vania-janet/multiturn-rag-retrieval-data huggingface dataset:
You can import your CRK to a key management service (KMS) instance or instruct the KMS to generate one for you. Root keys are rotated in your KMS instance.

When you rotate a root key, a new version of the key is created by generating or importing new cryptographic key material. The old root key is retired, which means its key material remains available for decrypting existing volumes, but not available for encrypting new ones. New resources are protected by the latest key. For more information, see [How key rotation works](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-key-rotationvpc-key-rotation-function).





 Am I charged for using customer-managed encryption? 

You are not charged extra for creating volumes with customer-managed encryption. However, setting up a Key Protect or Hyper Protect Crypto Services instance to import, create, and manage your root keys is not without cost. Contact your IBM customer service representative for details.





 What's the difference between using Key Protect as my KMS compared to Hyper Protect Crypto Services? When would I use one over the other? 

Both key management systems provide you complete control over your data, managed by your root keys. Key Protect is a multi-tenant KMS where you can import or create your root keys and securely manage them. Hyper Protect Crypto Services is a single-tenant KMS and hardware security module (HSM) that is controlled by you, which offers the highest level of security. For more information about these key management services, see [Supported key management services for customer-managed encryption](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-aboutkms-for-byok).





 Can I convert my volume from provider-managed encryption to customer-managed encryption? 

No, after you provision a volume and specify the encryption type, you can't change it.







 Is there a way to copy the block storage volume to a different zone? 

No. You can't copy the storage volume to a different zone.
Customer-managed encrypted resources such as Block Storage for VPC volumes use your root key (CRK) as the root-of-trust key that encrypts a LUKS passphrase that encrypts a master key that's protecting the volume. You can import your CRK to a key management service (KMS) instance or instruct the KMS to generate one for you. Root keys are rotated in your KMS instance.

When you rotate a root key, a new version of the key is created by generating or importing new cryptographic key material. The old root key is retired, which means its key material remains available for decrypting existing volumes, but not available for encrypting new ones. New resources are protected by the latest key. For more information, see [How key rotation works](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-key-rotationvpc-key-rotation-function).
* Am I charged for using customer-managed encryption?

 Am I charged for using customer-managed encryption? 

You are not charged extra for creating volumes with customer-managed encryption. However, setting up a Key Protect or Hyper Protect Crypto Services instance to import, create, and manage your root keys is not without cost. Contact your IBM customer service representative for details.
* What's the difference between using Key Protect as my KMS compared to Hyper Protect Crypto Services? When would I use one over the other?

 What's the difference between using Key Protect as my KMS compared to Hyper Protect Crypto Services? When would I use one over the other? 

Both key management systems provide you complete control over your data, managed by your root keys. Key Protect is a multi-tenant KMS where you can import or create your root keys and securely manage them. Hyper Protect Crypto Services is a single-tenant KMS and hardware security module (HSM) that is controlled by you, which offers the highest level of security.
ibmc-vpc-file-retain-5iops-tier vpc.file.csi.ibm.io
ibmc-vpc-file-custom vpc.file.csi.ibm.io







 Updating the File Storage for VPC add-on 



1. Disable the add-on.

ibmcloud ks cluster addon disable vpc-file-csi-driver --version VERSION
2. Enable the newer version of the add-on.The add-on might take a few minutes to become ready.

ibmcloud ks cluster addon enable vpc-file-csi-driver --version VERSION







 Understanding your storage removal options 

Removing persistent storage from your IBM Cloud account varies depending on how you provisioned the storage and what components you already removed.

Is my persistent storage deleted when I delete my cluster?
: During cluster deletion, you have the option to remove your persistent storage. However, depending on how your storage was provisioned, the removal of your storage might not include all storage components.

If you [dynamically provisioned](https://cloud.ibm.com/docs/containers?topic=containers-kube_conceptsdynamic_provisioning) storage with a storage class that sets reclaimPolicy: Delete, your PVC, PV, and the storage instance are automatically deleted when you delete the cluster. For storage that was [statically provisioned](https://cloud.ibm.com/docs/containers?topic=containers-kube_conceptsstatic_provisioning), VPC Block Storage, or storage that you provisioned with a storage class that sets reclaimPolicy: Retain, the PVC and the PV are removed when you delete the cluster, but your storage instance and your data remain. You are still charged for your storage instance. Also, if you deleted your cluster in an unhealthy state, the storage might still exist even if you chose to remove it.

How do I delete the storage when I want to keep my cluster?
: When you dynamically provisioned the storage with a storage class that sets reclaimPolicy: Delete, you can remove the PVC to start the deletion process of your persistent storage.
kms.secrets.list List keys 
 kms.secrets-key-versions.list List all the versions of a key 
 kms.secrets.wrap Wrap a key 
 kms.secrets.patch Patch a key 
 kms.secrets.purge Purge a key 
 kms.secrets.read Retrieve all key information 
 kms.secrets-metadata.read Retrieve key metadata (excluding key payload, if applicable) 
 kms.secrets.restore Restore a key 
 kms.secrets.rewrap Rewrap a key 
 kms.secrets.rotate Rotate a key 
 kms.secrets.setkeyfordeletion Authorize deletion for a key with Dual Authorization policy 
 kms.secrets.unsetkeyfordeletion Cancel deletion for a key with Dual Authorization policy 
 kms.secrets.unwrap Unwrap a key 







 Key Ring events 

The following table lists the key ring actions that generate an event:



Table 3. Key Ring actions

 Action Description 

 kms.key-rings.create Create a key ring 
 kms.key-rings.delete Delete a key ring 
 kms.key-rings.list List key rings in an instance 
 kms.key-rings.request Invalid key ring request 







 Policy events 

The following table lists the policy actions that generate an event:



Table 4. Policy actions

 Action Description 

 kms.policies.read List key policies 
 kms.policies.write Set key policies 
 kms.instance-policies.read List instance policies 
 kms.instance-policies.write Set instance policies 
 kms.policies.default Invalid policy request event 
 kms.instance-policies.request Invalid policy request event 







 Import token events 

The following table lists the import token actions that generate an event:



Table 5. Import token actions

 Action Description 

 kms.import-token.create Create an import token 
 kms.import-token.read Retrieve an import token 
 kms.import-token.request Invalid import token request event 







 Registration events 

The corresponding actions to both list registration for any key, or list registration for a specific key generate this event.
* Decide whether importing your own HSM root key or generating a root key by the KMS is preferable. If you want to set up a rotation policy for automatic key rotation, you must use KMS-generated root keys.
* See what happens to your [root key state](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managingbyok-root-key-states) when you take certain actions, such as disabling the key.
* Decide when the [disabling](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managingbyok-disable-root-keys) or [deletion](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managingbyok-delete-root-keys) of a root key is necessary. When you rotate keys, the former key remains active, and is still used to decrypt existing resources. Take precautions when you disable or delete root keys.
* Enable a key that was disabled or [restore a deleted key](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managingbyok-restore-root-key).
* Decide whether you might want to make your data temporarily inaccessible by [removing service authorization](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managinginstance-byok-inaccessible-data).
* Review the [Activity Tracker](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managingbyok-key-rotation-activity-tracker-events) to verify events as you manage the lifecycle of your keys.





 View root key registrations 

Block Storage for VPC volumes, snapshots, File Storage for VPC shares, and custom images that are encrypted with your key are registered against the root key in the key management service (Key Protect or Hyper Protect Crypto Services). By viewing the registration, you can map your resources to their associated encryption keys.
* Decide whether importing your own HSM root key or generating a root key by the KMS is preferable. If you want to set up a rotation policy for automatic key rotation, you must use KMS-generated root keys.
* See what happens to your [root key state](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managing&interface=uibyok-root-key-states) when you take certain actions, such as disabling the key.
* Decide when the [disabling](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managing&interface=uibyok-disable-root-keys) or [deletion](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managing&interface=uibyok-delete-root-keys) of a root key is necessary. When you rotate keys, the former key remains active, and is still used to decrypt existing resources. Take precautions when you disable or delete root keys.
* Enable a key that was disabled or [restore a deleted key](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managing&interface=uibyok-restore-root-key).
* Decide whether you might want to make your data temporarily inaccessible by [removing service authorization](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managing&interface=uiinstance-byok-inaccessible-data).
* Review the [Activity Tracker](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managing&interface=uibyok-key-rotation-activity-tracker-events) to verify events as you manage the lifecycle of your keys.





 View root key registrations
If the given SSH key is not present, create the SSH key in the current region.
2. While configuring multiple SSH keys, ensure that there is no white space added before or after the SSH key names.
3. If you are using multiple SSH keys, check whether a comma (,) is used as a delimiter between the SSH keys and that there is no white space added before or after the SSH key.







 Why am I getting an error when I try to run the Spectrum Symphony VaR simulation? 

 What’s happening 

You are getting a Failed to Login error when you try to run the [Spectrum Symphony Value at Risk (VaR) simulation](https://www.ibm.com/docs/en/spectrum-symphony/7.3.1?topic=started-sample-value-risk-var-simulation).

 Why it’s happening 

It is possible that you are hitting a limitation with the VaR simulation, which requires that the cluster prefix be no longer than 10 characters and that the Symphony primary host hostname is fewer than 20 characters.

 How to fix it 

Ensure that your cluster prefix is no longer than 10 characters.





 Worker nodes are released when workload is in progress 

The symA requester might release a compute node virtual machine while the workload is still in progress. This happens when the property return_idle_only is set to true and the immediate return policy symA is unable to get the allocation for this host, and therefore assumes it has no allocation. This issue happens if there are only a few tasks remaining for the monitored applications. For more information, see [Updating idle time before worker nodes are removed](https://cloud.ibm.com/docs/hpc-spectrum-symphony?topic=hpc-spectrum-symphony-update-idle-time&interface=api).





 Incorrect provider configuration values do not result in an error 

When updating the IBM Cloud provider configuration from the Symphony GUI, at Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) Resources > Cloud > Configuration, the values set in the configuration are not validated.
To use these images in any other Red Hat OpenShift projects or other IBM Cloud accounts, [you have the option to copy or create your own image pull secrets](https://cloud.ibm.com/docs/openshift?topic=openshift-registryother).

Can I pull images from a different IBM Cloud account?
: Yes, create an API key in the IBM Cloud account that you want to use. Then, in each project of each cluster that you want to pull images from the IBM Cloud account, create a secret that holds the API key. For more information, [follow along with this example that uses an authorized service ID API key](https://cloud.ibm.com/docs/openshift?topic=openshift-registryother_registry_accounts).

To use a non-IBM Cloud registry such as Docker, see [Accessing images that are stored in other private registries](https://cloud.ibm.com/docs/openshift?topic=openshift-registryprivate_images).

Does the API key need to be for a service ID? What happens if I reach the limit of service IDs for my account?
: The default cluster setup creates a service ID to store IBM Cloud IAM API key credentials in the image pull secret. However, you can also create an API key for an individual user and store those credentials in an image pull secret. If you reach the [IAM limit for service IDs](https://cloud.ibm.com/docs/account?topic=account-known-issuesiam_limits), your cluster is created without the service ID and image pull secret and can't pull images from the icr.io registry domains by default. You must [create your own image pull secret](https://cloud.ibm.com/docs/openshift?topic=openshift-registryother_registry_accounts), but by using an API key for an individual user such as a functional ID, not an IBM Cloud IAM service ID.

I see image pull secrets for the regional registry domains and all registry domains. Which one do I use?
* What happens when I update an instance template?

When the instance template that is used by an instance group is updated, all future instances that are created for the instance group use the new instance template. No changes are made to existing instances in the instance group.
* Can I update all instances in an instance group with a new instance template?

You can update all of the instances in an instance group by deleting the existing memberships and applying a new instance template. For more information, see [Pausing auto scale to apply a new instance template](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-instance-grouppausing-for-maint).
* How do I add health checks?

You can add health checking by associating a load balancer when you create your instance group. For more information about load balancers, see the following topics:



* [About IBM Cloud Application Load Balancer for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-load-balancers-about).
* [About IBM Cloud Network Load Balancer for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-network-load-balancers).



For more information about creating a load balancer, a load balancer pool, and configuring health checks, see the following topics:



* [Creating an IBM Cloud Application Load Balancer for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-load-balancers)
* [Creating an IBM Cloud Network Load Balancer for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-nlb-ui-creating-network-load-balancer)
* [Creating an IBM Cloud Private Network Load Balancer with routing mode for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-nlb-vnf)
Before creating the bucket for use with Key Protect, review the [relevant guidance around availability and disaster recovery](https://cloud.ibm.com/docs/key-protect?key-protect-ha-dr).

Note that managed encryption for a Cross Region bucket must use a root key from a Key Protect instance in the nearest [high-availability location](https://cloud.ibm.com/docs/key-protect?topic=key-protect-ha-dr) (us-south, eu-de, or jp-tok).





 Create or add a key in Key Protect 

Navigate to your instance of Key Protect and [generate or enter a root key](https://cloud.ibm.com/docs/services/key-protect?topic=key-protect-getting-started-tutorial).





 Grant service authorization 

Authorize Key Protect for use with IBM COS:



1. Open your IBM Cloud dashboard.
2. From the menu bar, click Manage > Access (IAM).
3. In the side navigation, click Authorizations.
4. Click Create authorization.
5. In the Source service menu, select Cloud Object Storage.
6. In the Source service instance menu, select the service instance to authorize.
7. In the Target service menu, select IBM Key Protect.

Zoom

![Grant service authorization](https://cloud.ibm.com/docs-content/v1/content/63322f2f3a72050206eb05ba7f590fdcb741105c/cloud-object-storage/images/kp-grant-auth.png)

Figure 1: Grant service authorization for Key Protect.
8. In the Target service instance menu, select the service instance to authorize. The additional fields may be left blank.
9. Enable the Reader role.
10. Click Authorize.







 Create a bucket 

When your key exists in Key Protect and you authorized the service for use with IBM COS, associate the key with a new bucket:



1. Navigate to your instance of Object Storage.
For more information, see [Configure IBM Cloud Function Channel](https://docs.sysdig.com/en/configure-ibm-cloud-functions-channel.html).
* For a Webhook notification channel, add the Webhook URL. Note: When an alert is triggered, the notification is sent as a POST in JSON format to your webhook endpoint. For more information, see [Configuring a Webhook channel](https://docs.sysdig.com/en/configure-a-webhook-channel.html). For example, IBM Cloud Monitoringcan be integrated with ServiceNow using a custom webhook. To learn about configuring IBM Cloud Monitoring with ServiceNow, see [Configure ServiceNow](https://docs.sysdig.com/en/configure-servicenow.html).
* For a VictorOps notification channel, add the API Key and the Routing Key.
* For an OpsGenie notification channel, add the OpsGenie API key. Notice that you must configure in OpsGenie the integration with IBM Cloud Monitoring. For more information, see [Add IBM Cloud Monitoring Integration in Opsgenie](https://docs.opsgenie.com/v1.0/docs/sysdig-cloud-integration).
* For a Microsoft Teams notification channel, add the Microsoft Teams URL.
* For a PagerDuty notification channel, first you must authorize IBM Cloud Monitoring to integrate with your account. When you select PagerDuty, a wizard to configure the integration with IBM Cloud Monitoring opens. Click either Authorize Integration or Sign In Using Your Identity Provider to authorize PagerDuty. Choose an existing service or set up a new service for IBM Cloud Monitoring notifications, then click Finish Integration. Select the escalation policy to use for IBM Cloud Monitoring incidents. Then, on the Notifications tab, confirm your PagerDuty account, your service name, and the service key.
The API key impersonates, or stores the credentials of, a user with access to the infrastructure and other services. Red Hat OpenShift on IBM Cloud uses the API key to order resources in the service, such as new worker nodes or VLANs in IBM Cloud infrastructure.



 What is the API key used for? 

The API key is used to authorize underlying actions in the following IBM Cloud services.



* Infrastructure, such as classic or VPC compute, networking, and storage resources for your cluster.
* Key Protect or Hyper Protect Crypto Services, if you [enable a key management service provider](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionkms) in your cluster.
* Secrets Manager, for managing the Ingress certificates for your cluster.
* Container Registry, for setting up default access to pull images from the registry to your cluster.
* Log Analysis, if you [enable the logging service](https://cloud.ibm.com/docs/containers?topic=containers-health).
* Monitoring, if you [enable the monitoring service](https://cloud.ibm.com/docs/containers?topic=containers-health).
* Activity Tracker, for sending audit events from your cluster.







 How many API keys do I need? 

You have a different API key for each region and resource group where you use Red Hat OpenShift on IBM Cloud. To check if an API key is already set up for the region and resource group, run the following command.

ibmcloud oc api-key info --cluster <cluster_name_or_ID>





 How do I set up the API key? 

To enable all users to access the infrastructure portfolio or other services, the user whose credentials are stored in the [API key must have the correct permissions](https://cloud.ibm.com/docs/openshift?topic=openshift-access-credsowner_permissions).
* How do I place a host in maintenance mode?

To place a host from a VMware vSAN cluster in maintenance mode, complete the following steps:



1. Review the three options provided in the VMware vSphere Web Client: Ensure accessibility, Full data migration, and No data migration.
2. Select the Ensure accessibility option.
3. If failures occur, complete the process by using the Full data migration option. For more information, see [Place a member of vSAN cluster in maintenance mode](https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.virtualsan.doc/GUID-521EA4BC-E411-47D4-899A-5E0264469866.html).
4. If you experience problems, [contact IBM support](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-trbl_support) for assistance.



* Can I add static routes on my ESXi servers to mount storage from other locations?

You can add static routes for storage but you must do it with extreme care. Otherwise, the existing shares might become unmounted.

Adding static routes for vMotion is not supported. Changes in vMotion subnet configuration might result in failure in the IBM Cloud for VMware Solutions functions.
* What happens if the license key you provided is not correct?

All license keys that you provide are validated to ensure that the following conditions are met:



* They are correct for the corresponding VMware components.
* They meet the minimum edition and CPU requirements of the VMware components.



If the validation of any license key fails, you get a notification and you cannot proceed with the instance order.
* Can you provide a license key with more than 8 CPUs?

Yes. For each VMware component, one license per CPU is required. Currently, all VMware vCenter Server® servers have two CPUs. Therefore, two licenses are required for each server.