vania-janet/multiturn-rag-retrieval-data huggingface dataset:
TKE Master Key operations (load, rotate, clear, zeroize, recover): ibmcloud tke cryptounit-mk-, ibmcloud tke auto-init, ibmcloud tke auto-mk-rotate, ibmcloud tke auto-recover. ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) 



1: This action is performed on your behalf by an [integrated service](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-integrate-services) that enables support for key registration. [Learn more](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-protected-resources).







 Managing access to multiple instances 

If you have multiple Hyper Protect Crypto Services instances in different accounts, you might need to leverage IBM Cloud enterprises to manage accounts and user access.



1. Create the enterprise hierarchy

With IBM Cloud enterprises, you can centrally manage multiple accounts and resources. You can create an enterprise hierarchy as needed by nesting account groups or accounts within the enterprise account. The access management to the enterprise and the child accounts is isolated to provide greater security. To learn how to create an enterprise and add accounts to an enterprise, see [Getting started with an enterprise](https://cloud.ibm.com/docs/account?topic=account-enterprise-tutorial) and [Best practices for setting up an enterprise](https://cloud.ibm.com/docs/account?topic=account-enterprise-best-practices).
2. Organize account resources in resource groups

Hyper Protect Crypto Services instances are associated with child accounts of the enterprise.
[IAM access control in an account](https://cloud.ibm.com/docs-content/v1/content/d4595e5202a9a27767cf034e81b038cdf772e0d5/secure-enterprise/includes/account/includes/account/images/tp-in-ag-access-diagram.svg)

Figure 1. How IAM access works in an account by using access groups

For classic infrastructure that doesn't support the use of IBM Cloud IAM policies for managing access, you can use the [classic infrastructure permissions](https://cloud.ibm.com/docs/account?topic=account-mngclassicinfra) documentation.



 What features are provided? 

IBM Cloud IAM provides a wide range of features for your identity and access management needs.



 User management 

With unified user management, you can add and delete users in an account for both platform and classic infrastructure services. You can organize a group of users in an access group to make assigning access for more than one user or service ID at a time a quick and easy task.





 Fine-grained access control 

Access for users, service IDs, access groups, and trusted profiles are defined by a policy. Within the policy, the scope of access can be assigned to a set of resources in a resource group, a single resource, or account management services. After the target is set, you can define what actions are allowed by the subject of the policy by selecting access roles. Roles provide a way to tailor the level of access that is granted for the subject of the policy to perform actions on the target of policy, whether it is platform management tasks within the account or accessing a service's UI or completing API calls.

You can also add time-based conditions to a policy that defines when the policy grants access, whether you want to grant temporary access to resources in your account or allow access during recurring time windows. For more information, see [Limiting access with time-based conditions](https://cloud.ibm.com/docs/account?topic=account-iam-time-based).





 Access groups for streamlined access management
Managing access with IAM 

IBM Cloud® Identity and Access Management (IAM) enables you to securely authenticate users and control access to all cloud resources consistently in the IBM Cloud.

Every user that accesses the IBM Log Analysis service in your account must be assigned an access policy with an IAM user role defined. The policy determines what actions the user can perform within the context of the service or instance you select. The allowable actions are customized and defined as operations that are allowed to be performed on the service. The actions are then mapped to IAM user roles.

Policies enable access to be granted at different levels. Some of the options include the following:



* Access to all IAM-enabled services in your account
* Access across all instances of the service in a single region in your account
* Access to an individual service instance in your account
* Access to all instances of the service within the context of a resource group
* Access to all instances of the service in a single region within the context of a resource group
* Access to all IAM-enabled services within the context of a resource group



Roles define the actions that a user or serviceID can run. There are different types of roles in the IBM Cloud:



* Platform management roles enable users to perform tasks on service resources at the platform level, for example assign user access for the service, create or delete service IDs, create instances, assign policies for your service to other users, and bind instances to applications.
* Service access roles enable users to be assigned varying levels of permission for calling the service's API.



To organize a set of users and service IDs into a single entity that makes it easy for you to manage IAM permissions, use access groups. You can assign a single policy to the group instead of assigning the same access multiple times per individual user or service ID.



 Managing access by using access groups 

To manage access or assign new access for users by using access groups, you must be the account owner, administrator or editor on all Identity and Access enabled services in the account, or the assigned administrator or editor for the IAM Access Groups Service.

Choose any of the following actions to manage access groups in the IBM Cloud:
Review the information about the impact to your account, and select I understand the impact to my account. Then, click Create.

After the account is added to the enterprise, it can't be removed. Be sure you want to permanently move the account to an enterprise.



After a few moments, your enterprise is created, and you can view the enterprise dashboard. Your IBMid is listed as the contact. The contact serves as a focal point for any enterprise concerns, such as billing or usage questions. You're also assigned as the enterprise account owner, so you can invite additional users to manage the enterprise.

Click Accounts to view your enterprise hierarchy, which contains two accounts.



* The enterprise account, which is where you invite users and grant access to manage the enterprise.
* The account that you used to create the enterprise. Its users and resources remain the same, but billing is now managed by the enterprise.







 Creating an enterprise by using the CLI 



1. Log in, and select the account.

ibmcloud login
2. Create the enterprise by running the [ibmcloud enterprise create](https://cloud.ibm.com/docs/account?topic=cli-ibmcloud_enterpriseibmcloud_enterprise_create) command, where NAME is a unique name to identify the enterprise.

ibmcloud enterprise create NAME [-d, --domain DOMAIN_NAME] [--primary-contact-id PRIMARY_CONTACT_USER_ID]

For example, the following command creates an enterprise that is named Example Corp Enterprise with the examplecorp.com domain.

ibmcloud enterprise create "Example Corp Enterprise" -d examplecorp.com

By default, the enterprise is created with the currently logged-in user in the following roles:



* The contact for the enterprise, which identifies a focal person to notify with enterprise-related concerns
* The owner of the enterprise account, which has full access to manage the enterprise account



You can specify the IBMid for a different user on the --primary-contact-id option. The same user is assigned to both roles.
3. Review the impact to your account, and confirm that you want to continue by entering y.
Service credentials 

A [service credential](https://cloud.ibm.com/docs/account?topic=account-service_credentials&interface=ui) provides the necessary information to connect an application to Object Storage packaged in a JSON document.

Service credentials are always associated with a Service ID, and new Service IDs can be created along with a new credential.

For a user to view a credential they must be granted the Administrator platform role or a custom role that has the resource-controller.credential.retrieve_all action. For more information about [this update](https://cloud.ibm.com/docs/overview?overview-whatsnewoverview-may2022), see [the documentation](https://cloud.ibm.com/docs/account?topic=account-service_credentials&interface=uiviewing-credentials-ui).

Use the following steps to create a service credential:



1. Log in to the IBM Cloud console and navigate to your instance of Object Storage.
2. In the side navigation, click Service Credentials.
3. Click New credential and provide the necessary information. If you want to generate HMAC credentials, switch the Include HMAC Credential to On. Verify the option is switched to On before continuing.
4. Click Add to generate service credential.



When creating a service credential, it is possible to provide a value of None for the role. This will prevent the creation of unintended or unnecessary IAM access policies. Any access policies for the associated service ID will need to be managed using the IAM console or APIs.

The credential has the following values:



 Field name Value 

 apikey New API key that is created for the Service ID 
 cos_hmac_keys Access Key and Secret Key pair for use with S3-compatible tools and libraries 
 endpoints Link to JSON representation of available endpoints 
 iam_apikey_description API key description - initially generated but editable 
 iam_apikey_name API key name - initially generated but editable 
 iam_role_crn Unique identifier for the assigned role
As the account owner or the administrator of an account management service, you can use these services to grant users access to All Account Management services, Billing, Global Resource Catalog, IAM Access Groups Service, IAM Identity Service, Support Center, and User Management. Account Management roles include Administrator, Editor, Operator, or Viewer.

With Classic Infrastructure, you can select from three permission sets that will assign bulk access: View Only, Basic User, and Super User. You can give users access to Classic Infrastructure service or Classic Infrastructure device with specific permissions for Account, Network, Devices, and Services.

Cloud Foundry roles grant access to organizations and spaces within the account. Cloud Foundry roles do not enable user permissions for completing actions within the context of a service across the account.

You can assign users to as many organizations and spaces as necessary. When the user is assigned to an org or space, you can set the level of access within each by assigning Cloud Foundry roles.

Cloud Foundry organization roles include Manager, Billing Manager, and Auditor. And Cloud Foundry space roles include Manager, Developer, and Auditor.

With Cloud Identity and Access Management, or IAM, you can assign and manage access to resources in your account. Within IBM Cloud, there are two types of roles: platform roles and service roles.

With IAM platform roles, users can be assigned varying levels of permissions for performing actions within the account and on a service. In the context of catalog resources and resource groups, the available platform roles are Viewer, Operator, Editor, and Administrator.

IAM service roles assign different levels of permissions to users for calling the service’s API and accessing the UI for service. These roles include Reader, Writer, and Manager.

When assigning roles within the IBM Cloud console, you should follow the best practice of assigning the least level of access based on what the user actually needs to perform their job role.
If you believe that your account was deactivated in error, contact support by calling 1-866-325-0045 and selecting the third option.
* What are my options for contacting IBM Cloud Support?

From the IBM Cloud console menu bar, click the Help icon ![Help icon](https://cloud.ibm.com/icons/help.svg) > Support center. The options that are available to you depend on your support plan. For more information, see [Getting support](https://cloud.ibm.com/docs/get-support?topic=get-support-support-plans).

To contact support, you can use the following methods:



* If you have a valid Pay-As-You-Go or Subscription account, you can click Live chat with support to chat with a support engineer.
* Lite and Trial account support is limited to nontechnical support issues that are related to account access and billing. Users with Lite or Trial accounts can view the [IBM Cloud documentation](https://cloud.ibm.com/docs/get-support?topic=get-support-using-avatar), Chat with Watson, and use [Stack Overflow](https://stackoverflow.com/questions/tagged/ibm-cloud).



* Can I view a list of accounts that I own?

The IBM Cloud console menu bar lists all of the accounts that are affiliated with your IBMid, including the accounts that you own. Click the account listing in the console menu bar to see the other accounts that you own or are a member. The account name begins with the account number for Pay-As-You-Go and Subscription accounts.

![A screen capture of the account selector in the console menu bar. The account selector displays the account name and account number, and you select the current account to display a list of other accounts that you can access.](https://cloud.ibm.com/docs/images/account-faq.svg)

Figure 1. Account selector

You can view your role in each account on the [Users page](https://cloud.ibm.com/iam/users).
Signing up for required accounts 



 The IBM Cloud account 

To use IBM Cloud® for VMware Solutions to order instances, you must have an IBM Cloud® account. This requirement applies to all VMware Solutions offerings.

You can sign up for an IBM Cloud account by using an existing IBMid or by creating a new IBMid. For more information, see [Signing up for IBM Cloud](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-signing_required_accountssigning_required_accounts-cloud).





 The IBM Cloud infrastructure account 

The requirement to have an IBM Cloud infrastructure account applies only to the following offerings: VMware vSphere, VMware vCenter Server, VMware Regulated Workloads, and Cyber Recovery.

Additionally, you must have an IBM Cloud infrastructure account. The price of the components that are ordered in your instances is billed to that IBM Cloud account.

This account is also used to log in to the IBM Cloud infrastructure customer portal which provides more functions to manage infrastructure products and services.

To sign up for an IBM Cloud infrastructure account, upgrade your IBM Cloud account to a billable account. For more information, see [How do I upgrade or convert my account type?](https://cloud.ibm.com/docs/account?topic=account-accountfaqschangeacct)



 Permissions for the IBM Cloud infrastructure account 

The IBM Cloud infrastructure account that you are using must have certain permissions to be able to order the components in your instances and perform operations on your behalf. The permission requirements are applicable to all types of instances and services that you are ordering from the IBM Cloud for VMware Solutions console.



Table 1. Required permissions for the IBM Cloud infrastructure account

 Permission Details 

 Add Server This permission is required for the following operations: to order IBM Cloud bare metal servers on which VMware ESXi™ runs and to provision hourly virtual servers that are used, for instance, configuration, maintenance, and support operations. 
 Cancel Server This permission is required to release and reclaim bare metal servers on which VMware ESXi runs. If you delete your instance, the ordered components are automatically released in the correct dependency sequence.
Setting up API key credentials so the service can access the infrastructure and other cloud services 

To successfully provision and work with clusters, you must ensure that your IBM Cloud account is correctly set up to access IBM Cloud infrastructure and other IBM Cloud services that you use in each resource group and region that your clusters are in.



 Setting up the API key for most use cases 

Your IBM Cloud Pay-As-You-Go or Subscription account is already set up with access to IBM Cloud infrastructure. To use this infrastructure in Red Hat OpenShift on IBM Cloud, the account owner must make sure that an [API key](https://cloud.ibm.com/docs/openshift?topic=openshift-access-credsapi_key_about) is created with appropriate permissions for each region and resource group.

The quickest way to set up the API key is to ask the account owner, who already has the required infrastructure permissions. However, the account owner might want to create a functional ID with all the required infrastructure permissions. Then, if the account owner is unavailable or changes, the API key owner remains the functional ID. Note that you can't use a service ID to set the API key.



1. As the account owner, [invite a functional ID](https://cloud.ibm.com/docs/account?topic=account-iamuserinv) to your IBM Cloud account to use to set the API key infrastructure credentials, instead of a personal user.
2. [Assign the functional ID the correct permissions](https://cloud.ibm.com/docs/openshift?topic=openshift-access-credsowner_permissions).
3. Log in as the functional ID.

ibmcloud login
4. Target the resource group where you want to set the API key. If you don't target a resource group, the API key is set for the default resource group. To list available resource groups, run ibmcloud resource groups.

ibmcloud target -g <resource_group_name>
5. Create an API key that impersonates your infrastructure permissions.
If you believe that your account was deactivated in error, contact support by calling 1-866-325-0045 and selecting the third option.
* What are my options for contacting IBM Cloud Support?

From the IBM Cloud console menu bar, click the Help icon ![Help icon](https://cloud.ibm.com/icons/help.svg) > Support center. The options that are available to you depend on your support plan. For more information, see [Getting support](https://cloud.ibm.com/docs/get-support?topic=get-support-support-plans).

To contact support, you can use the following methods:



* If you have a valid Pay-As-You-Go or Subscription account, you can click Live chat with support to chat with a support engineer.
* Lite and Trial account support is limited to nontechnical support issues that are related to account access and billing. Users with Lite or Trial accounts can view the [IBM Cloud documentation](https://cloud.ibm.com/docs/get-support?topic=get-support-using-avatar), Chat with Watson, and use [Stack Overflow](https://stackoverflow.com/questions/tagged/ibm-cloud).



* Can I view a list of accounts that I own?

The IBM Cloud console menu bar lists all of the accounts that are affiliated with your IBMid, including the accounts that you own. Click the account listing in the console menu bar to see the other accounts that you own or are a member. The account name begins with the account number for Pay-As-You-Go and Subscription accounts.

![A screen capture of the account selector in the console menu bar. The account selector displays the account name and account number, and you select the current account to display a list of other accounts that you can access.](https://cloud.ibm.com/images/account-faq.svg)

Figure 1. Account selector

You can view your role in each account on the [Users page](https://cloud.ibm.com/iam/users).
For more information, see [Granting access between services](https://cloud.ibm.com/docs/vpc?topic=vpc-object-storage-prereq). 







 Gathering IBM Cloud account information 



Table 3. Required IBM Cloud account information

 Account information Details 

 Username Create a username specifically for VPC+ Cloud Migration. In the IBM Cloud console, select Manage > Access (IAM) > Users. Select Users and then click Invite user, supplying the email address name of the user. This allows you to delete the username after your migration is complete. For more information, see [Inviting users to an account](https://cloud.ibm.com/docs/account?topic=account-iamuserinv). 
 API keys You need a classic infrastructure API key. You will also need to create an IBM Cloud API key (VPC API key) specifically for VPC+ Cloud Migration. Your IBM Cloud API key must have “Reader, Writer” access. You can verify the level of access in IBM Cloud console by clicking Manage > Access (IAM) and selecting Authorizations. For more information, see [Managing classic infrastructure API keys](https://cloud.ibm.com/docs/account?topic=account-classic_keys) and [Managing user API keys](https://cloud.ibm.com/docs/account?topic=account-userapikey). 
 IBM Cloud Object Storage and resource instance ID (service credentials) Your Object Storage bucket is used to store your images and volumes during the migration process and its resource instance ID allows VPC+ Cloud Migration to access your IBM Cloud Object Storage and import the images that you want to migrate. For more information, see [IBM Cloud Object Storage getting started tutorial](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-getting-started-cloud-object-storage) and [Service credentials](https://cloud.ibm.com/docs/services/cloud-object-storage/iam?topic=cloud-object-storage-service-credentials).
In Kubernetes, a service account provides an identity for processes that run in a Pod, and namespaces provide a mechanism for isolating groups of resources within a single cluster. All Kubernetes clusters have a default namespace, and each namespace has a default account.

When you establish trust with the Kubernetes service in a trusted profile, you are required to enter information in the namespace and service account fields. You can enter default for both.

For more information, see [Using Trusted Profiles in your Kubernetes and OpenShift Clusters](https://www.ibm.com/cloud/blog/using-trusted-profiles-in-your-kubernetes-and-openshift-clusters) and [Kubernetes namespace](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/).
* How can I view dynamic members of access groups?

To view a list of dynamic members in an access group, go to Manage > Access (IAM) > Access groups in the IBM Cloud console. Select an access group and click Users. Dynamically added users are indicated by the type Dynamic. For more information, see [Viewing dynamic members of access groups](https://cloud.ibm.com/docs/account?topic=account-rules&interface=uiview-dynamic-users)
* How do I find inactive users, service IDs, trusted profiles, and API keys in my account?

To view a list of the inactive identities in your account, go to Manage > Access (IAM) > Inactive identities. You might want to remove inactive identities if they are no longer needed. For more information, see [Identifying inactive identities](https://cloud.ibm.com/docs/account?topic=account-id-inactive-identities).
* Why am I required to migrate my resources?

To continue bringing you the best service, hardware, and connectivity, data centers are continually evaluated to ensure that they meet networking, electrical, and other infrastructure standards.