vania-janet/multiturn-rag-retrieval-data huggingface dataset:
[Log in to the IBM Cloud console](https://cloud.ibm.com/).
2. Go to Menu > Resource list to view a list of your resources.
3. From your IBM Cloud resource list, select your provisioned instance of Hyper Protect Crypto Services.
4. In the UI of the selected service instance, select the Instance policies tab in the side menu.
5. In the Allowed network section, select the network that you want traffic to come through, and click Save policy. The default network policy is public and private, which allows access from both public and private networks.

If a private-only network is enabled, you are not able to view or manage keys with the IBM Cloud console. However, you can still adjust the network setting later by using the API or CLI.







 Updating the network access policy for your Hyper Protect Crypto Services instance with the key management service API 

As a security administrator, update the network access policy for your Hyper Protect Crypto Services instance by making a PUT call to the following endpoint. See these API references to [set](https://cloud.ibm.com/apidocs/hs-cryptoputinstancepolicy) and [list](https://cloud.ibm.com/apidocs/hs-cryptogetinstancepolicy) instance policies.

https://api.<region>.hs-crypto.cloud.ibm.com/api/v2/instance/policies?policy=allowedNetwork



1. [Retrieve your authentication credentials to work with the API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-kms-api).

To change a network access policy, you must be assigned a Manager access policy for your Hyper Protect Crypto Services instance. To learn how IAM (identity and access management) roles map to Hyper Protect Crypto Services service actions, check out [Service access roles](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-accessservice-access-roles).
2.
Security strategy: Start by reviewing all [security options](https://cloud.ibm.com/docs/containers?topic=containers-security) that are available for your cluster.
2. Network security:



* Classic clusters:



1. To isolate networking workloads, you can restrict network traffic to [edge worker nodes](https://cloud.ibm.com/docs/containers?topic=containers-edge).
2. Set up a firewall by using a [gateway appliance](https://cloud.ibm.com/docs/containers?topic=containers-firewallvyatta_firewall) or [Calico network policies](https://cloud.ibm.com/docs/containers?topic=containers-network_policies).



* VPC clusters: Control traffic to and from your cluster with [VPC security groups](https://cloud.ibm.com/docs/containers?topic=containers-vpc-network-policy).



3. Workload security:



1. [Encrypt sensitive information](https://cloud.ibm.com/docs/containers?topic=containers-encryption) in the cluster, such as the master's local disk and secrets.
2. Set up a [private image registry](https://cloud.ibm.com/docs/containers?topic=containers-securityimages_registry) for your developers, such as the one provided by Container Registry, to control access to the registry and the image content that can be pushed.
3. [Set pod priority](https://cloud.ibm.com/docs/containers?topic=containers-pod_priority) to indicate the relative priority of the pods that make up your cluster's workload.
4. Authorize who can create and update pods by configuring [pod security policies (PSPs)](https://cloud.ibm.com/docs/containers?topic=containers-psp).









 Logging and monitoring 

Set up logging and monitoring to help you troubleshoot issues and improve the health and performance of your Kubernetes clusters and apps.



1.
Select the Key Protect service instance that you created earlier.
6. Authorize dependent services by selecting Enable authorization to be delegated. Delegation allows the Key Protect instance to propagate its authorizations to this service.
7. Make sure that the Reader role is enabled. Reader permissions allow the Watson service to see the root keys in the Key Protect instance.
8. Click Authorize and confirm delegated authorization.







 Step 4. Encrypt the Watson service data 

After you grant the Watson service the authorization to use your keys, you create another instance on your Premium plan and supply the key name or CRN. The service uses your encryption key to encrypt your data.

You must have the administrator or editor role on the Watson service.



1. Go to the [AI / Machine Learning](https://cloud.ibm.com/catalog/?category=ai) category page.
2. Select the Watson service that you authorized in [Step 3. Grant service access](https://cloud.ibm.com/docs/natural-language-understanding?topic=watson-keyserviceserviceauth-key)
3. Select a region. Make sure to create the instance in the same location as the Key Protect service that you created in Step 1.
4. Select the Premium plan. This feature is supported on the Premium plan only.
5. Encrypt the service data with Key Protect:



1. Select Yes to "Encrypt service with Key Protect."
2. Select the Key Protect instance that you authorized earlier.
3. Select the root key that you authorized earlier.



If you see a drop-down menu flash and disappear, check that you have correctly followed sub-step 5 of [Step 3. Grant service access](https://cloud.ibm.com/docs/natural-language-understanding?topic=watson-keyserviceserviceauth-key)
6. Click Create.



The data that is associated with this Watson service instance is now encrypted.







 Working with customer-managed keys
For example, Databases for PostgreSQL or Messages for RabbitMQ
6. In the Source service instance menu, select All instances.
7. In the Target service menu, select Key Protect.
8. Select or retain the default value Account as the resource group for the Target Service
9. In the Target service Instance ID menu, select the service instances to authorize.
10. Enable the Reader role.
11. To use "Bring your own key" (BYOK) for backups, Select the Enable authorizations to be delegated box in the Authorize dependent services section.
12. Click Authorize.



If the service authorization is not present before provisioning your deployment with a key, the provision fails.





 Using the Key Protect Key 

After you grant your Cloud Databases deployments permission to use your keys, you supply the [key name or CRN](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-keys) when you provision a deployment. The deployment uses your encryption key to encrypt your data.





 Using the Key Protect Key in the UI 

If provisioning from the catalog page, select the Key Protect instance and key from the dropdown menus.





 Using the Key Protect Key in the CLI 

In the CLI, use the disk_encryption_key_crn parameter in the parameters JSON object.

ibmcloud resource service-instance-create example-database <service-name> standard us-south -p '{
"disk_encryption_key_crn": "crn:v1:<...>:key:<id>"
}'

The Key Protect key needs to be identified by its full CRN, not just its ID. A key protect CRN is in the format crn:v1:<...>:key:<id>.





 Using the Key Protect Key in the API 

In the API, use the disk_encryption_key parameter in the body of the request.
Select the Key Protect service instance that you created earlier.
6. Authorize dependent services by selecting Enable authorization to be delegated. Delegation allows the Key Protect instance to propagate its authorizations to this service.
7. Make sure that the Reader role is enabled. Reader permissions allow the Watson service to see the root keys in the Key Protect instance.
8. Click Authorize and confirm delegated authorization.







 Step 4. Encrypt the Watson service data 

After you grant the Watson service the authorization to use your keys, you create another instance on your Premium plan and supply the key name or CRN. The service uses your encryption key to encrypt your data.

You must have the administrator or editor role on the Watson service.



1. Go to the [AI / Machine Learning](https://cloud.ibm.com/catalog/?category=ai) category page.
2. Select the Watson service that you authorized in [Step 3. Grant service access](https://cloud.ibm.com/docs/watson?topic=watson-keyserviceserviceauth-key)
3. Select a region. Make sure to create the instance in the same location as the Key Protect service that you created in Step 1.
4. Select the Premium plan. This feature is supported on the Premium plan only.
5. Encrypt the service data with Key Protect:



1. Select Yes to "Encrypt service with Key Protect."
2. Select the Key Protect instance that you authorized earlier.
3. Select the root key that you authorized earlier.



If you see a drop-down menu flash and disappear, check that you have correctly followed sub-step 5 of [Step 3. Grant service access](https://cloud.ibm.com/docs/watson?topic=watson-keyserviceserviceauth-key)
6. Click Create.



The data that is associated with this Watson service instance is now encrypted.







 Working with customer-managed keys
For more security, you can protect your data by using your own customer root keys (CRKs). You import your root keys to, or create them in, a supported key management service (KMS). Your root keys are safely managed by the supported KMS, either Key Protect (FIPS 140-2 Level 3 compliance) or Hyper Protect Crypto Services. Both KMS solutions offer the highest level of security (FIPS 140-2 Level 4 compliance). Your key material is protected in transit and at rest.

For more information, see [Supported key management services for customer-managed encryption](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-aboutkms-for-byok). To learn how to configure customer-managed encryption, see [Creating Block Storage for VPC volumes with customer-managed encryption](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-vpc-encryption).

You control access to your root keys stored in KMS instances within IBM Cloud® by using IBM Cloud Identity and Access Management (IAM). You grant access to the IBM Block Storage for VPC Service to use your keys. With the API, you can link a primary account that holds a root key to a secondary account, then use that key to encrypt new volumes in the secondary account. For more information, see [Cross-account encryption for multitenant storage resources](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started).

You can also revoke access at any time, for example, if you suspect your keys might be compromised. You can also disable or delete a root key, or temporarily revoke access to the key's associated data on the cloud. For more information, see [Managing root keys](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managingbyok-manage-root-keys).





 What are the advantages of using customer-managed encryption over provider-managed encryption?
Select the Key Protect service instance that you created earlier.
6. Authorize dependent services by selecting Enable authorization to be delegated. Delegation allows the Key Protect instance to propagate its authorizations to this service.
7. Make sure that the Reader role is enabled. Reader permissions allow the Watson service to see the root keys in the Key Protect instance.
8. Click Authorize and confirm delegated authorization.







 Step 4. Encrypt the Watson service data 

After you grant the Watson service the authorization to use your keys, you create another instance on your Premium plan and supply the key name or CRN. The service uses your encryption key to encrypt your data.

You must have the administrator or editor role on the Watson service.



1. Go to the [AI / Machine Learning](https://cloud.ibm.com/catalog/?category=ai) category page.
2. Select the Watson service that you authorized in [Step 3. Grant service access](https://cloud.ibm.com/docs/language-translator?topic=language-translator-keyserviceserviceauth-key)
3. Select a region. Make sure to create the instance in the same location as the Key Protect service that you created in Step 1.
4. Select the Premium plan. This feature is supported on the Premium plan only.
5. Encrypt the service data with Key Protect:



1. Select Yes to "Encrypt service with Key Protect."
2. Select the Key Protect instance that you authorized earlier.
3. Select the root key that you authorized earlier.



If you see a drop-down menu flash and disappear, check that you have correctly followed sub-step 5 of [Step 3. Grant service access](https://cloud.ibm.com/docs/language-translator?topic=language-translator-keyserviceserviceauth-key)
6. Click Create.



The data that is associated with this Watson service instance is now encrypted.







 Working with customer-managed keys
Managing data policy rules 

Protecting access to data is a critical requirement for many enterprises. To ensure that your data is protected from unauthorized access, IBM® watsonx.data can manage access controls for data. A user with admin privileges on the data can create access policies to define, extend, limit and deny, by using the data security solution that is provided by watsonx.data.

To maintain data security, you can create access policies for the following at the data level:



1.  Schemas, tables, and columns.
2.  Users or user groups.
3.  Actions.





  Create Access control policies 



1.  Log in to watsonx.data console.
2.  From the navigation menu, select Access control.
3.  Select Policies from the Access control page, click Add policy. Create Access policy page opens.
4.  In the Basics page, enter a policy name, policy description and select the policy status after creation. Click Next.
5.  In the Data page, select a catalog and choose a single or all schema, table, or column where you want to add the data policy.
6.  Click Next to add rules.
7.  In the Rules page, click Add rule.
8.  Select the rule type, user actions, users or groups and click Add to add the rule.
9.  Click Review to see the rule.
10. Click Save to save the policy.
Select the Key Protect service instance that you created earlier.
6. Authorize dependent services by selecting Enable authorization to be delegated. Delegation allows the Key Protect instance to propagate its authorizations to this service.
7. Make sure that the Reader role is enabled. Reader permissions allow the Watson service to see the root keys in the Key Protect instance.
8. Click Authorize and confirm delegated authorization.







 Step 4. Encrypt the Watson service data 

After you grant the Watson service the authorization to use your keys, you create another instance on your Premium plan and supply the key name or CRN. The service uses your encryption key to encrypt your data.

You must have the administrator or editor role on the Watson service.



1. Go to the [AI / Machine Learning](https://cloud.ibm.com/catalog/?category=ai) category page.
2. Select the Watson service that you authorized in [Step 3. Grant service access](https://cloud.ibm.com/docs/discovery?topic=watson-keyserviceserviceauth-key)
3. Select a region. Make sure to create the instance in the same location as the Key Protect service that you created in Step 1.
4. Select the Premium plan. This feature is supported on the Premium plan only.
5. Encrypt the service data with Key Protect:



1. Select Yes to "Encrypt service with Key Protect."
2. Select the Key Protect instance that you authorized earlier.
3. Select the root key that you authorized earlier.



If you see a drop-down menu flash and disappear, check that you have correctly followed sub-step 5 of [Step 3. Grant service access](https://cloud.ibm.com/docs/discovery?topic=watson-keyserviceserviceauth-key)
6. Click Create.



The data that is associated with this Watson service instance is now encrypted.







 Working with customer-managed keys
For more information, see [Setting a rotation policy](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-rotation-policy) in the Key Protect docs.





 Identify which key is encrypting your service instance 

To see which Key Protect instance is used to encrypt the data, use the link in the service details.



1. Go to your [resource list](https://cloud.ibm.com/resources).
2. Click the name of the Watson service instance.
3. Click the Manage tab on the left pane.
4. Find "Encrypted with a Key Protect root key". Click View KeyProtect Instance to see details of the keys in that Key Protect instance.









 Next steps 



* Read more about [Bringing your encryption keys to the cloud](https://cloud.ibm.com/docs/key-protect?topic=key-protect-importing-keys) in the Key Protect docs.
* See which [Activity Tracker events](https://cloud.ibm.com/docs/key-protect?topic=key-protect-at-events) are recorded with Key Protect.
You might also want to manage the public key in the same way to control who can build images. You can use [IBM Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-about) to store and protect your keys.

IBM Key Protect stores symmetric keys rather than the asymmetric PKI keys that are used for image encryption. You can add your keys separately as two IBM Key Protect standard keys by using the dashboard, CLI, or API. IBM Key Protect requires that only Base64 data is imported. To obtain pure Base64 data, you can encode the PEM files by running "openssl enc -base64 -A -in <user>Private.pem -out <user>Private.b64" before you load the Base64 content, and reverse this action to obtain the usable key again by running "openssl enc -base64 -A -d -in <user>Private..b64 -out <user>Private.pem".

For more information about how to use IBM Key Protect to store and protect your keys, see [Bringing your encryption keys to the cloud](https://cloud.ibm.com/docs/key-protect?topic=key-protect-importing-keys) and [Importing your own keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-getting-started-tutorialimport-keys).

As an alternative, you can protect your keys in your own store by using an IBM Key Protect root key to wrap them. This action means that you must unwrap them again by using IBM Key Protect and the valid root key.

For example, to wrap keys by using the CLI, run the command "ibmcloud kp key wrap <root_key_id> -p <base64 encoded image key>" and to unwrap keys, run the command "ibmcloud kp key unwrap <root_key_id> -p <base64 cyphertext>, where <root_key_id> is the ID of the root key that you are using.
Review the following ways that you can secure access to your location.



* Consider the types of [user access to resources that run in your Satellite location](https://cloud.ibm.com/docs/satellite?topic=satellite-service-connectionuser-access)
* [Manage access for Satellite by using IBM Cloud Identity and Access Management (IAM)](https://cloud.ibm.com/docs/satellite?topic=satellite-iam)
* Monitor user-initiated activities by [Setting up Activity Tracker for Satellite location events](https://cloud.ibm.com/docs/satellite?topic=satellite-healthsetup-at)
* In the case of a potential security incident, [reset the key that the control plane uses to communicate with all the hosts in the Satellite location](https://cloud.ibm.com/docs/satellite?topic=satellite-host-update-locationhost-key-reset)
* Protect sensitive data by [Encrypting the Kubernetes secrets by using a KMS provider](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkeyprotect).









 IBM operational access 

Learn more about IBM operational access to your Satellite location and how to monitor IBM-initiated activities.



 What automated access does IBM have to my location? 

Operations such as host attachment, host assignment, and major and minor version updates for the Satellite location control plane hosts are controlled by automation through the IBM Cloud Satellite API server in IBM Cloud. The Satellite API server communicates with the control plane master, which also exists in IBM Cloud, to make these changes in your location.

Regular maintenance and automation tooling accesses the masters of Satellite-enabled IBM Cloud service clusters in your location through the default openshift-api-<cluster_ID> Link endpoint. This endpoint allows the Red Hat OpenShift on IBM Cloud API to communicate with the master for the service cluster. For example, if you create a Red Hat OpenShift cluster to run applications in your location, all version updates for that cluster's master are automatically applied through the default openshift-api-<cluster_ID> Link endpoint for that cluster.
If you need full control over your encryption keys, you can use [IBM Cloud Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-overview) to create, add, and manage encryption keys and associate the keys with your Hyper Protect DBaaS for PostgreSQL service instance to encrypt your databases.

The following diagram shows how Hyper Protect DBaaS for PostgreSQL integrates with Hyper Protect Crypto Services.

Zoom

![Integration with Hyper Protect Crypto Services](https://cloud.ibm.com/docs-content/v1/content/dd578c7374d6964b05281d1f0f1a32c4c32667ff/hyper-protect-dbaas-for-postgresql/images/DBaaS-KYOK.svg)

Integration with Hyper Protect Crypto Services

Your backups are also protected by the data encryption key that is wrapped by your root key from Hyper Protect Crypto Services.



 Step 1. Create or add a root key in Hyper Protect Crypto Services 

To create or add a

root keyin Hyper Protect Crypto Services, complete the following steps:



1. [Provision](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-provision) and [initialize your Hyper Protect Crypto Services service instance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm) if you haven't.
2. Go to your instance of Hyper Protect Crypto Services and [create a root key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-root-keys) or [import an existing root key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-import-root-keys).







 Step 2. Grant service authorization 

Authorize Hyper Protect Crypto Services for use with Hyper Protect DBaaS for PostgreSQL service instances:
Use a key management service (KMS) provider, such as IBM® Key Protect, to create a private root key that you use in your Block Storage for VPC instance to encrypt data as it is written to the storage. After you create the private root key, create a custom storage class or a Kubernetes secret with your root key and then use this storage class or secret to provision your Block Storage for VPC instance.



1. [Create a Key Protect service instance](https://cloud.ibm.com/docs/key-protect?topic=key-protect-provisionprovision).
2. [Create a root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-create-root-keyscreate-root-keys). By default, the root key is created without an expiration date.
3. Retrieve the service CRN for your root key.



1. From the Key Protect details page, select the Keys tab to find the list of your keys.
2. Find the root key that you created and from the actions menu, click View CRN.
3. Note the CRN of your root key.



4. Authorize Block Storage for VPC to access IBM® Key Protect.



1. From the IBM Cloud menu, select Manage > Access (IAM).
2. From the menu, select Authorizations.
3. Click Create.
4. Select Cloud Block Storage for Classic as your source service.
5. Select Key Protect as your target service.
6. Select the Reader service access role and click Authorize.



5. [Decide if you want to store the Key Protect root key CRN in a customized storage class or in a Kubernetes secret](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-blockvpc-customize-default). Then, follow the steps to create a customized storage class or a Kubernetes secret.

Example customized storage class.

apiVersion: storage.k8s.io/v1