vania-janet/multiturn-rag-retrieval-data huggingface dataset:
The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--secret-action-prototype ([SecretActionPrototype](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-cli-plugin-secrets-manager-clicli-secret-action-prototype-example-schema))
: The request body to specify the properties for your secret action. Required.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, e.g. --secret-action-prototype=@path/to/file.json.





 Example 

ibmcloud secrets-manager secret-action-create --id=0b5571f7-21e6-42b7-91c5-3f5ac9793a46 --secret-action-prototype='{"action_type": "public_cert_action_validate_dns_challenge"}'









 Secret versions 

Create and manage the versions of your secrets.



 ibmcloud secrets-manager secret-version-create 

Create a new secret version.

ibmcloud secrets-manager secret-version-create --secret-id SECRET-ID --secret-version-prototype SECRET-VERSION-PROTOTYPE



 Command options 

--secret-id (string)
: The ID of the secret. Required.

The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.
Because strongSwan is integrated within your cluster, you don't need an external gateway appliance. When VPN connectivity is established, routes are automatically configured on all the worker nodes in the cluster. These routes allow two-way connectivity through the VPN tunnel between pods on any worker node and the remote system. For example, the following diagram shows how an app in Red Hat OpenShift on IBM Cloud can communicate with an on-premises server via a strongSwan VPN connection.

Zoom

![Flow of traffic between your cluster and an on-premises data center through the strongSwan VPN service.](https://cloud.ibm.com/docs-content/v1/content/bce0f0917a9eea684d1b4b704ac6343a1f65f446/openshift/images/cs_vpn_strongswan.png)

Figure 1. Flow of traffic through the strongSwan VPN service



1. An app in your cluster, myapp, receives a request from an Ingress or LoadBalancer service and needs to securely connect to data in your on-premises network.
2. The request to the on-premises data center is forwarded to the IPSec strongSwan VPN pod. The destination IP address is used to determine which network packets to send to the IPSec strongSwan VPN pod.
3. The request is encrypted and sent over the VPN tunnel to the on-premises data center.
4. The incoming request passes through the on-premises firewall and is delivered to the VPN tunnel endpoint (router) where it is decrypted.
5. The VPN tunnel endpoint (router) forwards the request to the on-premises server or mainframe, depending on the destination IP address that was specified in step 2. The necessary data is sent back over the VPN connection to myapp through the same process.







 strongSwan VPN service considerations 

Before using the strongSwan Helm chart, review the following considerations and limitations.



* The strongSwan Helm chart is supported only for classic clusters, and is not supported for VPC clusters.
[Configure Credential Keystore](https://cloud.ibm.com/docs-content/v1/content/57ab3ec034294d8a6de510b97bec3035d4654761/security-broker/images/secret_key.svg)

Configure Credential Keystore

The Data Security Broker Secret Key must contain at least 10 characters, a mixture of upper and lower case, including at least one numeric character. The Secret Key is used to generate a random key to encrypt the Keystore Config Password.
8. Once you complete the configuration process for the Data Security Broker Manager, the next step is to login to the Data Security Broker Manager using the steps mentioned in the [Login to Data Security Broker Manager](https://cloud.ibm.com/docs/security-broker?topic=security-broker-sb_login) section.
ibmcloud secrets-manager secret-version-unlock --secret-type SECRET-TYPE --id ID --version-id VERSION-ID [--locks LOCKS]



 Command options 

--secret-type (string)
: The secret type. Required.

Allowable values are: arbitrary, iam_credentials, imported_cert, public_cert, private_cert, username_password, kv.

--id (string)
: The v4 UUID that uniquely identifies the secret. Required.

The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--version-id (string)
: The v4 UUID that uniquely identifies the secret version. You can also use previous to retrieve the previous version.

Note: To find the version ID of a secret, use the Get secret metadata method and check the response details. Required.

The value must match regular expression /^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|previous)$/.

--locks ([]string)
: A comma-separated list of locks to delete.

The list items must match regular expression /^(\w(([\w-.]+)?\w)?|[])$/.





 Examples 

ibmcloud secrets-manager secret-version-unlock --secret-type=arbitrary --id=exampleString --version-id=exampleString --locks=exampleString







 ibmcloud secrets-manager all-locks 

List the lock details that are associated with all secrets in your Secrets Manager instance.

ibmcloud secrets-manager all-locks [--limit LIMIT] [--offset OFFSET] [--search SEARCH] [--groups GROUPS]
Show more

A successful request returns the following response.

TASK [Lookup KV secret with token] 
ok: [localhost] => {
"msg": "secret1"
}

TASK [Lookup User Credentials secret with token - full] 
ok: [localhost] => {
"msg": {
"created_by": "xxxxxxxxxxxxx",
"creation_date": "2023-01-19T10:15:54Z",

xxxxxx REDACTED xxxxxxxx

"secret_data": {
"password": "pass1",
"username": "user1"
},
"secret_type": "username_password",
"state": 1,
"state_description": "Active",
"versions": [
{
"auto_rotated": false,
"created_by": "xxxxxxxxxx",
"creation_date": "2023-01-19T10:15:54Z",
"downloaded": true,
"id": "373ff4a1-64a7-d6b0-993c-605ba564540d",
"payload_available": true,
"version_custom_metadata": {}
}
],
"versions_total": 1
}
}

TASK [Parsing username_password] 
ok: [localhost] => {
"msg": "user is user1 and password is pass1"
Show more





 Next steps 

You can run this playbook to look up other secrets from Secrets Manager.
{"enc}f1JwT6s3TT5ml+Ir7Y1ndRA8J4zq/KMVlgYGP44k9DxOiSiLEJ82giOvP86lHIDgiOM6zmZ5rN6j6/pRdlFnA/f5UiKj0gDx2LKViyEXyMyptQwDOfs8Lk2qPjM0G8M1WiPHvOVT6iYezgOv04DhNclIVwxAncPBvrUfMi3N5ZgyBrN5gyg/h/bCLQvIBkrcIaSnUHK2Uij6nDfcsPROHjpjI5KX24sHUFbNMkGPfyDsxHUw5ukFxyY3rV4MSHgBsDlq03qKTpnaFCUKAdybpolxA64i8cI0DW1stMpTa5QbuRodnZxa/9cj0QMokzmCNFnvyrHro8gI2TPCAkJLZw==:f1JwT6s3TT5ml+Ir7Y1ndRA8J4zq/KMVlgYGP44k9DxOiSiLEJ82giOvP86lHIDgiOM6zmZ5rN6j6/pRdlFnA/f5UiKj0gDx2LKViyEXyMyptQwDOfs8Lk2qPjM0G8M1WiPHvOVT6iYezgOv04DhNclIVwxAncPBvrUfMi3N5ZgyBrN5gyg/h/bCLQvIBkrcIaSnUHK2Uij6nDfcsPROHjpjI5KX24sHUFbNMkGPfyDsxHUw5ukFxyY3rV4MSHgBsDlq03qKTpnaFCUKAdybpolxA64i8cI0DW1stMpTa5QbuRodnZxa/9cj0QMokzmCNFnvyrHro8gI2TPCAkJLZw=="

Note: This key is only valid during the session.

Use the prefix {enc} on encrypted field values. For example: "password" : "{enc}encryptedpassword". Encrypted values are Base64 encoded.

Note: When starting a new session, you must re-encrypt sensitive information that is contained in modules. Before you encrypt these fields, you must update the data sources. Update the data sources by calling the updateModuleDefinitions() method.
This way, you require an API key to log in to the CLI, or users can log in with --sso, without requiring your users to complete MFA on each login.

To disable CLI logins with only a password, complete the following steps:



1. In the IBM Cloud console, go to Manage > Access (IAM)



* To apply this to an individual user, click Users and select the user whose MFA you want to update.



1. Go to the MFA section and click the Edit icon ![Edit icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/edit-tagging.svg).



* To apply this to the account, click Settings > Authentication.



2. Select None.
3. Select Disable CLI logins with only a password
4. Click Save for an individual user.



Users are prompted only once for an additional factor if IBMid detects that a user is logging in to a new device or browser. Once a user logs in using an additional factor on a new device, they aren't prompted for that factor again. This prevents certain programmatic attack vectors and enhances the security of users’ accounts without prompting users each time they log in.
"requestData":{
"serviceInstanceId":<analysis from instance CRN>,
"accountId":<token.account>,
"adminPubKeyId":<token.IBMid>
},
"responseData":{
"adminPubKeyId":<token.IBMid>
}
}
Show more







 Step 3: Admin key administration 

The secure network management CLI stores the newly generated key pair in the local file system, the private key is derived by using PBKDF2, which is aligned with the PKCS#5 standard, and the private key is protected by a mandatory passphrase. The private key is stored in a local file that follows the PKCS#8 standard, and you must ensure that you protect the passphrase and keep the private key file secure. The secure network management CLI uses the private key to sign the request to upload the public key to the secure network management agent over the secure connection. Thereafter, the uploaded public key is associated with the user ID, and works as the administrator key to authenticate all subsequent operations that the specified user executes.

After this is complete, the secure network management agent is ready to accept requests from the secure network management CLI to perform secure network administration including admin key management and VPN management. The administration requests are signed with the user provided admin private key (except reading requests which do not make any changes on the secure network), and are authenticated by the uploaded corresponded admin public key.



 Choosing the target Hyper Protect Virtual Servers instance 

After you login in to IBM Cloud, ensure that you have access to all Hyper Protect Virtual Servers instances that are required for establishing a VPN connection with each other. You can run the ibmcloud hpvs instances command from the IBM Cloud CLI to view all available Hyper Protect Virtual Servers instances that you have access to.

ibmcloud hpvs instances

Getting instances ...

Name hpnet-test1
If neither --password, nor --password-from-file, nor --password-from-json-file option is specified, then you are prompted for the password. This value is optional.

--password-from-file, --pf
: The path to a file containing the password to access the registry server. The first line of the file is used for the password. If neither --password, nor --password-from-file, nor --password-from-json-file option is specified, then you are prompted for the password. This value is optional.

--password-from-json-file, --pfj
: The path to a JSON file containing the password to access the registry server. The apikey field is used for the password. If neither --password, nor --password-from-file, nor --password-from-json-file option is specified, then you are prompted for the password. This value is optional.

--quiet, -q
: Specify this option to reduce the output of the command. This value is optional. The default value is false.

--server, -s
: The URL of the registry server. This value is optional. The default value is us.icr.io.

--username, -u
: The username to access the registry server. This value is optional. The default value is iamapikey.





 Example 

The following example creates image registry access that is called myregistry to a Container Registry instance that is located at us.icr.io and uses a username of iamapikey and the IAM API key as a password.

ibmcloud ce registry create --name myregistry --server us.icr.io --username iamapikey --password API_KEY





 Example output 

Creating image registry access secret myregistry...

OK







 ibmcloud ce registry delete 

Delete an image registry access secret.
ENCRYPTED_PASSWORD="$(echo -n "$PASSWORD" | base64 -d | openssl rsautl -encrypt -inkey $CONTRACT_KEY -certin | base64 -w0)"
5. Use the following command to encrypt env.yaml with a random password:

ENCRYPTED_ENV="$(echo -n "$PASSWORD" | base64 -d | openssl enc -aes-256-cbc -pbkdf2 -pass stdin -in "$ENV" | base64 -w0)"
6. Use the following command to get the encrypted section of the contract:

echo "hyper-protect-basic.${ENCRYPTED_PASSWORD}.${ENCRYPTED_ENV}"
7. To encrypt the workload section, see [Creating the encrypted workload section of a contract](https://cloud.ibm.com/docs/vpc?topic=vpc-about-contract_sehpcr_contract_encrypt_workload).
8. Get the output from step 6 and add it to the user-data.yaml file.

env: hyper-protect-basic.VWg/5/SWE+9jLfhr8q4i.........









 Contract signature 

Contract signature is an optional feature that can be used with the contract. You can choose to sign a contract before it is passed as input. Contracts that are in plain text or encrypted can be signed. Validation of the contract signature is done by the Hyper Protect Virtual Servers for VPC image. The purpose of this signature feature is to ensure that the workload and env sections are always used together and are not tampered with by a third party. The signature of the workload and the env sections are added as the value to the envWorkloadSignature section. The following are two sections in a contract that are relevant while creating and adding a contract signature:



* envWorkloadSignature: This is section where the signature of the other sections of the contract is added.
Use the prefix {enc} on encrypted field values. For example: "password" : "{enc}encryptedpassword". Encrypted values are Base64 encoded.

Note: When starting a new session, you must re-encrypt sensitive information that is contained in modules. Before you encrypt these fields, you must update the data sources. Update the data sources by calling the updateModuleDefinitions() method.

For more information on using the updateModuleDefinitions() method, see [Updating data source information](https://cloud.ibm.com/docs/services/cognos-dashboard-embedded?topic=cognos-dashboard-embedded-updating_data_source_informationupdating_data_source_information).

Update all modules with the encrypted fields, by using the encryption key of this session.
If a password isn't specified in the flags, the command prompts for a password interactively. The plug-in uses the default commands for command-line interaction and managing the CA certificate to ensure a secure TLS session. Defaults to connecting as the deployment's admin user.
* --user <userid> or -u Sets the user ID that is used when retrieving connection settings. It is substituted into connection strings. Defaults to the deployment's admin user.
* --password <password> or -p Sets the password that is used when retrieving connection settings. It is substituted into connection strings where $PASSWORD appears as default.
* --endpoint-type [public or private] or -e [public or private] Endpoint type for returned connection strings. Either 'public' or 'private'. (default: "public"). Endpoint type is not enforced and is only for display purposes.
* --all or -a Lists all connection settings available including component parts of connection strings.
* --certroot <path> or -c Use the path as the certificate root. If the path doesn't exist, it is created automatically. Works with the --save flag. The certificate root value can also be set in the $CERTROOT environment variable.
* --only [app or cli] or -o Show only the settings that are relevant to app connections or cli connections.
* --json or -j Display results as JSON.
* --endpoint-type or -e Endpoint type for returned connection strings, either public or private. Default is public. As the default is public, if there are no public endpoints then none will be found and you will receive an error: {"errors":"not_found"}. Use the -e private flag to use private endpoints.







 Examples 

Display how to connect to a deployment.

ibmcloud cdb deployment-connections MyPSQL

(Shows a connection string and a CLI command string)

Connect to a deployment as admin.

ibmcloud cdb deployment-connections MyPSQL --start
[User credentials](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-user-credentials) The existing password value is replaced with a randomly generated 32-character password that contains uppercase letters, lowercase letters, digits, and symbols. The username value does not change. 
 [IAM credentials](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam-credentials) The Service ID's API key value is replaced with a new API key. The previous API key remains available for the remaining time in the defined TTL. 









 Scheduling automatic rotation in the UI 

You can schedule the automatic rotation of secrets by using the Secrets Manager UI.



 Setting an automatic rotation policy for user credentials 

If you prefer to schedule your passwords to be automatically rotated at regular intervals, you can enable automatic rotation for your user credentials at their creation. You can also enable auto rotation by editing the details of an existing secret.

If you need more control over the rotation frequency of a secret, you can use the Secrets Manager API to set a custom interval by using day or month units of time. For more information, see the [API reference](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2put-policy).



1. If you're [adding a secret](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-user-credentialsuser-credentials-ui), enable the rotation option.
2. If you're editing an existing secret, enable automatic rotation by updating its details.



1. In the Secrets table, view a list of your existing secrets.
2. In the row for the secret that you want to edit, click the Actions menu ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/actions-icon-vertical.svg)> Edit details.
3.
"certificate": {
"certificate_base64": "AB0cAB1CDEaABcCEFABCDEF1ACB3ABCD1ab2AB0cAB1CDEaABcCEFABCDEF1ACB3ABCD1ab2AB0cAB1CDEaABcCEFABCDEF1ACB3ABCD1ab2..."



5. Encode your username and password to base64.

echo -n "<username_or_password>" | base64
6. Create a Kubernetes secret for your certificate.



1. Create a configuration file for your secret.

apiVersion: v1
kind: Secret
metadata:
name: px-etcd-certs
namespace: kube-system
type: Opaque
data:
ca.pem: <certificate_base64>
username: <username_base64>
password: <password_base64>
2. Create the secret in your cluster.

kubectl apply -f secret.yaml



7. Choose if you want to [set up encryption for your volumes with IBM Key Protect](https://cloud.ibm.com/docs/containers?topic=containers-storage_portworx_encryption). If you don't want to set up IBM Key Protect encryption for your volumes, continue with [installing Portworx in your cluster](https://cloud.ibm.com/docs/containers?topic=containers-storage_portworx_deploy).
For example, the host value for the target field from the previous example output is dashdb-entry-yp-lon02-01.services.eu-gb.bluemix.net. If you add the protocol https and the Postfix login, you can sign in with the following URL, https://dashdb-entry-yp-lon02-01.services.eu-gb.bluemix.net/login.
3. To sign in, use the value of the dynamite_user field as your username and the dynamite_token field as your password.
tEqoiCu9CeUsbqRe6yBUkrJg80QKKG/z46OkX0YQMV8=

 wrap the plaintext key with the root key, creating a DEK (this is the ciphertext)
$ CIPHERTEXT=$(ibmcloud kp key wrap $KEY_ID -p $PLAINTEXT --output json | jq -r '.["Ciphertext"]')

$ echo $CIPHERTEXT

eyJjaXBoZXJ0ZXh0IjoiTkdQRlhCb1dT ...<redacted>... M2ExNjdiNTA3In0=

 unwrap the ciphertext and reveal the original DEK
$ ibmcloud kp key unwrap $KEY_ID $CIPHERTEXT

tEqoiCu9CeUsbqRe6yBUkrJg80QKKG/z46OkX0YQMV8=





 Example 3 

Wrap a root key and provide AAD information.

One use case for supplying additional authentication data (AAD) is to "password protect" and add a "verification phrase" to the ciphertext, which makes it more difficult to unwrap.

The ciphertext and the AAD is required to unwrap the ciphertext and reveal the plaintext DEK.

 create a root key
$ KEY_ID=$(ibmcloud kp key create my-root-key --output json | jq -r '.["id"]')

$ echo $KEY_ID

5f2cc155-fe16-492c-845c-4d1f0688c7ba

 set the additional authentication data (AAD)
$ AAD1=My-Secret-Password
$ AAD2=My-Verification-Phrase

 wrap the plaintext DEK with the root key and AAD
$ CIPHERTEXT=$(ibmcloud kp key wrap $KEY_ID -a "$AAD1,$AAD2" --output json | jq -r '.["Ciphertext"]')

$ echo $CIPHERTEXT
* [Handling and securing secrets](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-secrets)







 IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



Rules for IA-5 in IBM Cloud for Financial Services v1.2.0 profile

 Requirement ID Rules 

 IA-5 (b) <br><br> * IBM Cloud IAM establishes initial authenticator content for authenticators that are defined by the organization (for example, API keys)<br><br><br> 
 IA-5 (c) <br><br> * Check whether App ID advanced password policies are enabled<br> * Check whether App ID lockout policy after failed # of sign-in attempts is enabled<br> * Check whether App ID lockout policy after failed # of sign-in attempts is enabled<br> * Check whether App ID prevent username in password policy is enabled<br> * Check whether App ID password strength regex is configured<br> * Check whether OpenShift cluster has image pull secrets enabled<br> * IBM Cloud IAM ensures that authenticators, such as API keys, have sufficient strength for their intended use<br> * Check whether VPN for VPC authentication is configured with a strong pre-shared key with at least # characters<br> * Check whether App ID avoid password reuse policy is enabled<br> * IBMid ensures that passwords have sufficient strength for their intended use<br><br><br>