vania-janet/multiturn-rag-retrieval-data huggingface dataset:
You can set up a [rotation policy](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-key-rotationvpc-key-rotation-policies) to schedule automatic key rotation. The KMS generates a new root key at the rotation interval and automatically replaces the root key with new key material.

For any root keys that you import to the KMS instance because you're providing new key material that is not in the KMS, you can't set up automatic key rotation. Instead, you must [manually rotate](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-key-rotationvpc-key-rotation-ui) your keys by using the new cryptographic key material that you imported.

The key rotation feature is available for root keys and does not apply to standard encryption keys.



 How key rotation works 

Key rotation works by securely transitioning root key material, shortening the cryptoperiod of the root keys that protect your resources. New resources are encrypted with the latest root keys.

When you rotate a root key, the service identifies all resources that are protected by that key and automatically reencrypts the resource. This encryption process wraps (encrypts) a LUKS passphrase that protects a data encryption key (DEK). The system-generated DEK encrypts the data in the virtual disk. This process is called [envelope encryption](https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryption), which creates a wrapped DEK, or WDEK. The WDEK does not refer to the data encryption key that is protecting data in the virtual disk. Rather, it encrypts the LUKS passphrase.

The new version of the root key is used to unwrap the newly rewrapped LUKS passphrase the next time the resource is decrypted. For example, it is used when you decrypt a volume upon restarting an instance.

The service retires the old root key version but it remains available for decrypting existing resources.
For more information, see [Adjusting file share IOPS](https://cloud.ibm.com/docs/vpc?topic=vpc-adjusting-share-iops&interface=ui).





 Can I change a file share profile? 

Yes, you can use the UI, CLI, or API to update a file share profile. You can change among IOPS tier profiles. When you select a custom profile or dp2 high-performance profile, you specify the maximum IOPS based on the file share size.

You cannot use the UI, CLI, or API to update multiple file shares in a single operation. For more on this issue, see [troubleshooting File Storage for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-troubleshooting-file-storage).







 Data security and encryption questions 



 How secure is my data? 

All data is encrypted at rest by default with IBM-managed encryption. You can also encrypt your file shares with your own root key, which gives your more control over your data security. For example, you can rotate, suspend, delete, and restore your root keys. For more information, see [Creating file shares with customer-managed encryption](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-encryption).

You can also enable secure end-to-end encryption of your file share data by setting up data encryption in transit. Encryption in transit for your file shares lets you establish an encrypted mount connection between the virtual server instance and storage system using the Internet Security Protocol (IPsec) security profile. For more information, see [Enabling file share encryption in transit secure connections](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-eit).





 Is there support for security groups and network ACLs? 

Yes. You can specify a security group access control mode to restrict mounting file shares to specific instances in your VPC.
* For vSAN encryption, rotate your VMware key encryption keys (KEKs) and optionally data encryption keys (DEKs) from the vSAN general settings in your vCenter Server cluster.
* For vSphere encryption, rotate your VMware KEKs and DEKs (optionally) by using the Set-VMEncryptionKey PowerShell command.







 Key revocation 

You can revoke all keys in use by KMIP for VMware by deleting your chosen CRK from your key manager.

When keys are revoked, all data that is protected by these keys and by your KMIP for VMware instance is cryptographically shredded by this method. VMware preserves some keys while an ESXi host is powered on, so you need to restart your vSphere cluster to ensure that all encrypted data is no longer in use.

KMIP for VMware stores individual wrapped KEKs in your Key Protect or Hyper Protect Crypto Services instance by using names that are associated with the key IDs that are known to VMware. You can delete individual keys to revoke the encryption of individual disks or drives.

VMware does not delete keys from the KMS when a VM having encrypted disks is removed from inventory. This process is to allow recovery of that VM from backup or if it is restored to inventory. If you want to reclaim these keys and cryptographically invalidate all backups, you need to delete the keys from your key manager instance after you delete your VMs.





 Related links 



* [Solution overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-kmip-overview)
* [Solution design](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-kmip-design)
* [High availability and disaster recovery](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-kmip-hadr)
Enrolling an Application in Data Security Broker Manager 

An application is the framework that links Data Security Broker Manager, databases, and Data Security Broker Shield and instructs the Data Security Broker Shield to encrypt and decrypt data.

A Data Security Broker Shield is limited to be enrolled with one application. But you can associate one application with multiple Data Security Broker Shields.

To enroll an application in Security Broker Manager, complete the following steps:



1.  Login to Data Security Broker Manager.
2.  Click the Applications icon in the left navigation panel.
3.  Click Enroll Application + in the upper right corner of the window. The Enroll Application dialog appears.
4.  Enter an Application Name and Application Description in the respective fields.
5.  Perform the following tasks:



*  Choose the Data Security Broker Shield from the drop-down list.
*  Select a Data Store for encryption.
*  Select the Keystore to be used as a source for data encryption keys.
*  Specify an Encryption Method as Column Level or Row Level.



Zoom

![Enroll Application](https://cloud.ibm.com/docs-content/v1/content/57ab3ec034294d8a6de510b97bec3035d4654761/security-broker/images/enroll_app.svg)

Enroll Application
6.  Click Enroll Application. After the application is enrolled, it is displayed under the Applications in the Data Security Broker Manager.

The Shield Sync ID is used when you install Data Security Broker Shield. Ensure that you have the Shield Sync ID handy during the Data Security Broker Shield installation.
7.  Once you have completed enrolling an application, you can proceed with the data encyrption. Refer to the [Data Encryption using IBM Cloud PostgreSQL Database](https://cloud.ibm.com/docs/security-broker?topic=security-broker-sb_encrypt_data) section to start protecting your data.
* Deploy canary versions of apps and control the traffic that is sent to them.
* Enable automatic encryption of data that is transferred between microservices.



An Istio service mesh is composed of a data plane and a control plane. The data plane consists of Envoy proxy sidecars in each app pod, which mediate communication between microservices. The control plane consists of Pilot, Mixer telemetry and policy, and Citadel, which apply Istio configurations in your cluster. For more information about each of these components, see the [istio add-on description](https://cloud.ibm.com/docs/containers?topic=containers-istio-aboutistio_ov_components).





 What is Istio on IBM Cloud Kubernetes Service? 

Istio on IBM Cloud Kubernetes Service is offered as a managed add-on that integrates Istio directly with your Kubernetes cluster.



 What does this look like in my cluster? 

When you install the Istio add-on, the Istio control and data planes use the network interfaces that your cluster is already connected to. Configuration traffic flows over the private network within your cluster, and does not require you to open any additional ports or IP addresses in your firewall. If you expose your Istio-managed apps with an Istio Gateway, external traffic requests to the apps flow over the public network interface.





 How does the update process work? 

The Istio version in the managed add-on is tested by IBM Cloud and approved for the use in IBM Cloud Kubernetes Service. Additionally, the Istio add-on simplifies the maintenance of your Istio control plane so you can focus on managing your microservices. IBM Cloud keeps all your Istio components up-to-date by automatically rolling out patch updates to the most recent version of Istio that is supported by IBM Cloud Kubernetes Service.
Also, vSAN encryption is fully compatible with all virtual machine (VM) backup and replication technologies, such as vSphere replication, cross-vCenter vMotion, VMware HCX™, Zerto, and Veeam®.



 VMware vSAN encryption notes 



* For vSphere versions older than 7.0u1a, vSAN encryption cannot encrypt the host to host vSAN replication communications within your cluster. Beginning with vSphere 7.0u1a, you can optionally enable data-in-transit encryption for each vSAN cluster.
* vSAN encryption is not applicable to other storage solutions such as IBM Cloud Endurance file and block storage.
* vSAN encryption requires the vSAN Enterprise license.
* The vSAN health check might send periodic warnings that it is unable to connect to the Key Management Service (KMS) cluster from one or more of your vSphere hosts. These warnings occur because the vSAN health check connection times out too quickly. You can ignore these warnings. For more information, see [vSAN KMS health check intermittently fails with SSL handshake timeout error](https://kb.vmware.com/s/article/67115).









 vSphere encryption 

vSphere encryption applies to all types of VMware storage, including vSAN storage and IBM Cloud Endurance file and block storage.

With this solution, vCenter Server and your ESXi hosts connect to a key management server such as KMIP for VMware to get encryption keys. These keys are used to protect individual VM disks, according to your VM storage policies.

vSphere encryption operates at the VM disk level, and so it can prevent data exposure if loss of physical disk drives or loss of VM disks occurs. Some backup and replication technologies cannot back up or replicate effectively because the provided data is encrypted.

vSphere encryption is not compatible with VMware HCX or Zerto. vSphere encryption is compatible with cross-vCenter vMotion when you use vSphere 7.0 or later. vSphere encryption is compatible with vSphere replication when you use vSphere 6.7u1 or later.
Using End to End (E2E) Encryption to provision an encrypted instance 

The End to End (E2E) Encryption feature is used so that you can bring your own encrypted, cloud-init enabled operating system image. You encrypt the image by using a data encryption key that you own and control. After you complete some environment setup, you can import your encrypted image to the image template repository and use it to provision encrypted virtual server instances. E2E encryption provides data-at-rest encryption for the storage that is associated with provisioned virtual server instances.

E2E Encryption brings together several IBM Cloud® components to provide a secure solution for your critical information.



* An IBM key management service such as IBM Key Protect or IBM Cloud Hyper Protect Crypto Services to secure your encryption keys (see Table 1).
* IBM Cloud Identity and Access Management (IAM) enables the Cloud Block Storage service to access your key management system and your root key that is used to wrap your data encryption key.
* IBM Cloud Object Storage securely stores your encrypted image when you upload it.
* In IBM Cloud console you can import your encrypted image and create an image template.
* With an encrypted image template available in the IBM Cloud console infrastructure environment, you can provision encrypted virtual server instances.
* Finally, you can audit events that are associated with your encrypted virtual servers through [Activity Tracker](https://cloud.ibm.com/docs/Activity-Tracker-with-LogDNA?topic=Activity-Tracker-with-LogDNA-getting-started).





 Encryption key management services 

Key Protect and Hyper Protect Crypto Services (now available in certain [regions](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regionsregions)) use a common key provider API to provide a consistent approach for managing encryption keys. Behind the scenes, IBM Cloud data centers provide a dedicated hardware security module (HSM) to protect your keys. You can choose from the following options:



Table 1. Available key management service options

 Key Management Service HSM Encryption Certification
With [Secrets Manager](https://cloud.ibm.com/docs/secrets-manager), you can manage secrets of various types in a dedicated instance. 
 You need to generate, renew, and manage SSL/TLS certificates for your deployments. You can also manage your SSL/TLS certificates and private keys in dedicated instance of [Secrets Manager](https://cloud.ibm.com/docs/secrets-manager). 
 You need to create and manage encryption keys that are backed by FIPS 140-2 Level 3 validated hardware. You can use [Key Protect](https://cloud.ibm.com/docs/key-protect) to generate and import encryption keys by using a multi-tenant service with shared hardware. 
 You are an admin in an industry, such as finance or legal, that must adhere to governance over how data is protected and isolated. You need to create and manage encryption keys by using a dedicated, FIPS 140-2 Level 4 hardware security module that you control and manage. With [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto), you can manage encryption keys in a single-tenant service with dedicated hardware. 
 You need a way to offload TLS handshake encryption to a dedicated, FIPS 140-2 Level 4 hardware security module that you control and manage. You can also use [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto) to control your TLS/SSL keys in a dedicated HSM. 







 What are key features for each data protection service? 

As you plan your data protection strategy, some differences between services to consider include the level of data isolation that your workload requires.

For a higher level of security and control, your business might benefit from the data isolation that a single-tenant offering provides, such as Secrets Manager or Hyper Protect Crypto Services. You might also decide that the reduced cost and scalability benefits of a multi-tenant service, such as Key Protect and Certificate Manager, are better suited to your needs. The following table lists key features for each service.



Table 2. Key features for IBM Cloud data protection services
Connecting with third-party tools 

You can connect third-party command-line interfaces, applications, and tools to your Db2 Warehouse on Cloud database.



 Data integration 



 Informatica 

You can connect Informatica to Db2 Warehouse on Cloud to help you manage your data.

Watch this video to see how to integrate Db2 Warehouse on Cloud with Informatica Cloud.





 Segment 

You can integrate Segment with a Db2 Warehouse on Cloud database. Segment is a single platform that collects, stores, and routes your user data to hundreds of tools.

[Segment](https://segment.com/docs/destinations/db2/)





 Aginity Workbench 

These instructions explain how to connect Aginity Workbench to a Db2 Warehouse on Cloud database. You can use Aginity Workbench to migrate IBM PureData for Analytics (Netezza) data models and data to Db2 Warehouse on Cloud.



 Prerequisites 

Before attempting to connect to your Db2 Warehouse on Cloud database, verify that you have the [prerequisites](https://cloud.ibm.com/docs/Db2whc/connecting?topic=Db2whc-connect_ovprereqs).





 Procedure 



1. Download and install Aginity Workbench.
2. Determine your ODBC DSN from the connection information that you noted earlier.
3. Launch Aginity Workbench. If the database connection dialog box does not open automatically, open it by clicking Connect on the toolbar.
4. [Establish a database connection](https://www.aginity.com/documentation/WB/dashDB/Default.htmAginity_Topics/Aginity_Workbench/Database_Connection_Dialog_Box.htm). Use the host name, user ID, and password from the connection information that you noted earlier.











 Data visualization & BI 



 Looker 

You can connect Looker to a Db2 Warehouse on Cloud database. Looker is a business intelligence app and big data analytics platform with which you can explore, analyze, and share real-time business analytics.
For more information about tags, see [Working with tags](https://cloud.ibm.com/docs/account?topic=account-tag). 
 Location The availability zone, inherited from the VPC (for example, Dallas-1). You can select a different zone in your location from the list. 
 Size Enter a volume size in GBs. Volume sizes can be between 10 GB - 2 TBs. Expanded capacity IOPS tiers increase volume size up to 16 TB and 48,000 IOPS. This Beta feature is available for evaluation and testing purposes. 
 IOPS Select [IOPS Tiers](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-profilestiers) and then select the tile with performance level you require. 
 Select [Custom](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-profilescustom) to specify a custom IOPS value based on the size of the volume you're creating. Click the storage size link to see a table of size and IOPS ranges. For more information, see [Custom IOPS profile](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-profilescustom). 
 Encryption Choose Customer Managed and use your own encryption key. See Table 2 for these fields. 



Complete provisioning customer-managed encryption by using the information in Table 2.



Table 2. Values for provisioning block storage volumes with customer-managed encryption

 Field Value 

 Encryption Provider managed is the default encryption mode. To use customer-managed encryption, select a key management service (Key Protect or Hyper Protect Crypto Services). The key management service instance includes the customer root key that you want to use for customer-managed encryption. 
 Encryption service instance If you provision multiple key management service instances in your account, select the one that includes the customer root key that you want to use for customer-managed encryption. 
 Key name Select the data encryption key within the Key Protect instance that you want to use for encrypting the volume. 
 Key ID Displays the key ID that is associated with the data encryption key that you selected.
If you don't have one, first [create a VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-startedcreate-and-configure-vpc). For more information about creating mount targets as a separate operation, see [Create a mount target](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-encryptionfs-create-mount-target-ui). 
 Profile Select an IOPS tier, custom, or dp2 profile. The profile that you select determines the input/output performance of a file share. For more information, see [file storage profiles](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-profiles). 
 Size Specify the size for the file share. 
 Encryption Choose Customer Managed and use your own encryption key. 



4. Update the fields in the Encryption section.



Table 2. Values for customer-managed encryption for file shares

 Field Value 

 Encryption To use customer-managed encryption, select a [key management service](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-aboutkms-for-byok) (Key Protect or Hyper Protect Crypto Services). The key management service (KMS) instance includes the root key that is imported to or created in that KMS instance. 
 Encryption service instance If you provisioned multiple KMS instances in your account, select the one that includes the root key that you want to use for customer-managed encryption. 
 Key name Select the root key within the KMS instance that you want to use for encrypting the share. 
 Key ID Shows the key ID that is associated with the data encryption key that you selected. 



5. When all the required information is provided, click Create file share. You're returned to the File Shares for VPC page, where a message indicates that the file share is provisioning. When completed, the status changes to Active.
See [Fabric documentation](https://hyperledger-fabric.readthedocs.io/en/release-2.2/hsm.htmlexample) for details.

Miscellaneous bug fixes







 24 March 2020 

IBM is in the process of migrating existing IBM Blockchain Platform consoles to v2.1.3, therefore, the new features described in this list may not yet be available in your console. Unsure what version you are currently using? Click the question mark icon in the upper right corner of the console. The IBM Blockchain Platform version is visible under the page heading. Existing customers will receive a Cloud notification with more details about when their console will be migrated.

Hyperledger Fabric v1.4.6

All new nodes are deployed using Hyperledger Fabric v1.4.6. If you have an existing blockchain network, you should review the topic on [Capabilities](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-governibp-console-govern-capabilities) to understand how this new Fabric version can impact your network.

Hardware Security Module (HSM) support for node identities

Full cryptographic HSM support is now available for HSMs that implement the PKCS #11 standard. Using an HSM provides on-demand encryption, key management, and key storage. When you deploy a CA, peer, or ordering node, you now have the option to store the private key for the node identity in an HSM. See [Configuring a node to use a HSM](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-adv-deploymentibp-console-adv-deployment-cfg-hsm) for more details.

Support for adding and removing ordering nodes from an existing ordering service

Previously, an ordering service could only contain one or five ordering nodes and they all were contributed from the same organization. Now, the ordering service can be deployed across multiple organizations in a blockchain network, enabling individual organizations to add and remove individual ordering nodes as required. Multi-organizational transaction ordering improves the decentralized nature of a blockchain network.