vania-janet/multiturn-rag-retrieval-data huggingface dataset:
By default, all commands print in table format. To change the output format to JSON, use --output json.







 Examples 

Note that the key ring must already be created, either as part of creating a key, or by itself.

This is an example of kp key update.

ic kp key update 5f2cc155-fe16-492c-845c-4d1f0688c7ba -r TestRing

Executing the command has a typical result:

Updating key...
OK
Key ID Key Name Key Ring ID
5f2cc155-fe16-492c-845c-4d1f0688c7ba TestKey TestRing







 kp key unwrap 

[Unwrap a data encryption key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-unwrap-keys) using a root key that is stored in your Key Protect instance.

ibmcloud kp key unwrap KEY_ID_OR_ALIAS CIPHERTEXT_FROM_WRAP
-i, --instance-id INSTANCE_ID
[-a, --aad ADDITIONAL_DATA]
[--key-ring KEY_RING_ID]
[-o, --output OUTPUT]



 Examples 

These are examples of kp key unwrap.



 Example 1 

Unwrap a ciphertext to reveal the plaintext data encryption key (DEK).

 create a root key
$ ibmcloud kp key create my-root-key

Creating key: 'my-root-key', in instance: '390086ac-76fa-4094-8cf3-c0829bd69526'...
OK
Key ID Key Name
807eb0a6-cc10-4bfe-8331-41a6f712c4ea my-root-key

 create a data encryption key (DEK), wrapped with the root key
The certification is listed on the [Cryptographic Module Validation Program (CVMP) Validated Modules List](https://csrc.nist.gov/Projects/cryptographic-module-validation-program/Validated-Modules).



* How to understand the key hierarchy for Hyper Protect Crypto Services KYOK?

The following table lists the keys that are needed for Hyper Protect Crypto Services Keep Your Own Key (KYOK) functionality.



Table 1. Hyper Protect Crypto Services key types and algorithms

 Key types Algorithms Functions 

 Signature key P521 Elliptic Curve (EC) When you [initialize your Hyper Protect Crypto Services instance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-introduce-service) to load the master key, you need to use signature keys to issue commands to the crypto units. The private part of the signature key is used to create signatures and is stored on the customer side. The public part is placed in a certificate that is stored in the target crypto unit to define a crypto unit administrator. 
 Master key 256-bit AES You need to load your master key to the crypto units to take the ownership of the cloud HSM and own the root of trust that encrypts the entire hierarchy of encryption keys, including root keys and standard keys in the key management keystore and Enterprise PKCS #11 (EP11) keys in the EP11 keystore. Depending on [the method that you use to load the master key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-instance-mode), the master key is stored in different locations. 
 Root key 256-bit AES Root keys are primary resources in Hyper Protect Crypto Services and are protected by the master key. They are symmetric key-wrapping keys that are used as roots of trust for wrapping (encrypting) and unwrapping (decrypting) other data encryption keys (DEKs) that are stored in a data service. This practice of root key encryption is also called envelope encryption.
Security and Compliance 



 Protection Against Unauthorized Access 

IBM Cloud® Databases for Redis use the following methods to protect data in transit or in storage.



* All Databases for Redis connections use TLS/SSL encryption for data in transit. The current supported version of this encryption is TLS 1.2.
* Access to the Account, Management Console UI, and API is secured via [Identity and Access Management (IAM)](https://cloud.ibm.com/docs/databases-for-redis?topic=databases-for-redis-iam).
* Access to the database is secured through the standard access controls provided by the database. These access controls are configured to require valid database-level credentials that are obtainable only through prior access to the database or through our Management Console UI or API.
* All Databases for Redis storage is provided on storage encrypted with LUKS using AES-256. The default keys are managed by [Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-about). Bring-your-own-key (BYOK) for encryption is also available through [Key Protect Integration](https://cloud.ibm.com/docs/databases-for-redis?topic=databases-for-redis-key-protect&interface=ui).
* IP allowlisting - All deployments support [allowlisting IP addresses](https://cloud.ibm.com/docs/databases-for-redis?topic=databases-for-redis-allowlisting&interface=ui) to restrict access to the service.
* Public and Private Networking - Databases for Redis is integrated with [Service Endpoints](https://cloud.ibm.com/docs/databases-for-redis?topic=databases-for-redis-service-endpoints). You can select whether to use connections over the public network, the IBM Cloud internal network, or both.
* Dedicated Cores - Allocating dedicated cores to your deployment introduces hypervisor-level isolation to your database instance, using isolated virtual machines to ensure your data processing remains separated from other customers. It also provides a guaranteed minimum number of CPUs to your deployment.
$kb exec -it $Mongo_container -- sh -c 'mongodump -u '${MONGO_USER}' -p '${MONGO_PASS}' --authenticationDatabase admin -d '$backup_db' --excludeCollection=audit -o /tmp/dump'
done
backupDumpMongoFile="/tmp/""$version"MONGO.tar.gz
$kb exec -it $Mongo_container -- sh -c 'tar -czvf '${backupDumpMongoFile}' /tmp/dump'
$kb cp $Mongo_container:$backupDumpMongoFile $backup_directory/"$version"MONGO.tar.gz
}

 DSB Manger backup
BMbackup() {
echo "BM backup.."
BMbackupDumpFile="/tmp/""$version"BM.tar.gz
$kb exec -it $BM_container -- sh -c 'tar -czvf '${BMbackupDumpFile}' /opt/dsb/dsb-manager'
$kb cp $BM_container:$BMbackupDumpFile $backup_directory/"$version"BM.tar.gz
}

BackupMongo
BMbackup
Show more



1. The following files are added to the specified backup location after you have finished executing the script:



Release-DSB.<release>MONGO.tar.gz
Release-DSB.<release>BM.tar.gz



1. Transfer the backups of the key management, Object Storage, and database services related to the Data Security Broker deployment, as well as the Data Security Broker Manager backup files, to a reliable backup storage location.







 Restore procedure 

The Data Security Broker deployment can be recovered in a disaster recovery situation to a state that was previously backed up, provided that all the dependent services are also recovered in the same manner. This applies to any services that has suffered a irrecoverable failure.
For a full description of SQL Server concepts, see [Backup Overview (SQL Server)](https://docs.microsoft.com/en-us/sql/relational-databases/backup-restore/backup-overview-sql-server?view=sql-server-ver15).
* Third party integration - There are a number of third party integrations available and here we describe just three; IBM Spectrum Protect, Veeam and IBM Spectrum Protect Plus:



* IBM Spectrum Protect - Data Protection for SQL allows you to perform online backups and restores of Microsoft SQL Server databases to an IBM Spectrum Protect Storage Manager Server. For a description of implementing IBM Spectrum Protect Storage Manager Server, see [IBM Spectrum Protect Cloud Blueprints](https://www.ibm.com/support/pages/ibm-spectrum-protect-cloud-blueprints). Installation of Data Protection for SQL is covered at [Download Information: Version 8.1.9 IBM Spectrum Protect for Databases](https://www.ibm.com/support/pages/node/1071626).
* Veeam - Veeam Agent for Microsoft Windows is a data protection and disaster recovery solution that can be deployed on IBM Cloud VPC virtual server instances. For more information, see [Using Veeam Agent](https://cloud.ibm.com/docs/vpc?topic=vpc-using-veeam-agent). It is also possible to use Veeam Agent for Microsoft Windows with Veeam Backup and Replication, where Veeam Backup and Replication provides a centralized backup solution for all your Veaam Agents. For more information, see [Using Veeam Backup and Replication software](https://cloud.ibm.com/docs/vpc?topic=vpc-using-veeam-backup-replication-software). For more information on backing up SQL Server, see [Back Up Microsoft SQL Server](https://helpcenter.veeam.com/docs/agentforwindows/userguide/howto_sql_backup.html?ver=50)
Recovering your VMware vSphere environment 

Data backup is the primary method to maintain data safety and integrity. In an ideal and perfect world, their use would never be required. Unfortunately, the reality is that accidents and disasters do happen. If they do, it is paramount to minimize system downtime and get back up and running as soon as possible.

In the past, storing backups on high-performance storage or tape were feasible solutions. Today, enterprises are seeking to alleviate the capital and operational costs that are associated with physical on-premises storage by augmenting or even replacing it with Object Storage. However, with Object Storage, because backups are no longer on on-premises storage, restoring from them is no longer a matter of locating the necessary backup and restoring from it. Fortunately, you can use a hybrid solution that performs much of the legwork of restoring backups that are stored on Object Storage. The solution consists of



* IBM Cloud® Object Storage
* NetApp AltaVault Cloud Storage Gateway from NetApp (formerly Riverbed SteelStore)
* Veeam Backup & Replication software



If a catastrophic event occurs and takes your primary environment offline, a secondary recovery site can be created within IBM Cloud® to recover it. You can deploy Veeam Backup & Replication software and an AltaVault cloud-integrated storage appliance to communicate with IBM Cloud Object Storage to access previous backups of the primary environment. The software connects with the storage appliance to restore the backups to a new location, bringing the primary environment back online, and averting any further loss of uptime.

On-premises IP addresses are retained when you restore the virtual machines (VMs) at the IBM Cloud recovery site. As a result, it is important to either change IP addresses upon successful recovery or design a BYOIP infrastructure. For assistance in either case, contact your IBM Representative.

The following procedure focuses on the coordinated use of a NetApp AltaVault Cloud Storage Gateway appliance, the IBM Cloud infrastructure, and Veeam Backup & Replication to fully restore a VMware vSphere environment failed. The software assumes that at least one backup of the environment was made by using the three preceding technologies and is on IBM Cloud Object Storage at the time of recovery.
IBM Cloud Data Engine 99.999% [Disaster recovery and backup](https://cloud.ibm.com/docs/sql-query?topic=sql-query-disaster) 







 Database services 

The following table describes the service level objectives (SLOs) for the high impact IBM Cloud database services in a high availability configuration.



Table 13. Service level objectives (SLOs) for the IBM Cloud databases services

 Databases service Availability target Performance detail Storage back end used for data Storage back end used for backups High availability guidance 

 IBM Cloud Databases for MongoDB 99.999% [Performance](https://cloud.ibm.com/docs/databases-for-mongodb?topic=databases-for-mongodb-performance) Block Storage [Object Storage](https://cloud.ibm.com/docs/databases-for-mongodb?topic=databases-for-mongodb-security-compliancedata-resilience) [Understanding high availability and disaster recovery for Cloud Databases](https://cloud.ibm.com/docs/databases-for-mongodb?topic=cloud-databases-ha-dr) 
 IBM Cloud Databases for DataStax 99.999% [Performance](https://cloud.ibm.com/docs/databases-for-cassandra?topic=databases-for-cassandra-performance) Block Storage [Object Storage](https://cloud.ibm.com/docs/databases-for-cassandra?topic=databases-for-cassandra-security-compliancedata-resilience) [High-Availability](https://cloud.ibm.com/docs/databases-for-cassandra?topic=databases-for-cassandra-high-availability)
* [Next steps](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-encryption-in-transitshared-encryption-in-transit-next-steps)







 Business continuity and disaster recovery 

[Business continuity and disaster recovery overview](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-bcdrshared-bcdr)



* [Requirements](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-bcdryour-workloads-requirements)



* [Alternative storage site](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-bcdryour-workloads-requirements-alternate-storage-site)
* [Information system backup](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-bcdryour-workloads-requirements-information-system-backup)
* [Information system recovery and reconstitution](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-bcdryour-workloads-requirements-information-system-recovery)



* [Backup and disaster recovery for the reference architectures](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-bcdrbcdr-for-reference-architectures)
* [Backup and disaster recovery for IBM Cloud services](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-bcdribm-cloud-services)
* [Related controls in IBM Cloud Framework for Financial Services](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-bcdrrelated-controls)
* Zerto Virtual Replication - The Zerto Virtual Manager (ZVM) system is deployed as an IBM Cloud virtual server instance (VSI) and its backup is not supported by Veeam. If your disaster recovery strategy requires you to recover the ZVM without you perform a site failover, use your preferred Windows® backup solution to back up and restore the ZVM.
* F5® BIG-IP - F5 recommends [file-based backup of the F5 configuration](https://support.f5.com/csp/article/K13132), which you can direct to your file server.
* FortiGate® Security Appliance or VM - Fortinet recommends [file-based backup of the FortiGate configuration](https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-best-practices-54/Firmware/Performing_Config_Backup.htm), which you can direct to your file server.
* Entrust CloudControl™ and Entrust DataControl® - Entrust supports both image and file-based backup of the Entrust server appliances. For more information, see the Entrust administration guides.
* VMware HCX™ - Use the HCX appliance management interface to create and download a file-based backup of the HCX Manager configuration similar to the vCenter Server Appliance.







 More considerations 

If you choose to deploy your AD/DNS server as an IBM Cloud virtual server instance (VSI), you cannot back it up by using Veeam. In this case, use your preferred Microsoft Windows® backup solution for backup and restore operations. Or, plan to deploy your instance by using AD/DNS VMs within your VMware cluster, which can be backed up by Veeam.

Beginning with VMware vCenter 6.5u2, VMware supports the backup of the vCenter Postgres database by using image-based backups. These backups use integrated suspend and resume scripts for the database during the backup window to ensure database integrity. If you want to use this method, choose to use Veeam to back up your vCenter Server and PSC.
IBM Cloud Databases for Elasticsearch 99.999% [Performance](https://cloud.ibm.com/docs/databases-for-elasticsearch?topic=databases-for-elasticsearch-performance) Block Storage [Object Storage](https://cloud.ibm.com/docs/databases-for-elasticsearch?topic=databases-for-elasticsearch-security-compliancedata-resilience) [High-Availability](https://cloud.ibm.com/docs/databases-for-elasticsearch?topic=databases-for-elasticsearch-high-availability) 
 IBM Cloud Messages for RabbitMQ 99.999% [Performance](https://cloud.ibm.com/docs/messages-for-rabbitmq?topic=messages-for-rabbitmq-performance) Block Storage [Object Storage](https://cloud.ibm.com/docs/messages-for-rabbitmq?topic=messages-for-rabbitmq-security-compliancedata-resilience) [High-Availability](https://cloud.ibm.com/docs/messages-for-rabbitmq?topic=messages-for-rabbitmq-high-availability) 
 IBM Cloudant 99.999% [Provisioned Throughtput Capacity](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-ibm-cloud-publicprovisioned-throughput-capacity) Local Storage: [Data is stored in triplicate across 3 servers for data durability](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-disaster-recovery-and-backupin-region-automatic-data-redundancy), in 3 availability zones where available [High availability, disaster recovery, and backup in a data center](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-ibm-cloud-publichigh-availability-disaster-recovery-and-backup-in-a-data-center)
An architecture diagram for disaster recovery for hybrid microservice applications

Some of the significant challenges that are unique to the hybrid DR microservices implementation architecture include the following:

Business continuity
: Business processes can continue to be processed despite man-made or natural disasters.

Operational flexibility
: Having a well-designed solution with code and data in multiple sites allows for flexibility for where applications and data are deployed based on user need and traffic.

Cost reduction
: By placing a DR site in the cloud, not all of the resources need to be always running. This results in cost savings compared to a cold standby at an on premises site.

Review the following functional requirements:



* Support for both SQL and NoSQL databases
* Failover and fallback of the whole application stack must be completely automated, or it must be activated by humans with a single action
* Monitor availability of both primary and backup hosting services
* Alert in case of failures







 Cloud architecture based on two multizone regions (MZRs) 

To design a resilient architecture, you need to consider the individual blocks of your solution and their specific capabilities.

Zoom

![Cloud architecture with two multizone regions](https://cloud.ibm.com/docs-content/v1/content/adcecdbe4e86955f88aac7f3c1e7ec3ff44992ef/overview/images/BCDR-Architecture-Diagram-image2_MZRs.svg)

Figure 2. An architecture diagram for Cloud architecture with two multizone regions

In this example, three different infrastructure solutions are used across two MZRs. To achieve the goal of having a resilient architecture, the required deployment footprint differs between IaaS solutions like VMware and Kernel-based virtual machine (KVM) and Kubernetes (Kubernetes Service and Red Hat OpenShift on IBM Cloud) versus a fully-managed serverless service like Code Engine.





 Network architecture 

Review the following network architecture assumptions:



1. As a baseline, the current architecture and procedures being used today in a dedicated deployment also work in public isolated. This might not be the preferred architecture, but it should be used as a starting point.
* The witness site contains two VMware ESXi™ hosts that provide quorum for both vSAN and vCenter.
* Single vCenter Server and NSX Manager architecture.
* vCenter Server Appliance with embedded Platform Services Controller (PSC) that uses vCenter Server High Availability (HA) over an L3 network architecture.
* NSX Manager recovery is using a Hot Standby method that syncs up backup files.







 Tools and technology architecture specifications 

The tools and technology architecture has the following specifications:



* VMware Aria Operations, VMware Aria Operations for Logs, and VMware Aria Operations for Networks to provide operations and management capabilities specific to the VMware products that are used, for example NSX, vSAN, and vSphere.
* IBM Software Defined Environment (SDE) automation tool health check for validating deployments against best practices and security policies.
* Optional Disaster Recovery (DR) to an out of Region IBM Cloud site.
* FortiGate Security Appliance or similar to secure any internet access and to facilitate active-active network integration with the on-premises network.







 vSphere + vSAN stretched cluster architecture specifications 

The vSphere + vSAN stretched cluster architecture has the following specifications:



* Provides storage and compute capabilities, which span two sites for enhanced availability.
* Write requests from VMs are synchronously written to both sites, which incur site-to-site network latency.
* Read requests from VMs are fulfilled locally to the physical location of where the VM is located, thus avoiding extra latency.
* The witness site and witness host act as the split brain or quorum.
* vSAN native encryption (for at rest encryption) can be used in combination with this architecture.







 Network architecture specifications 

The network architecture has the following specifications:



* Edge/DLR/VXLANs in combination with BGP metric-based routing to facilitate an active-active site design with automated failover.
* Each site has the concept of their own set of Edges, DLRs, and VXLANs.
* Under normal circumstances, any VMs connected to DLR-A, for example VM-A, are in IBM Cloud availability zone #1 and traffic is both ingress and egress locally.
The shown URL should have a pattern like https://worldcities.unique-subdomain.region.codeengine.appdomain.cloud. Click on the link to access the app. Another option to retrieve app details is to visit the [Code Engine console](https://cloud.ibm.com/codeengine).







 Step 6: Security, Backup & Recovery, Monitoring 

The Db2 Warehouse on Cloud is a managed service. IBM takes care of securing the environment, daily backups and system monitoring. When you are using one of the enterprise plans there are [several options to manage access](https://cloud.ibm.com/docs/Db2whc?topic=Db2whc-iam) and to configure [enhanced data encryption](https://cloud.ibm.com/docs/Db2whc?topic=Db2whc-key-protect).

In addition to the traditional administration options the [Db2 Warehouse on Cloud service also offers a REST API for monitoring, user management, utilities, load, storage access and more](https://cloud.ibm.com/apidocs/db2-warehouse-on-cloud/db2-warehouse-on-cloud-v4introduction).





 Step 7: Test the App 

The app to display city information based on the loaded data set is reduced to a minimum. It offers a search form to specify a city name - names are case sensitive - and few preconfigured cities. They are translated to either /search?name=cityname (search form) or /city/cityname (directly specified cities). Both requests are served from the same lines of code in the background. The cityname is passed as value to a prepared SQL statement using a parameter marker for security reasons. The rows are fetched from the database and passed to an HTML template for rendering.





 Step 8: Cleanup 

To clean up resources used by the tutorial, follow these steps:



1. Visit the [IBM Cloud® Resource List](https://cloud.ibm.com/resources).
2. In the Code Engine section locate the project sqldatabase.