vania-janet/multiturn-rag-retrieval-data huggingface dataset:
These examples show help for some sub-commands.



* ibmcloud kp import-token create -h
* ibmcloud kp key delete -h







 kp import-token create 

[Create an import token](https://cloud.ibm.com/docs/key-protect?topic=key-protect-create-import-tokens) that you can use to encrypt and import a root key to the Key Protect instance. By default, the import token expires after 10 minutes (600 seconds).

ibmcloud kp import-token create
-i, --instance-id INSTANCE_ID
[-e, --expiration EXPIRATION_TIME_SECONDS]
[-m, --max-retrievals MAX_RETRIEVALS]



 Example 

This example creates a import token. The import token consists of a nonce and a public key.

A nonce is an arbitrary number that can be used just once in a cryptographic communication.

 create an import token that expires in 5 minutes and allows 3 retrievals
$ ibmcloud kp import-token create --expiration 300 --max-retrievals 3

Created Expires Max Retrievals Remaining Retrievals
2020-05-04 19:12:07 +0000 UTC 2020-05-04 19:17:07 +0000 UTC 3 3

 show the created token
$ ibmcloud kp import-token show

{
"nonce": "8rf2ldP/zWm1Tjrb",
"payload":
"LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0t ...<redacted>... QyBLRVktLS0tLQo="
}





 Required parameters 

-i, --instance-id
: The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command.

$ export KP_INSTANCE_ID=INSTANCE_ID





 Optional parameters 

-e, --expiration
Created Expires Max Retrievals Remaining Retrievals
2020-06-18 12:30:54 +0000 UTC 2020-06-18 12:35:54 +0000 UTC 10 10

 extract the nonce that was created by the "kp import-token create" command
$ NONCE=$(ibmcloud kp import-token show | jq -r '.["nonce"]')

$ echo $NONCE

N3x8F0ihAZ51nj6M

 extract the public key that was created by the "kp import-token create" command
$ PUBLIC_KEY=$(ibmcloud kp import-token show | jq -r '.["payload"]')

$ echo $PUBLIC_KEY

LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0t ...<redacted>... QyBLRVktLS0tLQo=

 encrypt the key material using the public key
$ ibmcloud kp import-token key-encrypt -k $KEY_MATERIAL -p $PUBLIC_KEY

Encrypted Key
Ch7hcsT1EOfSdghjOHKAemBZuzDoqJoH ...<redacted>... F4p/mkGT/EQJS5o=

 capture the encrypted key material
$ ENCRYPTED_KEY=Ch7hcsT1EOfSdghjOHKAemBZuzDoqJoH ...<redacted>... F4p/mkGT/EQJS5o=

 encrypt the nonce
$ ibmcloud kp import-token nonce-encrypt -k $KEY_MATERIAL -n $NONCE

Encrypted Nonce IV
nrrCczvYXvc6T7J2G+EOLjHZO1cpPyu/nhsIlA== N6oLJnUqaKF3v5Sd

 capture the encrypted nonce and the initialization vector (IV)
If the service key is compromised or you have a policy to renew it after a number of days, you can generate a new key and delete the old one.

To renew the service key for an IBM Cloud Activity Tracker instance by using the IBM Cloud Activity Tracker Web UI, complete the following steps:



1. [Launch the IBM Cloud Activity Tracker web UI](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-launch).
2. Click the Settings icon ![Settings icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/images/admin.png) > Organization.
3. Select API keys.

You can see the service keys that are enabled.
4. Select Generate Service Key.

A new key is added to the list.
5. Delete the old service key. Click X next to the service key to be deleted.



After you reset the service key, you must update any operation processes where the service key is used with the new value.







 Managing a service key by using the CLI 

You can create and view service keys by using the IBM Cloud CLI.



 Creating a service key by using the CLI 

Only a single auditing service key can be created by using the CLI. Using these commands to create a service key where one already exists will not create a new key. If you need to create more than one auditing service key, use the [UI](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-service_keysservice_keys_ui) or use the [API]](service_keys_api_create).

To create an auditing service key for a auditing instance through the command line, complete the following steps:



1. [Pre-requisite] [Install the IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli).
* The requestData.initialValue.keyRingId field includes the ID of the key ring that the key previously belonged to.
* The requestData.newValue.keyRingId field includes the ID of the key ring that the key belongs to.







 List key versions 

The following field includes extra information:



* The responseData.totalResources field includes the total number of key versions returned in the response.







 Set or unset key for deletion 

The following fields include extra information:



* The responseData.initialValue.authID field includes the initiator ID of the person who set the dual authorization policy.
* The responseData.initialValue.authExpiration field includes the expiration date for the dual authorization policy.
* The responseData.newValue.authID field includes the initiator ID of the person who set the dual authorization policy.
* The responseData.newValue.authExpiration field includes the expiration date for the dual authorization policy.



initialValue is the initiatorID of the person who last set the dual authorization policy and newValue is the new initiatorID of the person who set the dual authorization policy.







 Policy events 



 Allowed network policies 

The following fields include extra information:



* The requestData.initialValue.policyAllowedNetworkEnabled field includes if your allowed network policy was previously enabled or disabled.
* The requestData.initialValue.policyAllowedNetworkAttribute field includes if your allowed network policy was previously only for public networks or both public and private networks.
* The requestData.newValue.policyAllowedNetworkEnabled field includes if your allowed network policy is enabled or disabled.
* The requestData.newValue.policyAllowedNetworkAttribute field includes if your allowed network policy is only for public networks or both public and private networks.







 Dual auth delete policies 

The following fields include extra information:



* The requestData.initialValue.policyDualAuthDeleteEnabled field includes if your dual auth delete policy was previously enabled or disabled.
Alias cannot contain spaces or special characters other than underscores and dashes. A maximum of 5 aliases are allowed per key.
* -d, --dual-auth-delete-policy-enabled



Enables the dual auth delete policy for a key.



* -k, --key-material

If you generated a key then this is the base64-encoded key material that you store and manage in the service.

Root keys must be 16, 24, or 32 bytes long; corresponding to 128, 192, or 256 bits. The key must be base64-encoded.

Standard keys can be up to 7,500 bytes in size. The key must be base64-encoded.

If you are creating a key using an import token then this is the encrypted key from the kp import-token key-encrypt process.

To generate a new key, omit the -k, --key-material parameter.
* -n, --encrypted-nonce

Used with import tokens. The encrypted nonce value that verifies your request to import a key to Key Protect. This value must be encrypted by using the key material that you import into the service. See ibmcloud kp import-token --help.

To retrieve a nonce, use ibmcloud kp import-token show. Then, encrypt the value by running ibmcloud kp import-token nonce-encrypt.
* -o, --output

Set the CLI output format. By default, all commands print in table format. To change the output format to JSON, use --output json.
* -m, --rotation-interval-month



Specify the rotation time interval (in months) for a key. The default value is -1.



* -s, --standard-key

Set the parameter only if you want to create a [standard key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryptionkey-types).
"nonce": "8rf2ldP/zWm1Tjrb",
"payload":
"LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0t ...<redacted>... QyBLRVktLS0tLQo="
}





 Required parameters 



* -i, --instance-id

The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.







 Optional parameters 



* -e, --expiration

Specify an expiration time (in seconds) for an import token. This value determines how long the import token and its associated public key remain valid for operations.

The minimum value is 300 seconds (5 minutes), and the maximum value is 86400 seconds (24 hours). The default value is 600 seconds (10 minutes).
* -m, --max-retrievals

Set the use count for the import token. This value determines the number of times that the import token can be retrieved within its expiration time before it is no longer accessible. The default value is 1.









 kp import-token key-encrypt 

Encrypt the key material that you import into Key Protect by using the public key that's associated with your Key Protect instance.

Then, provide the retrieved encrypted key when you run ibmcloud kp key create to import the key to the service.

ibmcloud kp import-token key-encrypt
-i, --instance-id INSTANCE_ID
-k, --key KEY_MATERIAL
-p, --pubkey PUBLIC_KEY
[-a, --hash HASH_ALGORITHM]



 Example 

This example encrypts a key material using the public key created by kp import-token create.

 create an import token that expires in 5 minutes and allows 10 retrievals
$ ibmcloud kp import-token create -e 300 -m 10

 create a random, base64-encoded, 32-byte key material
OpenVPN Operator image v1.4.5 v1.4.6 Update base image to version v1.22.0 to resolve CVEs. 
 Red Hat OpenShift on IBM Cloud. 4.6.57 4.6.58 See the [Red Hat OpenShift on IBM Cloud release notes](https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.htmlocp-4-6-58). 
 Red Hat OpenShift on IBM Cloud Control Plane Operator v4.6.0-20220509 v4.6.0-20220614 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.6.0%2B20220614). 
 Red Hat OpenShift on IBM Cloud Metrics Server and toolkit v4.6.0-20220509 v4.6.0-20220614 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.6.0%2B20220614). 







 Change log for worker node fix pack 4.6.58_1587_openshift, released 20 June 2022 

The following table shows the changes that are in the worker node fix pack 4.6.58_1587_openshift. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 4.6.58_1585_openshift

 Component Previous Current Description 

 RHEL 7 Packages N/A N/A Worker node package updates for [CVE-2022-1271](https://nvd.nist.gov/vuln/detail/CVE-2022-1271).
OpenVPN Operator image v1.4.5 v1.4.6 Update base image to version v1.22.0 to resolve CVEs. 
 Red Hat OpenShift on IBM Cloud. 4.7.50 4.7.52 See the [Red Hat OpenShift on IBM Cloud release notes](https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.htmlocp-4-7-52). 
 Red Hat OpenShift on IBM Cloud Control Plane Operator v4.7.0-20220509 v4.7.0-20220614 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.7.0%2B20220614). 
 Red Hat OpenShift on IBM Cloud Metrics Server and toolkit v4.7.0-20220509 v4.7.0-20220614 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.7.0%2B20220614). 







 Change log for worker node fix pack 4.7.53_1568_openshift, released 20 June 2022 

The following table shows the changes that are in the worker node fix pack 4.7.53_1568_openshift. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 4.7.51_1566_openshift

 Component Previous Current Description 

 RHEL 7 Packages N/A N/A Worker node package updates for [CVE-2022-1271](https://nvd.nist.gov/vuln/detail/CVE-2022-1271).
Red Hat OpenShift Control Plane Operator v4.6.0-20210512 v4.7.0-20210512 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.7.0+20210512). 
 OpenVPN Operator image v1.3.1 v1.3.2 Updated ansible operator base image to version 1.7.2 to resolve CVEs and updated image to implement additional IBM security controls. 
 Red Hat OpenShift on IBM Cloud Metrics Server v4.6.0-20210512 v4.7.0-20210512 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.7.0+20210512). 
 Red Hat OpenShift on IBM Cloud toolkit 4.6.0+20210512 4.7.0+20210512 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.7.0+20210512).
OpenVPN Operator image v1.4.5 v1.4.6 Update base image to version v1.22.0 to resolve CVEs. 
 Red Hat OpenShift on IBM Cloud. 4.8.39 4.8.42 See the [Red Hat OpenShift on IBM Cloud release notes](https://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.htmlocp-4-8-42). 
 Red Hat OpenShift on IBM Cloud Control Plane Operator v4.8.0-20220509 v4.8.0-20220614 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.8.0%2B20220614). 
 Red Hat OpenShift on IBM Cloud Metrics Server and toolkit v4.8.0-20220509 v4.8.0-20220614 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.8.0%2B20220614). 







 Change log for worker node fix pack 4.8.42_1561_openshift, released 20 June 2022 

The following table shows the changes that are in the worker node fix pack 4.8.42_1561_openshift. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 4.8.42_1559_openshift

 Component Previous Current Description 

 RHEL 7 Packages N/A N/A Worker node package updates for [CVE-2022-1271](https://nvd.nist.gov/vuln/detail/CVE-2022-1271).
Red Hat OpenShift node N/A N/A N/A 







 Change log for worker node pack 3.11.570_1624_openshift, released 14 March 2022 



Changes since version 3.11.570_1623_openshift

 Component Previous Current Description 

 RHEL 7 Packages N/A N/A N/A 
 Red Hat OpenShift 3.11.570 3.11.634 See the [Red Hat OpenShift release notes](https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.htmlocp-3-11-634). 







 Change log for master fix pack 3.11.570_1623_openshift, released 3 March 2022 



Changes since version 3.11.570_1619_openshift

 Component Previous Current Description 

 Cluster health image v1.1.30 v1.1.32 Updated golang.org/x/crypto to v0.0.0-20220214200702-86341886e292. Adds fix for [CVE-2021-43565](https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-43565). Adds Golang dependency updates. 
 Key Management Service provider v1.0.22 v1.0.25 Updated golang.org/x/crypto to v0.0.0-20220214200702-86341886e292. Adds fix for [CVE-2021-43565](https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-43565). Adds Golang dependency updates. 
 IBM Cloud File Storage for Classic plug-in and monitor 404 405 Adds fix for [CVE-2021-3538](https://nvd.nist.gov/vuln/detail/CVE-2021-3538) and adds dependency updates. 







 Change log for worker node fix pack 3.11.570_1624_openshift, released 28 February 2022
: Red Hat OpenShift [4.8.28_1543_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_changelog_484828_1543), [4.7.41_1548_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_changelog_474741_1548), [4.6.53_1571_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_changelog_464653_1571), [3.11.570_1620_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_changelog_311311570_1620).

New! Worker node flavor reference
: View a list of all available worker node flavors by zone. For more information, see [VPC Gen 2 flavors](https://cloud.ibm.com/docs/openshift?topic=openshift-classic-flavors) or [Classic flavors](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-flavors).





 28 January 2022 

New! Troubleshooting the Red Hat OpenShift console.
: If you receive a 500 error when trying to log in to your Red Hat OpenShift cluster via oc login or the console, you can resolve this issue by running the cluster config command. For more information, see [500 error when trying to log in to a Red Hat OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-ts_clis500_error_oc_login).
: You must synchronize the IAM user information initially to fix this error.
Red Hat OpenShift Control Plane Operator v4.8.0-20211109 v4.8.0-20211201 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.8.0+20211201). 
 OpenVPN Operator image v1.3.8 v1.3.9 Updated ansible operator base image to version v1.14.0 to resolve CVEs. 
 Portieris admission controller v0.12.0 v0.12.1 See the [Portieris admission controller release notes](https://github.com/IBM/portieris/releases/tag/v0.12.1). 
 Red Hat OpenShift on IBM Cloud Metrics Server v4.8.0-20211109 v4.8.0-20211201 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.8.0+20211201). 
 Red Hat OpenShift on IBM Cloud toolkit 4.8.0+20211109 4.8.0+20211201 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.8.0+20211201). 







 Change log for worker node fix pack 4.8.22_1538_openshift, released 6 December 2021 

The following table shows the changes that are in the worker node fix pack patch update 4.8.22_1538_openshift. Worker node patch updates can be applied by updating, reloading (in classic infrastructure), or replacing (in VPC infrastructure) the worker node.



Changes since version 4.8.20_1536_openshift

 Component Previous Current Description 

 RHEL 7 Packages 3.10.0-1160.45 3.10.0-1160.49 Updated worker node images and kernel with package updates.
Default service settings for Red Hat OpenShift components 

Review the default settings for Red Hat OpenShift components in your Red Hat® OpenShift® on IBM Cloud® clusters.



 Feature gates 

Review the feature gates that are applied to all master and worker node components by default in Red Hat OpenShift on IBM Cloud clusters. These feature gates differ from the ones that are set up in community distributions. In clusters that run version 4.10 or earlier, the IBM Cloud provider version enables Red Hat OpenShift APIs and features that are at beta. In version 4.11 and later, most new beta features are disabled by default. Red Hat OpenShift alpha features, which are subject to change, are disabled in all versions.

4.13
: RetroactiveDefaultStorageClass=false

4.12
: Community feature gates applied.

4.11
: Community feature gates applied.

4.10
: ServiceLBNodePortControl=false

4.9
: ServiceLBNodePortControl=false

4.8
: ServiceLoadBalancerClass=true
: LegacyNodeRoleBehavior=false
: DownwardAPIHugePages=true

4.7
: LegacyNodeRoleBehavior=false
: RemoveSelfLink=false

4.6
: APIPriorityAndFairness=true
: LegacyNodeRoleBehavior=false
: SCTPSupport=false
: ServiceAppProtocol=false

4.5
: ExperimentalCriticalPodAnnotation=true
: LocalStorageCapacityIsolation=false

4.4
: ExperimentalCriticalPodAnnotation=true
: LocalStorageCapacityIsolation=false

4.3
: ExperimentalCriticalPodAnnotation=true
: LocalStorageCapacityIsolation=false





 Global settings 

Because Red Hat OpenShift on IBM Cloud is a managed service, many OpenShift Container Platform global settings are set up for you.
Click Information for formatting specifics.
6. Enter a name, for example, sdh.com for Domain. Domain is the identification string that defines administrative control within the internet. Click Information for formatting specifics.
7. Select your Placement group, default is None.
8. Select the Location of the data center (zone) where you set up your Red Hat OpenShift on IBM Cloud cluster.
9. Click All profiles and select B1.4x16, which is the minimum requirement.
10. Provide your SSH key for SSH Keys or leave the default None. For more information on SSH keys, see [About SSH keys](https://cloud.ibm.com/docs/ssh-keys?topic=ssh-keys-about-ssh-keys).
11. Select Red Hat 7xMinimal (64 bit) - HVM for Image.
12. Leave the default values for Attached storage disks and Network interface.
13. Click Third-Party Service Agreements and click Create.



Your Red Hat OpenShift on IBM Cloud cluster and your virtual server should be available in about 15 minutes.





 Preparing the jump host 

Prepare your jump host to connect to the Red Hat® OpenShift® on IBM Cloud® cluster that you created to host SAP Data Hub.



 Before you begin 

It's recommended you become familiar with the [Managing your IBM Cloud accounts](https://cloud.ibm.com/docs/account?topic=account-accounts). Your IBM Cloud user ID must have the cluster Administrator role.





 Install the IBM Cloud and Red Hat OpenShift on IBM Cloud client Command Line Interfaces (CLI) 

Use the following commands to download and install the CLIs you use to configure the connection between your Red Hat OpenShift on IBM Cloud cluster and your jump host.



1. Login to the jump host as root and install the IBM Cloud CLI ibmcloud.

curl -sL https://ibm.biz/idt-installer | bash
Accessing your Red Hat OpenShift API Satellite link endpoints 

By default, your Red Hat OpenShift on IBM Cloud API Satellite link endpoints are protected to accept traffic from only the IBM Cloud control plane. To access them from other sources, you must configure a source list for your endpoint. You can configure a source list from the console only.



1.  From the [Satellite Locations dashboard](https://cloud.ibm.com/satellite/locations), click the name of your location.
2.  From the User endpoints tab, click the name of your endpoint.
3.  In the Access control list section, click Create rule.
4.  Enter a rule name and IP addresses of the clients that will be allowed to connect to the endpoint, and click Add.

The value for IP addresses can be a single IP address, a CIDR block, or a comma-separated list. The value must be fully contained in the following CIDRs: 10.0.0.0/8, 161.26.0.0/16, 166.8.0.0/14, 172.16.0.0/12.
5.  Use the toggle to enable or disable the rule. After you enable a rule, network traffic to the destination through the endpoint is permitted only from clients that use an IP address in the range that you specified in the rule. Network traffic from other clients that is sent to the destination resource through the endpoint is blocked.
6.  Repeat these steps for any clients that you want to grant access to.



You can find the Red Hat OpenShift API Satellite link endpoint by looking in the IBM Cloud Log Analysis logs for your Satellite location. To open these logs, click Open Dashboard under Logging for Link. You can set up a filter in the monitoring instance to filter out the value you need. For example, search for flowlog: rejected by in the log and you will see an IP. Add a filter with a subnet matching that IP for your endpoint. This IP is logged when you use oc commands via link endpoint on the Red Hat OpenShift API. For more information, see [Logging for Satellite](https://cloud.ibm.com/docs/satellite?topic=satellite-health).