vania-janet/multiturn-rag-retrieval-data huggingface dataset:
[Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) 









 Enabling notifications 

Events that are generated by an instance of the Secrets Manager service can be forwarded to an Event Notifications service instance that is available in the same account. You can configure only one Secrets Manager instance to one Event Notifications service instance. To get started, you need:



* [Manager service access](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam) on the Secrets Manager service.
* [Manager service access](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-service-access-management) on the Event Notifications service. To view an existing Event Notifications service instance in your account, you also need Viewer platform access or higher.





 Connecting to Event Notifications in the UI 

Before you can enable notifications for Secrets Manager, be sure that you have an [Event Notifications service instance](https://cloud.ibm.com/catalog/services/event-notifications) that is in the same account as your Secrets Manager instance. Then, you can use the Settings > Event Notifications section in the Secrets Manager UI to connect the services.

Zoom

![The image shows the Event Notifications screen in the Secrets Manager UI.](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/secrets-manager/images/event-notifications.svg)

Figure 1.
To prevent malicious use of an API, you can use API keys to track and control how that API is used. For more information about API keys, see [Understanding API keys](https://cloud.ibm.com/docs/account?topic=account-manapikey).

Complete the following steps to update the API key for use with the Delivery Pipeline Private Worker tool integration:



1. From the IBM Cloud console, click the menu icon ![hamburger icon](https://cloud.ibm.com/docs-content/v1/content/562806c0b18119f4d21cb66f5ae6d051634b4a16/ContinuousDelivery/images/icon_hamburger.svg) and select DevOps. On the Toolchains page, click a toolchain to open its Overview page. Alternatively, on your app's Overview page, on the Continuous delivery card, click View toolchain.
2. On the Delivery pipelines card, go to the Delivery Pipeline Private Worker that you want to modify, click the menu, and then click Configure to access the configuration options.
3. Specify your new API key. It is recommended that you do not use the API key directly. Instead, use a Secrets Manager to store the API key and add a reference to that stored key in your private worker configuration.
4. Click Save Integration.



You can revoke access to a private worker by deleting the corresponding API key. Due to caching policies and invalidation, it might take up to 60 minutes for a deleted API key to prevent jobs from running. For more information about deleting an API key, see [Deleting an API key for a service ID](https://cloud.ibm.com/docs/account?topic=account-serviceidapikeysdelete_service_key).







 Deleting a Delivery Pipeline Private Worker 

Complete the following steps to delete a private worker:



1. Delete the private worker from the pool of workers.
2. Delete the private worker from your Kubernetes cluster.
[hamburger icon](https://cloud.ibm.com/docs-content/v1/content/562806c0b18119f4d21cb66f5ae6d051634b4a16/ContinuousDelivery/images/icon_hamburger.svg) and select DevOps. On the Toolchains page, click the toolchain to open its Overview page. Alternatively, on your app's Overview page, on the Continuous Delivery card, click View toolchain. Then, click Overview.

a. Click Add tool.

b. In the Tool Integrations section, click Secrets Manager.
2. Specify a name for this instance of the Secrets Manager tool integration to use in your toolchain.
3. Choose to identify this instance by the service instance CRN.
4. Specify the CRN of the Secrets Manager service instance where your secrets are stored. This service instance can exist in a different account if your toolchain is [authorized to access secrets](https://cloud.ibm.com/docs/services/ContinuousDelivery?topic=ContinuousDelivery-secretsmanagersecretsmanager_authorize_secrets) in that account.
5. Click Create Integration.





 Applying secrets 

After you configure the Secrets Manager tool integration and [authorize your toolchain](https://cloud.ibm.com/docs/services/ContinuousDelivery?topic=ContinuousDelivery-secretsmanagerauthorizing-your-toolchain-to-access-secrets) to access secrets in that account, you can use it to apply secrets anywhere that they are required by the toolchain.

You can use either of the following methods to select a CRN secret for use in your toolchain:



* Copy the CRN of the secret from the Secrets Manager service instance and paste it into the edit box of secret field. The secret must reside in the Secrets Manager service instance that was configured when you added the Secrets Manager tool integration to your toolchain.
* Use the Secrets dialog.
[hamburger icon](https://cloud.ibm.com/docs-content/v1/content/562806c0b18119f4d21cb66f5ae6d051634b4a16/ContinuousDelivery/images/icon_hamburger.svg) and select DevOps. On the Toolchains page, click the toolchain to open its Overview page. Alternatively, on your app's Overview page, on the Continuous Delivery card, click View toolchain. Then, click Overview.

a. Click Add tool.

b. In the Tool Integrations section, click Secrets Manager.
2. Specify a name for this instance of the Secrets Manager tool integration to use in your toolchain.
3. Choose to identify this instance by the service instance CRN.
4. Specify the CRN of the Secrets Manager service instance where your secrets are stored. This service instance can exist in a different account if your toolchain is [authorized to access secrets](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-secretsmanagersecretsmanager_authorize_secrets) in that account.
5. Click Create Integration.





 Applying secrets 

After you configure the Secrets Manager tool integration and [authorize your toolchain](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-secretsmanagerauthorizing-your-toolchain-to-access-secrets) to access secrets in that account, you can use it to apply secrets anywhere that they are required by the toolchain.

You can use either of the following methods to select a CRN secret for use in your toolchain:



* Copy the CRN of the secret from the Secrets Manager service instance and paste it into the edit box of secret field. The secret must reside in the Secrets Manager service instance that was configured when you added the Secrets Manager tool integration to your toolchain.
* Use the Secrets dialog.
(https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-what-is-secret)[![carousel thumbnail](https://cloud.ibm.com/docs-content/v1/content/secrets-manager-cli-plugin//images/secure-manage-secrets-video-thumbnail.png)<br><br>Securely managing your cloud secrets with Secrets Manager](https://www.youtube.com/watch?v=rOp7aGyavnk)

 Latest updates 

[View more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-release-notes)20 September 2021 | Now available: Order domain-validated TLS certificates from Let's Encrypt

You can now use Secrets Manager to order Let's Encrypt certificates that you can deploy to your apps and services. Check the full release notes for details.

30 August 2021 | Now available: Certificate Manager to Secrets Manager migration scripts

Looking to migrate your certificates from Certificate Manager into Secrets Manager? Take advantage of migration scripts to start your transition.

20 June 2021 | Now available: Import your existing TLS certificates

You can now use Secrets Manager to import and manage certificates for your apps and service. This release also adds support for connecting to Secrets Manager from a Virtual Private Cloud (VPC) network. Check the full release notes for details.
ibmcloud ks nlb-dns secret regenerate --cluster <cluster_name_or_id> --nlb-subdomain <nlb_subdomain>
3. Verify that your default Ingress secrets regenerated. In the output, the CRN of the default Ingress secrets should contain secrets-manager.

It may take several minutes for your secrets to regenerate. During this process, the Status column in the output says regenerating and switches to created when the regeneration is complete.

ibmcloud ks ingress secret ls --cluster <cluster_name_or_id>

Example output.

Name Namespace CRN Expires On Domain Status Type
secret-11111aa1a1a11aa1111111-000 default crn:v1:bluemix:public:secrets-manager:us-south:a/1aa111aa1:secret:a111aa11-11a1 2022-12-21T19:52:29+0000 secret-11111aa1a1a.us-south.containers.appdomain.cloud created TLS
secret-22222aa2a2a22aa2222222-000 default crn:v1:bluemix:public:secrets-manager:us-south:a/2aa222aa2:secret:a222aa22-22a2 2022-12-21T19:52:29+0000 secret-22222aa2a2a.us-south.containers.appdomain.cloud created TLS











 Controlling access to your secrets with secret groups 

With Secrets Manager, you can use secret groups to control who has access to the secrets in your cluster. A secret group can be assigned to an IAM access group so that only select users or service IDs can access the secrets within the secret group. For more information, see [Organizing your secrets](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-secret-groups&interface=ui).





 Registering a Secrets Manager instance when creating a cluster
ibmcloud oc nlb-dns secret regenerate --cluster <cluster_name_or_id> --nlb-subdomain <nlb_subdomain>
3. Verify that your default Ingress secrets regenerated. In the output, the CRN of the default Ingress secrets should contain secrets-manager.

It may take several minutes for your secrets to regenerate. During this process, the Status column in the output says regenerating and switches to created when the regeneration is complete.

ibmcloud oc ingress secret ls --cluster <cluster_name_or_id>

Example output.

Name Namespace CRN Expires On Domain Status Type
secret-11111aa1a1a11aa1111111-000 default crn:v1:bluemix:public:secrets-manager:us-south:a/1aa111aa1:secret:a111aa11-11a1 2022-12-21T19:52:29+0000 secret-11111aa1a1a.us-south.containers.appdomain.cloud created TLS
secret-22222aa2a2a22aa2222222-000 default crn:v1:bluemix:public:secrets-manager:us-south:a/2aa222aa2:secret:a222aa22-22a2 2022-12-21T19:52:29+0000 secret-22222aa2a2a.us-south.containers.appdomain.cloud created TLS











 Controlling access to your secrets with secret groups 

With Secrets Manager, you can use secret groups to control who has access to the secrets in your cluster. A secret group can be assigned to an IAM access group so that only select users or service IDs can access the secrets within the secret group. For more information, see [Organizing your secrets](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-secret-groups&interface=ui).





 Registering a Secrets Manager instance when creating a cluster
Figure 6. DevSecOps pipeline configuration





 Secrets 

Several tools in this toolchain require secrets to access privileged resources. An IBM Cloud API key is an example of such a secret. All secrets must be stored securely in a secrets vault and then referenced as required by the toolchain.

With IBM Cloud, you can choose from various secrets management and data protection offerings that help you to protect your sensitive data and centralize your secret. The Secrets step specifies which secret vault integrations are added to your toolchain. Use the provided toggles to add or remove the vault integrations that you require as explained in [Managing IBM Cloud secrets](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-manage-secrets-ibm-cloud). This documentation gives you information on prerequisites and how to use a list of prescribed secret names that are otherwise known as hints. By using hints in a template, a toolchain can be automatically populated with preconfigured secrets without any need to manually select them from various vault integrations that are attached to the toolchain.

This document uses IBM Secrets Manager as the vault for secrets.

Zoom

![DevSecOps secrets options](https://cloud.ibm.com/docs-content/v1/content/5eb88a2575e30e316dbb83829c7f4c8b1ddbc67c/devsecops/images/devsecops-secrets-options.png)

Figure 7. DevSecOps secrets options





 IBM Key Protect 

Use [Key Protect](https://cloud.ibm.com/catalog/services/key-protect) to securely store and apply secrets like API keys, Image Signature, or HashiCorp Vault credentials that are part of your toolchain. You must create a Key Protect Service Instance before you proceed further. If you already created a Key Protect Service Instance, you can link the same in this step.

Zoom

!
For more information, see the [API docs](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2).







 Delivering notifications to select destinations 

After you enable notifications for Secrets Manager, create topics and subscriptions in Event Notifications so that alerts can be forwarded and delivered to your selected destinations.

For a complete list of supported destinations, see the [Event Notifications documentation](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-destination).



 Email notifications 

You can use the [IBM Cloud email service](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-destinations-email) as a delivery channel for Secrets Manager event notifications. [Create an Event Notifications subscription](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-create-en-subscription) between an existing topic and the IBM Cloud email service to forward your alerts to various recipients by email.

An email from IBM Cloud that contains information about a Secrets Manager event resembles the following example:

Subject: Your 2 public certificate secrets expire in 10 days
Body: You have 2 public certificate secrets that expire in 10 days: my-certificate-1, my-certificate-2. You can view and manage your existing secrets by accessing Secrets Manager in the console, or by using the CLI or APIs. For more information, check out the docs.

To receive detailed information about an event notification in your email, select the Add notification payload option when you create an Event Notifications subscription. Your email displays the [notification payload details](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-event-notificationsevent-notifications-payload) that are associated with the event.





 Webhooks 

You can configure a webhook destination so that an incoming notification can be consumed programmatically by an app or service.
For more information, see the [API docs](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2).







 Delivering notifications to select destinations 

After you enable notifications for Secrets Manager, create topics and subscriptions in Event Notifications so that alerts can be forwarded and delivered to your selected destinations.

For a complete list of supported destinations, see the [Event Notifications documentation](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-destination).



 Email notifications 

You can use the [IBM Cloud email service](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-destinations-email) as a delivery channel for Secrets Manager event notifications. [Create an Event Notifications subscription](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-create-en-subscription) between an existing topic and the IBM Cloud email service to forward your alerts to various recipients by email.

An email from IBM Cloud that contains information about a Secrets Manager event resembles the following example:

Subject: Your 2 public certificate secrets expire in 10 days
Body: You have 2 public certificate secrets that expire in 10 days: my-certificate-1, my-certificate-2. You can view and manage your existing secrets by accessing Secrets Manager in the console, or by using the CLI or APIs. For more information, check out the docs.

To receive detailed information about an event notification in your email, select the Add notification payload option when you create an Event Notifications subscription. Your email displays the [notification payload details](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-event-notifications&interface=uievent-notifications-payload) that are associated with the event.





 Webhooks 

You can configure a webhook destination so that an incoming notification can be consumed programmatically by an app or service.
Using IBM Cloud, you can choose from various secrets management and data protection offerings that help you to protect your sensitive data and centralize your secret. In the Secrets step, you can specify which secret vault integrations to add or remove from your toolchain. For more information about adding and removing vault integrations, including prerequisites and by using hints, see [Managing IBM Cloud secrets](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-manage-secrets-ibm-cloud).

By using hints within a template, a toolchain is automatically populated with preconfigured secrets; you don't need to manually select secrets from vault integrations that are attached to the toolchain.

This tutorial uses the [IBM Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-getting-started) as the secrets vault.

Zoom

![Kubernetes secure app secrets options](https://cloud.ibm.com/docs-content/v1/content/562806c0b18119f4d21cb66f5ae6d051634b4a16/ContinuousDelivery/images/sat_kub_setup_secrets.png)

Figure 5. Kubernetes secure app secrets options

IBM Secrets Manager securely stores and applies secrets such as API keys, Image Signature, or HashiCorp credentials that are part of your toolchain.

Zoom

![Kubernetes secure app secrets options](https://cloud.ibm.com/docs-content/v1/content/562806c0b18119f4d21cb66f5ae6d051634b4a16/ContinuousDelivery/images/sat_kub_secrets_manager.png)

Figure 6. Kubernetes Secure app secrets options
Monitor IBM Cloud® Secrets Manager certificates and secrets expiry 

This tutorial shows you how to monitor the expiry date or any updates on the secrets or certificates by using TLS certificates or secrets.

Zoom

![Secrets Manager and Event Notifications](https://cloud.ibm.com/docs-content/v1/content/4c9a07fe500838e5e55e71e73131ef20b44a6c66/event-notifications/images/en-secrets-manager.png)

Figure 1. Secrets Manager and Event Notifications



 How Secrets Manager sends events 

When an event of interest takes place in your Secrets Manager instance, it communicates with a connected Event Notifications instance to forward a notification to a [Supported destination](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-destination).

This tutorial shows you how to configure the following flow:



1. An alert is raised in Secrets Manager.
2. Secrets Manager sends a notification to Event Notifications.
3. Event Notifications creates an email and sends the email to the subscribed user.



Secrets Manager aggregates a list of your pending notifications by [event type](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-event-notifications&interface=uievent-notifications-list), the type of secret, and expiry details if they apply. Every few minutes, the service checks for and dispatches any pending notifications to the connected Event Notifications service. For example, you might receive notifications that are similar to the following messages:



* You have five public certificate secrets that expire in 10 days.
* You have 100 imported certificate secrets that expire in 30 days.



You can be notified of a maximum 100 secrets in a single event notification.





 Before you begin 

You need an IBM Cloud® account. If you don't have an account, then [Create an IBM Cloud account](https://cloud.ibm.com/registration/).





 Step 1: Create an Event Notifications service instance
ibmcloud_api_key IBM Cloud API key or use a secret that is stored in Secrets Manager 
 private_ssh_key Input id_rsa private key content or use a secret that is stored in Secrets Manager 
 sap_main_password SAP main password or use a secret that is stored in Secrets Manager 



4. Review and update the optional parameters. The Ansible scripts expect the SAP kits to be in the default locations listed. For more detailed information, see the [Readme file](https://cloud.ibm.com/catalog/content/sapsingletierdb2-20099bf4-f33a-4ce6-a48b-6d8cb1ac7a27-global/readme/terraform/terraform/e4ec2c13-cf6d-435a-8513-55d6232d5283-global).



 Parameter Description 

 IMAGE VSI OS image 
 PROFILE VSI profile 
 kit_db2_dir kit_db2_dir 
 kit_db2client_dir kit_db2client_dir 
 kit_export_dir kit_export_dir 
 kit_igsexe_file kit_igsexe_file 
 kit_igshelper_file kit_igshelper_file 
 kit_sapcar_file kit_sapcar_file 
 kit_sapexe_file kit_sapexe_file 
 kit_saphotagent_file kit_saphotagent_file 
 kit_swpm_file kit_swpm_file 



5. Accept the license agreement.
6. Select Install. The deployment starts and you are directed to the Schematics page that displays the script log files for you to monitor the deployment progress.







 Deploying SAP NetWeaver 7.x and Db2 by using the Schematics user interface 

Use these steps to configure the SAP NetWeaver 7.X with Db2 on your existing VPC by using the Schematics user interface. The scripts can take 1 - 2 hours to complete.



1.
Debugging service bindings 

Use the tips to learn how to troubleshoot IBM Cloud® Code Engine service bindings.



 Limits to consider 

When you create service bindings with Code Engine, secrets are created. Every new service binding that does not reuse a service credential creates a secret. The maximum number of secrets per project is 100 secrets.

For more information about limits for secrets, see [Limits and quotas for Code Engine](https://cloud.ibm.com/docs/codeengine?topic=codeengine-limits).

Be sure to also consider limits for the specific service instance that you are binding to.

For more information about service bindings, see [Working with service bindings to integrate IBM Cloud services with Code Engine](https://cloud.ibm.com/docs/codeengine?topic=codeengine-service-binding).





 Configuring service binding operations 

Did you know that you can configure project-wide service binding operations with the Code Engine console?

With the right permissions, use the Integrations page in the console to configure settings for service binding operations so that all users of a specific project can create and delete bindings without having to assign all necessary privileges to their personal user IDs. For more information, see [Configuring project-wide service binding operations](https://cloud.ibm.com/docs/codeengine?topic=codeengine-project-integrationsprojectintegration-sb).

If you configure project-wide settings for service binding operations, do not manually update or remove the service ID or API key that is created as part of the configuration of service binding operations. See [Configuring service bindings operations with a Code Engine autogenerated service ID](https://cloud.ibm.com/docs/codeengine?topic=codeengine-project-integrationsprojectintegration-sb-auto).





 Listing service bindings 

You can list service bindings that are set for a Code Engine app or job.

From the console, use one of the following ways.