vania-janet/multiturn-rag-retrieval-data huggingface dataset:
OK





 Example of a generic secret 

A generic secret stores simple key-value pairs and Code Engine makes no assumptions about the defined key-value pairs nor about the intended use of the secret.

To see CLI help for creating a generic secret, run ibmcloud ce secret create or ibmcloud ce secret create --format generic.

Note that --format generic is the default when you create a secret with the secret create command in the CLI.

The following example creates a generic secret that is named mysecret-generic and the value of this secret is specified for a key-value pair with the --from-literal option.

ibmcloud ce secret create --name mysecret-generic --format generic --from-literal "TARGET=My literal secret"





 Example output for a generic secret 

Creating generic secret 'mysecret-generic'...
OK





 Example of a generic secret with values from a file 

The following example creates a secret that is named mysecret-fromfile with values from a file. By using the --from-file option to point to a file, all the contents of the file become the value for the key-value pair.

ibmcloud ce secret create --name mysecret-genericfromfile --from-file ./value1.txt --from-file ./value2.txt



 Example output of a generic secret with values from a file 

Creating secret mysecret-genericfromfile...
OK







 Example of a registry secret 

A registry secret stores credentials to access a container registry.

To see CLI help for creating a registry secret, run ibmcloud ce secret create --format registry.

The following example creates a registry secret that is named mysecret-registry to an IBM Cloud Container Registry instance that is on the us.icr.io registry server and specifies credentials for username and password.

ibmcloud ce secret create --name mysecret-registry --format registry --server us.icr.io --username iamapikey --password API_KEY





 Example output for a registry secret 

Creating registry secret mysecret-registry...
OK
IBM Secrets Manager 

Use [Secrets Manager](https://cloud.ibm.com/catalog/services/secrets-manager) to securely store and apply secrets like API keys, Image Signature, or HashiCorp Vault credentials that are part of your toolchain. You must create a Secrets Manager Service Instance before you proceed further. If you created a Secrets Manager Service Instance as prerequisite, you can link the same in this step.

Zoom

![DevSecOps IBM Secrets Manager](https://cloud.ibm.com/docs-content/v1/content/5eb88a2575e30e316dbb83829c7f4c8b1ddbc67c/devsecops/images/devsecops-secrets-manager.png)

Figure 9. DevSecOps IBM Secrets Manager



* Name: Name of Secrets Manager instance created by the toolchain. This Secrets Manager instance can be accessed by this name during various stages of the toolchain setup.
* Region: Region in which the Secrets Manager service is located.
* Resource Group: Resource Group to which the Secrets Manager service belongs.
* Service name: Secrets Manager service name.







 HashiCorp Vault 

Use HashiCorp Vault to securely store secrets that are needed by your toolchain. Examples of secrets are API keys, user passwords, or any other tokens that enable access to sensitive information. Your toolchain stores references to the HashiCorp Vault secrets, not the literal secret values, which enable advanced capabilities like secret rotation.

Zoom

![HashiCorp Vault](https://cloud.ibm.com/docs-content/v1/content/5eb88a2575e30e316dbb83829c7f4c8b1ddbc67c/devsecops/images/devsecops_hashicorp1_orig.png)

Figure 10. HashiCorp Vault



* Name: A name for this tool integration. This name is displayed in the toolchain.
* Server URL: The server URL for your HashiCorp Vault Instance.
Can I still use Secrets Manager? 

Yes. To use Secrets Manager, you don't need to install Vault or the IBM Cloud plug-ins for Vault. You can try Secrets Manager for free, without needing an extensive background on how to use Vault. To get started, [choose the type of secret](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-what-is-secret) that you want to create. Then, you can integrate with the standard [Secrets Manager APIs](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2) so that you can access the secret programmatically.





 Where can I find information about compliance certifications for Secrets Manager? 

To view a complete list of certifications for Secrets Manager, see section 5.4 of the [Secrets Manager software product compatibility report](https://www.ibm.com/software/reports/compatibility/clarity-reports/report/html/softwareReqsForProduct?deliverableId=FDDE7600BDD511EA92B4FC8223E18670).
[Secret Reference to a Vault](https://cloud.ibm.com/docs-content/v1/content/562806c0b18119f4d21cb66f5ae6d051634b4a16/ContinuousDelivery/images/secret-pill.png)

Figure 1. Secret reference to a vault

The name of the secret that you select appears in capsule form. You cannot edit the secret name inline, but you can click ![remove icon](https://cloud.ibm.com/docs-content/v1/content/562806c0b18119f4d21cb66f5ae6d051634b4a16/ContinuousDelivery/images/secret-pill-delete-16.png) to delete the name. You can also replace the secret name by using the Secrets Picker control again. If you manually type or paste a secret name into the Secrets field, it is displayed in a different format:

Zoom

![Literal Secret Value](https://cloud.ibm.com/docs-content/v1/content/562806c0b18119f4d21cb66f5ae6d051634b4a16/ContinuousDelivery/images/secret-literal.png)

Figure 2. Secret value

The format that the secret is displayed in indicates whether the value references a secret that is stored in a backend vault or is a secret that is stored in your toolchain. By using references to secrets that are managed by secret providers such as Key Protect, your secret values are centralized and stored securely in a single location. This approach resolves secrets sprawl and proliferation, and means that you can update secrets without updating your toolchain. When you use secret references, the actual secret value is resolved when the toolchain runs by dynamically retrieving it from Key Protect. This approach is useful when you must rotate the value of your toolchain secrets periodically.





 Adding a Key Protect tool integration to your toolchain template
ibmcloud secrets-manager secret-version-locks-bulk-create --secret-id=0b5571f7-21e6-42b7-91c5-3f5ac9793a46 --id=eb4cf24d-9cae-424b-945e-159788a5f535 --locks='[{"name": "lock-example-1", "description": "lock for consumer 1", "attributes": {"anyKey": "anyValue"}}]' --mode=remove_previous





 Example output 

Example of response body to create secret locks

{
"secret_id" : "0cf4addb-7a90-410b-a3a7-a15bbe2b7909",
"secret_group_id" : "d8371728-95c8-4c12-b2af-1af98adb9e41",
"versions" : [ {
"version_id" : "7bf3814d-58f8-4df8-9cbd-f6860e4ca973",
"version_alias" : "current",
"locks" : "lock-3", "lock-4" ],
"payload_available" : true
}, {
"version_id" : "5bf89b0c-df55-c8d5-7ad6-8816951c6784",
"version_alias" : "previous",
"locks" : "lock-example-1", "lock-example-2" ],
"payload_available" : true
} ]
}







 ibmcloud secrets-manager secret-version-locks-bulk-delete 

Delete all the locks or a subset of the locks that are associated with the specified version of a secret.

To delete only a subset of the locks, add a query param with a comma to separate the list of lock names:

Example: ?name=lock-example-1,lock-example-2.
Configuring Dynamic Content Acceleration 

Dynamic Content Acceleration (DCA) is a technology to accelerate the dynamic web content. It provides improved reliability, offload, and network performance over your original web infrastructure, while handling the specific requirements of dynamically generated content — without a costly hardware build-out. Using real-time network optimizations and advanced caching techniques, it speeds and secures interactive websites.



 Working with DCA configurations 

To enable DCA, follow these steps:



1. Open the page of a specified CDN mapping, click Settings from the navigation pane. Click Edit from the Optimization settings, then select Dynamic content acceleration from the Optimize for list menu.
2. Enable DCA:



* Download the route detection 'test object', or use your own test file, and upload it to your origin server. For more information about the criteria of the test object, see [Detection path](https://cloud.ibm.com/docs/CDN?topic=CDN-dynamic-content-accelerationdetection-path).
* Type the path of the object in the Detection path field. Click Test to open a new browser window to verify that the object can be reached.

If the window is blocked, update your browser settings to allow pop-up windows, or you can use your own method to check that the detection path is reachable.
* Enable/Disable [Prefetching](https://cloud.ibm.com/docs/CDN?topic=CDN-dynamic-content-accelerationprefetching) and [Image compression](https://cloud.ibm.com/docs/CDN?topic=CDN-dynamic-content-accelerationimage-compression).



3. Click Save to save the settings. If the Detection path is unreachable, the optimal route for dynamic content acceleration is impacted.







 Understanding DCA concepts 



 Detection path 

Detection path is used by Akamai Edge servers to find the best optimized route from Edge servers to origin. The best path to origin must be known at the time a user’s request arrives at an Edge server because any inline analysis or detection would defeat the purpose of speeding up things.
If reuse_api_key is false for IAM credentials, manual rotation for the secret isn't supported. For more information, see [Manually rotating secrets](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-manual-rotation).





 Using an existing service ID in your account 

You might already have a service ID in your account that you want to use to dynamically generate an API key. In this scenario, you can choose to create an IAM credentials secret by bringing your own service ID. For example, the following command creates an IAM credential by using the service_id field.

You can store metadata that are relevant to the needs of your organization with the custom_metadata and version_custom_metadata request parameters. Values of the version_custom_metadata are returned only for the versions of a secret. The custom metadata of your secret is stored as all other metadata, for up to 50 versions, and you must not include confidential data.

You can find the ID value of a service ID in the IAM section of the console. Go to Manage > Access (IAM) > Service IDs > name. Click Details to view the ID.

curl -X POST
-H "Authorization: Bearer {iam_token}" -H "Accept: application/json" -H "Content-Type: application/json" -d '{
"name": "example-iam-credentials-secret",
"description": "Description of my IAM Credentials secret",
"service_id":"iam-ServiceId-c0c7cfa4-b24e-4917-ad74-278f2fee5ba0",
"secret_type": "iam_credentials",
"secret_group_id": "bfc0a4a9-3d58-4fda-945b-76756af516aa",
"labels": [
"dev",
"us-south"
],
"ttl": "30m",
Names are unique per secret version. /n Note: Creating a lock with an existing name replaces the lock and overrides its attributes. 
 description An extended description of your secret lock. 
 attributes Optional information to associate with a lock, such as resources CRNs to be used by automation. 





 Example request 

Create a lock on the specified version of a secret in the default secret group.

curl -X POST "https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/{secret_type}/locks/{secret_id}/versions/{version_id}/lock" -H 'X-Vault-Token: {Vault-Token}'
-H 'Content-Type: application/json' -D '{
"locks": [
{
"name": "lock-for-app-1",
"description": "Test lock for secret in the default secret group.",
"attributes": {
"key": "value"
}
}
]
}'

Replace {version_id} in the URL path with the current alias to create a lock on the current secret version. The aliases current or previous are allowed.

Create two locks on the current version of a secret in an existing secret group.

curl -X POST "https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/{secret_type}/locks/groups/{group_id}/{secret_id}/versions/current/lock" -H 'X-Vault-Token: {Vault-Token}'
-H 'Content-Type: application/json' -D '{
"locks": [
{
"name": "lock-for-app-1",
"description": "Test lock for secret in a custom secret group.",
"attributes": {
"key": "value"
}
},
{
"name": "lock-for-app-2",
{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/{secret_type}/locks/{secret_id}/unlock" -H 'X-Vault-Token: {Vault-Token}'
-H 'Content-Type: application/json' -D '{
"locks": [""]
}'

Remove two locks from a secret in an existing secret group.

curl -X POST "https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/{secret_type}/locks/groups/{group_id}/{secret_id}/unlock" -H 'X-Vault-Token: {Vault-Token}'
-H 'Content-Type: application/json' -D '{
"locks": ["lock-name-1", "lock-name-2"]
}'





 Example response 

A request to remove all locks returns the following response:

{
"request_id": "4708ebbf-eab0-e68a-9e72-d1c67a209fdc",
"lease_id": "",
"renewable": false,
"lease_duration": 0,
"data": {
"secret_group_id": "default",
"secret_id": "184408d6-8264-5ff3-c308-6922ed04ad88",
"versions": [
{
"alias": "current",
"id": "f2b68dbb-c291-87df-6026-7611c324c823",
"locks": ],
"payload_available": true
}
]
},
"wrap_info": null,
"warnings": null,
"auth": null
}

A request to remove only specific locks lists the remaining locks in the response:

{
The IAM credentials secret type is fully integrated with IAM. Secrets Manager auto-manages dynamic service IDs and API keys that are associated with an IAM credentials secret. Continuous Delivery and Secrets Manager service APIs engage to resolve authorized IAM Credentials secret references in Continuous Delivery toolchains and pipeline workloads.

When you create an IAM credentials secret in Secrets Manager, make sure that you select the Reuse IAM credentials until lease expires checkbox. Also, specify a lease duration with a minimum of 12 hours when you use public worker agents to run your pipeline. If you use private worker agents, make sure that you set a minimum lease duration to the forced cancellation duration for a pipeline. It is recommended that you confirm these settings with your account administrator. By setting the reuse option and an appropriate lease duration, you can make sure that the dynamically managed IAM credentials service ID API key persists during your pipeline runs.

Zoom

![IAM credentials lease duration and reuse API key](https://cloud.ibm.com/docs-content/v1/content/562806c0b18119f4d21cb66f5ae6d051634b4a16/ContinuousDelivery/images/secret-leaseduration.png)

Figure 3. IAM credentials lease duration and reuse API key

By running the Rotate action on IAM credentials from the Secrets Manager dashboard, you can maintain the compliance posture requirements for API Key rotations that are used by your Continuous Delivery pipelines. Secrets Manager works with IAM to generate a new API Key for an IAM credentials secret and manages the versioning of the secret.

The IAM credentials secret type also helps to provide continuity of service during and after secret rotation:



* New Continuous Delivery pipeline workloads use the newly rotated API Key until its lease duration expires.
* Existing Continuous Delivery pipeline workloads that are running with the API Key that was issued before rotation can continue to run with the previous version until the lease duration of the previous version expires.



Zoom

!
{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/kv/metadata/{secret_name}' -H 'Accept: application/json'
-H 'X-Vault-Token: {Vault-Token}'



Table 9. Delete the metadata of a key-value secret request parameters

 Request parameter Description 

 instance_id The ID of the Secrets Manager instance. 
 region The region in which the Secrets Manager instance was created. 
 secret_name The name of the key-value secret. 
 Vault-Token The authentication token that is retrieved from Vault. 







 Example response 

A request to delete the metadata and all versions of a key-value secret in the default secret group returns the following response:

{
"request_id": "62b1e2c2-801a-6592-0526-edb38896a546",
"lease_id": "",
"renewable": false,
"lease_duration": 0,
"data": null,
"wrap_info": null,
"warnings": null,
"auth": null
}







 List key names of a key-value secret 

Get a list of key names of a key-value secret. Do not encode sensitive information in key names. The values of the keys are not accessible by using this command.

In {sm-short}, you can't use the LIST HTTP verb to get the list of key names. You can do so only in Vault's KV API.



 Example request 

curl -X GET "https://{instance_id}.{region}.secrets-manager.test.appdomain.cloud/v1/ibmcloud/kv/metadata/?list=true" 
-H 'Accept: application/json' -H 'X-Vault-Token: {Vault-Token}'



Table 10. List the key names of a key-value secret request parameters

 Request parameter Description 

 instance_id The ID of the Secrets Manager instance. 
 region The region in which the Secrets Manager instance was created.
CLI plug-in version 0.1.20
: Version 0.1.20 of the Secrets Manager CLI is now available for download. To learn about the latest updates, see the [CLI change log](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-cli-change-log).





 8 June 2022 

Allow access to Secrets Manager in a restricted account
: Working in an account that has [IP address access restrictions](https://cloud.ibm.com/docs/account?topic=account-ips&interface=ui)? To use certain features in Secrets Manager, for example, to generate IAM credentials, an extra step is required to ensure that your account is able to accept incoming requests from the service. If your account allows access to only specific IP addresses, you can update your account settings to specify a required list of IP addresses for Secrets Manager.





 27 May 2022 

Integration with Application Load Balancer for VPC
: You can now use Secrets Manager to centrally manage the SSL/TLS certificates that are required for load balancers to perform SSL offloading tasks. To learn more about this integration, check out the [Application Load Balancer for VPC documentation](https://cloud.ibm.com/docs/vpc?topic=vpc-load-balancers).





 16 May 2022 

Updated Secrets Manager event notifications
: Previously, notifications for Secrets Manager were supported for certificates only. Now, you can be notified when other types of secrets in your instance are expired or soon to expire.



* secret_about_to_expire: Now available for arbitrary secrets, IAM credentials, and user credentials.
* secret_expired: Now available for arbitrary secrets, IAM credentials, and user credentials.



For more information about using Event Notifications to enable lifecycle notifications for your Secrets Manager instance, see [Enabling event notifications](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-event-notifications).

CLI plug-in version 0.1.19
: Version 1.1.19 of the Secrets Manager CLI is now available for download.
Learning about Secrets Manager architecture and workload isolation 

IBM Cloud® Secrets Manager is a single tenant, dedicated service that is managed by both you and IBM Cloud. To learn more, review the following architecture diagram to see how Secrets Manager can meet the requirements of the sensitive workloads that you want to run in the cloud.



  Secrets Manager architecture 

The following image shows the main Secrets Manager components, how they interact with each other, and what type of encryption is applied to your personal information.

Zoom

![This image is a visual representation of the architecture for Secrets Manager.](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/secrets-manager/images/secrets-arch.svg)

Figure 1. Secrets Manager architecture



1.  A user creates an instance of Secrets Manager. At provisioning, the user can [configure a root key from a key management service](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-mng-datadata-encryption) or choose the default, provider-managed encryption option. A dedicated instance of the service is created.
2.  When a user, CLI, application, or DevOps tool makes a request to the service by using the Secrets Manager UI or APIs, the request is completed through their vault formation.
3.  Service data and secrets are stored in a dedicated Cloud Object Storage bucket.







  Secrets Manager workload isolation 

Secrets Manager is a single-tenant, dedicated service instance. Each workload is isolated within its own namespace within the data plane of the service clusters.
{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/kv/data/{secret_name}' -H 'Accept: application/json' -H 'X-Vault-Token: {Vault-Token}'



Table 3. Delete the latest version of a key-value secret request parameters

 Request parameter Description 

 instance_id The ID of the Secrets Manager instance. 
 region The region in which the Secrets Manager instance was created. 
 secret_name The name of the key-value secret. 
 Vault-Token The authentication token that is retrieved from Vault. 







 Example response 

A request to delete the latest version of a key-value secret in the default secret group returns a blank response with a 204 status code to confirm that the latest version was deleted.







 Delete specified versions of a key-value secret 

Delete the specified versions of a key-value secret. After you delete the versions, you can't retrieve them by using list or get API calls. However, it is a soft delete and the underlying data is not removed. You can undo the deletion by calling the [undelete](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-vault-manage-kv&interface=apikv-version-restore) API endpoint.



 Example request 

curl -X POST 'https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/kv/delete/test-kv' -H 'Accept: application/json' -H 'X-Vault-Token: {Vault-Token}' -d '{
"versions": [1, 2]
}'



Table 4. Delete specified versions of a key-value secret request parameters

 Request parameter Description 

 instance_id The ID of the Secrets Manager instance. 
 region The region in which the Secrets Manager instance was created. 
 secret_name The name of the key-value secret. 
 Vault-Token The authentication token that is retrieved from Vault. 
 versions The specified versions that are to be deleted. 







 Example response
"name": "test-kv-secret",
"description": "Extended description for my secret.",
"payload": {
"key1": "value1"
},
"labels": [
"dev",
"us-south"
]
}'

Create a key-value secret in an existing secret group.

curl -X POST 'https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/kv/secrets/groups/{group_id}' -H 'Accept: application/json/groups/{group_id}' -H 'X-Vault-Token: {Vault-Token}' -H 'Content-Type: application/json' -d '{
"name": "test-kv-secret",
"description": "Extended description for my secret.",
"payload": {
"key1": "value1"
},
"labels": [
"dev",
"us-south"
]
}'
Show more

Create user credentials in the default secret group.

curl -X POST "https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/username_password/secrets" -H 'Accept: application/json' -H 'X-Vault-Token: {Vault-Token}' -H 'Content-Type: application/json' -d '{
"name": "test-username-password",
"description": "Extended description for my secret.",
"username": "user123",
"password": "cloudy-rainy-coffee-book",
"expiration_date": "2020-12-31T00:00:00Z",
"labels": [
"dev",
"us-south"
]
}'
Show more

Create user credentials in an existing secret group: