vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Follow the instructions in [Provide Access Credentials for a Password Protected Container Registry](https://help.sap.com/viewer/e66c399612e84a83a8abe97c0eeb443a/2.7.latest/en-US/a1cbbc0acc834c0cbbe443f2e0d63ab9.html). Be sure to use the following parameters, including pasting the copied API key into the password field.

cat >/tmp/vsystem-registry-secret.txt <<EOF
username: "iamapikey"
password: ""
EOF





 Final Step 

[Testing your installation](https://help.sap.com/viewer/e66c399612e84a83a8abe97c0eeb443a/2.7.latest/en-US/1551785f3d7e4d37af7fe99185f7acb6.html).
A lock can be used to prevent a secret from being deleted or modified while it's in use by your applications. A successful request attaches a new lock to your secret, or replaces a lock of the same name if it already exists. Additionally, you can use this operation to clear any matching locks on a secret by using one of the following optional lock modes:



* remove_previous: Removes any other locks with matching names if they are found in the previous version of the secret.
* remove_previous_and_delete: Carries out the same function as remove_previous, but also permanently deletes the data of the previous secret version if it doesn't have any locks.



ibmcloud secrets-manager secret-version-locks-bulk-create --secret-id SECRET-ID --id ID --locks LOCKS [--mode MODE]



 Command options 

--secret-id (string)
: The ID of the secret. Required.

The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--id (string)
: The ID of the secret version. Required.

The maximum length is 36 characters. The minimum length is 7 characters. The value must match regular expression /^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|current|previous)$/.

--locks ([SecretLockPrototype]](https://cloud.ibm.com/docs/cli?topic=cli-secrets-manager-clicli-secret-lock-prototype-example-schema))
: The locks data to be attached to a secret version. Required.

The maximum length is 1000 items.
: The ID of the secret. Required.

The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--secret-version-prototype ([SecretVersionPrototype](https://cloud.ibm.com/docs/secrets-manager-cli-plugin?topic=secrets-manager-cli-plugin-secrets-manager-clicli-secret-version-prototype-example-schema))
: Specify the properties for your new secret version. Required.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, e.g. --secret-version-prototype=@path/to/file.json.





 Example 

ibmcloud secrets-manager secret-version-create --secret-id=0b5571f7-21e6-42b7-91c5-3f5ac9793a46 --secret-version-prototype='{"payload": "updated secret credentials", "custom_metadata": {"anyKey": "anyValue"}, "version_custom_metadata": {"anyKey": "anyValue"}}'







 ibmcloud secrets-manager secret-versions 

List the versions of a secret.

A successful request returns the list of versions of a secret, along with the metadata of each version.

ibmcloud secrets-manager secret-versions --secret-id SECRET-ID



 Command options 

--secret-id (string)
: The ID of the secret. Required.

The maximum length is 36 characters. The minimum length is 36 characters.
The ciphertext and the AAD is required to unwrap the ciphertext and reveal the plaintext data encryption key (DEK).

 create a root key
$ KEY_ID=$(ibmcloud kp key create my-root-key --output json | jq -r '.["id"]')

$ echo $KEY_ID

5f2cc155-fe16-492c-845c-4d1f0688c7ba

 create a random, base64-encoded, 32-byte data encryption key (DEK)
$ PLAINTEXT=$(openssl rand -base64 32)

$ echo $PLAINTEXT

H4ZfQe66aKcxirfCdNZ/3Na0JECP6HsAM3yclKmIfPQ=

 set the additional authentication data (AAD)
$ AAD1=My-Secret-Password
$ AAD2=My-Verification-Phrase

 wrap the plaintext with the root key and AAD
$ CIPHERTEXT=$(ibmcloud kp key wrap $KEY_ID -a "$AAD1,$AAD2" -p $PLAINTEXT --output json | jq -r '.["Ciphertext"]')

$ echo $CIPHERTEXT

eyJjaXBoZXJ0ZXh0IjoiL1pQUzRLbUxQ ...<redacted>... ZjA2ODhjN2JiIn0=

 unwrap the ciphertext and reveal the original plaintext DEK
$ ibmcloud kp key unwrap $KEY_ID $CIPHERTEXT -a $AAD1,$AAD2

Unwrapping key...
OK
Plaintext Rewrapped Plaintext
H4ZfQe66aKcxirfCdNZ/3Na0JECP6HsAM3yclKmIfPQ=

 this should fail (missing some of the AAD)
$ ibmcloud kp key unwrap $KEY_ID $CIPHERTEXT -a $AAD1

Unwrapping key...
FAILED
"dualAuthDelete": {
"enabled": false
}
}

 decode the payload to get the original string (credentials)
$ echo $PAYLOAD | base64 -d

{
"host": "localhost",
"database": "dev-backup",
"username": "my-username",
"password": "my-password"
}





 Example 7 

Create a root key with an alias, then use that alias to identify the key to show the key details.

 create a root key with an alias
$ ibmcloud kp key create root-key-with-alias -a example-alias --output json

{
"id": "b3660416-4186-4587-b528-484886a4731b",
"name": "root-key-with-alias",
"type": "application/vnd.ibm.kms.key+json",
"extractable": false,
"state": 1,
"aliases": [
"example-alias"
],
"keyRingID": "default",
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:390086ac-76fa-4094-8cf3-c0829bd69526:key:b3660416-4186-4587-b528-484886a4731b",
"deleted": false
}

 show key details using the alias as identifier
$ ibmcloud kp key show example-alias --output json

{
"id": "b3660416-4186-4587-b528-484886a4731b",
"name": "root-key-with-alias",
If authenticationType is set to ApiKey, the header that is formed is Authorization: <apiKey>. Field is ignored for authenticationType as Basic. Optional 
 username String Username to be used for authenticationTypeBasic. Required if authenticationType as Basic 
 password String Password to be used for authenticationTypeBasic. Required if authenticationType as Basic 



For sensitive information like credentials, you must read these values from a vault or a secret store.





 Configuring ZAP UI scans 

Similar to configuring ZAP API scans, create or update the file trigger_zap_scans inside your application repository, at a location of your choice, for example, inside a scripts directory.

Set the values for the corresponding parameters by adding these lines to the trigger_zap_scans as follows - set_env <parameter name> <value>. For more information about a reference implementation, see [hello-compliance-app](https://us-south.git.cloud.ibm.com/open-toolchain/hello-compliance-app).

Set the zap-ui-scan parameter to true for ZAP UI scan to run.

Parameters that are required for configuring ZAP UI scans are as follows.



Table 4. ZAP UI configuration parameters

 Name Type Description Required or Optional 

 zap-ui-custom-script String Path to the file that contains the modification logic for the UI scan payload, if required, before the ZAP UI scan is initiated. Optional 
 zap-ui-script-directory String Path to the directory that contains the UI tests and required files to run the UI scan. Required 
 context-file String Path to a custom context file for UI scans provided to ZAP. Optional 
 zap-ui-port String Port to run the ZAP UI scanner when deployed to a cluster, default: 9085. Optional 
 zap_ui_deployment_name String Name of the ZAP UI scanner deployment, default: zap-ui-deployment. Optional 
 zap-proxy-service String Name for the ZAP Proxy service required by the UI scanner, default: zap-proxy-service. Optional
Setting the Root Password 

The IBM Cloud® Databases for etcd service is provisioned with a root user.

You must set the root password before you can use it to connect. To set the password through the IBM Cloud dashboard, select Manage from the service dashboard to open the management panel for your service. Open the Settings tab, and use the Change Database Admin Password panel to set a new root password.

![The Change Database Admin Password Panel in Settings](https://cloud.ibm.com/docs-content/v1/content/fcee192e52fce225776143bc6ccc3a023d1d193a/databases-for-etcd/images/settings-admin-password.png){: caption="Figure 1. The Change Database Admin Password Panel in Settings" caption-side="bottom"}



  Setting the root password from the command line 

Use the cdb user-password command from the [Cloud Databases CLI plug-in](https://cloud.ibm.com/docs/databases-cli-plugin?topic=databases-cli-plugin-cdb-reference) to set the root password with the command line.

For example, to set the root password for a deployment named "example-deployment", use the following command.

ibmcloud cdb user-password example-deployment root <newpassword>





  Setting the root password from the API 

The Foundation Endpoint that is shown on the Overview panel of your service provides the base URL to access this deployment through the API. Use it with the /deployments/{id}/users/{username} endpoint to set the root password.

curl -X PATCH https://api.{region}.databases.cloud.ibm.com/v4/ibm/deployments/{id}/users/root' -H "Authorization: Bearer $APIKEY" -H "Content-Type: application/json" -d '{"password":"newrootpasswordsupersecure21"}'

For more information, see the [API Reference](https://cloud.ibm.com/apidocs/cloud-databases-apiset-database-level-user-s-password).
The host operating system is unaware of the virtual client.





 Hash-Based Message Authentication Code (HMAC) 

A cryptographic code that uses a cryptic hash function and a secret key.





 headroom analysis 

The process of determining how much improvement in accuracy, precision, or recall can be expected by addressing some class of problems that are identified while performing accuracy analysis.





 health check 

A process that monitors system resources and conditions to determine whether the system is running efficiently. The health check can be configured to report potential problems and to display warnings and fail levels before the integrity of the system is compromised.





 heavy API call 

A client operation that writes, deletes, or inserts data. Heavy API calls consume more resources than light API calls because they are affecting the data. See also [light API call](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx7690463).





 high availability (HA) 

The ability of IT services to withstand all outages and continue providing processing capability according to some predefined service level. Covered outages include both planned events, such as maintenance and backups, and unplanned events, such as software failures, hardware failures, power failures, and disasters. See also [disaster recovery](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx2113280).





 HMAC 

See [Hash-Based Message Authentication Code](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx6652268).





 host 

A computer that is connected to a network and that provides an access point to that network. The host can be a client, a server, or both a client and server simultaneously.
On the line "value": "dev-topic-{{}}-{{?}}.?.log", the {{}} indicates the character * and the {{?}} indicates the character ?. Therefore, a topic such as dev-topic--?.1.log matches this pattern.







 String comparisons 

The following table lists the string comparison operators that you can use to build access policies with /v2/policies syntax. For more information about each version, see [Comparing /v1/policies and /v2/policies syntax](https://cloud.ibm.com/docs/account?topic=account-known-issuescompare-syntax).



Table 3. The string comparison operators available for conditions in access policies.

 Operator Description 

 stringEquals Case-sensitive string comparison. Boolean or number values are converted into a string before comparison. 
 stringMatch Case-sensitive string match is performed between the pattern and the target string by using either an asterisk (), question mark (?), or both. An asterisk () represents any sequence of zero or more characters in the string, and a question mark (?) represents any single character. You can also express an asterisk * and question mark ? as a literal value by enclosing each within two sets of curly brackets {{}}. 
 stringExists String must be present but can have any none zero value. 
 stringEqualsAnyOf Case-sensitive exact string matching any of the strings in an array of strings. 
 stringMatchAnyOf Case-sensitive string matching any of the strings in an array of strings. The values can include a multi-character wildcard (), which matches any sequence of zero or more characters, a single-character wildcard (?), matching any single character, or both. You can also express an asterisk * and question mark ? as a literal value by enclosing each within two sets of curly brackets {{}}.
If a user does not supply the information that is pulled by the parameter, it appears blank.



Table 3. Parameters that you can use in messages that are related to forgotten passwords

 Parameter Description 

 %{linkExpiration.hours} Displays the number of hours that the link is valid. 
 %{linkExpiration.minutes} Displays the number of minutes that the link is valid. 
 %{resetPassword.code} Displays a one-time passcode as part of the URL. This means that each person would have a different code. Example: https://us-south.appid.cloud.ibm.com/wfm/verify/6574839563478 
 %{resetPassword.link} Displays the link that a user clicks to reset their password. 



You can also use the message parameters that are listed in the [Welcome message](https://cloud.ibm.com/docs/appid?topic=appid-cd-typescd-messages-welcome) section.
4. Define an expiration time for the action URL. The URL expiration is the amount of time, in minutes, that a user must complete the action before the verification link expires. This setting also affects the amount of time that your reset password link is valid.
5. Enter a URL for the page that you want to display after a user verifies their email in the Reset password page URL box. If you choose to leave this field blank, an App ID default page is displayed.
6. Click Save.







 Email: Password change 

You can notify a user when their password is updated. The notification can be helpful if they did not request that their password be changed. They can take the proper steps to resecure their account.



1. Go to the Cloud Directory > Email templates > Password change tab of the service dashboard.
2. Set Password changed email to Enabled.
3. Customize the content of your message. You can add parameters and insert images by using the UI.
: Specify this option to reduce the output of the command. This option applies for basic_auth, generic, registry, ssh, and tls secrets. This value is optional. The default value is false.

--server, -s
: The URL of the registry server for a registry secret. This option is required for registry secrets. This value is optional. The default value is us.icr.io.

--username, -u
: The username for your basic auth or registry secret. This option is required for basic_auth and registry secrets. This value is optional.





 Example of a basic auth secret 

A basic auth secret contains a username and password key and is used when you access a service that requires basic HTTP authentication.

To see CLI help for creating a basic auth secret, run ibmcloud ce secret create --format basic_auth.

The following example creates a basic auth secret that is named mysecret-basicauth. This secret contains the username myusername, and the password value is obtained from a file on the local machine. If the password is not provided from a file or a JSON file, then you are prompted to enter the password value.

ibmcloud ce secret create --name mysecret-basicauth --format basic_auth --username myusername --password-from-file ./password.txt





 Example output for a basic auth secret 

Creating basic_auth secret 'mysecret-basicauth'...
OK





 Example of a generic secret 

A generic secret stores simple key-value pairs and Code Engine makes no assumptions about the defined key-value pairs nor about the intended use of the secret.

To see CLI help for creating a generic secret, run ibmcloud ce secret create or ibmcloud ce secret create --format generic.

Note that --format generic is the default when you create a secret with the secret create command in the CLI.
"version_id" : "5bf89b0c-df55-c8d5-7ad6-8816951c6784",
"version_alias" : "previous",
"locks" : "lock-example-1", "lock-example-2" ],
"payload_available" : true
} ]
}







 ibmcloud secrets-manager secret-version-locks 

List the locks that are associated with a specified secret version. Note: If the --all-pages option is not set, the command will only retrieve a single page of the collection.

ibmcloud secrets-manager secret-version-locks --secret-id SECRET-ID --id ID [--offset OFFSET] [--limit LIMIT] [--sort SORT] [--search SEARCH]



 Command options 

--secret-id (string)
: The ID of the secret. Required.

The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--id (string)
: The ID of the secret version. Required.

The maximum length is 36 characters. The minimum length is 7 characters. The value must match regular expression /^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|current|previous)$/.

--offset (int64)
: The number of locks to skip.

The minimum value is 0.

--limit (int64)
: The number of secrets with locks to list.

The maximum value is 100. The minimum value is 1.

--sort (string)
Encryption in transit - Securing mount connections between file share and virtual server instance 

New

You can establish an encrypted mount connection between the virtual server instance and storage system by using the Internet Security Protocol (IPsec) security profile and X.509 certificates. By enabling encryption in transit, you create secure end-to-end encryption for your data.

IBM Cloud® File Storage for VPC is available for customers with special approval to preview this service in the Frankfurt, London, Madrid, Dallas, Toronto, Washington, Sao Paulo, Sydney, Osaka, and Tokyo regions. Contact your IBM Sales representative if you are interested in getting access.



 Overview 

With this feature, you can enable secure end-to-end encryption of your data when you use file shares with security-group-based access control mode and mount targets with virtual network interfaces. When such a mount target is attached and the share is mounted on a virtual server instance, the virtual network interface checks the security group policy to ensure only authorized instances can communicate with the share. The traffic between the authorized virtual server instance and the file share can be IPsec encapsulated by the client.

IPsec is a group of protocols that together set up encrypted connections between devices. It helps keep data sent over public networks secure. IPsec Encrypts IP packets, and authenticates the source where the packets come from. To configure IPsec on your virtual server instance, you can use [strongSwan](https://www.strongswan.org/), which is an open source IPsec-based VPN solution. For more information about how strongSwan works, see [Introduction to strongSwan](https://docs.strongswan.org/docs/5.9/howtos/introduction.html) and [IPsec Protocol](https://docs.strongswan.org/docs/5.9/howtos/ipsecProtocol.html), too.

Encrypting data in transit can have some performance impact due to the processing that is needed to encrypt and decrypt the data at the endpoints.

The IPsec connection requires that you have an X.509 certificate for authentication.
The value must match regular expression /^[0-9]+[s,m,h,d]{0,1}$/.

--rotation ([RotationPolicy](https://cloud.ibm.com/docs/secrets-manager-cli-plugin?topic=secrets-manager-cli-plugin-secrets-manager-clicli-rotation-policy-example-schema))
: This field indicates whether Secrets Manager rotates your secrets automatically.





 Example 

ibmcloud secrets-manager secret-metadata-update --id=0b5571f7-21e6-42b7-91c5-3f5ac9793a46 --name=updated-arbitrary-secret-name --description='updated Arbitrary Secret description' --labels=dev,us-south --custom-metadata='{"anyKey": "anyValue"}' --expiration-date=2033-04-12T23:20:50.520Z







 ibmcloud secrets-manager secret-action-create 

Create a secret action. This operation supports the following actions:.

ibmcloud secrets-manager secret-action-create --id ID --secret-action-prototype SECRET-ACTION-PROTOTYPE



 Command options 

--id (string)
: The ID of the secret. Required.

The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--secret-action-prototype ([SecretActionPrototype](https://cloud.ibm.com/docs/secrets-manager-cli-plugin?topic=secrets-manager-cli-plugin-secrets-manager-clicli-secret-action-prototype-example-schema))
: The request body to specify the properties for your secret action. Required.
Updating a user's SSL VPN password 

VPN passwords are required for any VPN connectivity. Passwords can be set by any user with VPN Administration permissions that are associated with an account, such as an account owner or parent user.

Follow these steps to update a user’s VPN password:



1.  Log in to the [IBM Cloud console](https://cloud.ibm.com/).
2.  From the menu bar, click Manage > Access (IAM).
3.  Select Users, and then click User details.
4.  On the User details page, go to VPN access for classic infrastructure.
5.  Select the Edit icon ![Edit icon](https://cloud.ibm.com/docs-content/v1/content/d826dd464c32f9849223da7328a5779b31e76d28/images/icon_write.svg) to enter a new VPN password.
6.  Click Update password.
The generated NSX Manager password for vCenter Server primary instances is now 15 characters in length. Previously, the generated password was 8 characters in length.





 Policy for accessing clients' instances 

vCenter Server environments, which are delivered as IBM Cloud for VMware Solutions, provide a VMware® management platform layer for our clients to manage the virtualization capabilities. Throughout the lifecycle of IBM Cloud for VMware Solutions products and services, IBM Support might be required to help guarantee their success. Usually, intervention by IBM Support is the result of a client request (that is, a support ticket). However, on rare occasions, IBM Support might assist proactively and without a client–written support ticket to prevent future issues. This access is through the IBM Cloud internal support network and is documented through a support ticket that is opened by IBM Support and continuously monitored by IBM Cloud SOC. At no time will IBM Support modify instance configuration without prior consent from the client. The access is to the VMware management components and to the IBM Cloud management components and never to the client's virtual machines or applications.





 Proactive support 



 Proactive support for initial provisioning 



* During the initial ordering and provisioning of an instance or service, IBM Support might access client instances and information without prior notification of the client to ensure that orders are properly fulfilled.
* IBM Support actively monitors instance lifecycle operations such as adding new hosts, in addition to the ordering, provisioning, and installation processes.
* To fix issues that arise or might arise in the future, IBM Support might take a number of actions. These actions include, but are not limited to, reviewing client order details, restarting automation jobs, performing operating system reload operations, or opening IBM Cloud tickets by using the provided client IBM Cloud user ID and API key.







 Proactive support for steady-state operations 



* On rare occasions, IBM Support might require access to client instances during steady-state operations to proactively troubleshoot an instance issue or to verify function of provisioned services or components.
* This access is through the IBM Cloud internal support network. At no time will IBM Support modify instance configuration without prior consent from the client.
* Access is to the VMware management components and to the IBM Cloud management components and never to the client's virtual machines or applications.