vania-janet/multiturn-rag-retrieval-data huggingface dataset:
: Required. An array describing the type and group of target keystores that the managed key is to be installed in. The maximum length is 1 item. The minimum length is 1 item.

--description (string)
: Optional. The description of the key template. The length must be between 0 and 200 characters. The value must match the regular expression /(.|\n)/.
* Example

ibmcloud hpcs uko key-template-create 
--uko-vault=5295ad47-2ce9-43c3-b9e7-e5a9482c362b 
--vault='{"id": "5295ad47-2ce9-43c3-b9e7-e5a9482c362b"}' 
--name=IBM-CLOUD-EXAMPLE-TEMPLATE 
--key='{"size": "256", "algorithm": "aes", "activation_date": "P5Y1M1W2D", "expiration_date": "P1Y2M1W4D", "state": "active"}' 
--keystores='[{"group": "Production", "type": "ibm_cloud_kms"}]' 
--description="IBM CLOUD key template description" 
--output json
* Output

The command returns the output similar to the following example:

ETag
2022-05-20T15:13:37Z
{
"vault": {
"id": "5295ad47-2ce9-43c3-b9e7-e5a9482c362b",
"name": "Test Vault Name",
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/vaults/5295ad47-2ce9-43c3-b9e7-e5a9482c362b"
},
Handling and securing secrets 

A secret is any piece of data that is sensitive within the context of an application or service. Secrets must be securely protected through their entire lifecycle.

Secrets include all of the following but are not limited to:



* Passwords of any type (database logins, OS accounts, functional IDs, and so on)
* API keys
* Long-lived authentication tokens (OAuth2, GitHub, IAM, and so on)
* SSH keys
* Encryption keys
* Other private keys (PKI/TLS certificates, HMAC keys, signing keys, and so on)



Application providers should ensure:



* Secrets are generated and stored in the environment (for example, dev, test, and production) where your service is deployed.
* Secrets never leave their environments (for example, dev, test, and production) and should be secured by using access control measures. Service design should minimize the number of machines and people with access to secrets by using both authorization and network restrictions based on the principle of least privilege.
* Secrets are rotated in according with the requirements of the IBM Cloud Framework for Financial Services with minimal or no downtime.
* Secrets are never stored in source code, configuration files, or documentation.



The following table lists the different solutions that you can use to protect your application secrets.



Table 1. Secrets management and data protection scenarios

 Scenario What to use 

 You need to create, lease, and manage API keys, credentials, database configurations, and other secrets for your services and applications. Use [IBM Cloud Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-getting-started). 
 You need to generate, renew, and manage TLS/SSL certificates for your deployments. Use [IBM Cloud Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-getting-started). 
 You need to create and manage encryption keys. Use [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-overview) to manage encryption keys in a single-tenant service with dedicated hardware.
* Has someone recently tried to change the password for the server by modifying the password in the IBM Cloud console? Changing the password in the IBM Cloud console changes what you see as the password. It doesn't change the server password. If so, you can contact [Support](https://cloud.ibm.com/docs/get-support?topic=get-support-using-avatar) and they can usually recover the original, working password.
* You might need to start into rescue mode to reset your password. For more information, see [Rescue mode](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-launching-rescuelaunching-rescue).



If still can't connect to the server by using the password, open a [support case](https://cloud.ibm.com/docs/get-support?topic=get-support-using-avatargetting-support) and request a password reset. Support needs to restart the server to reset the password, so prepare to approve the restart and set a maintenance time frame for completion. Most password resets are completed in 15 minutes. In the IBM Cloud console, you can create a support case by going to Support > Create a case and use the subject Accounts and access.





 How do I cancel a device? 

You can cancel a device at any time. Go to the [Device List](https://cloud.ibm.com/classic/devices). Click Actions for the device that you want to cancel, and select the cancel option from the menu. For more information, see [Canceling virtual servers](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-managing-virtual-serverscancel).





 Are LVM partitions supported as a valid file system? 

LVM (Logical Volume Management) provides logical management of Linux file systems. In the IBM Cloud® environment, LVM isn't supported as a bootable partitioning scheme. Virtual server instances can't be ordered with LVM, and importing images that use LVM as a boot partition fail to provision.
: The ID of the secret. Required.

The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--secret-version-prototype ([SecretVersionPrototype](https://cloud.ibm.com/docs/cli?topic=cli-secrets-manager-clicli-secret-version-prototype-example-schema))
: Specify the properties for your new secret version. Required.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, e.g. --secret-version-prototype=@path/to/file.json.





 Example 

ibmcloud secrets-manager secret-version-create --secret-id=0b5571f7-21e6-42b7-91c5-3f5ac9793a46 --secret-version-prototype='{"payload": "updated secret credentials", "custom_metadata": {"anyKey": "anyValue"}, "version_custom_metadata": {"anyKey": "anyValue"}}'







 ibmcloud secrets-manager secret-versions 

List the versions of a secret.

A successful request returns the list of versions of a secret, along with the metadata of each version.

ibmcloud secrets-manager secret-versions --secret-id SECRET-ID



 Command options 

--secret-id (string)
: The ID of the secret. Required.

The maximum length is 36 characters. The minimum length is 36 characters.
Supported authentication methods per data resource for Data Engine 



Table 1. Supported

 Authentication method IBM Cloud® Object Storage IBM® Db2® on Cloud IBM® Db2® Warehouse on Cloud 

 IAM SSO Yes Enterprise Enterprise 
 CRN with Service Credentials No Yes Yes 
 User and password through Secrets Manager CRN No Yes Yes 
 User and password through Key Protect CRN No Yes Yes 
 API key through Secrets Manager CRN No Enterprise Enterprise 
 API key through Key Protect CRN No Enterprise Enterprise
The value must match regular expression /[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]/.

[--force] (Boolean)
: Activate to force resource deletion (to bypass the confirmation prompt).







 ibmcloud event-notifications subscription update 



* Action: Update existing Subscription.

ibmcloud event-notifications subscription update --id ID [--name NAME] [--description DESCRIPTION] [--attributes ATTRIBUTES] [--instance-id INSTANCE-ID]
* Parameters to provide:

--id ID (string)
: Unique identifier for subscription. Required.

The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}/.

[--name NAME] (string)
: The updated description to be set for subscription.

The maximum length is 100 characters. The minimum length is 1 character. The value must match regular expression /[a-zA-Z0-9-:_]/.

[--instance-id INSTANCE-ID] (string)
: The Unique identifier for IBM Cloud Event Notifications instance.

The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]/.

[--description DESCRIPTION] (string)
: The updated description to be set for subscription.
dataSource.setSecurityMechanism( com.ibm.db2.jcc.DB2BaseDataSource.PLUGIN_SECURITY );
dataSource.setPluginName( "IBMIAMauth" );
dataSource.setApiKey( "<api_key>" );
Connection conn = dataSource.getConnection( );

or

Connection conn = DriverManager.getConnection( "jdbc:db2://<host_name_or_IP_address>:50001/BLUDB:apiKey=<api_key>;securityMechanism=15;pluginName=IBMIAMauth;sslConnection=true" );
* IBMid/password

DB2SimpleDataSource dataSource;

dataSource.setDriverType( 4 );
dataSource.setDatabaseName( "BLUDB" );
dataSource.setServerName( "<host_name_or_IP_address>" );
dataSource.setPortNumber( 50001 );
dataSource.setSecurityMechanism( com.ibm.db2.jcc.DB2BaseDataSource.PLUGIN_SECURITY );
dataSource.setPluginName( "IBMIAMauth" );
Connection conn = dataSource.getConnection( "<IBMid>", "<password>" );

or

Connection conn = DriverManager.getConnection( "jdbc:db2://<host_name_or_IP_address>:50001/BLUDB:user=<IBMid>;password=<password>;securityMechanism=15;pluginName=IBMIAMauth;sslConnection=true" );









 Console user experience 

The service console login page has the option to log in with your IBMid and password. After the Sign In via IBMid button is clicked, the user is directed to the IAM login page, on which the password is entered.
If the gocryptfs.conf file becomes corrupted or you ever forget your password,
there is only one hope for recovery: The master key. Print it to a piece of
paper and store it in a drawer. This message is only printed once.
The gocryptfs filesystem has been created successfully.
You can now mount it using: gocryptfs filestor/cipher MOUNTPOINT

Mount the encrypted storage as unencrypted and work with it:

root@classic-byok-poc01:/mnt ls
filestor plain
root@classic-byok-poc01:/mnt gocryptfs filestor/cipher plain
Password:
Decrypting master key
Filesystem mounted and ready.
root@classic-byok-poc01:/mnt cd plain
root@classic-byok-poc01:/mnt/plain uname -a >test
root@classic-byok-poc01:/mnt/plain cat test
Linux classic-byok-poc01 5.4.0-107-generic 121-Ubuntu SMP Thu Mar 24 16:04:27 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
root@classic-byok-poc01:/mnt/plain cd ../filestor/cipher/
root@classic-byok-poc01:/mnt/filestor/cipher ls
gocryptfs.conf gocryptfs.diriv KRCHWT02ixA0375d6ur3MQ

You can change the key with the passwd option.

root@classic-byok-poc01:/mnt/filestor gocryptfs -passwd cipher





 IBM Cloud Object Storage server-side encryption 

IBM Cloud Object Storage provides the following methods of customer-managed encryption:



* [Server-Side Encryption based on SSE-C headers](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-sse-c)
*  CLI
*  API







  Setting the Admin Password 

The IBM Cloud® Databases for Elasticsearch service is provisioned with an admin user.

You must set the admin password before you can use it to connect. To set the password through the IBM Cloud dashboard, select Manage from the service dashboard to open the management panel for your service. Open the Settings tab, and use the Change Database Admin Password panel to set a new admin password.

Zoom

![The Change Database Admin Password Panel in Settings](https://cloud.ibm.com/docs-content/v1/content/6da1ae87b1f476791c38688e7a0b7f7c7a7d71b9/databases-for-elasticsearch/images/settings-admin-password.png)

Figure 1. The Change Database Admin Password Panel in Settings



  Setting the admin password with the command line 

Use the cdb user-password command from the [Cloud Databases CLI plug-in](https://cloud.ibm.com/docs/databases-cli-plugin?topic=databases-cli-plugin-cdb-reference) to set the admin password with the command line.

For example, to set the admin password for a deployment named "example-deployment", use the following command.

ibmcloud cdb user-password example-deployment admin <newpassword>





  Setting the admin password with the API 

The Foundation Endpoint that is shown on the Overview panel of your service provides the base URL to access this deployment through the API. Use it with the /deployments/{id}/users/{username} endpoint to set the admin password.

curl -X PATCH https://api.{region}.databases.cloud.ibm.com/v4/ibm/deployments/{id}/users/admin' -H "Authorization: Bearer $APIKEY" -H "Content-Type: application/json" -d '{"password":"newrootpasswordsupersecure21"}'

For more information, see the [API Reference](https://cloud.ibm.com/apidocs/cloud-databases-apiset-database-level-user-s-password).
You incur an extra charge when you enable them. For example, if you obtain 10,000 access tokens, then you turn on password policy management and obtain 10,000 more. You would pay for 20,000 authentication events and 10,000 advanced security events. If you disable all the advanced features, your account reverts to the original-cost policy.



Table 1. Description of the benefits that are gained with advanced authentication events

 Feature Benefit 

 Multi-factor authentication With [MFA for Cloud Directory](https://cloud.ibm.com/docs/appid?topic=appid-cd-mfacd-mfa), you can confirm a user’s identity by requiring them to enter a one time passcode that is sent to their email or SMS after they enter their email and password. 
 Runtime authentication activity tracking By integrating Activity Tracker with App ID, you can track different types of authentication events at run time. For example, a password reset request, authentication failures, or a user logout. For more information, see [Viewing runtime events](https://cloud.ibm.com/docs/appid?topic=appid-at-eventsat-monitor-runtime). 
 Password policy management As an account owner, you can enforce more secure passwords for Cloud Directory by configuring a set of rules that user passwords must conform to. Examples include, the number of attempted sign-ins before lockout, expiration times, minimum time span between password updates, or the number of times that a password can't be repeated. For a complete list of the options and setup information, see [Advanced password management](https://cloud.ibm.com/docs/appid?topic=appid-cd-strengthcd-advanced-password). 



These features are available only to those instances that are on the graduated tier pricing plan and that were created after 15 March 2018.





 When am I charged? 

Your first 1000 authentication events and 1000 authorized users per service instance are free of charge. You are charged monthly for any additional authentication events and authorized users, as well as any advanced security features that are enabled for each service instance.





 How do I stop getting charged for App ID?
Age: 66s
Created: 2023-03-07 20:00:45 +0000 UTC

Data:
---
email: ""
password: REDACTED
server: dXMuaWNyLmlv
username: aWFtYXBpa2V5

Notice that the value of the username and server keys for this registry secret is encoded, and the value of password is redacted. To display the secret data as decoded, use the --decode option with the secret get command.





 Creating an SSH secret with the CLI 

An SSH secret stores credentials to authenticate to a service with an SSH key; for example, authenticating to a Git repository, such as GitHub or GitLab.

The following example creates an SSH secret that is named mysecret-ssh to access a host that is included in the known_hosts file by authenticating with an unencrypted SSH private key file that is located at /<filepath>/.ssh/<key_name>, where <filepath> is the path on your local workstation. This command requires a name and a key path, and also allows other optional arguments such as the path to the known hosts file.

ibmcloud ce secret create --name mysecret-ssh --format ssh --key-path /.ssh/<key_name> --known-hosts-path /.ssh/known_hosts

To display the details of this secret,

ibmcloud ce secret get --name mysecret-ssh

Example output

Getting secret 'mysecret-ssh'...
OK

Name: mysecret-ssh'
ID: abcdefgh-abcd-abcd-abcd-1a2b3c4d5e6f
Format: ssh
Project Name: myproject
Project ID: 01234567-abcd-abcd-abcd-abcdabcd1111
Age: 66s
Created: 2023-03-07 19:19:59 +0000 UTC

Data:
---
authentication_method required, updatable String authentication_method The authentication method for your HashiCorp Vault instance. 
 dashboard_url required, updatable String dashboard_url The URL of the HashiCorp Vault server dashboard for this tool integration. In the graphical UI, the browser goes to this dashboard when you click the HashiCorp Vault tool integration card. 
 default_secret optional, updatable String default_secret The default secret name that is used if your HashiCorp Vault instance does not return a list of secret names. 
 name required, updatable String name The name of this tool integration. Secret references include this name to identify the secrets store where the secrets reside. All of the secrets store tools that are integrated into a toolchain must have a unique name to allow secret resolution to function properly. 
 password optional, updatable Password password The authentication password for your HashiCorp Vault instance when you use the userpass authentication method. This parameter is ignored for other authentication methods. You can use a toolchain secret reference for this parameter. For more information about using secret references, see [Protecting your sensitive data in Continuous Delivery](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-cd_data_securitycd_secure_credentials). 
 path required, updatable String path The mount path where your secrets are stored in your HashiCorp Vault instance. 
 role_id optional, updatable Password role_id The authentication role ID for your HashiCorp Vault instance when you use the approle authentication method. This parameter is ignored for other authentication methods. Manage role_id as a secret and do not share this parameter in plain text. You can use a toolchain secret reference for this parameter. For more information about secret references, see [Protecting your sensitive data in Continuous Delivery](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-cd_data_securitycd_secure_credentials). 
 secret_filter optional, updatable String secret_filter A regular expression to filter the list of secret names that are returned from your HashiCorp Vault instance.
Authorization: 'AWS4-HMAC-SHA256 Credential={access-key}/{date}/{region}/s3/aws4_request,SignedHeaders=host;x-amz-date;,Signature={signature}'
x-amz-date: {timestamp}
Content-Type: text/plain
Host: s3.us.cloud-object-storage.appdomain.cloud

<CreateBucketConfiguration>
<LocationConstraint>us-vault</LocationConstraint>
</CreateBucketConfiguration>

Example response

HTTP/1.1 200 OK
Date: Fri, 17 Mar 2017 17:52:17 GMT
X-Clv-Request-Id: b6483b2c-24ae-488a-884c-db1a93b9a9a6
Accept-Ranges: bytes
Server: Cleversafe/3.9.0.115
X-Clv-S3-Version: 2.5
Content-Length: 0

--------------------





 Create a new bucket with Key Protect or Hyper Protect Crypto Services managed encryption keys (SSE-KP) 

To create a bucket where the encryption keys are managed by Key Protect or Hyper Protect Crypto Services, it is necessary to have access to an active Key Protect or Hyper Protect Crypto Services service instance. This operation does not make use of operation specific query parameters.

For more information on using Key Protect to manage your encryption keys, [see the documentation for Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-getting-started-tutorial).

For more information on Hyper Protect Crypto Services, [see the documentation](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-get-started).
The value must match regular expression /^[0-9]+[s,m,h,d]{0,1}$/.

--crl-disable (bool)
: This field disables or enables certificate revocation list (CRL) building.

If CRL building is disabled, a signed but zero-length CRL is returned when you're downloading the CRL. If CRL building is enabled, it rebuilds the CRL.

--crl-distribution-points-encoded (bool)
: This field determines whether to encode the certificate revocation list (CRL) distribution points in the certificates that are issued by this certificate authority.

--issuing-certificates-urls-encoded (bool)
: This field determines whether to encode the URL of the issuing certificate in the certificates that are issued by this certificate authority.

--allowed-secret-groups (string)
: This field scopes the creation of private certificates to only the secret groups that you specify.

This field can be supplied as a comma-delimited list of secret group IDs.

The maximum length is 1024 characters. The minimum length is 2 characters. The value must match regular expression /(.?)/.

--ttl (string)
: The requested time-to-live (TTL) for certificates that are created by this CA. This field's value can't be longer than the max_ttl limit.

The value can be supplied as a string representation of a duration in hours, for example '8760h'. In the API response, this value is returned in seconds (integer).

The maximum length is 10 characters. The minimum length is 2 characters. The value must match regular expression /^[0-9]+[s,m,h,d]{0,1}$/.

--allow-localhost (bool)
: This field indicates whether to allow localhost to be included as one of the requested common names.

--allowed-domains ([]string)
: The domains to define for the certificate template.
Click Storage > Cloud Backup to display the list of backup services.
3. Click the instance name of the backup vault where you want to change your password.
4. On the Overview page, you can see your Portal Password. Click the Pencil icon to modify the password.

The IBM Cloud Backup for Classic username is displayed in the upper-left area of the page.
5. Enter the new password in the Password field.

The password must be 8 - 12 characters in length. It must include at least one uppercase letter, at least one lowercase letter, at least one numeric character, and at least one of these special characters: !@#%^. It can contain only letters, numerals, and these special characters: !@#%^.
6. Press Enter to update the password.







 What kind of applications can be backed up? 

IBM Cloud® Backup for Classic can be used to back up various applications. IBM Cloud® also offers software agents for some of the more common software systems that are backed up, which include the following plug-ins.



* [Bare Metal Restore](https://cloud.ibm.com/docs/Backup?topic=Backup-BMRplugin)
* [Microsoft® Exchange](https://cloud.ibm.com/docs/Backup?topic=Backup-Exchangeplugin)
* [Microsoft® SQL](https://cloud.ibm.com/docs/Backup?topic=Backup-MSSQLpluginMSSQLplugin)
* [Oracle](https://cloud.ibm.com/docs/Backup?topic=Backup-OraclepluginOracleplugin)
* [VMware® VRA](https://cloud.ibm.com/docs/Backup?topic=Backup-VRAVRA)



The plug-ins that are listed here are only compatible with Windows® servers, except for the Oracle or VMware® plug-ins. Each agent is available as an add-on to your backup service at no cost.





 How frequently can we back up the data?
ewoJImhvc3QiOiAibG9jYWxob3N0IiwK...<redacted>...cGFzc3dvcmQiCn0K

 create a new key that contains the base64-encoded credentials
$ ibmcloud kp key create credentials-key -i $KP_INSTANCE_ID --key-material $ENCODED --standard-key --output json

 OR... CAPTURE THE KEY_ID
$ KEY_ID=$(ibmcloud kp key create credentials-key -i $KP_INSTANCE_ID --key-material $ENCODED --standard-key --output json | jq -r '.["id"]')

{
"id": "8480e26f-3add-4fff-bca7-8cf908894b7c",
"name": "credentials-key",
"type": "application/vnd.ibm.kms.key+json",
"extractable": true,
"state": 1,
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:a192d603-0b8d-452f-aac3-f9e1f95e7411:key:8480e26f-3add-4fff-bca7-8cf908894b7c",
"deleted": false
}

 retrieve the base64-encoded payload
$ ibmcloud kp key show $KEY_ID --output json

 OR... CAPTURE THE PAYLOAD
$ PAYLOAD=$(ibmcloud kp key show $KEY_ID --output json | jq -r '.["payload"]')

{
"id": "8480e26f-3add-4fff-bca7-8cf908894b7c",