vania-janet/multiturn-rag-retrieval-data huggingface dataset:
ibmcloud ks ingress secret create --cert-crn crn:v1:staging:public:cloudcerts:us-south:a/06580c923e40314421d3b6cb40c01c68:0db4351b-0ee1-479d-af37-56a4da9ef30f:certificate:4bc35b7e0badb304e60aef00947ae7ff --cluster my_cluster --type tls --name my_alb_secret --namespace demo_ns







 ibmcloud ks ingress secret field add 

Virtual Private Cloud

Classic infrastructure

Add a non-TLS CRN field to an Opaque secret. There are three ways to specify the field type. The one you choose depends on the secret type and how you want to name the field in the non-TLS secret. For more information, see [Managing non-TLS secret fields](https://cloud.ibm.com/docs/containers?topic=containers-secretsnon-tls-field).

ibmcloud ks ingress secret field add --cluster CLUSTER --name SECRET_NAME --field CRN --namespace NAMESPACE [-q]

Minimum required permissions
: Administrator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

--c, --cluster CLUSTER
: Required. The name or ID of the cluster.

--name NAME
: Required. The name of the secret to add the field to.

--field CRN
: Required. The secret CRN to add to the field. You can specify more than one field at a time. For more information, see [Managing non-TLS secret fields](https://cloud.ibm.com/docs/containers?topic=containers-secretsnon-tls-field).



* To pull in the secret with the default field name for the secret type, use the default field option: --field <crn>. This option is available for all non-TLS secret types.
Create an Ingress secret in a cluster for a certificate that is stored in IBM Cloud® Secrets Manager. This command can be used to create TLS or non-TLS secrets.

The previous alias for this command, ibmcloud ks ingress alb cert deploy, is deprecated. In CLI version 1.0.157 and later, the ibmcloud ks ingress alb cert category is deprecated, and these commands are now listed in the ibmcloud ks ingress secret subcategory. For more information, see the [CLI change log](https://cloud.ibm.com/docs/containers?topic=containers-cs_cli_changelog10).

To use the ibmcloud ks ingress secret create command, you must have a default [Secrets Manager](https://cloud.ibm.com/docs/containers?topic=containers-secrets-mgr) instance registered to your cluster. If you do not have a Secrets Manager instance and your secrets are instead written directly to your cluster, your secrets do not have the required CRN value and you must manage them with kubectl commands.

ibmcloud ks ingress secret create --cert-crn CERTIFICATE_CRN --cluster CLUSTER --name SECRET_NAME [--namespace NAMESPACE] [--field CRN] [--persist] [--type] [-q]

Minimum required permissions
: Administrator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

--cert-crn CERTIFICATE_CRN
: Required: The certificate CRN.

-c, --cluster CLUSTER
: Required: The name or ID of the cluster.

--name SECRET_NAME
: Required: Specify a name for the secret. Make sure that you don't create the secret with the same name as the IBM-provided Ingress secret, which you can find by running ibmcloud ks cluster get --cluster <cluster_name_or_ID> | grep Ingress.

--field CRN
: Required for non-TLS secrets. Add a field to the secret. You can specify more than one field at a time.
The following example creates a registry secret that is named mysecret-registry to an IBM Cloud Container Registry instance that is on the us.icr.io registry server and specifies credentials for username and password.

ibmcloud ce secret create --name mysecret-registry --format registry --server us.icr.io --username iamapikey --password API_KEY





 Example output for a registry secret 

Creating registry secret mysecret-registry...
OK





 Example of an SSH secret 

An SSH secret stores credentials to authenticate to a service with an SSH key; for example, authenticating to a Git repository, such as GitHub or GitLab.

To see CLI help for creating an SSH secret, run ibmcloud ce secret create --format ssh.

The following example creates an SSH secret that is named mysecret-ssh for a host that is included in the known_hosts file, and authenticates with an unencrypted SSH private key file located at /<filepath>/.ssh/<key_name>, where <filepath> is the path on your system. This command requires a name and a key path, and also allows other optional arguments such as the path to the known hosts file.

ibmcloud ce secret create --name mysecret-ssh --format ssh --key-path /.ssh/<key_name> --known-hosts-path /.ssh/known_hosts





 Example output for an SSH secret 

Creating SSH secret mysecret-ssh...
OK





 Example of a TLS secret 

A Transport Layer Security (TLS) secret contains a signed TLS certificate, including all its intermediate certificates, and its corresponding private key from a certificate authority (CA). Use TLS secrets when you work with custom domain mappings.

To see CLI help for creating a TLS secret, run ibmcloud ce secret create --format tls.

The following example creates an TLS secret that is named mysecret-tls.
If your ALB runs the IBM Cloud Kubernetes Service Ingress image, and you don't specify a namespace, the certificate secret is created in a namespace called ibm-cert-store. A reference to this secret is then created in the default namespace, which any Ingress resource in any namespace can access. While processing requests, the ALB follows the reference to pick up and use the certificate secret from the ibm-cert-store namespace.

--persist
: Optional: Persist the secret data in your cluster. If the secret is later deleted from the CLI or Red Hat OpenShift web console, the secret is automatically re-created in your cluster. To permanently delete the secret, you must use the [/ingress/v2/secret/deleteSecret API](https://containers.cloud.ibm.com/global/swagger-global-api//beta/DeleteIngressSecret).

--type
: Optional. The type of secret. Choose from tls for certificate CRNs or opaque for non-certificate CRNs. For tls, specify up to one CRN. Foropaque, you can specify multiple CRNs. If no secret type is specified, tls is applied by default.

-q
: Optional: Do not show the message of the day or update reminders.



 Example ingress secret create command 

ibmcloud ks ingress secret create --cert-crn crn:v1:staging:public:cloudcerts:us-south:a/06580c923e40314421d3b6cb40c01c68:0db4351b-0ee1-479d-af37-56a4da9ef30f:certificate:4bc35b7e0badb304e60aef00947ae7ff --cluster my_cluster --type tls --name my_alb_secret --namespace demo_ns







 ibmcloud ks ingress secret field add 

Virtual Private Cloud

Classic infrastructure

Add a non-TLS CRN field to an Opaque secret. There are three ways to specify the field type.
: In this scenario, the cluster admin creates one customized storage class with the default PVC settings and a reference to a generic Kubernetes secret. Cluster users can override the default settings of the storage class by creating a Kubernetes secret with the PVC settings that they want. In order for the customized settings in the secret to get applied to your Block Storage for Classic instance, you must create a PVC with the same name as your Kubernetes secret.

[Enforce base64 encoding for the Key Protect root key](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-blockstatic-secret)
: In this scenario, you create one customized storage class with the default PVC settings and a reference to a static Kubernetes secret that overrides or enhances the default settings of the customized storage class. Your cluster users can't override the default settings by creating their own Kubernetes secret. Instead, cluster users must provision Block Storage for VPC with the configuration that you chose in your customized storage class and secret. The benefit of using this method over creating a [customized storage class](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-blockvpc-customize-storage-class) only is that you can enforce base64 encoding for the root key CRN of your Key Protect service instance when you want to encrypt the data in your Block Storage for Classic instance.

What do I need to be aware of before I start using the Kubernetes secret for my PVC settings?
: Some PVC settings, such as the reclaimPolicy, fstype, or the volumeBindingMode can't be set in the Kubernetes secret and must be set in the storage class. As the cluster admin, if you want to enable your cluster users to override your default settings, you must ensure that you set up enough customized storage classes that reference a generic Kubernetes secret so that your users can provision Block Storage for VPC with different reclaimPolicy, fstype, and volumeBindingMode settings.





 Enabling every user to customize the default PVC settings 



1.
containers-kubernetes.cluster-alb-healthcheck.set Details of an ALB healthcheck are viewed. 
 containers-kubernetes.cluster-alb.list ALBs in a cluster are listed. 
 containers-kubernetes.cluster-alb.update ALB pods are updated. 
 containers-kubernetes.cluster-alb-policy.get The status of automatic updates for Ingress ALBs is viewed. 
 containers-kubernetes.cluster-alb-migration.start A migration of IBM Cloud Ingress ConfigMap and Ingress resources to the Kubernetes Ingress format is started. 
 containers-kubernetes.cluster-alb-migration-status.get The status of the migration process is viewed. 
 containers-kubernetes.cluster-ingress-status.get The status of migrated Ingress resources in a cluster is viewed. 
 containers-kubernetes.cluster-alb-migration.cleanup Ingress resources and configmaps that are no longer needed after an Ingress migration are deleted. 
 containers-kubernetes.cluster-alb-policy.update Automatic updates for the ALBs are enabled or disabled, or all ALB pods in a cluster are rolled back to their previously running build. 
 containers-kubernetes.alb-image.list Supported Ingress controller images are listed. 







 Ingress secret events 

The following list of Ingress secret events are sent to IBM Cloud Activity Tracker.



Ingress secret events

 Action Description 

 containers-kubernetes.cluster-ingress-secret.get Details for an Ingress secret are viewed. 
 containers-kubernetes.cluster-ingress-secret.list Ingress secrets for a cluster are listed. 
 containers-kubernetes.cluster-ingress-secret.create An Ingress secret for a certificate is created. 
 containers-kubernetes.cluster-ingress-secret.delete An Ingress secret is deleted from the cluster. 
 containers-kubernetes.cluster-ingress-secret.update The certificate for an Ingress secret is updated. 
 containers-kubernetes.cluster-ingress-secret-field.add A field in an Ingress secret is added.
With Secrets Manager, you can create managed Kubernetes secrets, update your secrets automatically, create secret groups that control who has access to the secrets in your cluster, and more.



 Creating a non-TLS secret in your cluster 

Create a non-TLS secret by specifying the --type Opaque option in the ibmcloud ks ingress secret create command. With the Opaque type, you can include multiple non-certificate CRN values. If the --type option is not specified, TLS is applied by default. For more information and additional command options, see the [CLI reference](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_ingress_secret_create).

The following example command creates a non-TLS secret with the Opaque type specified. Non-TLS secrets require at least one secret [field](https://cloud.ibm.com/docs/containers?topic=containers-secretsnon-tls-field-add). Note that how you specify the --field option varies [based on the type of secret you create](https://cloud.ibm.com/docs/containers?topic=containers-secretsnon-tls-field-add).

ibmcloud ks ingress secret create -c cluster-test --name example-secret --namespace default --field crn:v1:bluemix:public:secrets-manager:us-south:a/1aa111aa1a11111aaa1a1111aa1aa111:111a1111-11a1 --type Opaque

To verify that the secret is created, list all secrets in the namespace.

kubectl get secret -n default

The following example shows the output.

NAME TYPE DATA AGE
all-icr-io kubernetes.io/dockerconfigjson 1 41h
default-token-8t6xw kubernetes.io/service-account-token 3 41h
example-secret Opaque 3m





 Managing non-TLS secret fields 

A secret field is a key-value pair that is stored in a non-TLS secret.
"not_after" : "2023-10-05T11:49:42Z"
},
"versions_total" : 1
} ],
"total_count" : 232
}







 ibmcloud secrets-manager secret 

Get a secret and its details by specifying the ID of the secret.

A successful request returns the secret data that is associated with your secret, along with other metadata. To view only the details of a specified secret without retrieving its value, use the [Get secret metadata](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-cli-plugin-secrets-manager-cliget-secret-metadata) operation.

ibmcloud secrets-manager secret --id ID



 Command options 

--id (string)
: The ID of the secret. Required.

The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.





 Example 

ibmcloud secrets-manager secret --id=0b5571f7-21e6-42b7-91c5-3f5ac9793a46







 ibmcloud secrets-manager secret-delete 

Delete a secret by specifying the ID of the secret.

ibmcloud secrets-manager secret-delete --id ID



 Command options 

--id (string)
: The ID of the secret. Required.

The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.





 Example
"not_after" : "2023-10-05T11:49:42Z"
},
"versions_total" : 1
} ],
"total_count" : 232
}







 ibmcloud secrets-manager secret 

Get a secret and its details by specifying the ID of the secret.

A successful request returns the secret data that is associated with your secret, along with other metadata. To view only the details of a specified secret without retrieving its value, use the [Get secret metadata](https://cloud.ibm.com/docs/cli?topic=cli-secrets-manager-cliget-secret-metadata) operation.

ibmcloud secrets-manager secret --id ID



 Command options 

--id (string)
: The ID of the secret. Required.

The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.





 Example 

ibmcloud secrets-manager secret --id=0b5571f7-21e6-42b7-91c5-3f5ac9793a46







 ibmcloud secrets-manager secret-delete 

Delete a secret by specifying the ID of the secret.

ibmcloud secrets-manager secret-delete --id ID



 Command options 

--id (string)
: The ID of the secret. Required.

The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.





 Example
"not_after" : "2023-10-05T11:49:42Z"
},
"versions_total" : 1
} ],
"total_count" : 232
}







 ibmcloud secrets-manager secret 

Get a secret and its details by specifying the ID of the secret.

A successful request returns the secret data that is associated with your secret, along with other metadata. To view only the details of a specified secret without retrieving its value, use the [Get secret metadata](https://cloud.ibm.com/docs/secrets-manager-cli-plugin?topic=secrets-manager-cli-plugin-secrets-manager-cliget-secret-metadata) operation.

ibmcloud secrets-manager secret --id ID



 Command options 

--id (string)
: The ID of the secret. Required.

The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.





 Example 

ibmcloud secrets-manager secret --id=0b5571f7-21e6-42b7-91c5-3f5ac9793a46







 ibmcloud secrets-manager secret-delete 

Delete a secret by specifying the ID of the secret.

ibmcloud secrets-manager secret-delete --id ID



 Command options 

--id (string)
: The ID of the secret. Required.

The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.





 Example
This error is because Portieris determines that this deployment can't succeed because the test namespace is unable to pull images from your IBM Cloud Container Registry namespace. The default Kubernetes namespace in an IBM Cloud Kubernetes Service cluster comes preconfigured with [image pull secrets](https://cloud.ibm.com/docs/containers?topic=containers-registrycluster_registry_auth) to pull images from IBM Cloud Container Registry. However, these secrets aren't present in your new namespace.
2. Apply the configuration after Portieris is removed from your cluster.



1. [Remove Portieris](https://cloud.ibm.com/docs/Registry?topic=Registry-security_enforce_portierisuninstall_portieris).
2. Apply the configuration by running the following command:

kubectl apply -f hello-world.yaml

The kubectl apply command completes successfully. However, when you inspect the deployment's

podby running the kubectl describe pod <pod_name> -n test command, where <pod_name> is the name of the pod, the events log indicates that the cluster isn't authorized to pull the image.

You can find the pod name by running kubectl get pod -n test.





4. You must [set up an image pull secret](https://cloud.ibm.com/docs/containers?topic=containers-registryother) in your namespace so that you can deploy containers to that namespace. Several options are available, but this tutorial follows the steps to [copy an image pull secret](https://cloud.ibm.com/docs/containers?topic=containers-registrycopy_imagePullSecret) to the test namespace. Rather than copying all the icr.io secrets, you can copy the us.icr.io secret because your image is in that local registry. The following command copies the default-us-icr-io secret to the test namespace, giving it the name test-us-icr-io:
Developing an authentication and authorization flow for your service 

When you onboard your product to IBM Cloud® Partner Center, you can develop an authentication flow to identify users when they use your services, and an authorization flow to validate that they have permission to access a specific service instance.



 Before you begin 

Before you can start developing an authentication flow, you must have a client ID and a secret configured.



 Configuring your client ID and secret 

To develop an authentication flow, you need a client ID and a secret, and a redirect URL. The client ID is generated to identify your service, along with the secret, which is the password for your service. Your client ID is not confidential since it is publicly identified. However, the secret is confidential and is only known to the application and the authorization server. You can create and manage you client ID in Partner Center. A redirect URL is the host URL for your service that users are redirected to after a successful authentication.

The following example shows redirect URLs:

https://<myapp>.cloud.ibm.com/integrate/auth/callback
http://localhost:3000/auth/callback <-- for testing locally

To generate your client ID, complete the following steps:



1. Go to Partner Center > Sell > My products.
2. Select the product that you're onboarding, and go to the Brokers tab.
3. Click Set up IBM Cloud SSO.
4. Add owners who can manage the client ID.

Only owners are able to view, edit and delete the client ID setup, or add extra redirect URLs. Users who create the client ID are automatically added to the owners list, and not able to remove themselves.
5. Add the redirect URL, and click Next. You can add more than one URL and use these as the redirect_uri in the upcoming tasks. The redirect_uri value refers to the redirect URL.
6. Save your credentials. Copy the password for your service that is generated along with the client ID.
"state": 1,
"state_description": "Active",
"ttl": 3600
}
],
"roles_total": 2
},
"warnings": null
}

If the role belongs to a secret group, the roles.data.secret_group_id value is included in the response to identify the secret group assignment.







 Read the metadata of a role 

Use the following commands to view details about a registered role or secret, such as its name and history.

View the details of a role.

vault read [-format=FORMAT] ibmcloud/SECRET_TYPE/roles/ROLE_ID/metadata

View the details of a role that is assigned to a secret group.

vault read [-format=FORMAT] ibmcloud/SECRET_TYPE/roles/groups/GROUP_ID/ROLE/metadata



 Prerequisites 

You need the [Reader service role](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam) to view the metadata of a secret.





 Command options 

SECRET_TYPE
: The type of secret that you want to view. Currently, iam_credentials is supported.

SECRET_GROUP_ID
: The ID of the secret group that is assigned to the role and its credentials

ROLE_ID
: The ID that is assigned to the role for this secret.

-format
: Prints the output in the format that you specify. Valid formats are table, json, and yaml. The default is table. You can also set the output format by using the VAULT_FORMAT environment variable.





 Examples 

View the details of a role that is assigned to a secret group.

vault read -format=json ibmcloud/iam_credentials/roles/groups/9ab2250f-a369-4e07-ade7-d417d63ad587/091ca93f-5c99-4078-9d7e-4801143030fd/metadata





 Output 

The command returns the following output:

{
ID: abcdefgh-abcd-abcd-abcd-1a2b3c4d5e6f
Format: ssh
Project Name: myproject
Project ID: 01234567-abcd-abcd-abcd-abcdabcd1111
Age: 66s
Created: 2023-03-07 19:19:59 +0000 UTC

Data:
---
known_hosts: fDF8bGh0ekpiSFVXdXRxZWg1NUlrWTk4RjdOdjJZPXxsUmhZd0txVmIwd3dSV2xzcjEySFdoWURUTG89IHNzaC1yc2EgQUFBQUIzTnphQzF5YzJFQUFBQUJJd0FBQVFFQXEyQTdoUkdtZG5tOXRVRGJPOUlEU3dCSzZUYlFhK1BYWVBDUHk2cmJUclR0dzdQSGtjY0tycHAweVZocDVIZEVJY0tyNnBMbFZEQmZPTFg5UVVzeUNPVjB3emZqSUpObEdFWXNkbExKaXpIaGJuMm1VanZTQUhRcVpFVFlQODFlRnpMUU5uUEh0NEVWVlVoN1ZmREVTVTg0S2V6bUQ1UWxXcFhMbXZVMzEveU1mK1NlOHhoSFR2S1NDWklGSW1Xd29HNm1iVW9XZjluenBJb2FTakIrd2VxcVVVbXBhYWFzWFZhbDcySitVWDJCKzJSUFczUmNUMGVPelFncWxKTDNSS3JUSnZkc2pFM0pFQXZHcTNsR0hTWlh5MjhHM3NrdWEyU21WaS93NHlDRTZnYk9EcW5UV2xnNyt3QzYwNHlkR1hBOFZKaVM1YXA0M0pYaVVGRkFhUT09CnwxfEpUSjI4MCt0RkFSMGcxZ3VrZW56U3ZBYm5sQT18RDlSUWppenZlR3UxS0FnNjhNeisrUHM3RmZrPSBlY2RzYS1zaGEyLW5pc3RwMjU2IEFBQUFFMlZqWkhOaExYTm9ZVEl0Ym1semRIQXlOVFlBQUFBSWJtbHpkSEF5TlRZQUFBQkJCRW1LU0VOalFFZXpPbXhrWk15N29wS2d3RkI5bmt0NVlScllNak51RzVOODd1UmdnNkNMcmJvNXdBZFQveTZ2MG1LVjBVMncwV1oyWUIvKytUcG9ja2c9CnwxfDhIOXpNb0VORklZVDNPeVZYWlQrY25wb0srND18dVdhVThFV1FPc0ttSDMzREVVd0xnNUtiUk44PSBzc2gtZWQyNTUxOSBBQUFBQzNOemFDMWxaREkxTlRFNUFBQUFJT01xcW5rVnpybTBTZEc2VU9vcUtMc2FiZ0g1Qzlva1dpMGRoMmw5R0tKbAo=
ssh-privatekey: REDACTED

Notice that the value of the known_hosts key for this SSH secret is encoded, and the value of ssh-privatekey is redacted. To display the secret data as decoded, use the --decode option with the secret get command.





 Creating a TLS secret with the CLI 

A Transport Layer Security (TLS) secret contains a signed TLS certificate, including all its intermediate certificates, and its corresponding private key from a certificate authority (CA). Use TLS secrets when you work with custom domain mappings.

The following example creates a TLS secret that is named mysecret-tls. The certificate chain that corresponds to the custom domain is contained in the file certificate.txt and the matching private key file is contained in the file privatekey.txt. In this example, both of these files are located in the root directory of the local workstation.

ibmcloud ce secret create --name mysecret-tls --format tls --cert-chain-file certificate.txt --private-key-file privatekey.txt

To display the details of this secret,

ibmcloud ce secret get --name mysecret-tls

Example output

Getting secret 'mysecret-tls'...
OK

Name: mysecret-tls'
ID: abcdefgh-abcd-abcd-abcd-1a2b3c4d5e6f
Format: tls
Project Name: myproject
Project ID: 01234567-abcd-abcd-abcd-abcdabcd1111
Age: 66s