vania-janet/multiturn-rag-retrieval-data huggingface dataset:
"Hash": "SHA2",
"Security": 256,
"FileKeyStore": {
"KeyStore": null
}
},
"PKCS11": {
"Library": null,
"Label": null,
"Pin": null,
"Hash": null,
"Security": null,
"FileKeyStore": {
"KeyStore": null
}
}
},
"client": {
"connTimeout": "3s"
},
"deliveryclient": {
"reconnectTotalTimeThreshold": "3600s",
"connTimeout": "3s",
"reConnectBackoffThreshold": "3600s",
"addressOverrides": null
},
"adminService": null,
"validatorPoolSize": null,
"discovery": {
"enabled": true,
"authCacheEnabled": true,
"authCacheMaxSize": 1000,
"authCachePurgeRetentionRatio": 0.75,
"orgMembersAllowedAccess": false
}
},
"chaincode": {
"startuptimeout": "300s",
"executetimeout": "30s",
"logging": {
"level": "info",
"shim": "warning",
"format": "%{color}%{time:2006-01-02 15:04:05.000 MST} [%{module}] %{shortfunc} -> %{level:.4s} %{id:03x}%{color:reset} %{message}"
}
},
"metrics": {
"provider": "disabled",
"statsd": {
"network": "udp",
* The JSON response for the retrieval of multiple objects like listing keys, policies, and registrations is set as an empty array: [] when there are no objects returned by the service.
* The JSON response for the retrieval of a single object, like a key policy, is set as an empty object: {} when there is no policy returned by the service.









 CLI version 0.6.4 

Release date: 2021-07-23



 Changes 

Changes included in this [version](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-reference):



* Error messages have been formatted to make them easier for users to understand.
* Additional validation for sha1 encryption ensures that requests are only made to the correct endpoint.









 CLI version 0.6.3 

Release date: 2021-06-25



 Changes 

There are minor changes in this latest [release](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-reference).

Support for IBM Cloud® Hyper Protect Crypto Services specific algorithms in [Key Create](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-create) and [Key Rotate](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-rotate).







 CLI version 0.6.2 

Release date: 2021-05-20



 Changes 

There are minor changes in this [release](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-reference).



* [Key purge](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-reference) command supports purging a deleted key resulting in the permanent deletion of information related to that key.
62ad0cd5-70a4-4c4d-9d87-5f4db620b120

 list keys - verify the key was deleted
$ ibmcloud kp keys

Retrieving keys...
OK
Key ID Key Name

 restore the deleted key
$ ibmcloud kp key restore $KEY_ID -k $KEY_MATERIAL --output json

{
"id": "62ad0cd5-70a4-4c4d-9d87-5f4db620b120",
"name": "my-base64-root-key",
"type": "application/vnd.ibm.kms.key+json",
"extractable": false,
"state": 1,
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:a192d603-0b8d-452f-aac3-f9e1f95e7411:key:62ad0cd5-70a4-4c4d-9d87-5f4db620b120"
}

 list keys - verify the key was restored
$ ibmcloud kp keys

Retrieving keys...
OK
Key ID Key Name
62ad0cd5-70a4-4c4d-9d87-5f4db620b120 my-base64-root-key





 Example 2 

This workflow creates a root key using an import token, deletes the key, then restores the key.

This is a two-step process.



1. Create a root key using an import token and then delete the key
2. Create an import token, which is required to restore the key, and restore the key



Creating a root key using an import token has a time limit (the -e, --expiration option).
Verifying disk encryption status 

Both the root disk and data disks in the Hyper Protect Virtual Servers for VPC instance are encrypted with Linux Unified Key Setup (LUKS) Encryption. You can verify the encryption status by checking the messages in the log.



* The root disk is re-created and encrypted on every boot with the original content. A passphrase for the root disk is not stored.
* The data disk encryption is configured by using the “seeds” provided in the workload and env sections within the contract and, if you enable the [integration](https://cloud.ibm.com/docs/vpc?topic=vpc-hyper-protect-virtual-server-mng-data), a third seed from Hyper Protect Crypto Services. During the instance initiation, the disks are attached and encrypted by using the seeds to create a LUKS passphrase. If the seed information or the data disk is not configured, the instance fails to initiate. For more information, see [The workload - volumes subsection](https://cloud.ibm.com/docs/vpc?topic=vpc-about-contract_sehpcr_contract_volumes) of the contract.



The disk encryption status check daemon checks the crypto headers of the root disk and data disks that are attached to the instance each hour, and then writes the information messages about the disk encryption status into the log.

The following example shows the disk encryption check related messages within the log.

...
Nov 29 10:24:07 hpvs211vsi verify-disk-encryption info HPL13000I: Verify LUKS Encryption...
Nov 29 10:24:07 hpvs211vsi systemd info verify-disk-encryption-invoker.service: Succeeded.
...
Nov 29 10:24:08 hpvs211vsi verify-disk-encryption info Checked for mount point /mnt/data, LUKS encryption with 1 key slot found
Nov 29 10:24:08 hpvs211vsi verify-disk-encryption info HPL13001I: Root disk and all the data disks are encrypted
...

Note:



1.
Recovery crypto units can also be used as backup crypto units that save a copy of the master key value used by the operational crypto units. If the master key is lost or destroyed, you can [recover the master key from a recovery crypto unit](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-recover-master-key-recovery-crypto-unit) using signed TKE administrative commands.

If smart cards are used to load the master key, the recovery crypto units are not applicable and can be ignored. The backup of the master key relies on the backup of the smart cards in that case.
* Failover crypto unit

Failover crypto units back up the operational crypto units and keystores in another region, and are initialized to provide quick failover in case of disaster. Failover crypto units [charge extra fees](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-pricing) and this option is now available only in regions of us-south and us-east, which means if you create your instance in either of the two regions, the failover crypto units are located in the other region. For more information about using failover crypto units in a regional disaster, see [Restoring your data by using failover crypto units](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-restore-datarestore-data-failover-crypto-units).







 Administrators 

Administrators can be added to the target crypto units for issuing commands to the crypto units. You can add up to eight administrators to one crypto unit to increase security. Each administrator owns one private [signature key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-understand-conceptsuko-signature-key-concept) for identity authentication.





 Signature keys 

An administrator must sign any commands that are issued to the crypto unit with a signature key. The signature keys that are created in Hyper Protect Crypto Services are P521 Elliptic Curve (EC) keys.
The UUID of the key. You can use the ibmcloud hpcs uko managed-keys command to retrieve the key UUID.

--uko-vault (string)
: Required. The UUID of the vault where the update is to take place. You can use the ibmcloud hpcs uko vaults command to retrieve the vault UUID.

--if-match (string)
: Required. The precondition of the update, which is the value of the ETag from the header on a GET request. You can use the ibmcloud hpcs uko managed-key command to retrieve the ETag.

--label (string)
: Required. The label of the key. The length must be between 1 and 255 characters. The value must match the regular expression /^[A-Za-z0-9._ /-]+$/.

--activation-date (strfmt.Date)
: Optional. The activation date must be provided in format YYYY-MM-DD.

--expiration-date (strfmt.Date)
: Optional. The expiration date must be provided in format YYYY-MM-DD.

--tags ([Tag[]](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-cli-plugin-hpcs-cli-pluginuko-tag-example-schema))
: Optional. Key-value pairs that are associated with the key. The length must be between 0 and 128 items.

--description (string)
: Optional. The description of the managed key. The length must be between 0 and 200 characters. The value must match the regular expression /(.|\n)/.
* Example

ibmcloud hpcs uko managed-key-update 
--id=21a7498e-2ae4-47ee-85ac-a19bf64e92fa
The root key retains its original name and ID.



You can click the Actions icon again and click Key details to view the key registration information. You can also view Activity Tracker events for key rotation. For more information, see [Important events for key rotation](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managingbyok-key-rotation-events)





 Rotate keys with the key management service CLI 

This procedure describes how to rotate the root key that protects your data with a new root key from the CLI. This example uses a Key Protect instance for rotating keys, the Hyper Protect Crypto Services steps are similar.



 Before you begin 

Before you begin, you need:



* The CRN of the root key in your key management service.
* The instance ID for the Key Protect service instance where your customer root keys are stored.
* The list of available keys and their associated CRNs within your Key Protect service instance.



You also need to install the Key Protect CLI plug-in. For more information, see [Step 1 - Obtain service instance and root key information](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-vsi-instances-byokbyok-cli-setup-prereqs).





 CLI procedure for imported keys 



1. To import a root key and key material, you must use the UI or API, then continue with CLI step. For more information about importing root keys, see the topics for [Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-import-root-keys) instances or [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-import-root-keys) instances.
2. List the available keys and their associated CRNs for the Key Protect service instance by specifying the instance ID:

ibmcloud kp keys -c --instance-id 7mnxxxo8-91xx-23px-q4rs-xxtuv5w6xxx7
3.
The UUID of the key. You can use the ibmcloud hpcs uko managed-keys command to retrieve the key UUID.

--uko-vault (string)
: Required. The UUID of the vault where the update is to take place. You can use the ibmcloud hpcs uko vaults command to retrieve the vault UUID.

--if-match (string)
: Required. The precondition of the update, which is the value of the ETag from the header on a GET request. You can use the ibmcloud hpcs uko managed-key command to retrieve the ETag.
* Example

ibmcloud hpcs uko managed-key-update-from-template 
--id=22c04c00-0687-4f10-b0ac-b9f01d68ee85 
--uko-vault=eb66ebbd-7230-4cde-89bf-17282cda5faa 
--if-match=2022-05-27T12:27:37Z 
--output json
* Output

The command returns the output similar to the following example:

ETag
2022-05-27T12:29:46Z
{
"id": "3dab42dc-6941-4841-8d27-4dabcc5aa09e",
"vault": {
"id": "5295ad47-2ce9-43c3-b9e7-e5a9482c362b",
"name": "Test Vault Name",
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/vaults/5295ad47-2ce9-43c3-b9e7-e5a9482c362b"
},
"template": {
If you need to adjust resources or use a Key Protect key, add any of the optional parameters key_protect_key, members_disk_allocation_mb, members_memory_allocation_mb, and members_cpu_allocation_count, and their preferred values to the body of the request.







 Backups and Restoration 



* IBM Cloud Databases are not responsible for restoration, timeliness, or validity of said backups.
* Actions that you take as a user can compromise the integrity of backups, such as under-allocating memory and disk. Users can monitor that backups are successful by using the API, and periodically restore a backup to ensure validity and integrity. Users can retrieve the most recent-scheduled backup details from the [Cloud Databases CLI plug-in](https://cloud.ibm.com/docs/databases-for-postgresql?topic=databases-for-postgresql-dashboard-backupsbackups-in-the-cli) and the [Cloud Databases API](https://cloud.ibm.com/docs/databases-for-postgresql?topic=databases-for-postgresql-dashboard-backupsrestoring-a-backup-through-the-api).
* As a managed service, Cloud Databases monitors the state of your backups and can attempt to remediate when possible. If you encounter issues from which you cannot recover, contact support for more help.







 Backup Locations 

Backup location differs per database region. Ensure that the backup region location matches your data location requirements.



Table 1. Database and Backup Regions

 Database Region Backup Region 

 Dallas US Cross Regional Object Storage 
 Washington D.C. US Cross Regional Object Storage 
 London EU Cross Regional Object Storage 
 Frankfurt EU Cross Regional Object Storage 
 Tokyo AP Cross Regional Object Storage 
 Osaka AP Cross Regional Object Storage 
 Sydney AP Cross Regional Object Storage 
 Toronto Montreal Object Storage 
 Chennai Chennai Object Storage 
 Sao Paolo Sao Paolo Object Storage 



For more details about Cloud Databases Object Storage locations, review the location's [documentation](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-endpointsendpoints-geo).
If you need to adjust resources or use a Key Protect key, add any of the optional parameters key_protect_key, members_disk_allocation_mb, members_memory_allocation_mb, and members_cpu_allocation_count, and their preferred values to the body of the request.







 Backups and Restoration 



* IBM Cloud Databases are not responsible for restoration, timeliness, or validity of said backups.
* Actions that you take as a user can compromise the integrity of backups, such as under-allocating memory and disk. Users can monitor that backups are successful by using the API, and periodically restore a backup to ensure validity and integrity. Users can retrieve the most recent-scheduled backup details from the [Cloud Databases CLI plug-in](https://cloud.ibm.com/docs/databases-for-enterprisedb?topic=cloud-databases-dashboard-backupsbackups-in-the-cli) and the [Cloud Databases API](https://cloud.ibm.com/docs/databases-for-enterprisedb?topic=cloud-databases-dashboard-backupsrestoring-a-backup-through-the-api).
* As a managed service, Cloud Databases monitors the state of your backups and can attempt to remediate when possible. If you encounter issues from which you cannot recover, contact support for more help.







 Backup Locations 

Backup location differs per database region. Ensure that the backup region location matches your data location requirements.



Table 1. Database and Backup Regions

 Database Region Backup Region 

 Dallas US Cross Regional Object Storage 
 Washington D.C. US Cross Regional Object Storage 
 London EU Cross Regional Object Storage 
 Frankfurt EU Cross Regional Object Storage 
 Tokyo AP Cross Regional Object Storage 
 Osaka AP Cross Regional Object Storage 
 Sydney AP Cross Regional Object Storage 
 Toronto Montreal Object Storage 
 Chennai Chennai Object Storage 
 Sao Paolo Sao Paolo Object Storage 



For more details about Cloud Databases Object Storage locations, review the location's [documentation](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-endpointsendpoints-geo).





 Point-in-Time Recovery
--id=0325e05e-2b25-4f13-85b2-2d7f85e54359 
--uko-vault=5295ad47-2ce9-43c3-b9e7-e5a9482c362b 
--output json
* Output

The command returns the output similar to the following example:

ETag
2022-05-20T14:59:03Z
{
"vault": {
"id": "5295ad47-2ce9-43c3-b9e7-e5a9482c362b",
"name": "Test Vault Name",
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/vaults/5295ad47-2ce9-43c3-b9e7-e5a9482c362b"
},
"id": "f6a5ccc1-7fc3-435e-9637-482e470ba8e8",
"name": "IBM Keystore Name",
"description": "The description of the created keystore.",
"groups": [
"IBM Keystore Name"
],
"type": "ibm_cloud_kms",
"created_at": "2022-03-09T11:00:11Z",
"updated_at": "2022-03-09T11:00:11Z",
"created_by": "IBMid-1308197YB4",
"updated_by": "IBMid-1308197YB4",
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/keystores/f6a5ccc1-7fc3-435e-9637-482e470ba8e8",
curl -X GET https://<region>.kms.cloud.ibm.com/api/v2/keys/metadata -H 'accept: application/vnd.ibm.collection+json' -H 'authorization: Bearer <IAM_token>' -H 'bluemix-instance: <instance_ID>'

Review the lastRotateDate and keyVersion values in the response to inspect the date and time that your key was last rotated. The keyVersion attribute contains identifying information that describes the latest version of the root key.



When your root keys are successfully rotated, an HTTP 204 No Content response is returned, which indicates that your root key was replaced by new key material.

When you unwrap (decrypt) a wrapped data encryption key (WDEK) by using a rotated root key, the service returns a new ciphertext in the response entity-body. Each ciphertext remains available for unwrap actions. If you unwrap a DEK with a previous ciphertext, the service also returns the latest ciphertext and latest key version in the response. Use the latest ciphertext for future unwrap operations.





 Listing root key versions 

To see all versions of a root key that you rotated, make a GET /keys/{key_ID}/versions call. The older versions remain valid for decrypting existing resources but can't be used to encrypt new ones. They are removed from the list upon their expiration date or when no more resources are encrypted by them. For an example request and response, see [List key versions](https://cloud.ibm.com/apidocs/key-protectlist-key-versions).

For more information about programmatically managing your keys, see the [Key Protect API reference](https://cloud.ibm.com/apidocs/key-protect).







 Next steps 

[Manage your root keys](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managing).
[checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) 
 Restore key. ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) 







 Monitoring for lifecycle changes 

After you add a root key to the service, use the IBM Cloud console or the Hyper Protect Crypto Services key management REST API to view your key's transition history and configuration.

For audit purposes, you can also monitor the activity trail for a root key by integrating Hyper Protect Crypto Services with the [IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started). After both services are provisioned and running, activity events are generated and automatically collected in a IBM Cloud Activity Tracker log when you perform actions on keys in Hyper Protect Crypto Services.
If you need to adjust resources or use a Key Protect key, add any of the optional parameters key_protect_key, members_disk_allocation_mb, members_memory_allocation_mb, and members_cpu_allocation_count, and their preferred values to the body of the request.







 Backups and Restoration 



* IBM Cloud Databases are not responsible for restoration, timeliness, or validity of said backups.
* Actions that you take as a user can compromise the integrity of backups, such as under-allocating memory and disk. Users can monitor that backups are successful by using the API, and periodically restore a backup to ensure validity and integrity. Users can retrieve the most recent-scheduled backup details from the [Cloud Databases CLI plug-in](https://cloud.ibm.com/docs/databases-for-mysql?topic=databases-for-mysql-dashboard-backupsbackups-in-the-cli) and the [Cloud Databases API](https://cloud.ibm.com/docs/databases-for-mysql?topic=databases-for-mysql-dashboard-backupsrestoring-a-backup-through-the-api).
* As a managed service, Cloud Databases monitors the state of your backups and can attempt to remediate when possible. If you encounter issues from which you cannot recover, contact support for more help.







 Backup Locations 

Backup location differs per database region. Ensure that the backup region location matches your data location requirements.



Table 1. Database and Backup Regions

 Database Region Backup Region 

 Dallas US Cross Regional Object Storage 
 Washington D.C. US Cross Regional Object Storage 
 London EU Cross Regional Object Storage 
 Frankfurt EU Cross Regional Object Storage 
 Tokyo AP Cross Regional Object Storage 
 Osaka AP Cross Regional Object Storage 
 Sydney AP Cross Regional Object Storage 
 Toronto Montreal Object Storage 
 Chennai Chennai Object Storage 
 Sao Paolo Sao Paolo Object Storage 



For more details about Cloud Databases Object Storage locations, review the location's [documentation](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-endpointsendpoints-geo).





 Point-in-Time Recovery
"key_id_in_keystore": "93777bca-baef-4070-b9b5-a2e6079df1b4",
"type": "com_ibm_cloud_kms_registration",
"com_ibm_cloud_kms_registration": {
"prevents_key_deletion": false,
"service_name": "cloud-object-storage",
"service_instance_name": "Cloud Object Storage-7s",
"crn": "crn:v1:bluemix:public:cloud-object-storage:global:a/db995d8d9cc715cd99f13b0671d978b6:57da8e3a-a86d-4e01-b840-f22d36e6f23f:bucket:keyprotecttest",
"description": "some description"
}
}
]
}







 hpcs uko managed-key-ds 

Return the keystore distribution status for a managed key.

ibmcloud hpcs uko managed-key-ds --id ID --uko-vault UKO-VAULT



* Command options

--id (string)
: Required. The UUID of the key. You can use the ibmcloud hpcs uko managed-keys command to retrieve the key UUID.

--uko-vault (string)
: Required. The UUID of the vault where the update is to take place. You can use the ibmcloud hpcs uko vaults command to retrieve the vault UUID.
* Example

ibmcloud hpcs uko managed-key-ds 
--id=21a7498e-2ae4-47ee-85ac-a19bf64e92fa 
--uko-vault=eb66ebbd-7230-4cde-89bf-17282cda5faa 
--output json
* Output

The command returns the output similar to the following example:

{
--if-match=2022-05-27T10:15:38Z
* Output

The command returns the output similar to the following example:

...
OK







 hpcs uko managed-key 

Retrieve a managed key and its details by specifying the key ID.

ibmcloud hpcs uko managed-key --id ID --uko-vault UKO-VAULT



* Command options

--id (string)
: Required. The UUID of the key. You can use the ibmcloud hpcs uko managed-keys command to retrieve the key UUID.

--uko-vault (string)
: Required. The UUID of the vault where the update is to take place. You can use the ibmcloud hpcs uko vaults command to retrieve the vault UUID.
* Example

ibmcloud hpcs uko managed-key 
--id=21a7498e-2ae4-47ee-85ac-a19bf64e92fa 
--uko-vault=eb66ebbd-7230-4cde-89bf-17282cda5faa 
--output json
* Output

The command returns the output similar to the following example:

ETag
2022-05-26T14:18:10Z
{
"id": "3dab42dc-6941-4841-8d27-4dabcc5aa09e",
"vault": {
"id": "5295ad47-2ce9-43c3-b9e7-e5a9482c362b",
"name": "Test Vault Name",
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/vaults/5295ad47-2ce9-43c3-b9e7-e5a9482c362b"
},
"template": {