vania-janet/multiturn-rag-retrieval-data huggingface dataset:
"code": "KEY_IMPT_REQ_ERR",
"message": "Only imported keys may be restored.",
"status": 400,
"moreInfo": "https://cloud.ibm.com/apidocs/key-protect"
}
]
}
]
}











 17 - Requested action can only be completed... 



 Message 

Requested action can only be completed with a root key

Reason code: KEY_ROOT_REQ_ERR





 HTTP status code 

400 - Bad Request

The HTTP 400 Bad Request response status code indicates that the server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing).

The client should not repeat this request without modification.





 Context 

Many key "actions" can only be performed on "root" keys. This is a list of commands that can only be performed on root keys.



* disable key
* enable key
* restore key
* rotate key
* unwrap key
* wrap key





 Example 

This example creates a "standard" key then attempts to disable it. This fails because only "root" keys can be disabled.

 create a standard key
$ KEY_ID=$(ibmcloud kp key create example-key -i $KP_INSTANCE_ID --output json --standard-key | jq -r '.["id"]')

$ echo $KEY_ID

b2dae7bb-2da5-493e-99d2-a6379e35e58c

 this request fails because a standard key cannot be disabled
* KEY_ROTATION_NOT_PERMITTED - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-key-rotation-not-permitted)
* KEY_VERSION_INVALID - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-key-version-invalid)
* NO_BODY_ERR - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-no-body-err)
* NOT_DUAL_AUTH_ERR - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-not-dual-auth-err)
* NUM_COLLECTION_RESOURCE_ERR - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-num-collection-resource-err)
* PREV_KEY_DEL_ERR - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-prev-key-del-err)
* PROTECTED_RESOURCE_ERR - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-protected-resource-err)
* REQ_TOO_EARLY_ERR - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-req-too-early-err)
* RESOURCE_OWNER_ERR - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-resource-owner-err)
Why can't I delete my project? 

You tried to delete a project, but it doesn't delete successfully.

  What’s happening 

The project displays a Needs attention alert and a message displays on the Activity tab that states that the project deletion failed.

  Why it’s happening 

One of the reasons a project might not delete successfully is due to an issue with the project tooling services.

  How to fix it 

Project tooling is required to delete a project. If an error occurs with the project tooling service, you can’t delete the project. Try again later or contact IBM Cloud Support.
However, if you stop the virtual server instance, it can't be restarted. You also can't provision a resource by using a disabled key. Before you disable a key, it's best to verify which resources are being protected by it.

To see which root keys are disabled, look in the UI list of resources. The status of volume and snapshot resources are unusable. File shares in a stable state remain so. The UI tooltip displays "key suspended" for the resource. In the API response, you can see an encryption_key_disabled reason code.

You can [enable a root key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-disable-keysenable-ui) that's in a suspended state, which returns the key to an active state. You can also [delete a suspended key](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managing&interface=uibyok-delete-root-keys) or restore the deleted key if necessary.

For more information about disabling root keys the following topics.



* [Key Protect - Disabling root keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-disable-keys)
* [Hyper Protect Crypto Services - Disabling root keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-disable-keys)







 Deleting root keys 

When you delete a root key, the key is no longer available to decrypt passphrases that are used to protect your resources. Deleting a root key places it in a destroyed or deleted state in the KMS. Volume, snapshot, and image resources that are protected by the deleted root key have an unusable status and can't be used for normal operations. File Storage for VPC shares show a suspended status. The storage system is offline, and data cannot be accessed.

Your data still exists.
Launch mysqladmin like this:

mysqladmin [options] command [command-arg] [command command-arg]] ...





 Cryptoshredding keys 

Key Protect provides for a [force delete](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keys) of a key that is in use by IBM Cloud® services, including your Cloud Databases deployments. This action is called cryptoshredding.

Cryptoshredding is a destructive action. When the key is deleted, your data is unrecoverable even from a soft delete state.





 Backups Removal 

Backups cannot be manually deleted. However, if you delete your deployment, its backups are deleted automatically.





 Reenabling from a soft delete 

You are able to discover available soft-deleted instances by using the IBM Cloud CLI [ibmcloud resource reclamations](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_resourceibmcloud_resource_reclamations) command.

You can then "undelete", recover, or reclaim an available soft-deleted instance by using the IBM Cloud CLI [ibmcloud resource reclamation-restore](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_resourceibmcloud_resource_reclamation_restore) command:

ibmcloud resource reclamation-restore resource_ID
[details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-bearer-sub-extraction-err)
4. Invalid body data was passed... [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-bad-body-err)
5. Invalid field error... [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-invalid-field-err)
6. Key could not be deleted... [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-key-delete-err)
7. Key has already been deleted... [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-key-deleted-err)
8. Key is not in a valid state (409) [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-key-action-invalid-state-err)
9. Key is not in a valid state (422) [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-key-invalid-state-err)
10. Key is protecting one or more cloud... [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-protected-resource-err)
11. Key metadata became corrupted...
* Clusters automatically respond if you disable, enable, or restore root keys.
* Disabling a root key restricts cluster functionality until you reenable the key.
* Deleting a root key makes the cluster unusable and unrecoverable.
* Root keys can't be deleted if the key is used by a cluster.









 Encrypting the Kubernetes secrets by using a KMS provider 

Virtual Private Cloud

Classic infrastructure

Enable a [key management service (KMS) provider](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkms) to encrypt the Kubernetes secrets in your cluster.



 Prerequisites 

Before you enable a key management service (KMS) provider in your cluster, create a KMS instance and complete the following steps.

Setting up cross-account encryption by using a KMS in a different account is supported in the CLI or API.



1. Create a KMS instance, such as [Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-provisionprovision) or [Hyper Protect Crypto Services](https://cloud.ibm.com/catalog/services/hyper-protect-crypto-services).
2. Create a customer root key (CRK) in your KMS instance.



* [Key Protect root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-create-root-keyscreate-root-keys).
* [Hyper Protect Crypto Services root key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-root-keys). By default, the root key is created without an expiration date.



Key Protect: Need to set an expiration date to comply with internal security policies? [Create the root key by using the API](https://cloud.ibm.com/docs/key-protect?topic=key-protect-create-root-keyscreate-root-key-api) and include the expirationDate parameter.
Why can't I delete my DNS Services instance? 

You attempted to delete your DNS Services instance, but received an error.

  What’s happening 

You received an error when you tried to delete your DNS Services instance. It might be for the following reason.



  A permitted network is still in the zone 

To delete a service instance, you must first remove all permitted networks from zones within the service instance.

  How to fix it 

Remove all permitted networks in the zone's instance again.
To retrieve a list of your available keys, run the [kp keys](https://cloud.ibm.com/docs/key-protect-cli-plugin?topic=key-protect-cli-plugin-key-protect-cli-referencekp-keys) command.







 Optional parameters 



* -m, --monthly-interval

Set the key rotation interval in months. The rotation interval must be 1 to 12 months.
* -e, --enable or -d, --disable

By default, key rotation policy is enabled. If user wants to disable or enable the policy, they can use -d(--disable) or -e(--enable) respectively.
* -o, --output

Set the CLI output format. By default, all commands print in table format. To change the output format to JSON, use --output json.
* --key-ring

A unique, human readable name for the key-ring. Required if the user doesn't have permissions on the default key ring.









 kp key restore 

Key Protect can restore a previously deleted root key, which restores access to its associated data in the cloud.

As an admin, you might need to restore a root key that was imported into Key Protect to access data the key previously protected.

When you restore a key, you move the key from the Destroyed (value is 5) to the Active (value is 1) key state, and you restore access to any data that was previously encrypted with the key.

You can restore a deleted key within 30 days of its deletion. This capability is available only for root keys that were created with a key material.

You can only restore root keys that were created with a key material, using kp key create with the -k, --key-material option. You cannot restore a root key if the --key-material option was not specified.

If you want to restore a deleted root key then you must save the key material that was used to create the root key. You cannot restore a deleted key without provided the original key material.

ibmcloud kp key restore KEY_ID_OR_ALIAS
For more information, see [Understanding Key Management Service (KMS) providers](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkms).

Do not delete root keys in your KMS instance, even if you rotate to use a new key. If you delete a root key that a cluster uses, the cluster becomes unusable, loses all its data, and can't be recovered.

ibmcloud ks kms crk ls --instance-id KMS_INSTANCE_ID [--output json] [-q]

Minimum required permissions
: Viewer platform access role in IBM Cloud Kubernetes Service

Command options:

--instance-id KMS_INSTANCE_ID
: The ID of the key management service instance that you want to list root keys for. To list available KMS instances, run ibmcloud ks kms instance ls.

--output json
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.



 Example kms crk ls command 

ibmcloud ks kms crk ls --instance-id 1aa1a111-1111-1111-a111-a1aaaa1a1a1a







 ibmcloud ks kms enable 

Virtual Private Cloud

Classic infrastructure

Encrypt your Kubernetes secrets by [enabling a key management service (KMS) provider](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkeyprotect) in your cluster. To rotate a key in a cluster with existing key encryption, rerun this command with a new root key ID.

Do not delete root keys in your KMS instance, even if you rotate to use a new key. If you delete a root key that a cluster uses, the cluster becomes unusable, loses all its data, and can't be recovered. When you rotate a root key, you can't reuse a previous root key for the same cluster.
(https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-delete-vaulttroubleshoot-delete-vault)

[Why can't I delete internal keystores?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-delete-keystoretroubleshoot-delete-keystore)

[Why do I fail to see the changes to my key in Azure Key Vault?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-azure-delaytroubleshoot-azure-delay)





 Getting help and support for Hyper Protect Crypto Services 

[Getting help and support for Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-getting-helpgetting-help)



* [Providing support case details](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-getting-helpsupport-case-details)
Key is not in a valid state (422) [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-key-invalid-state-err)
10. Key is protecting one or more cloud... [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-protected-resource-err)
11. Key metadata became corrupted... [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-incomplete-metadata-err)
12. Key restoration has expired [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-key-restore-expired)
13. KeyCreateImportAccess instance policy... [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-key-create-import-access-err)
14. Missing body in request [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-no-body-err)
15. Number of authorizations required to... [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-authorizations-not-met)
16. Only a single instance policy may be... [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-num-collection-resource-err)
17.
"creationDate": "2020-06-15T20:36:46Z"
}
}
]

 delete the authorization policy between COS AND KMS - this breaks everything
$ ibmcloud iam authorization-policy-delete $COS_KMS_AUTHORIZATION --force

 delete the KP root key - this fails because the registration was not deleted
$ ibmcloud kp key delete $MY_COS_KEY_ID

Deleting key: 52a9d772-8982-4620-bfb4-b070dd812a0c, from instance: b0d84b32-09d0-4314-8049-da78e3b9ab6f...
FAILED
kp.Error:
correlation_id='c27b7948-4a1f-4cbd-8770-cb3616888e27',
msg='Conflict: Key could not be deleted. Please see "reasons" for more details.',
reasons='[PROTECTED_RESOURCE_ERR: Key is protecting one or more cloud resources -
FOR_MORE_INFO_REFER: https://cloud.ibm.com/docs/key-protect?topic=key-protect-troubleshootingunable-to-delete-keys]'

 delete the KP root key; use --force because the registration between COS and KMS still exists
$ ibmcloud kp key delete $MY_COS_KEY_ID --force --output json

{
"id": "52a9d772-8982-4620-bfb4-b070dd812a0c"
}

 delete the KMS instance
$ ibmcloud resource service-instance-delete $KMS_NAME --force

 delete the COS instance
$ ibmcloud resource service-instance-delete $COS_NAME --force

 view resources (COS and KMS should no longer exist)
$ ibmcloud resource service-instances
Why can't I delete my Subnet? 

You attempted to delete your subnet, and received an error.

  What’s happening 

The following error message appeared when you attempted to delete a subnet:

Zoom

![Delete subnet error](https://cloud.ibm.com/docs-content/v1/content/d56dbd8ab7d14086029681ee71679e14aea53723/dns-svcs//images/delete-subnet-error.png)

Figure 1. Delete subnet error

  Why it’s happening 

When you create a pool and associate a health check to that pool, DNS Services automatically provisions an appliance that attaches to a network interface in your subnet.

  How to fix it 

To remove the subnet, first remove the health check configuration associated with your pool and then try deleting your subnet again.

To remove the health check, take the following steps:



1.  Navigate to Global load balancer > Origin pools
2.  Click the overflow menu ![overflow menu](https://cloud.ibm.com/docs-content/v1/content/d56dbd8ab7d14086029681ee71679e14aea53723/dns-svcs//images/overflow-icon.png) and select Edit
3.  In the side panel that appears, scroll to the Health monitoring section and select No health check from the drop down menu
4.  Click Save



You do not need to delete the pool itself.
To retrieve a list of your available keys, run the [kp keys](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-keys) command.







 Optional parameters 



* -m, --monthly-interval

Set the key rotation interval in months. The rotation interval must be 1 to 12 months.
* -e, --enable or -d, --disable

By default, key rotation policy is enabled. If user wants to disable or enable the policy, they can use -d(--disable) or -e(--enable) respectively.
* -o, --output

Set the CLI output format. By default, all commands print in table format. To change the output format to JSON, use --output json.
* --key-ring

A unique, human readable name for the key-ring. Required if the user doesn't have permissions on the default key ring.









 kp key restore 

Key Protect can restore a previously deleted root key, which restores access to its associated data in the cloud.

As an admin, you might need to restore a root key that was imported into Key Protect to access data the key previously protected.

When you restore a key, you move the key from the Destroyed (value is 5) to the Active (value is 1) key state, and you restore access to any data that was previously encrypted with the key.

You can restore a deleted key within 30 days of its deletion. This capability is available only for root keys that were created with a key material.

You can only restore root keys that were created with a key material, using kp key create with the -k, --key-material option. You cannot restore a root key if the --key-material option was not specified.

If you want to restore a deleted root key then you must save the key material that was used to create the root key. You cannot restore a deleted key without provided the original key material.

ibmcloud kp key restore KEY_ID_OR_ALIAS
-i, --instance-id INSTANCE_ID
If you delete a root key that a cluster uses, the cluster becomes unusable, loses all its data, and can't be recovered. When you rotate a root key, you can't reuse a previous root key for the same cluster. Similarly, if you disable a root key, operations that rely on reading secrets fail. Unlike deleting a root key, however, you can reenable a disabled key to make your cluster usable again.





 Enabling KMS encryption for the cluster through the console 

You can enable a KMS provider, update the KMS provider instance, or update the root key through the IBM Cloud console.



1. Complete the [prerequisite steps](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionkms_prereqs) to create a KMS instance and root key.
2. From the [Red Hat OpenShift clusters console](https://cloud.ibm.com/kubernetes/clusters?platformType=openshift), select the cluster that you want to enable encryption for.
3. From the Overview tab, in the Summary > Key management service section, click Enable. If you already enabled the KMS provider, click Update.
4. Select the Key management service instance and Root key that you want to use for the encryption.

During the enablement, you might not be able to access the Kubernetes master such as to update YAML configurations for deployments.
5. Click Enable (or Update).
6. Verify that the KMS enablement process is finished. From the Summary > Master status section, you can check the progress. Example output when the enablement is in progress.

Master status KMS feature enablement in progress.

Example output when the master is ready.

Master status Ready

After the KMS provider is enabled in the cluster, all cluster secrets are automatically encrypted.
7. Clusters that run version 3.11: Existing secrets are not automatically encrypted and need to be rewritten to be encrypted.



1. [Log in to your account.
correlation_id='c2edbdad-7e62-4690-8fcc-10515ade9913',
msg='Conflict: Action could not be performed on key. Please see "reasons" for more details.',
reasons='[KEY_ACTION_INVALID_STATE_ERR: Key is not in a valid state -
FOR_MORE_INFO_REFER: https://cloud.ibm.com/apidocs/key-protect]'





 Example 3 

Create a root key with an alias, use that alias to identify the key to be disabled, verify the key state (suspended), then enable the root key and verify the new key state (active).

 create a root key
$ ibmcloud kp key create root-key-with-alias -a example-alias-1 --output json

{
"id": "264fadc3-7667-4b25-916e-5825fe70de0b",
"name": "root-key-with-alias",
"type": "application/vnd.ibm.kms.key+json",
"extractable": false,
"state": 1,
"aliases": [
"example-alias"
],
"deleted": false,
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:390086ac-76fa-4094-8cf3-c0829bd69526:key:264fadc3-7667-4b25-916e-5825fe70de0b"
}

 show key details using the alias as identifier - a state of "1" is "active"
$ ibmcloud kp key show example-alias-1 --output json

{
"id": "264fadc3-7667-4b25-916e-5825fe70de0b",
$ ibmcloud kp key delete $KEY_ID -i $KP_INSTANCE_ID

Deleting key: 'e631925f-affb-457e-886d-57cb2a5f565b', from instance: 'a192d603-0b8d-452f-aac3-f9e1f95e7411'...
OK
Deleted Key
e631925f-affb-457e-886d-57cb2a5f565b

 step 3 - sleep 30 seconds
$ sleep 30

 step 4 - create a key material
$ KEY_MATERIAL=$(openssl rand -base64 32)

$ echo $KEY_MATERIAL

lZM/guRnn/VklwRBoNOP/AUdCtpDNSo3+xXXhwrnO7c=

 step 5 - this CLI request fails because you can only restore keys
 that were imported (created with a key material or an import token)
$ ibmcloud kp key restore $KEY_ID -i $KP_INSTANCE_ID --key-material $KEY_MATERIAL

Restoring key: 'e631925f-affb-457e-886d-57cb2a5f565b', in instance: 'a192d603-0b8d-452f-aac3-f9e1f95e7411'...
FAILED
kp.Error:
correlation_id='6d000f60-47f2-4a49-ba72-f02a8efa2945',
msg='Bad Request:
Key could not be restored.
Please see reasons for more details.',
reasons='[KEY_IMPT_REQ_ERR:
Only imported keys may be restored. -
FOR_MORE_INFO_REFER: https://cloud.ibm.com/apidocs/key-protect]'

 step 5 - this API request fails because you can only restore keys