vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Use a key management service (KMS) provider, such as IBM® Key Protect, to create a private root key that you use in your Block Storage for VPC instance to encrypt data as it is written to the storage. After you create the private root key, create a custom storage class or a Kubernetes secret with your root key and then use this storage class or secret to provision your Block Storage for VPC instance.



1. [Create a Key Protect service instance](https://cloud.ibm.com/docs/key-protect?topic=key-protect-provisionprovision).
2. [Create a root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-create-root-keyscreate-root-keys). By default, the root key is created without an expiration date.
3. Retrieve the service CRN for your root key.



1. From the Key Protect details page, select the Keys tab to find the list of your keys.
2. Find the root key that you created and from the actions menu, click View CRN.
3. Note the CRN of your root key.



4. Authorize Block Storage for VPC to access IBM® Key Protect.



1. From the IBM Cloud menu, select Manage > Access (IAM).
2. From the menu, select Authorizations.
3. Click Create.
4. Select Cloud Block Storage for Classic as your source service.
5. Select Key Protect as your target service.
6. Select the Reader service access role and click Authorize.



5. [Decide if you want to store the Key Protect root key CRN in a customized storage class or in a Kubernetes secret](https://cloud.ibm.com/docs/containers?topic=containers-vpc-blockvpc-customize-default). Then, follow the steps to create a customized storage class or a Kubernetes secret.

Example customized storage class.

apiVersion: storage.k8s.io/v1
kind: StorageClass
If you have data that must be available, even if an outage occurs, make sure to store your data on [persistent storage](https://cloud.ibm.com/docs/openshift?topic=openshift-storage-plan).

For more information about how to achieve high availability for your cluster, see [High availability for Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-haha).





 What options do I have to secure my cluster? 

You can use built-in security features in Red Hat OpenShift on IBM Cloud to protect the components in your cluster, your data, and app deployments to ensure security compliance and data integrity. Use these features to secure your Red Hat OpenShift API server, etcd data store, worker node, network, storage, images, and deployments against malicious attacks. You can also leverage built-in logging and monitoring tools to detect malicious attacks and suspicious usage patterns.

For more information about the components of your cluster and how you can meet security standards for each component, see [Security for Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-securitysecurity).





 What access policies do I give my cluster users? 

Red Hat OpenShift on IBM Cloud uses Cloud Identity and Access Management (IAM) to grant access to cluster resources through IAM platform access roles and Kubernetes role-based access control (RBAC) policies through IAM service access roles. For more information about types of access policies, see [Pick the correct access policy and role for your users](https://cloud.ibm.com/docs/openshift?topic=openshift-access-overviewaccess_roles).

The access policies that you assign users vary depending on what you want your users to be able to do. You can find more information about what roles authorize which types of actions on the [User access reference page](https://cloud.ibm.com/docs/openshift?topic=openshift-access_reference) or in the following table's links.
For Source service, select the cloud data service that you want to integrate with Key Protect

For Target service, select IBM Key Protect.
4. Enable the Reader role.

With Reader permissions, your source service can browse the root keys that are provisioned in the specified instance of Key Protect.
5. Click Authorize.







 What's next 

Add advanced encryption to your cloud resources by creating a root key in Key Protect.

Add a new resource to a supported cloud data service, and then select the root key that you want to use for advanced encryption.



* To find out more about creating root keys with the Key Protect service, see [Creating root keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-create-root-keys).
* To find out more about bringing your own root keys to the Key Protect service, see [Importing root keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-import-root-keys).
* UI
* CLI
* API







 Key Protect Integration 

The data that you store in IBM Cloud® Databases is encrypted by default by using randomly generated keys. To control the encryption keys, you can Bring Your Own Key (BYOK) through [IBM Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-integrate-services) and use one of your own keys to encrypt your databases and backups.

This document covers the integration of Key Protect with Cloud Databases, which includes Databases for DataStax, Databases for Elasticsearch, Databases for EnterpriseDB, Databases for etcd, Databases for MongoDB, Databases for PostgreSQL, Databases for Redis, Messages for RabbitMQ, IBM Cloud® Databases for MySQL, and IBM Cloud® Databases for MySQL.

To get started, you need [Key Protect](https://cloud.ibm.com/catalog/key-protect) provisioned on your IBM Cloud account.



 Creating or adding a key in Key Protect 

Go to your instance of Key Protect and [generate or enter a key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-getting-started-tutorial).





 Granting service authorization 

Authorize Key Protect for use with Cloud Databases deployments:



1. Open your IBM Cloud dashboard.
2. From the menu bar, click Manage -> Access (IAM).
3. In the side navigation, click Authorizations.
4. Click Create.
5. In the Source service menu, select the service of the deployment. For example, Databases for PostgreSQL or Messages for RabbitMQ
6. In the Source service instance menu, select All instances.
7. In the Target service menu, select Key Protect.
8. Select or retain the default value Account as the resource group for the Target Service
9. In the Target service Instance ID menu, select the service instances to authorize.
10. Enable the Reader role.
11.
* UI
* CLI
* API







 Key Protect Integration 

The data that you store in IBM Cloud® Databases is encrypted by default by using randomly generated keys. To control the encryption keys, you can Bring Your Own Key (BYOK) through [IBM Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-integrate-services) and use one of your own keys to encrypt your databases and backups.

This document covers the integration of Key Protect with Cloud Databases, which includes Databases for DataStax, Databases for Elasticsearch, Databases for EnterpriseDB, Databases for etcd, Databases for MongoDB, Databases for PostgreSQL, Databases for Redis, Messages for RabbitMQ, IBM Cloud® Databases for MySQL, and IBM Cloud® Databases for MySQL.

To get started, you need [Key Protect](https://cloud.ibm.com/catalog/key-protect) provisioned on your IBM Cloud account.



 Creating or adding a key in Key Protect 

Go to your instance of Key Protect and [generate or enter a key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-getting-started-tutorial).





 Granting service authorization in the UI 

Authorize Key Protect for use with Cloud Databases deployments:



1. Open your IBM Cloud dashboard.
2. From the menu bar, click Manage -> Access (IAM).
3. In the side navigation, click Authorizations.
4. Click Create.
5. In the Source service menu, select the service of the deployment. For example, Databases for PostgreSQL or Messages for RabbitMQ
6. In the Source service instance menu, select All instances.
7. In the Target service menu, select Key Protect.
8. Select or retain the default value Account as the resource group for the Target Service
9. In the Target service Instance ID menu, select the service instances to authorize.
10. Enable the Reader role.
11.
If you need to control the encryption keys, you can integrate with your Hyper Protect Crypto Services instance to use your own root keys. [Enabling a customer-managed key for Event Streams](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-managing_encryptionenabling_encryption) 







 Security service integrations 

You can integrate Hyper Protect Crypto Services with the following security-related services. By default, the data that you store in these services is encrypted at rest by using an IBM-managed key. You can add a higher level of encryption control to your data at rest by enabling integration with Hyper Protect Crypto Services to use your own root keys.



Table 6. Supported security services.

 Service Description Integration instruction 

 [App ID](https://cloud.ibm.com/docs/appid) App ID stores and encrypts user profile attributes. As a multi-tenant service, every tenant has a designated encryption key and user data in each tenant is encrypted with only that tenant's key. [Enabling customer-managed keys for App ID by using Hyper Protect Crypto Services](https://cloud.ibm.com/docs/appid?topic=appid-mng-dataenable-customer-keys-hpcs) 
 [Secrets Manager](https://cloud.ibm.com/docs/secrets-manager) With Secrets Manager, you can centrally manage your secrets in a single-tenant, dedicated instance. [Protecting your sensitive data in Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-mng-datadata-encryption) 
 [Certificate Manager](https://cloud.ibm.com/docs/certificate-manager) You can use Certificate Manager to order and manage SSL/TLS certificates for your applications and services. [Protecting your sensitive data in Certificate Manager](https://cloud.ibm.com/docs/certificate-manager?topic=certificate-manager-mng-datadata-encryption)
__ Make sure that you have a unique name for your file share that easily identifies the file share as your list of shares grows. Associate it with a resource group in your IBM Cloud customer account. 
 __ Think about which encryption type suits your needs the best. By default, your file shares are encrypted with IBM-managed encryption. For greater control, consider the use of customer-managed encryption. Your data can be protected at rest with your own root keys. For more information about this option, see [Creating file shares with customer-managed encryption](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-encryption). For more information about using the same root keys across accounts, see [Cross-account encryption for multitenant storage resources](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-byok-cross-acct-key). 
 __ You can also choose to [encrypt data in transit](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-eit). This feature might decrease performance slightly for increased security. <br><br>New 
 __ Choose between the UI, CLI, API, or Terraform for creating and managing your file shares. 







 Next Steps 

[Create file shares and mount points](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-create).
As a security administrator, disable a network access policy for a Hyper Protect Crypto Services instance by making a PUT call to the following endpoint. See these API references to [set](https://cloud.ibm.com/apidocs/hs-cryptoputinstancepolicy) and [list](https://cloud.ibm.com/apidocs/hs-cryptogetinstancepolicy) instance policies.

https://api.<region>.hs-crypto.cloud.ibm.com/api/v2/instance/policies?policy=allowedNetwork



1. [Retrieve your authentication credentials to work with the API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-kms-api).

To change a network access policy, you must be assigned a Manager access policy for your Hyper Protect Crypto Services instance. To learn how IAM (identity and access management) roles map to Hyper Protect Crypto Services service actions, check out [Service access roles](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-accessservice-access-roles).
2. Disable a network access policy for your Hyper Protect Crypto Services instance by running the following cURL command.

$ curl -X PUT "https://api.<region>.hs-crypto.cloud.ibm.com/api/v2/instance/policies?policy=allowedNetwork" -H "accept: application/vnd.ibm.kms.policy+json" -H "authorization: Bearer <IAM_token>" -H "bluemix-instance: <instance_ID>" -H "content-type: application/vnd.ibm.kms.policy+json" -d '{
"metadata": {
"collectionType": "application/vnd.ibm.kms.policy+json",
"collectionTotal": 1
},
"resources": [
{
"policy_type": "allowedNetwork",
"policy_data": {
In VPC you also have a choice of using a customer managed encryption key. For storing your own encryption keys, you can use one of two available services: (1) A FIPS 140-2 Level 3 service [IBM Key Protect](https://www.ibm.com/cloud/key-protect). See the [Provisioning the IBM Key Protect service](https://cloud.ibm.com/docs/key-protect?topic=key-protect-provision) topic in the documentation. (2) A FIPS 140-2 Level 4 service [IBM Cloud Hyper Protect Crypto Services](https://www.ibm.com/cloud/hyper-protect-services), see the [Getting started with IBM Cloud Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-get-started) topic in the documentation. While creating the volume you can specify the --encryption-key parameter with the CRN to the encryption key you want to use.
2. Capture the ID of the VSI created earlier by listing all instances and filtering based on the instance name:

VSI_ID=$(ibmcloud is instances --json | jq -r '.[] | select(.name == "vsi-lamp-1") | .id')
3. Attach the data volume to your existing VSI.

ibmcloud is instance-volume-attachment-add attachment-data-1 $VSI_ID $VOLUME_ID --auto-delete false --json
4. Connect to the server with SSH.

ssh root@$FLOATING_IP
5. Configure the newly created data volume on the VSI, run each line below one at a time.

new_bsv=$(echo $(parted -l 2>&1) | awk 'NR==1{print $2}' | sed 's/:$//')
parted $new_bsv mklabel gpt
parted -a opt $new_bsv mkpart primary ext4 0% 100%
For more information about TLS and these ciphers, check out [Data encryption](https://cloud.ibm.com/docs/key-protect?topic=key-protect-security-and-compliancedata-security).





 Private endpoints 

For added benefits, you can also enable [virtual routing and forwarding (VRF) and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint) for your infrastructure account.

When you enable VRF for your account, you can connect to Key Protect by using a private IP that is accessible only through the IBM Cloud private network.

To learn more about VRF, see [Virtual routing and forwarding on IBM Cloud](https://cloud.ibm.com/docs/dl?topic=dl-overview-of-virtual-routing-and-forwarding-vrf-on-ibm-cloud).

To learn how to connect to Key Protect by using a private endpoint, see [Using private endpoints](https://cloud.ibm.com/docs/key-protect?topic=key-protect-private-endpoints).







 Service endpoints 

If you are managing your Key Protect resources programmatically, see the following table to determine the API endpoints to use when you connect to the [Key Protect API](https://cloud.ibm.com/apidocs/key-protect).

Public

Private



Table 1. Lists public endpoints for interacting with Key Protect APIs over IBM Cloud's public network

 Region Public endpoints 

 Dallas us-south.kms.cloud.ibm.com 
 Washington DC us-east.kms.cloud.ibm.com 
 London eu-gb.kms.cloud.ibm.com 
 Frankfurt eu-de.kms.cloud.ibm.com 
 Sydney au-syd.kms.cloud.ibm.com 
 Tokyo jp-tok.kms.cloud.ibm.com 
 Osaka jp-osa.kms.cloud.ibm.com 
 Toronto ca-tor.kms.cloud.ibm.com 
 São-Paulo br-sao.kms.cloud.ibm.com
To access the User List, click Account > Users > User list. Use the [Virtual Private Network](https://www.ibm.com/cloud/vpn-access) page to connect to one of the various VPN options.
6. After you have your infrastructure and environments up and running, you are ready to set up your monitoring service. IBM Cloud Monitoring gives you insight into the performance and health of your applications, services, and platforms. Your administrators, DevOps teams, and developers have full stack telemetry with advanced features to help them monitor and troubleshoot, define alerts, and design custom dashboards. For more information, see [IBM Cloud Monitoring](https://cloud.ibm.com/docs/cloud-infrastructure?topic=cloud-infrastructure-monitoring-iaas).
7. Secure your system. Use the available hardware firewalls to secure your device. You can provision hardware firewalls on demand with no downtime, if rules are established properly, to protect your server from unwanted activity. After you order your firewall, it must be enabled and rules must be set.
8. Schedule backups to make sure that your data is safely stored outside of your device and able to reload any lost data. You can choose from various backup services to store your data in a secure location:



* IBM Cloud Backup is an automated, agent-based backup system. IBM Cloud Backup is a “set-and-forget” solution for managing your device. It is compatible with Microsoft software such as Exchange and SQL through extra plug-ins. IBM Cloud Backup users interact with this service through the IBM Cloud Backup WebCC web-based application.
* R1Soft Continuous Data Protection (CDP) can be installed on your server or self-managed virtual machine. It is recommended if you are looking for a single interface to manage all of your backups. You interact with R1Soft CDP through your proprietary management system, which allows agents to be installed on virtual machines and offers database plug-ins for extra functionality.
If you enable [dual authorization settings for your Key Protect instance](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-dual-auth), keep in mind that any keys that you add to the service require an authorization from two users to delete keys.



1. [Log in to the IBM Cloud console](https://cloud.ibm.com/login/).
2. Go to Menu > Resource List to view a list of your resources.
3. From your IBM Cloud resource list, select your provisioned instance of Key Protect.
4. To create a new key, click Add. A side panel will open. Make sure the Create a key option is selected. Note that to set a Key alias, Key Ring, or Rotation policy for this key, you must click the Advanced options tab to reveal them.



If you are not a Manager (or have an equivalent level of permissions), the Rotation policy option does not appear.

Specify the key's details:



Table 1. Describes the Create a key settings.

 Setting Description 

 Type The [type of key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryptionkey-types) that you would like to manage in Key Protect. Root keys are selected by default. 
 Key name A human-readable display name for easy identification of your key. Length must be within 2 - 90 characters (inclusive). To protect your privacy, ensure that the key name does not contain personally identifiable information (PII), such as your name or location. Note that key names do not need to be unique. 
 Key alias Optional. [Key aliases](https://cloud.ibm.com/docs/key-protect?topic=key-protect-create-key-alias) are ways to describe a key that allow them to be identified and grouped beyond the limits of a display name. Keys can have up to five aliases. 
 Key ring Optional.
Depending on the type of storage that you choose, you can set up additional encryption with IBM Key Protect to protect your data in transit and at rest with your own encryption key.



* [IBM Cloud Object Storage](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-encryption)
* [Portworx](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_portworx_encryption)



You can also use an IBM Cloud database service, such as [IBM Cloudant NoSQL DB](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-getting-started-with-cloudant), to persist data in a managed database outside the cluster. Data that is stored with a cloud database service can be accessed across clusters, zones, and regions. For security-related information, see the database service-specific IBM Cloud documentation.





 Monitoring and logging 

The key to detect malicious attacks in your cluster is the proper monitoring and logging of metrics and all the events that happen in the cluster. Monitoring and logging can also help you understand the cluster capacity and availability of resources for your app so that you can plan accordingly to protect your apps from a downtime.

Does IBM monitor my cluster?
: Every cluster master is continuously monitored by IBM to control and remediate process level Denial-Of-Service (DOS) attacks. Red Hat OpenShift on IBM Cloud automatically scans every node where the master is deployed for vulnerabilities that are found in Kubernetes, Red Hat OpenShift, and OS-specific security fixes. If vulnerabilities are found, Red Hat OpenShift on IBM Cloud automatically applies fixes and resolves vulnerabilities on behalf of the user to ensure master node protection.

What information is logged?
: By default, Red Hat OpenShift on IBM Cloud automatically collects logs for the following cluster components:



* Containers: Logs that are written to STDOUT or STDERR.
* Apps: Logs that are written to a specific path inside your app.
* Restrict access to your instances by using [security groups](https://cloud.ibm.com/docs/vpc?topic=vpc-configuring-the-security-group).
* Set up [access control lists](https://cloud.ibm.com/docs/vpc?topic=vpc-using-acls)(ACL) to control all incoming and outgoing traffic in IBM Cloud® Virtual Private Cloud. An ACL is a built-in, virtual firewall, similar to a security group. In contrast to security groups, ACL rules control traffic to and from the subnets, rather than to and from the instances.
* Use a Virtual Private Network (VPN) for VPC to establish private connections from your remote networks to your VPCs.
* Use IBM Cloud® [Virtual Private Endpoints](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe) (VPE) for VPC to connect to supported IBM Cloud services from your VPC network by using the IP addresses of your choosing, which are allocated from a subnet within your VPC. VPEs are virtual IP interfaces that are bound to an endpoint gateway created on a per service or service instance basis.
* Use IBM Cloud [flow Logs](https://cloud.ibm.com/docs/vpc?topic=vpc-flow-logs) on the VPC to monitor the traffic that reaches your instances.







 Manage security and compliance with VPC Infrastructure Services 

Security and Compliance Center can help you monitor your VPC infrastructure to validate resource configurations in your account against a profile and identify potential issues as they arise. See [Available goals for Virtual Servers](https://cloud.ibm.com/docs/vpc?topic=vpc-manage-security-compliancevirtual-servers-available-goals) to define security standards for your virtual server instances.