vania-janet/multiturn-rag-retrieval-data huggingface dataset:
ibmcloud hpcs uko key-template-update 
--id=07b62c12-75a2-46c9-9259-0cecde3985d2 
--uko-vault=5295ad47-2ce9-43c3-b9e7-e5a9482c362b 
--if-match=2022-05-11T14:58:26Z 
--description="The update of the template" 
--output json
* Output

The command returns the output similar to the following example:

ETag
2022-05-20T15:20:06Z
{
"vault": {
"id": "5295ad47-2ce9-43c3-b9e7-e5a9482c362b",
"name": "Test Vault Name",
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/vaults/5295ad47-2ce9-43c3-b9e7-e5a9482c362b"
},
"id": "ada4293c-07ed-4903-b3ee-419bd1a05fde",
"version": 0,
"name": "IBM-CLOUD-EXAMPLE-TEMPLATE",
"key": {
"size": "256",
"algorithm": "aes",
"activation_date": "P5Y1M1W2D",
"expiration_date": "P1Y2M1W4D",
"state": "active"
},
"description": "IBM CLOUD key template description",
"created_at": "2022-03-09T15:40:52Z",
"updated_at": "2022-03-09T15:40:52Z",
{
"name": "README1.md",
"blob": '""$ENC""',
"md5": '""$HASH""'
}'

You can verify the uploaded data.

For Elasticsearch 6:

curl https://user:password@host:port/ibm_file_sync/files/README.md?pretty

For Elasticsearch 7:

curl https://user:password@host:port/ibm_file_sync/_doc/README.md?pretty

If everything went smoothly, the returned data looks like this (shortened) example. The "md5" field can contain a file name alongside the hash.

For Elasticsearch 6:

{
"_index" : "ibm_file_sync",
"_type" : "files",
"_id" : "README1.md",
"_version" : 1,
"found" : true,
"_source" : {
"name" : "README1.md",
"blob" : "IyBF ... KWBgCg==",
"md5" : "270f60e62d3d37add3702ced7f6969a1 README.md"
}
}

For Elasticsearch 7:

{
"_index" : "ibm_file_sync",
"_id" : "README1.md",
"_version" : 1,
"found" : true,
"_source" : {
"name" : "README1.md",
"blob" : "IyBF ... KWBgCg==",
"md5" : "270f60e62d3d37add3702ced7f6969a1 README.md"
}
}





 Syncing files to disk 

After the files are uploaded to the index, they can be synced to the disk.
The UUID of the keystore. You can use the ibmcloud hpcs uko keystores command to retrieve the UUID.

--uko-vault (string)
: Required. The UUID of the vault where the update is to take place. You can use the ibmcloud hpcs uko keystores command to retrieve the UUID.
* Example

ibmcloud hpcs uko keystore-status 
--id=0325e05e-2b25-4f13-85b2-2d7f85e54359 
--uko-vault=5295ad47-2ce9-43c3-b9e7-e5a9482c362b 
--output json
* Output

The command returns the output similar to the following example:

{
"last_heartbeat": "2022-01-26T00:56:01Z",
"health_status": "ok",
"message": "Ping executed successfully."
}







 hpcs uko managed-keys-from-keystore 

List all managed keys that are activated in the target keystore.

If the --all-pages option is not set, the command only retrieves a single page of the collection.
ibmcloud hpcs uko managed-key-ds 
--id=21a7498e-2ae4-47ee-85ac-a19bf64e92fa 
--uko-vault=eb66ebbd-7230-4cde-89bf-17282cda5faa 
--output json
* Output

The command returns the output similar to the following example:

{
"status_in_keystores": [
{
"keystore": {
"id": "b28bf13d-f49d-4b00-8b8d-457d38ad1e15",
"name": "AWS KMS Keystore Name",
"type": "aws_kms",
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/keystores/b28bf13d-f49d-4b00-8b8d-457d38ad1e15"
},
"status": "not_present"
}
]
}







 hpcs uko managed-key-update-from-template 

Update a managed key to match the latest version of the associated key template. You can install, activate, or deactivate the key on target keystores in the group defined by the key template.

ibmcloud hpcs uko managed-key-update-from-template --id ID --uko-vault UKO-VAULT --if-match IF-MATCH



* Command options

--id (string)
: Required. The UUID of the key. You can use the ibmcloud hpcs uko managed-keys command to retrieve the key UUID.

--uko-vault (string)
: Required. The UUID of the vault where the update is to take place. You can use the ibmcloud hpcs uko vaults command to retrieve the vault UUID.

--if-match (string)
: Required.
All storage that is ordered in these data centers is automatically provisioned with encryption for data-at-rest.

When you order File Storage for Classic, select a data center that is marked with an asterisk (). You can see a lock icon to the right of the Volume Name field that indicates that the volume is encrypted. See Figure 1.

Zoom

![Figure 1. Example of the lock icon that indicates that the volume is encrypted.](https://cloud.ibm.com/docs-content/v1/content/04e9937a86546143babfc65ea21fdd4ea2d12d13/FileStorage//images/encryptedstorage.svg)

Figure 1. Example of the lock icon that indicates that the volume is encrypted.

Any nonencrypted storage that was provisioned before a data center upgrade is not automatically encrypted. If you own nonencrypted storage in an upgraded data center and you want to have it encrypted, you need to create a volume, and move your data. For more information, see [File Storage Migration in Upgraded Data Centers](https://cloud.ibm.com/docs/FileStorage?topic=FileStorage-migratestorage).





 Deleting File Storage for Classic instances 

If you no longer need a specific volume, you can cancel that storage. File Storage for Classic presents file shares to customers on physical storage that is wiped before any reuse. For more information, see the [FAQs](https://cloud.ibm.com/docs/FileStorage?topic=FileStorage-file-storage-faqsdeleted).

Customers with special requirements for compliance such as NIST 800-88 Guidelines for Media Sanitization can perform the data sanitization procedure before they delete their storage.

To cancel a storage volume, you need to revoke access from any hosts first. Active replicas and dependent duplicates can also block reclamation of the Storage volume.
If you backed up your data to a new Key Protect instance by using the same root keys, you can update your Secrets Manager instance with data from your backup Key Protect instance. To do so, open a case and include the following information.



* Your Secrets Manager instance's CRN
* Your backup Key Protect instance's CRN
* The key ID
* The original Key Protect instance's CRN and key ID, if available



You must enable service-to-service authorization between your backup Key Protect instance and your Secrets Manager instance.

For more information, see Key Protect's procedures for [high availability and disaster recovery](https://cloud.ibm.com/docs/key-protect?topic=key-protect-ha-dr&interface=ui).
For more information, see [Logging for Hyper Protect Virtual Servers for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-logging-for-hyper-protect-virtual-servers-for-vpcsyslog).



Security claims on disks encryption



* Both the root disk and data disks in the Hyper Protect Virtual Servers for VPC instance are configured with Linux Unified Key Setup (LUKS) Encryption. You can verify the encryption status by checking related messages in the log. For more information, see [Verifying disk encryption status](https://cloud.ibm.com/docs/vpc?hpvs-disks-encryption-validate).







 11 November 2022 

Access management tags to manage VPC resources
: You can now use access management tags to control access to VPC resources, such as virtual server instances and block storage volumes. See the [Access management tags](https://cloud.ibm.com/docs/vpc?topic=vpc-iam-getting-started&interface=uiiam-access-management-tags) section in [Managing IAM access for VPC Infrastructure Services](https://cloud.ibm.com/docs/vpc?topic=vpc-iam-getting-started). For more information about using access management tags, see the following IAM resources:



* [Controlling access to resources by using tags](https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial) UI tutorial
* [Working with tags](https://cloud.ibm.com/docs/account?topic=account-tag&interface=ui)
* [Granting users access to tag resources and service IDs](https://cloud.ibm.com/docs/account?topic=account-access&interface=ui)







 8 November 2022 

Backup policy jobs
: You can now list all jobs for a backup policy and retrieve backup policy job details from the UI, CLI, or API. Backup policy job information includes the backup plan that is used to create the backup snapshot, the backup job type, job status, source volume, target snapshot, and additional information.
"updated_at": "2022-03-09T11:00:47Z",
"created_by": "IBMid-1308197YB4",
"updated_by": "IBMid-1308197YB4",
"keystores":
{
"group": "Production",
"type": "ibm_cloud_kms"
}
],
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/templates/93777bca-baef-4070-b9b5-a2e6079df1b4"
},
{
"vault": {
"id": "5295ad47-2ce9-43c3-b9e7-e5a9482c362b",
"name": "Test Vault Name",
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/vaults/5295ad47-2ce9-43c3-b9e7-e5a9482c362b"
},
"id": "4411f1ae-62cc-484e-9910-65d2e8f258bb",
"version": 0,
"name": "AZURE-EXAMPLE-TEMPLATE",
"key": {
"size": "2048",
"algorithm": "rsa",
"activation_date": "P5Y1M1W2D",
"expiration_date": "P1Y2M1W4D",
"state": "active"
},
"description": "AZURE key description",
"created_at": "2022-03-09T11:00:40Z",
"id": "30372f20-d9f1-40b3-b486-a709e1932c9c",
"creationDate": "2020-03-12T03:37:32Z"
},
"dualAuthDelete": {
"enabled": false
},
"deleted": false
}
]
}







 Enabling a disabled root key 

When you enable a root key that was previously disabled, the key moves from the Suspended to the Active key state. This action restores the key's encrypt and decrypt operations.

For an integrated cloud service that supports revoking access to a disabled root key, the service can take up to 4 hours to restore access to the associated data of the root key. After access to the associated data is restored, a corresponding enable event is displayed in the Activity Tracker web UI.

You can enable a root key that's in the Suspended key state by making a POST call to the following endpoint.

https://api.<region>.hs-crypto.cloud.ibm.com:<port>/api/v2/keys/<key_ID>/actions/enable



1. [Retrieve your authentication credentials to work with keys in the service](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-kms-apiretrieve-kms-credentials).

To enable a root key, you must be assigned a Manager service access role for the instance or key. To learn how IAM roles map to Hyper Protect Crypto Services service actions, check out [Service access roles](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-accessservice-access-roles).
2. Retrieve the key management service API endpoint URL.
Size Size in GBs of the snapshot, it is inherited from the source volume. 
 Source Volume Source volume from which the first snapshot was taken. Click the link for volume details. If the volume was deleted, the name appears without a link. 
 Encryption Either provider-managed or customer-managed. 









 View backup jobs from the CLI 

You can view a list of backup jobs by specifying the ID or name of the backup policy. You can also see details of a backup job with the ID of the backup job.



 View a list of backup jobs from the CLI 

Run the backup-policy-jobs command to view the backup jobs for your backup snapshots. Status indicates when backup snapshots are being created, failed completion, or succeeded completion.

ibmcloud is backup-policy-jobs POLICY [--volume VOLUME] [--snapshot SNAPSHOT] [--snapshot-crn SNAPSHOT_CRN] [--status failed | running | succeeded] [--plan PLAN] [--output JSON] [-q, --quiet]

In the first example, the name of the backup policy is used to list the jobs of that backup policy.

cloudshell:$ ibmcloud is backup-policy-jobs new-policy-23
Listing jobs of backup policy new-policy-23 under account Test Account as user test.user@ibm.com...
ID Auto delete Auto delete after Completed at Created at Job type Status
r138-25828175-2b51-4247-ba01-79c538f68282 true 15 2023-02-23T20:12:37+00:00 2023-02-23T20:12:14+00:00 creation succeeded
r138-57028109-4702-443a-891b-31cac565546c true 15 2023-02-22T20:12:44+00:00 2023-02-22T20:12:25+00:00 creation succeeded
* When you rotate your master key by using key part files, an invalid set of crypto units is selected.
* One or more crypto units are in imprint mode.
* Signature thresholds on the crypto units are not set the same.
* A common set of administrators is not selected and installed in all crypto units large enough to meet the signature threshold value.
* The current master key registers are not all in the Valid state with the same verification pattern.
* When you rotate your master key by using key part files, the new master key registers are not all in the Valid state with the same verification pattern.



Operational workloads cannot be run until master key rotation is completed.

 How to fix it 

If an error occurs when you run the ibmcloud tke cryptounit-mk-rotate command to rotate master keys, check whether the error is an expired authentication token or failed pre-check. If it is not, check whether the following messages are displayed:

KMS CRK rewrap successful, waiting on cryptounit-mk-setimm.



* If this message is not present, you can recover from the error by running the ibmcloud tke cryptounit-mk-rotate command again.
* If the message is present, the reencryption of key storage is complete. The only remaining step in the command is to promote the values in the new master key registers to the current master key registers.

Run the ibmcloud tke cryptounit-mks command. If all the new master key registers are in the Valid state with the same verification pattern and all the current master key registers are in the Valid state with a different same verification pattern, run the ibmcloud tke cryptounit-mk-setimm command to finish the master key rotation.

If for some crypto units the new master key value is moved to the current master key register, clear those crypto units by using the ibmcloud tke cryptounit-rm command. And then, run the ibmcloud tke cryptounit-mk-setimm command to finish the master key rotation.

In both cases, it is safe to continue past the warning on the ibmcloud tke cryptounit-mk-setimm command.
* The ability to purge keys using the UI was added in the [August, 2021 release](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-key-protect-relnoteskey-purge-aug-2021).









 March 2021 



 12 March 2021 

Key Protect supports key transfers in key rings
: You can now use the Key Protect API to transfer a key from one key ring to another key ring. In order to move a key, you must have Manager IAM access permissions to both the key and the target key ring, which is the key ring that you would like the key to be transferred to. To find out more, see [Grouping keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grouping-keystransfer-key-key-ring-api). Also, support for aliases and key-rings brings best practices to using the [Key Protect CLI plug-in](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-reference). Learn more about all of the new features in the [CLI changelog](https://cloud.ibm.com/docs/key-protect?topic=key-protect-cli-changelog).







 February 2021 



 25 February 2021 

The process to restore keys has been enhanced
: Deleted keys can now be restored up to 30 days after deletion. After 30 days, it is no longer possible to restore a key. Any and all types of keys (standard or root, imported or created) can be restored. It is no longer required to pass in key material when restoring a key. For more information, check out [Restoring keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-restore-keys). Rotating keys and re-wrapping encrypted content with a new DEK is fundamental to security.
It is possible to sort by the following parameters: name, created_at, updated_at, vault.id.

ibmcloud hpcs uko keystore-create --uko-vault UKO-VAULT --keystore-body KEYSTORE-BODY [--dry-run DRY-RUN]



* Command options

--uko-vault (string)
: Required. The UUID of the vault where the update is to take place. You can use the ibmcloud hpcs uko keystores command to retrieve the UUID.

--keystore-body ([KeystoreCreationRequest](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-cli-plugin-hpcs-cli-pluginuko-keystore-creation-request-example-schema))
: Required. Properties of the keystore that you want to create or connect to.

--dry-run (bool)
: Optional. Perform a test to verify whether a keystore created with given parameters can be communicated with successfully. No keystores are created in the database. The default value is false.
* Example

ibmcloud hpcs uko keystore-create 
--uko-vault=75d0f626-44b0-4076-80cd-8cb9e485fe73 
--keystore-body='{"type": "aws_kms", "vault": {"id": "75d0f626-44b0-4076-80cd-8cb9e485fe73"}, "name": "AWS KMS Keystore", "description": "AWS KMS Keystore", "groups": ["Production", "Production-DE"], "aws_access_key_id": "HSNGYJMKHGFFF", "aws_secret_access_key": "JHGSY766YUG67GFV", "aws_region": "eu_central_1"}' 
--output json
* Output
<br> <br>Important: To protect your privacy, do not store your personal data as metadata for your key. <br> <br>Each alias must be alphanumeric, case sensitive, and cannot contain spaces or special characters other than - or _. The alias cannot be a UUID and must not be a Key Protect reserved name: allowed_ip, key, keys, metadata, policy, policies. registration, registrations, ring, rings, rotate, wrap, unwrap, rewrap, version, versions. 
 key_description Optional.An extended description of your key. To protect your privacy, do not store your personal data as metadata for your key. 
 expiration_date Optional.The date and time that the key expires in the system, in RFC 3339 format (YYYY-MM-DD HH:MM:SS.SS, for example 2019-10-12T07:20:50.52Z). The key will transition to the deactivated state within one hour past the key's expiration date. If the expirationDate attribute is omitted, the key does not expire. 
 key_material Required.The base64-encoded key material, such as a symmetric key, that you want to manage in the service. For more information, check out [Base64 encoding your key material](https://cloud.ibm.com/docs/key-protect?topic=key-protect-import-standard-keyshow-to-encode-standard-key-material). <br> <br>Ensure that the key material meets the following requirements: <br>A standard key can be up to 7,500 bytes in size. The key must be base64-encoded. 
 key_type A boolean value that determines whether the key material can leave the service. <br> <br>When you set the extractable attribute to true, the service designates the key as a standard key that you can store in your apps or services. 



To protect the confidentiality of your personal data, avoid entering personally identifiable information (PII), such as your name or location, when you add keys to the service.
Grabbing info for key id: 8635b804-9966-4918-a16b-d561fdbf181f...
OK
Key ID Key Name Description Creation Date Expiration Date
8635b804-9966-4918-a16b-d561fdbf181f my-root-key 2020-05-05 19:58:02 +0000 UTC Key does not expire





 Example 2 

This is an explanation of the JSON keys and values from the kp key show command. In this example the key was rotated to ensure all JSON key/value pairs are shown.

$ ibmcloud kp key show 8635b804-9966-4918-a16b-d561fdbf181f --output json

{
"id": "8635b804-9966-4918-a16b-d561fdbf181f",
"name": "my-root-key",
"type": "application/vnd.ibm.kms.key+json",
"algorithmType": "AES",
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-05-05T19:58:02Z",
"lastUpdateDate": "2020-05-05T19:58:24Z",
"lastRotateDate": "2020-05-05T19:58:24Z",
"keyVersion": {
"id": "85b65b20-4165-4da3-8ba9-880e72390461",
"creationDate": "2020-05-05T19:58:24Z"
},
"extractable": false,
"state": 1,
A human-readable name for convenient identification of your key. Important: To protect your privacy, do not store your personal data as metadata for your key. 
 alias_list One or more unique, human-readable aliases assigned to your key. Important: To protect your privacy, do not store your personal data as metadata for your key. Each alias must be alphanumeric, case sensitive, and cannot contain spaces or special characters other than dashes (-) or underscores (_). The alias cannot be a version 4 UUID and must not be a Key Protect reserved name: allowed_ip, key, keys, metadata, policy, policies, registration, registrations, ring, rings, rotate, wrap, unwrap, rewrap, version, versions. Alias size can be between 2 - 90 characters (inclusive). 
 key_description An extended description of your key. Important: To protect your privacy, do not store your personal data as metadata for your key. 
 expiration_date Optional. The date and time that the key expires in the system, in RFC 3339 format (YYYY-MM-DD HH:MM:SS.SS, for example 2019-10-12T07:20:50.52Z). The key will transition to the deactivated state within one hour past the key's expiration date. If the expirationDate attribute is omitted, the key does not expire. 
 key_type A boolean value that determines whether the key material can leave the service. When you set the extractable attribute to false, the service creates a root key that you can use for wrap or unwrap operations. 



To protect the confidentiality of your personal data, avoid entering personally identifiable information (PII), such as your name or location, when you add keys to the service.

If the expirationDate is provided in your create key request, the key will transition to the deactivated state within one hour past the key's expiration date.

A successful POST api/v2/keys response returns the ID value for your key, along with other metadata. The ID is a unique identifier that is assigned to your key and is used for subsequent calls to the Key Protect API.

{
Create a key material (payload) and an expiration date
2. Create a root key using the key material and the expiration date
3. Capture the key id
4. Allow the expiration date to pass
5. Delete the key
6. Restore the key, which fails because you cannot restore a deleted key after the expiration date



 step 1 - create a key material (payload) and an expiration date
 create an expiration date, on a Mac, add 1 (one) minute to the current time
$ KEY_MATERIAL=$(openssl rand -base64 32)
$ EXPIRE=$(date -u -v+1M "+%Y-%m-%dT%H:%M:%SZ")

 step 2 - Create a root key using the key material and the expiration date
$ curl -X POST "https://us-south.kms.cloud.ibm.com/api/v2/keys" -H "authorization: Bearer $ACCESS_TOKEN" -H "bluemix-instance: $KP_INSTANCE_ID" -H "content-type: application/vnd.ibm.kms.key+json" -d '{
"metadata": {
"collectionType": "application/vnd.ibm.kms.key+json",
"collectionTotal": 1
},
"resources": [
{
"type": "application/vnd.ibm.kms.key+json",
"name": "Root-key-1",
"payload": "'$KEY_MATERIAL'",
"description": "example-key",
"expirationDate": "'$EXPIRE'",
"extractable": false
}
]
}'
Show more



 JSON response 

{
"metadata": {
"collectionType": "application/vnd.ibm.kms.key+json",
"collectionTotal": 1
},
"resources": [
{