vault-Token}'
-H 'Content-Type: application/json' -D '{
"locks": [
{
"name": "lock-for-app-1",
"description": "Test lock for secret in a custom secret group.",
"attributes": {
"key": "value"
}
}
]
}'





 Example response 

A request to lock the previous version of a secret in a custom secret group

{
"request_id": "97a3d1fb-c137-9c1c-16fb-7aebf05a0eae",
"lease_id": "",
"renewable": false,
"lease_duration": 0,
"data": {
"secret_group_id": "d2e98a96-18ed-f13c-8dee-db955fb94122",
--secret-prototype='{"name": "example-iam-credentials-secret","description": "Description of my IAM credentials secret","secret_type": "iam_credentials","secret_group_id": "<secret_group_id>","labels": ["dev","us-south"],"ttl": "30m","service_id":"<service_id>","reuse_api_key": false, "custom_metadata": {"metadata_custom_key": "metadata_custom_value"},"version_custom_metadata": { "custom_version_key": "custom_version_value"}}'

The command outputs the ID value of the secret, along with other metadata. For more information about the command options, see [ibmcloud secrets-manager secret-create](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-cli-plugin-secrets-manager-clisecrets-manager-cli-secret-create-command).







 Creating IAM credentials with the API 

You can create IAM credentials programmatically by calling the Secrets Manager API.

The following example shows a query that you can use to create a dynamic service ID and API key. When you call the API, replace the ID variables and IAM token with the values that are specific to your Secrets Manager instance.

You can store metadata that are relevant to the needs of your organization with the custom_metadata and version_custom_metadata request parameters. Values of the version_custom_metadata are returned only for the versions of a secret. The custom metadata of your secret is stored as all other metadata, for up to 50 versions, and you must not include confidential data.

curl -X POST
-H "Authorization: Bearer {iam_token}" -H "Accept: application/json" -H "Content-Type: application/json" -d '{
{
"name": "example-iam-credentials-secret",
"description": "Description of my IAM Credentials secret",
"last_update_date": "2022-01-26T20:11:29Z",
"name": "test-kv-secret-from-group",
"secret_group_id": "aded0a0000e-0a0f-edfh-000a-ec2000ab00",
"secret_type": "kv",
"state": 1,
"state_description": "Active",
"versions_total": 1
},
"wrap_info": null,
"warnings": null,
"auth": null
}







 Update secret metadata 

Update the metadata of a secret, such as its name, description, or expiration date. To rotate the actual value of a secret, use [Rotate a secret](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-vault-apivault-rotate-secret).



Table 7. Update secret metadata request parameters

 Request parameters Description 

 name The updated name to assign to the secret. 
 description The updated description to assign to the secret. 
 expiration_date The updated expiration date to assign to the secret. This option is supported for the arbitrary and username_password secret types. The date format follows [RFC 3339](https://datatracker.ietf.org/doc/html/rfc3339). 





 Example requests 

Update the name of an arbitrary secret in the default secret group.

curl -X PUT "https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/arbitrary/secrets/{secret_id}/metadata" -H 'Accept: application/json' -H 'X-Vault-Token: {Vault-Token}' -d '{
"name": "updated-arbitrary-secret-name"
}'

Update the expiration date of an arbitrary secret in an existing secret group.

curl -X PUT "https://{instance_id}.
{region}.secrets-manager.test.appdomain.cloud/v1/ibmcloud/kv/metadata/?list=true" 
-H 'Accept: application/json' -H 'X-Vault-Token: {Vault-Token}'



Table 10. List the key names of a key-value secret request parameters

 Request parameter Description 

 instance_id The ID of the Secrets Manager instance. 
 region The region in which the Secrets Manager instance was created. 
 Vault-Token The authentication token that is retrieved from Vault. 







 Example response 

A request to list the key names of a key-value secret in the default secret group returns the following response:

{
"request_id": "a21993df-a4b7-21f1-95a9-c1af7be87d1b",
"lease_id": "",
"renewable": false,
"lease_duration": 0,
"data": {
"keys": [
"secret1",
"secret2"
]
},
"wrap_info": null,
"warnings": null,
"auth": null
}







 Patch a key-value secret 

Update an existing key-value secret by providing only the details that you want to change. When you patch a secret, a new version is created. Any data that you don't change remains exactly as it is in the previous version of the secret.



 Example request 

curl -X PATCH 'https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/kv/data/{secret_name}' -H 'Accept: application/json'  -H 'X-Vault-Token: {Vault-Token}' -H 'Content-Type: application/merge-patch+json' -d '{
"data": {
"key":"value"
}
}'



Table 11. Create or update a key-value secret request parameters

 Request parameter Description 

 instance_id The ID of the Secrets Manager instance.
--mount-secret, --mount-sec
: Add the contents of a secret to the file system of runs of the job by providing a mount directory and the name of a secret, with the format MOUNT_DIRECTORY=SECRET_NAME. Each mounted secret must use a unique mount directory. For each key-value pair in the secret, a file is added to the specified mount directory where the filename is the key and the contents of the file is the value of the key-value pair. Specify one mount configuration per --mount-secret option; for example, --mount-secret /etc/secret-a=secret--a --mount-secret /etc/secret-b=secret-b. This value is optional.

--no-wait, --nw
: Do not wait for the build run to complete. If you specify the --no-wait option, the build run begins and does not wait. Use the buildrun get command to check the build run status. The no-wait option is allowed only if the --build-source option is set. This value is optional. The default value is true.

--output, -o
: Specifies the format of the command output. Valid values are json, yaml, jsonpath=JSONPATH_EXPRESSION, and jsonpath-as-json=JSONPATH_EXPRESSION. Use jsonpath to specify the path to an element of the JSON output. This value is optional.

--quiet, -q
: Specify this option to reduce the output of the command. This value is optional. The default value is false.

--registry-secret, --rs
: The name of the registry secret. The registry secret is used to authenticate with a private registry when you download the container image. This value is optional.

--retrylimit, -r
: The number of times to rerun an instance of the job before the job is marked as failed. An array index of a job is rerun when it gives an exit code other than zero. This option can only be specified if mode is task. This value is optional.
For more information about adding and removing vault integrations, including prerequisites and by using hints, see [Managing IBM Cloud secrets](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-manage-secrets-ibm-cloud).

By using hints within a template, a toolchain is automatically populated with preconfigured secrets; you don't need to manually select secrets from vault integrations that are attached to the toolchain.

This tutorial uses the [IBM Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-getting-started) as the secrets vault.

Zoom

![Code Engine secure app secrets options](https://cloud.ibm.com/docs-content/v1/content/562806c0b18119f4d21cb66f5ae6d051634b4a16/ContinuousDelivery/images/code_engine_setup_secrets.png)

Figure 3. Code Engine secure app secrets options

IBM Secrets Manager securely stores and applies secrets such as API keys, Image Signature, or HashiCorp credentials that are part of your toolchain.

Zoom

![Code Engine Secrets Manager options](https://cloud.ibm.com/docs-content/v1/content/562806c0b18119f4d21cb66f5ae6d051634b4a16/ContinuousDelivery/images/code_engine_secrets_manager.png)

Figure 4. Code Engine Secrets Manager options
2. Click Continue.
: You can now integrate with the [ß[en-short]}](https://cloud.ibm.com/catalog/services/event-notifications) service so that you can manage and route all of your Secrets Manager alerts to your preferred destinations.

Currently, Secrets Manager supports notifications for certificates only. For more information, see [Enabling event notifications](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-event-notifications).





 31 January 2022 

Store key-value secrets
: You can now create key-value secrets with the Secrets Manager UI and API. For more information, see [Storing key-value secrets](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-key-value&interface=ui).





 22 November 2021 

View the version history of your secrets
: With the Secrets Manager UI, you can now check the version history of your secrets so that you can quickly understand when a secret was last rotated. For more information, see [Viewing your version history](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-version-history).

Create IAM credentials by using a service ID in your account
: In addition to using access groups to determine the access capabilities of an IAM credential, you can now create a secret by using an existing service ID in your account. You can choose this option if you need Secrets Manager to dynamically generate and manage an API key only.

For more information, see [Creating IAM credentials](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam-credentials).

Restore secrets to a previous version
: Need to roll back a secret to its previous version? If you need to revert a secret, you can now restore select secret types to a previous version.

Currently, you can restore 1 version back for IAM credentials and public certificate secrets only.
The name of the secret that you select appears in capsule form. You cannot edit the secret name inline, but you can click ![remove icon](https://cloud.ibm.com/docs-content/v1/content/562806c0b18119f4d21cb66f5ae6d051634b4a16/ContinuousDelivery/images/secret-pill-delete-16.png) to delete the name. You can also replace the existing secret name by selecting the secret name again. If you manually type or paste a secret name into the Secrets field, it is displayed in a different format:

Zoom

![Literal Secret Value](https://cloud.ibm.com/docs-content/v1/content/562806c0b18119f4d21cb66f5ae6d051634b4a16/ContinuousDelivery/images/secret-literal.png)

Figure 2. Secret value

The format that the secret is displayed in indicates whether the value references a secret that is stored in a backend vault or a secret that is stored in your toolchain. By using references to secrets that are managed by secret providers such as Secrets Manager, your secret values are centralized and stored securely in a single location. This approach resolves secrets sprawl and proliferation, and means that you can update secrets without updating your toolchain. When you use secret references, the actual secret value is resolved when the toolchain runs by dynamically retrieving it from Secrets Manager. This approach is useful when you must rotate the value of your toolchain secrets periodically.







 Using IAM credentials secrets 

The IAM credentials secret type is fully integrated with IAM. Secrets Manager auto-manages dynamic service IDs and API keys that are associated with an IAM credentials secret. Continuous Delivery and Secrets Manager service APIs engage to resolve authorized IAM Credentials secret references in Continuous Delivery toolchains and pipeline workloads.

When you create an IAM credentials secret in Secrets Manager, make sure that you select the Reuse IAM credentials until lease expires checkbox.
* Provider: The Secret Provider that stores your API Key to access the cluster, as linked to your toolchain earlier. It can be a Key Protect Instance, Secret Manager Instance, or HashiCorp Vault Instance.
* Resource Group: Resource Group that the Secrets Manager Provider belongs.
* Secret name: Name or alias of the secret, that is, API Key.



When the API Key field is filled, the registry and cluster related fields are filled automatically.

Zoom

![DevSecOps Tekton Pipeline](https://cloud.ibm.com/docs-content/v1/content/5eb88a2575e30e316dbb83829c7f4c8b1ddbc67c/devsecops/images/devsecops-cd-deployment-target.png)

Figure 15. DevSecOps Tekton Pipeline





 Inventory target and source branches 



* Inventory Source Environment: The environment from where you want to promote the application. Default: master
* Inventory Target Environment: The environment to where you want to deploy the application. Default: prod
* Target Region: The target region to where the application is deployed(Optional)
* Emergency Label for change request PRs and issues: Label on Change Request to be used for Emergency deployment







 Change Request Management 

You can select IBM Cloud hosted Git Repos and Issue Tracking repository to manage Change Requests.

Zoom

![Change Request](https://cloud.ibm.com/docs-content/v1/content/5eb88a2575e30e316dbb83829c7f4c8b1ddbc67c/devsecops/images/devsecops_set-up_cd_change_request_orig.png)

Figure 16. Change request





 Git Repos and Issue Tracking 



* New repository name: Name of the Git Repos and Issue Tracking Repository to be used for Change Request Management.



The default behavior of the toolchain is to Use default Git Repos and Issue Tracking change request management repo that creates a new Change Request Management Repository as IBM-hosted Git Repos and Issue Tracking Repository.
"name": "lock-1",
"description": "Lock for consumer 1.",
"attributes": {
"key": "value"
}
},
{
"name": "lock-2",
"description": "Lock for consumer 2.",
"attributes": {
"key": "value"
}
}
]
}' 
"https://{instance_ID}.{region}.secrets-manager.appdomain.cloud/api/v2/secrets/{id}/locks_bulk"

If you're building an automated flow, you can use the attributes object to specify key-value data with each lock on your secret. For example, you can include a resource identifier, such as an ID or Cloud Resource Name (CRN).

A successful response returns details about the new locks, along with other metadata.

{
"secret_id": "0cf4addb-7a90-410b-a3a7-a15bbe2b7909",
"secret_group_id": "d8371728-95c8-4c12-b2af-1af98adb9e41",
"versions": [
{
"version_id": "7bf3814d-58f8-4df8-9cbd-f6860e4ca973",
"version_alias": "current",
"locks":
"lock-3",
"lock-4"
],
"payload_available": true
},
{
"version_id": "5bf89b0c-df55-c8d5-7ad6-8816951c6784",
"version_alias": "previous",
"locks":
"lock-1",
"lock-2"
],
"payload_available": true
}
]
}