vania-janet/multiturn-rag-retrieval-data huggingface dataset:
In your KMS instance, [disable the root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-disable-keys) that is used to encrypt your cluster. If you encrypted your cluster with a KMS and CRK from a different account, the CRK can only be disabled from the account where it is located.
5. Wait for the cluster to detect the change to your root key.
6. Try to list your secrets. You get a timeout error because you can no longer connect to your cluster. If you try to set the context for your cluster by running ibmcloud ks cluster config, the command fails.

kubectl get secrets --all-namespaces

Example output

Unable to connect to the server: dial tcp 169.48.110.250:32346: i/o timeout
7. For clusters that run Kubernetes version 1.19 or later, check that your cluster is in a warning state. Your cluster remains in this state and is unusable until you enable your root key again.

ibmcloud ks cluster get -c <cluster_name_or_ID>
8. In your KMS instance, [enable the root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-disable-keys) so that your cluster returns to a normal state and becomes usable again.







 Managing encryption for the worker nodes in your cluster 

You can manage the encryption of the local disks in your worker nodes by using a [key management service (KMS) provider](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkms) such as [Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-getting-started-tutorial). The way that you manage encryption for worker nodes depends on the infrastructure provider.



 Classic worker nodes 

Classic infrastructure: Classic worker nodes have two disks, and you can manage encryption for the second disk.



* The primary disk has the kernel images to boot your worker node.
IBM Key Protect for IBM Cloud IBM Key Protect for IBM Cloud on Satellite is a dedicated service that allows users to more fully control their own encryption keys by deploying Key Protect into a Satellite location where users control their own infrastructure. See [About Key Protect for Satellite](https://cloud.ibm.com/docs/key-protect?topic=key-protect-satellite-about). No 
 IBM® Event Streams for IBM Cloud® Event Streams is a high-throughput message bus built with Apache Kafka. It is optimized for event ingestion into IBM Cloud and event stream distribution between your services and applications. See [About IBM Cloud Satellite for Event Streams](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-satellite_about). No 





 Setting up access for Satellite-enabled services 

For most Satellite-enabled services, you must set up service-to-service access through IAM, with Satellite as your target service and the managed service as the source service.



1. Open [Manage authorizations](https://cloud.ibm.com/iam/authorizations) in the IBM Cloud console.
2. Click Create.
3. Select the account for the authorization.
4. For Source service, select the service that you want to authorize. You can further scope the access by selecting Resources based on selected attributes and then adding attributes.
5. For Target service, select Satellite. You can further scope the access by selecting Resources based on selected attributes and then adding attributes.
6. Select your options as the Service access.
7. Click Authorize.



For more information, see [Managing access overview](https://cloud.ibm.com/docs/satellite?topic=satellite-iam) or consult the service documentation.
Scaling: Enable [horizontal pod autoscaling](https://cloud.ibm.com/docs/containers?topic=containers-update_appapp_scaling) to automatically increase or decrease the number of instances of your apps based on CPU.







 Secure your app 

Use Kubernetes secrets to store confidential information, such as credentials or keys, and encrypt data in Kubernetes secrets to prevent unauthorized users from accessing sensitive app information.



1. Secrets:



1. Store personal or sensitive information in [Kubernetes secrets](https://cloud.ibm.com/docs/containers?topic=containers-securitypi) that your app can access.
2. [Encrypt secrets by using a KMS provider](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkeyprotect).
3. [Verify that secrets are encrypted](https://cloud.ibm.com/docs/containers?topic=containers-encryptionverify_kms).



2. Pod-to-pod traffic: [Enable mTLS encryption for traffic between microservices within an Istio service mesh](https://cloud.ibm.com/docs/containers?topic=containers-istio-meshmtls).







 Expose your app 

Publicly expose an app in your cluster to the internet or privately expose an app in your cluster to the private network only.



1. Plan service discovery:



1. Understand the [basics of Kubernetes service discovery](https://cloud.ibm.com/docs/containers?topic=containers-plan_deployservice_discovery).
2. [Choose an app exposure service](https://cloud.ibm.com/docs/containers?topic=containers-cs_network_planning) that fits your requirements for incoming traffic to the app.



2. Expose your app:



* Load balancers:



* Classic clusters:



1.
[Webhook-create commands](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_webhook_create) Register a webhook in a cluster. 
 [API-key commands](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-cliapi_key-commands) View information about the API key for a cluster or reset it to a new key. 
 [Credential commands](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clicredential) Set and unset credentials that allow you to access the IBM Cloud classic infrastructure portfolio through your IBM Cloud account. 
 [Infra-permissions commands](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-cliinfra-commands) Check classic IBM Cloud infrastructure permissions that are used in IBM Cloud Kubernetes Service. 
 [KMS commands](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-cliks_kms) Enable a key management service (KMS) provider in your cluster to encrypt the etcd component and Kubernetes secrets with a root key that you control. 
 [Quota commands](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_quota) View the quota and limits for cluster-related resources in your IBM Cloud account. 
 [Subnets commands](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_subnets) List available subnets in your IBM Cloud infrastructure account. 
 [VLAN commands](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clivlan) List public and private VLANs for a zone and view the VLAN spanning status.
Verify that the IBM Cloud API key that you entered has sufficient permissions to work with your cluster. You must be assigned the Editor platform access role and the Manager service access role for IBM Cloud Kubernetes Service. For more information, see [User access permissions](https://cloud.ibm.com/docs/containers?topic=containers-access_reference).
3. Verify that you entered the etcd API endpoint for your Databases for etcd service instance in the correct format.



1. [Retrieve the Databases for etcd endpoint](https://cloud.ibm.com/docs/containers?topic=containers-storage_portworx_kv_store).
2. Add the etcd endpoint in the format etcd:<etcd_endpoint1>;etcd:<etcd_endpoint2>. If you have more than one endpoint, include all endpoints and separate them with a semicolon (;).

Example endpoint:

etcd:https://1ab234c5-12a1-1234-a123.databases.appdomain.cloud:32059



4. Verify that you stored the credentials to access your Databases for etcd service instance in a Kubernetes secret in your cluster. For more information, see [Setting up a Databases for etcd service instance for Portworx metadata](https://cloud.ibm.com/docs/containers?topic=containers-storage_portworx_kv_store).



1. Review steps 4-6 and verify that you retrieved the correct username, password, and certificate.
2. List the secrets in your cluster and look for the secret that holds the credentials of your Databases for etcd service instance.

kubectl get secrets
3. Make sure that the username, password, and certificate are stored as a base64 encoded value in your Kubernetes secret.
4. Verify that you entered the correct name of the secret in the IBM Cloud catalog.



5.
Verify that the user who experiences this problem has [Editor permissions for IBM Cloud Kubernetes Service](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-perms).
2. Verify that the user who experiences this problem has the [Cloud Foundry developer role for the space](https://cloud.ibm.com/docs/account?topic=account-mngcfupdate_cf_access) where the service is provisioned.
3. If the correct permissions exists, try assigning a different permission and then re-assigning the required permission.
4. Wait a few minutes, then let the user try to bind the service again.
5. If this does not resolve the problem, then the IBM Cloud IAM permissions are out of sync and you can't resolve the issue yourself. [Contact IBM support](https://cloud.ibm.com/docs/get-support?topic=get-support-using-avatar) by opening a support case. Make sure to provide the cluster ID, the user ID, and the service instance ID.



1. Retrieve the cluster ID.

ibmcloud ks cluster ls
2. Retrieve the service instance ID.

ibmcloud service show <service_name> --guid
Now that your service is bound to your cluster, you must configure your app to [access the service credentials in the Kubernetes secret](https://cloud.ibm.com/docs/openshift?topic=openshift-service-bindingadding_app).







 Accessing service credentials from your apps 

To access an IBM Cloud service instance from your app, you must make the service credentials that are stored in the Kubernetes secret available to your app.

The credentials of a service instance are base64 encoded and stored inside your secret in JSON format. To access the data in your secret, choose among the following options:



* [Mount the secret as a volume to your pod](https://cloud.ibm.com/docs/openshift?topic=openshift-service-bindingmount_secret)
* [Reference the secret in environment variables](https://cloud.ibm.com/docs/openshift?topic=openshift-service-bindingreference_secret)



Before you begin:



* Ensure you have the [Writer or Manager IBM Cloud IAM service access role](https://cloud.ibm.com/docs/openshift?topic=openshift-userschecking-perms) for the kube-system project.
* [Access your Red Hat OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-access_cluster).
* [Add an IBM Cloud service to your cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-service-bindingbind-services).





 Mounting the secret as a volume to your pod 

When you mount the secret as a volume to your pod, a file that is named binding is stored in the volume mount directory. The binding file in JSON format includes all the information and credentials that you need to access the IBM Cloud service.



1. List available secrets in your cluster and note the name of your secret. Look for a secret of type Opaque. If multiple secrets exist, contact your cluster administrator to identify the correct service secret.

oc get secrets

Example output
Choose a combination of [platform and service access roles](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-accessmanage-access-roles) to assign access for the user.
11. Click Add.
12. Continue to add platform and service access roles as needed and when you are finished, click Assign. Note that the user must be assigned at least Reader access to the entire instance in order for them to list, create and delete key rings within the instance.



Zoom

![The image shows an example of how to grant user access to a key ring.](https://cloud.ibm.com/docs-content/v1/content/0bc8db34a3d90b2a5103c9c71b08a96de9525bbc/key-protect/images/key-ring-iam-policy.png)

Figure 1. Shows how to grant user access to an instance.





 Listing key rings with the API 

For a high-level view, you can browse the key rings that are managed in your provisioned instance of Key Protect by making a GET call to the following endpoint.

https://<region>.kms.cloud.ibm.com/api/v2/keys_rings



1. [Retrieve your authentication credentials to work with keys in the service](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-up-api).
2. View general characteristics about your key rings by running the following curl command.

$ curl -X GET "https://<region>.kms.cloud.ibm.com/api/v2/key_rings?totalCount=<show_total>&offset=<offset_value>&limit=<offset_limit>" -H "accept: application/vnd.ibm.kms.key_ring+json" -H "authorization: Bearer <IAM_token>" -H "bluemix-instance: <instance_ID>" -H "correlation-id: <correlation_ID>"
ibmcloud ks cluster addon disable vpc-block-csi-driver --cluster CLUSTER [-f]

Minimum required permissions
: Administrator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

--cluster CLUSTER
: Required: The name or ID of the cluster.

-f
: Optional: Force the command to run with no user prompts.







 ibmcloud ks cluster addon enable 

Enable a managed add-on in an existing cluster. This command must be combined with one of the following subcommands for the managed add-on that you want to enable.



 ibmcloud ks cluster addon enable alb-oauth-proxy 

Virtual Private Cloud

Classic infrastructure

Enable the add-on for the [ALB OAuth Proxy](https://cloud.ibm.com/docs/containers?topic=containers-debug-tool) in a cluster. When your ALBs run the Kubernetes Ingress image, you can use the ALB OAuth proxy to enforce authentication for your apps by configuring Ingress with IBM Cloud App ID.

ibmcloud ks cluster addon enable alb-oauth-proxy --cluster CLUSTER [--version VERSION]

Minimum required permissions
: Administrator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

--version VERSION
: Optional: Specify the version of the add-on to install. If no version is specified, the default version is installed.



 Example addon enable alb-oauth-proxy command 

ibmcloud ks cluster addon enable alb-oauth-proxy --cluster my_cluster







 ibmcloud ks cluster addon enable debug-tool 

Virtual Private Cloud

Classic infrastructure

Enable the add-on for the [IBM Cloud Kubernetes Service Diagnostics and Debug Tool](https://cloud.ibm.com/docs/containers?topic=containers-debug-tool) in a cluster.
You can also use the [kubectl create secret](https://cloud.ibm.com/docs/containers?topic=containers-storage-cos-understandcreate_cos_secret) command to create a new secret and let Kubernetes automatically encode your values to base64. 
 can't access bucket <bucket_name>: Forbidden: Forbidden You specified ibm.io/auto-create-bucket: false and tried to access a bucket that you did not create, the secret access key or access key ID of your IBM Cloud Object Storage HMAC credentials are incorrect, or the regional endpoint of the bucket has changed. You can't access a bucket that you did not create. Automatically create a bucket instead by setting ibm.io/auto-create-bucket: true and ibm.io/bucket: "". If you are the owner of the bucket, see [PVC creation fails due to wrong credentials or access denied](https://cloud.ibm.com/docs/containers?topic=containers-cred_failure) to check your credentials. 
 can't create bucket <bucket_name>: AccessDenied: Access Denied You specified ibm.io/auto-create-bucket: true to automatically create a bucket in IBM Cloud Object Storage, but the credentials that you provided in the Kubernetes secret are assigned the Reader IAM service access role. This role does not allow bucket creation in IBM Cloud Object Storage. See [PVC creation fails due to wrong credentials or access denied](https://cloud.ibm.com/docs/containers?topic=containers-cred_failure). 
 can't create bucket <bucket_name>: AccessForbidden: Access Forbidden You specified ibm.io/auto-create-bucket: true and provided a name of an existing bucket in ibm.io/bucket. In addition the credentials that you provided in the Kubernetes secret are assigned the Reader IAM service access role. This role does not allow bucket creation in IBM Cloud Object Storage. To use an existing bucket, set ibm.io/auto-create-bucket: false and provide the name of your existing bucket in ibm.io/bucket.
Minimum required permissions
: Administrator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

-f
: Optional: Force the command to run with no user prompts.

-q
: Optional: Do not show the message of the day or update reminders.



 Example cluster ca create command 

ibmcloud ks cluster ca create --cluster my_cluster







 ibmcloud ks cluster ca get 

Virtual Private Cloud

Classic infrastructure

View the details of a cluster's CA certificate.

ibmcloud ks cluster ca get --cluster CLUSTER [ --output OUTPUT] [-q]

Minimum required permissions
: Administrator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

--output json
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.



 Example cluster ca get command 

ibmcloud ks cluster ca get --cluster my_cluster







 ibmcloud ks cluster ca rotate 

Virtual Private Cloud

Classic infrastructure

Rotate the certificate authority (CA) certificates of a cluster. Rotating invalidates certificates signed by the cluster's previous CA and issues certificates signed by the cluster's new CA to worker nodes.

Before you run this command, follow the steps in [Rotating CA certificates in your cluster](https://cloud.ibm.com/docs/containers?topic=containers-securitycert-rotate) to ensure that any tooling that uses the old CA certificates is updated to use the new certificates and to update your worker nodes.

ibmcloud ks cluster ca rotate --cluster CLUSTER [-f] [-q]

Minimum required permissions
: Administrator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

-f
: Optional: Force the command to run with no user prompts.
ibmcloud ks cluster master pod-security policy enable --cluster CLUSTER [--output OUTPUT] [-q]

Minimum required permissions
: Administrator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

--output json
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.



 Example cluster master pod-security policy enable command 

ibmcloud ks cluster master pod-security policy enable --cluster mycluster







 ibmcloud ks cluster master pod-security policy get 

Virtual Private Cloud

Classic infrastructure

View the pod security policy configuration for a cluster's Kubernetes API server. Note that pod security policies are not available in clusters that run version 1.25 or later.

ibmcloud ks cluster master pod-security policy get --cluster CLUSTER [--output OUTPUT] [-q]

Minimum required permissions
: Viewer platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

--output json
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.



 Example cluster master pod-security policy get command 

ibmcloud ks cluster master pod-security policy get --cluster mycluster







 ibmcloud ks cluster master pod-security set 

Virtual Private Cloud

Classic infrastructure

Set and enable the [pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission&interface=ui) for a cluster's Kubernetes API server.

ibmcloud ks cluster master pod-security set --cluster CLUSTER [-q]

Minimum required permissions
: Editor platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.
ibmcloud oc cluster master pod-security policy disable 

Virtual Private Cloud

Classic infrastructure

Disable the pod security policy for a cluster's Kubernetes API server.

ibmcloud oc cluster master pod-security policy disable --cluster CLUSTER [-q]

Minimum required permissions
: Administrator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

-q
: Optional: Do not show the message of the day or update reminders.



 Example cluster master pod-security policy disable command 

ibmcloud oc cluster master pod-security policy disable --cluster mycluster







 ibmcloud oc cluster master pod-security policy enable 

Virtual Private Cloud

Classic infrastructure

Enable the pod security policy for a cluster's Kubernetes API server. Note that pod security policies are not available in clusters that run version 1.25 or later.

ibmcloud oc cluster master pod-security policy enable --cluster CLUSTER [--output OUTPUT] [-q]

Minimum required permissions
: Administrator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

--output json
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.



 Example cluster master pod-security policy enable command 

ibmcloud oc cluster master pod-security policy enable --cluster mycluster







 ibmcloud oc cluster master pod-security policy get 

Virtual Private Cloud

Classic infrastructure

View the pod security policy configuration for a cluster's Kubernetes API server. Note that pod security policies are not available in clusters that run version 1.25 or later.

ibmcloud oc cluster master pod-security policy get --cluster CLUSTER [--output OUTPUT] [-q]

Minimum required permissions
: Viewer platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:
[Learn more about this integration](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-event-notifications). 
 [Kubernetes Service](https://cloud.ibm.com/docs/containers) Arbitrary secrets <br>Certificates <br>IAM credentials <br>Key-value secrets <br>User credentials Centrally manage Ingress subdomain certificates and other secrets for your Kubernetes clusters. [Learn more about this integration](https://cloud.ibm.com/docs/containers?topic=containers-secrets-mgr). 
 [Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift) Arbitrary secrets <br>Certificates <br>IAM credentials <br>Key-value secrets <br>User credentials Centrally manage Ingress subdomain certificates and other secrets for your Red Hat OpenShift on IBM Cloud clusters. [Learn more about this integration](https://cloud.ibm.com/docs/openshift?topic=openshift-ingress-roks4). 







 Authorizing an IBM Cloud service to access Secrets Manager 

To authorize a supported IBM Cloud service to access your Secrets Manager instance, you can [create an authorization between the services](https://cloud.ibm.com/docs/account?topic=account-serviceauth). Be sure that you have the [SecretsReader service role or higher](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam) on your Secrets Manager instance.



1. In the console, click Manage > Access (IAM), and select Authorizations.
2. Click Create.
3. Select a source account for the authorization.
4. From the Source service list, select the service that you want to integrate with Secrets Manager.
5. Specify whether you want the authorization for the source service to apply to all the instances that are associated with the account, only a specific instance, or instances that are only in a specific resource group.
6. From the Target service list, select Secrets Manager.
7.