vania-janet/multiturn-rag-retrieval-data huggingface dataset:
To ensure that all infrastructure-related actions can be completed in the cluster, the user whose credentials you want to set for the API key must have the proper permissions. Consider using a functional ID user for the API key owner instead of a personal user. In case the person leaves the team, the functional ID user remains the API key owner. Note that you can't use a service ID to set the API key.



1. Log in to the [IBM Cloud console](https://cloud.ibm.com/).
2. To make sure that all account-related actions can be successfully performed, verify that the user has the correct IBM Cloud IAM platform access roles.



1. From the menu bar, select Manage > Access (IAM), and then click the Users page.
2. Click the name of the user who you want to set the API key for or whose credentials you want to set for the API key, and then click the Access policies tab.
3. [Assign the user](https://cloud.ibm.com/docs/openshift?topic=openshift-userschecking-perms) the [minimum permissions that are needed to create and manage clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-access_referencecluster_create_permissions).



3. To make sure that all infrastructure-related actions in your cluster can be successfully performed, verify that the user has the correct infrastructure access policies.



1. From the menu bar, select Manage > Access (IAM).
2. Select the Users tab, click on the user. The required infrastructure permissions vary depending on what type of [cluster infrastructure provider](https://cloud.ibm.com/docs/openshift?topic=openshift-infrastructure_providers) you use, classic or VPC.



* For classic clusters



1. In the API keys pane, verify that the user has a Classic infrastructure API key, or click Create an IBM Cloud API key.
The IBM Cloud platform validates that the user has permission to create the service instance by using IBM Cloud IAM. After this validation occurs, your service broker's creation endpoint (PUT /v2/resource_instances/:resource_instance_id) is started. For the instance to be created, the following rules must be met:



* The IBM Cloud context is included in the context variable
* The X-Broker-API-Originating-Identity has the IBM IAM ID of the user that started the request
* The parameters section includes the requested location (and more parameters that are required by your service).



Example request for creating an instance:

PUT /v2/service_instances/crn%3Av1%3Abluemix%3Apublic%3Acompose-redis%3Aus-south%3Aa%2F46aa677e-e83f-4d17-a2b6-5b752564477c%3A416d769b-682d-4833-8bd7-5ef8778e5b52?accepts_incomplete=true HTTP/1.1
Host: https://broker.compose.cloud.ibm.com
Authorization: basic dXNlcjpwYXNzd29yZA==
X-Broker-Api-Version: 2.12
X-Broker-API-Originating-Identity: ibmcloud aWJtaWQtNDU2MzQ1WA==
{
"service_id": "0bc9d744-6f8c-4821-9648-2278bf6925bb", // your service's GUID from onboarding
"plan_id": "ecc19311-aba2-49f7-8198-1e450c8460d4", //your plan's GUID from onboarding
"context": {
"platform": "ibmcloud",
"account_id": "003e9bc3993aec710d30a5a719e57a80",
/var/run/secrets/kubernetes.io/serviceaccount from default-token-tqp61 (ro)
/volumemount from myvol (rw)
...
Volumes:
myvol:
Type: PersistentVolumeClaim (a reference to a PersistentVolumeClaim in the same namespace)
ClaimName: block-storage-pvc
ReadOnly: false







 Using existing block storage in your cluster 

If you have an existing physical storage device that you want to use in your cluster, you can manually create the PV and PVC to [statically provision](https://cloud.ibm.com/docs/containers?topic=containers-kube_conceptsstatic_provisioning) the storage.

Before you can start to mount your existing storage to an app, you must retrieve all necessary information for your PV.



 Retrieving the information of your existing block storage 



1. Retrieve or generate an API key for your IBM Cloud infrastructure account.



1. Log in to the [IBM Cloud infrastructure portal](https://cloud.ibm.com/classic).
2. Select Account, then Users, and then User List.
3. Find your user ID.
4. In the API KEY column, click Generate to generate an API key or View to view your existing API key.



2. Retrieve the API username for your IBM Cloud infrastructure account.



1. From the User List menu, select your user ID.
2. In the API Access Information section, find your API Username.



3. Log in to the IBM Cloud infrastructure CLI plug-in.

ibmcloud sl init
4. Choose to authenticate by using the username and API key for your IBM Cloud infrastructure account.
5. Enter the username and API key that you retrieved in the previous steps.
6. List available block storage devices.

ibmcloud sl block volume-list

Example output

id username datacenter storage_type capacity_gb bytes_used lunId
Viewer View IDs crn:v1:bluemix:public:iam::::role:Viewer 
 Operator Create and delete IDs and API keys<br><br>View, create, update, and delete IdPs<br><br>Update IAM account setting for service IDs and user API key creation<br><br>Delete trusted profiles crn:v1:bluemix:public:iam::::role:Operator 
 Editor Create and update IDs and API keys<br><br>View and update IdPs<br><br>Update IAM account setting for service IDs and user API key creation<br><br>Update trusted profiles crn:v1:bluemix:public:iam::::role:Editor 
 Administrator Create, update, and delete IDs and API keys<br><br>Assign access policies to IDs<br><br>View, create, update, and delete IdPs<br><br>Update IAM account setting for service IDs and user API key creation<br><br>Create trusted profiles crn:v1:bluemix:public:iam::::role:Administrator 
 User API Key Creator Can create API keys when the account setting to restrict API key creation is enabled. crn:v1:bluemix:public:iam-identity::::serviceRole:UserApiKeyCreator 
 Service ID Creator Can create service IDs when the account setting to restrict service ID creation is enabled. crn:v1:bluemix:public:iam-identity::::serviceRole:ServiceIdCreator 







 IBM Cloud Shell settings 

You can assign users access to view and update IBM Cloud Shell settings for the account. Only the account owner or a user with the IBM Cloud Shell administrator role can view and update the settings.



Table 13. Roles and example actions for the IBM Cloud Shell service

 Roles Actions role_ID value 

 Viewer Not applicable 
 Operator Not applicable 
 Editor Not applicable 
 Administrator View and update IBM Cloud Shell settings crn:v1:bluemix:public:iam::::role:Administrator 
 Cloud Operator Create Cloud Shell environments to manage IBM Cloud resources.
Configure Qiskit Runtime for an organization 

Follow these steps to start setting up Qiskit runtime.



 Step 1: Configure IAM settings 

First, configure some settings in the administrator's Identity and Access Management (IAM) account. To review and configure these settings, go to [Manage → IAM → Settings](https://cloud.ibm.com/iam/settings).



* User list visibility determines whether users can see each other, regardless of project assignment. The enabled setting restricts user visibility. That is, users in your account cannot see each other, even if they can access the same resources. Choose the appropriate value for your environment. See [Controlling user visibility](https://cloud.ibm.com/docs/account?topic=account-iam-user-setting) for more information.
* API key creation controls whether users can create API keys. In Qiskit Runtime, it is common to use API keys. If API keys are being used, choose disabled. Alternatively, you can give specific permissions to each user.



Zoom

![IAM settings](https://cloud.ibm.com/docs-content/v1/content/5f399fa794584e8a662591b494b9a99aa927c74c/quantum-computing/images/org-guide-iam-settings.png)

Figure 1. IAM settings page with User list visibility enabled





 Step 2: (Optional) Create resource groups 

Skip this step if you are using access groups that directly reference Qiskit Runtime service instances.

If you chose to use resource groups, go to [Manage → Account → Resource groups (in Account resources)](https://cloud.ibm.com/account/resource-groups) and click Create.





 Step 3: Create Qiskit Runtime service instances 

If you already created Qiskit Runtime service instances, skip this step.



* If you are using resource groups, make sure to create the service instances on the appropriate resource group.
* NOT_SET - to unset a previous set value.



resource "ibm_iam_account_settings" "iam_account_settings_instance" {
restrict_create_service_id = "RESTRICTED"
}
3. Provision the resources from the main.tf file. For more information, see [Provisioning Infrastructure with Terraform](https://www.terraform.io/cli/run).



1. Run terraform plan to generate a Terraform execution plan to preview the proposed actions.

terraform plan
2. Run terraform apply to create the resources that are defined in the plan.

terraform apply





For more information, see the [Terraform documentation](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/iam_account_settingsrestrict_create_service_id).





 Assigning access to create service IDs with restrictions enabled in the console 

If the Service ID creation setting is enabled, only users, including the account owner, assigned the Service ID creator role on the IAM Identity Service can create service IDs.

The quickest way to assign a group of users the required access for creating service IDs is to create an access group and assign the group the required role. For more information about assigning access policies, see [Setting up access groups](https://cloud.ibm.com/docs/account?topic=account-groups).
Deploying IBM WebSphere Application Server 

The Deploying IBM WebSphere Application Server tutorial describes how you can use [IBM WebSphere Application Server](https://cloud.ibm.com/catalog/content/.::1-b9f20fe3-baac-459b-b047-cb4ae9eb46f2-global) to install a WebSphere Application Server traditional environment on one or more Red Hat® Enterprise Linux® 8.4 virtual server instances (VSIs) on IBM Cloud®.



 Step 1: Prepare for installation 



1. Read the terminology and topology descriptions in [Topologies](https://cloud.ibm.com/docs/was-for-vsi?topic=was-for-vsi-topologies).
2. Check your IBMid and credential for BYOL. To download the WebSphere Application Server installation images, your [IBMid](https://www.ibm.com/account/) must have entitlement to download the required images from IBM Passport Advantage. Check your entitlements at [Passport Advantage Online for customers](https://www.ibm.com/software/passportadvantage/pao_customer.html).
3. Set up your access and SSH key in your account. See the "Before you begin" section of [Getting started with Virtual Private Cloud (VPC)](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-startedprereqs).







 Step 2: Install a WebSphere product 



1. Launch [IBM WebSphere Application Server](https://cloud.ibm.com/catalog/content/.::1-b9f20fe3-baac-459b-b047-cb4ae9eb46f2-global).
2. In the form, set an identifiable name for your installation.
3. Specify all the required parameters. Set a strong password for vsi_os_admin_password and vsi_websphere_admin_password.
4. Review and specify optional parameters as needed.
* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-5.3control-requirements)



[IA-5 (4) - Automated Support for Password Strength Determination](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-5.4ia-5.4)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-5.4control-requirements)
* [IBM Cloud for Financial Services profile](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-5.4scc-fs-cloud-profile)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-5.4nist-supplemental-guidance)



[IA-5 (5) - Change Authenticators Prior to Delivery](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-5.5ia-5.5)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-5.5control-requirements)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-5.5nist-supplemental-guidance)



[IA-5 (6) - Protection of Authenticators](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-5.6ia-5.6)
helm show values iks-charts/strongswan > config.yaml
3. Open the config.yaml file.







 Step 2: Configure basic IPSec settings 

To control the establishment of the VPN connection, modify the following basic IPSec settings.

For more information about each setting, read the documentation provided within the config.yaml file for the Helm chart.



1. If your on-premises VPN tunnel endpoint does not support ikev2 as a protocol for initializing the connection, change the value of ipsec.keyexchange to ikev1.
2. Set ipsec.esp to a list of ESP encryption and authentication algorithms that your on-premises VPN tunnel endpoint uses for the connection.



* If ipsec.keyexchange is set to ikev1, this setting must be specified.
* If ipsec.keyexchange is set to ikev2, this setting is optional.
* If you leave this setting blank, the default strongSwan algorithms aes128-sha1,3des-sha1 are used for the connection.



3. Set ipsec.ike to a list of IKE/ISAKMP SA encryption and authentication algorithms that your on-premises VPN tunnel endpoint uses for the connection. The algorithms must be specific in the format encryption-integrity[-prf]-dhgroup.



* If ipsec.keyexchange is set to ikev1, this setting must be specified.
* If ipsec.keyexchange is set to ikev2, this setting is optional.
* If you leave this setting blank, the default strongSwan algorithms aes128-sha1-modp2048,3des-sha1-modp1536 are used for the connection.



4. Change the value of local.id to any string that you want to use to identify the local Kubernetes cluster side that your VPN tunnel endpoint uses. The default is ibm-cloud. Some VPN implementations require that you use the public IP address for the local endpoint.
5.
You can customize the sign-in flow by [configuring the forgot password process](https://cloud.ibm.com/docs/appid?topic=appid-cd-strength). Additionally, you can [enable single sign-on (SSO)](https://cloud.ibm.com/docs/appid?topic=appid-cd-sso) to provide your users a smooth authentication experience between multiple web apps. App ID provides SSO for Cloud Directory users. Therefore, if enabled, your users do not need to reenter their credentials every time they sign-in. Instead, users are automatically signed in to any of your apps that are protected by the same App ID instance.

With App ID Cloud Directory, you can make the sign-in flow more secure by requiring [multiple authentication factors](https://cloud.ibm.com/docs/appid?topic=appid-cd-mfa). With a second authentication factor, you can increase the security of your application by confirming that a user can access their registered email or phone number.





 Integrate App ID with your own mail provider 

With Cloud Directory, you can send email messages to your users to verify their email address, allow them to reset their password, and more. By default, you can use App ID to deliver the email messages. However, if you choose to define a custom extension point to be called when an email needs to be sent, you can provide a better experience to your users.

For example, [by using your own mail provider](https://cloud.ibm.com/docs/appid?topic=appid-cd-types), you can reduce the chance that your emails get filtered as spam by replacing the default domain with your own recognizable domain. Additionally, you can gain deeper insights directly from your email provider, such as whether your email was delivered and opened. The email insights can help you identify and solve issues since you can track individual messages and see overall statistics.
When VPN connectivity is established, routes are automatically configured on all the worker nodes in the cluster. These routes allow two-way connectivity through the VPN tunnel between pods on any worker node and the remote system. For example, the following diagram shows how an app in IBM Cloud Kubernetes Service can communicate with an on-premises server via a strongSwan VPN connection.

Zoom

![Flow of traffic between your cluster and an on-premises data center through the strongSwan VPN service.](https://cloud.ibm.com/docs-content/v1/content/4d497aff9e27b92fbbc2ee4e343a9ec4549cb1d7/containers/images/cs_vpn_strongswan.png)

Figure 1. Flow of traffic through the strongSwan VPN service



1. An app in your cluster, myapp, receives a request from an Ingress or LoadBalancer service and needs to securely connect to data in your on-premises network.
2. The request to the on-premises data center is forwarded to the IPSec strongSwan VPN pod. The destination IP address is used to determine which network packets to send to the IPSec strongSwan VPN pod.
3. The request is encrypted and sent over the VPN tunnel to the on-premises data center.
4. The incoming request passes through the on-premises firewall and is delivered to the VPN tunnel endpoint (router) where it is decrypted.
5. The VPN tunnel endpoint (router) forwards the request to the on-premises server or mainframe, depending on the destination IP address that was specified in step 2. The necessary data is sent back over the VPN connection to myapp through the same process.







 strongSwan VPN service considerations 

Before using the strongSwan Helm chart, review the following considerations and limitations.



* The strongSwan Helm chart is supported only for classic clusters, and is not supported for VPC clusters.
For more information, see [Connecting to your on-premises network](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-onprem-example). Yes 
 Direct Link With [IBM Cloud® Direct Link](https://cloud.ibm.com/docs/dl?topic=dl-dl-about), you can create a direct, private connection between your remote network environments and IBM Cloud Kubernetes Service without routing over the public internet. The Direct Link offerings are useful when you must implement hybrid workloads, cross-provider workloads, large or frequent data transfers, or private workloads. To choose a Direct Link offering and set up a Direct Link connection, see [Get Started with IBM Cloud Direct Link (2.0)](https://cloud.ibm.com/docs/dl?topic=dl-get-started-with-ibm-cloud-dl). Yes Yes 
 strongSwan IPSec VPN Service Set up a [strongSwan IPSec VPN service](https://www.strongswan.org/about.html) that securely connects your Kubernetes cluster with an on-premises network. The strongSwan IPSec VPN service provides a secure end-to-end communication channel over the internet that is based on the industry-standard Internet Protocol Security (IPSec) protocol suite. To set up a secure connection between your cluster and an on-premises network, [configure and deploy the strongSwan IPSec VPN service](https://cloud.ibm.com/docs/containers?topic=containers-vpnvpn-setup) directly in a pod in your cluster. Yes 
 Transit Gateway Use IBM Cloud Transit Gateway to manage access between your VPCs. Transit Gateway instances can be configured to route between VPCs that are in the same region (local routing) or VPCs that are in different regions (global routing). Additionally, you can use Transit Gateway to manage access between your VPCs in multiple regions to resources in your IBM Cloud classic infrastructure.
The cryptographic strength of P521 EC keys is equivalent to RSA 15360, which means the updated signature keys can provide the higher level of security comparing to the previous signature keys. The previous RSA 2048 signature keys are still valid and can be used.





 28 February 2021 

Added: Key verification by using the PKCS #11 API
: To ensure that no tampering has occurred to the keys that are stored in the Hyper Protect Crypto Services instance by using the PKCS #11 API, a key verification mechanism is now provided for you to check the key objects that are stored in Hyper Protect Crypto Services. For instructions on how to verify key objects, see [Verifying that keys are protected by crypto units](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-pkcs11-api-refpkcs11-key-verify).

For an example of how to retrieve checksum values for AES, DES2, and DES3 keys along with the verification of the key checksums, see [the code sample](https://github.com/IBM-Cloud/hpcs-pkcs11/blob/master/samples/pkcs11-checksum.c).

Added: Support for the Schnorr algorithm
: Hyper Protect Crypto Services now supports the Schnorr algorithm, which can be used as a signing scheme to generate digital signatures. It is proposed as an alternative algorithm to the Elliptic Curve Digital Signature Algorithm (ECDSA) for cryptographic signatures in the Bitcoin system. Before you can use the Schnorr algorithm, make sure to enable this feature by following the instructions in [Enabling the Schnorr algorithm](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-enable-mechanismsenable-schnorr).





 31 January 2021 

Added: Support for a single-tenant KMIP adapter
: Hyper Protect Crypto Services now provides a single tenant KMIP adapter to manage the key distribution in the vSphere or vSAN environment.
[Follow the instructions](https://cloud.ibm.com/docs/openshift?topic=openshift-helminstall_v3) to install the version 3 Helm client on your local machine.
2. Save the default configuration settings for the strongSwan Helm chart in a local YAML file.

helm show values iks-charts/strongswan > config.yaml
3. Open the config.yaml file.







 Step 2: Configure basic IPSec settings 

To control the establishment of the VPN connection, modify the following basic IPSec settings.

For more information about each setting, read the documentation provided within the config.yaml file for the Helm chart.



1. If your on-premises VPN tunnel endpoint does not support ikev2 as a protocol for initializing the connection, change the value of ipsec.keyexchange to ikev1.
2. Set ipsec.esp to a list of ESP encryption and authentication algorithms that your on-premises VPN tunnel endpoint uses for the connection.



* If ipsec.keyexchange is set to ikev1, this setting must be specified.
* If ipsec.keyexchange is set to ikev2, this setting is optional.
* If you leave this setting blank, the default strongSwan algorithms aes128-sha1,3des-sha1 are used for the connection.



3. Set ipsec.ike to a list of IKE/ISAKMP SA encryption and authentication algorithms that your on-premises VPN tunnel endpoint uses for the connection. The algorithms must be specific in the format encryption-integrity[-prf]-dhgroup.



* If ipsec.keyexchange is set to ikev1, this setting must be specified.
* If ipsec.keyexchange is set to ikev2, this setting is optional.
* If you leave this setting blank, the default strongSwan algorithms aes128-sha1-modp2048,3des-sha1-modp1536 are used for the connection.



4.