vania-janet/multiturn-rag-retrieval-data huggingface dataset:
4.0.9, 25 May 2022 



* Discovery generates a partial failure status message for the IBM Cloud Pak for Data Red Hat OpenShift APIs for Data Protection (OADP) backup and restore utility.



* Error: When you check the status of the OADP backup utility after using it to backup a cluster where Discovery is installed, a Phase: PartiallyFailed message is displayed. One or more Discovery components are included in the Failed list.
* Cause: Discovery cannot be backed up and restored by using the OADP backup and restore utility. When the Discovery service is present, and an administrator backs up an entire IBM Cloud Pak for Data instance, a status message is displayed that indicates a partial failure. This status is displayed because the persistent volume claims (PVCs) for Discovery are not backed up. However, the message does not impact the back up of the rest of the services.
* Solution: No action is required to resolve the status message. You can remove the persistent volume claims that are associated with the Discovery service separately. After using the scripts to back up your Discovery service data, you can follow the step that is documented in the uninstall instructions for the Discovery service to delete the PVCs. For more information about how to remove the PVC associated with Discovery, see [Uninstalling the Discovery service](https://www.ibm.com/docs/en/cloud-paks/cp-data/4.0?topic=discovery-uninstalling-service).









 4.0.8, 27 April 2022 



* The wd-discovery-multi-tenant-migration job fails if anyone besides a system administrator performs the upgrade.



* Error: When you upgrade with a user ID other than admin, the migration job fails.
* Cause: The migration script assumes that the script is run by a user with the admin user ID.
* Solution: Apply a patch that allows the migration to be successful. Complete the following steps:



1. From the Cloud Pak for Data web client, get the user ID of the owner of the instance that you want to upgrade.
2.
<br><br> * rate_increase_percent - Auto scaling rate in increase percent. -> [Scale up by rate_increase_percent]<br><br><br> 
 <br><br> * rate_limit_mb_per_member - Auto scaling rate limit in megabytes per member. [Scale up by rate_increase_percent every rate_period_seconds up to rate_limit_mb_per_member]<br><br><br> 
 <br><br> * rate_period_seconds - Auto scaling rate period in seconds. -> [Scale up by rate_increase_percent every<br><br><br> 
 <br><br> * rate_units - Auto scaling rate in units.<br><br><br> 
 tags A list of tags that you want to add to your instance. 
 whitelist A list of allowed IP addresses for the database. Multiple blocks are allowed.Nested scheme for whitelist: 
 <br><br> * address - The IP address or range of database client addresses to be whitelisted in CIDR format.<br><br><br> 
 -description - A description for the allowed IP addresses range. 
 backup_id The CRN of a backup resource to restore from. The backup is created by a database deployment with the same service ID. The backup is loaded after provisioning and the new deployment starts up that uses that data. 
 backup_encryption_key_crn The CRN of a key protect key, that you want to use for encrypting disk that holds deployment backups. 
 key_protect_key The root key CRN of a Key Management Services like Key Protect or Hyper Protect Crypto Service (HPCS) that you want to use for disk encryption. 
 key_protect_instance The instance CRN of a Key Management Services like Key Protect or Hyper Protect Crypto Service (HPCS) that you want to use for disk encryption. 
 remote_leader_id A CRN of the leader database to make the replica(read-only) deployment. The leader database is created by a database deployment with the same service ID.
Creating key: 'my-imported-root-key', in instance: '390086ac-76fa-4094-8cf3-c0829bd69526'...
OK
Key ID Key Name
4241a9b3-0ee0-4cfd-b0f3-fd80505fb675 my-imported-root-key





 Example 5 

Create a standard key.

 create a standard key
$ ibmcloud kp key create my-standard-key -s

Creating key: 'my-standard-key', in instance: '390086ac-76fa-4094-8cf3-c0829bd69526'...
OK
Key ID Key Name
12d3f3a4-aea5-4832-8339-fa14dbffd935 my-standard-key





 Example 6 

Create a standard key, which is used as a vault for credentials.

Any base64-encoded string can be imported as a standard key. This example shows how to store credentials, not just encryption keys, in Key Protect.

Standard keys can be up to 7,500 bytes in size before base64-encoding.

 create a file with your credentials
$ cat credentials.json

{
"host": "localhost",
"database": "dev-backup",
"username": "my-username",
"password": "my-password"
}

 encode the credentials (or any string) to a base64 string
$ ENCODED=$(base64 -i credentials.json)

$ echo $ENCODED

ewoJImhvc3QiOiAibG9jYWxob3N0IiwK...<redacted>...cGFzc3dvcmQiCn0K

 create a new key that contains the base64-encoded credentials
$ ibmcloud kp key create credentials-key -i $KP_INSTANCE_ID --key-material $ENCODED --standard-key --output json

 OR...
You can also generate a second transition encryption key to serve as a backup "trusted shared secret." If the token provided by the user is not valid based on the primary encryption key, the Edge server checks the token using the transition key. This ensures that users are not denied access if you are in the process of rotating the primary key.

This assumes that you transitioned to generating your tokens with the transition key for some period of time before updating the encryption key value.
2. Generate the token.

The following is an example that uses [Python SDK](https://github.com/akamai/EdgeAuth-Token-Python) to generate the token with the primary or the transition key that is generated in [step 1](https://cloud.ibm.com/docs/CDN?topic=CDN-working-with-token-authenticationcreate-encryption-key).

!/usr/bin/python
 -- coding: UTF-8 --

from akamai.edgeauth import EdgeAuth, EdgeAuthError

ET_TOKEN_NAME = '__token__' token name
ET_ENCRYPTION_KEY = '87e23a68764b79b4deb46a521ae7a8a49f156460e6461f3b6cc633bf8a548381' Encryption key
DEFAULT_WINDOW_SECONDS = 5000 The token valid time in seconds

et = EdgeAuth({'token_name': ET_TOKEN_NAME,
'key': ET_ENCRYPTION_KEY,
'window_seconds': DEFAULT_WINDOW_SECONDS})

acl_path = ["/private/"] The path(s) you want to protect
token = et.generate_acl_token(acl_path)

print('token: ', token)
Show more

This code generates a token that is a string, and looks like the following:
Unattached iops update supported false
Busy false
Tags env:test,env:prod

Capacity, indicated in megabytes, can range 10 - 16,000 GBs. If not specified, the default capacity is 100 GBs. IOPS values can be 100 - 48,000 IOPS, depending on the profile and volume size. If not specified, the IOPS value defaults to the valid configuration per volume profile. For more information, see the table of [custom IOPS](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-profilescustom).

The volume name can be up to 63 lowercase alpha-numeric characters and include the hyphen (-), and must begin with a lowercase letter. Volume names must be unique across the entire VPC infrastructure.

Note the volume ID. You need to specify the ID when you attach Block Storage for VPC to a virtual server instance, view Block Storage for VPC volume details, or delete volumes.

The volume health state shows inapplicable while the volume status is pending. After the volume is created, the health state shows OK, unless the creation failed. For more information, see [Block Storage for VPC volume health states](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-block-storage&interface=cliblock-storage-vpc-health-states).

User tags are added to identify the volume resource. When these tags are matched with the tags in a backup policy, the volume is backed up according to the schedule in the backup plan. For more information, see [Creating a backup policy](https://cloud.ibm.com/docs/vpc?topic=vpc-backup-policy-create).





 Creating a stand-alone Block Storage for VPC volume with customer-managed encryption from the CLI 

To create a block storage volume with customer-managed encryption from the CLI, use the ibmcloud is volume-create command with the --encryption-key option. The encryption_key option needs a valid CRN for the root key in the key management service.
After you connect to IBM Cloud Object Storage, the appliance needs to be placed in recovery mode to sync the metadata content of the original backup data from IBM Cloud Object Storage.

Use the following steps to place the AltaVault appliance in recovery mode.

The AltaVault appliance syncs data from IBM Cloud Object Storage. Note: The time it takes to complete the sync depends on the size and number of backups that are being restored.



1. Go to the AltaVault appliance, log in, and enter the commands that are shown in Figure 3:
![Figure 3](https://cloud.ibm.com/docs-content/v1/content/daaf82729a2761a117348c80991949080773f289/virtualization/images/veeam_restore_fig5.png)
Figure 5: Recovery mode commands
2. Return to the AltaVault appliance web console after the sync process completes.
3. Verify that the Storage Optimization Service is running and that it's Status is ready. It might take a few minutes for the Status to change to ready.







 Configure the CIFS/SMB Mount Point in AltaVault 

After the internal connection to IBM Cloud Object Storage is established, configured the e0b interface to access a CIFS/SMB mount point.



1. In the AltaVault web console, go to Settings > Data Interfaces.
2. Expand the e0b interface and select Enable Data Interface, if necessary.
3. Enter the IP address, subnet mask, and gateway that you want to use to mount the CIFS/SMB share. Make sure to use a different subnet than the one that is used for the primary interface.
4. Leave the default MTU value of 1500 bytes.



* Although the default maximum transmission unit (MTU) is 1,500, you can change it to 9,000 if you are using jumbo frames. Your ESXi host and physical infrastructure need to support jumbo frames. By default, IBM Cloud supports an MTU size of 9,000 bytes with no configuration changes needed.
$ ibmcloud kp key create my-standard-key -s

Creating key: 'my-standard-key', in instance: '390086ac-76fa-4094-8cf3-c0829bd69526'...
OK
Key ID Key Name
12d3f3a4-aea5-4832-8339-fa14dbffd935 my-standard-key





 Example 6 

Create a standard key, which is used as a vault for credentials.

Any base64-encoded string can be imported as a standard key. This example shows how to store credentials, not just encryption keys, in Key Protect.

Standard keys can be up to 7,500 bytes in size before base64-encoding.

 create a file with your credentials
$ cat credentials.json

{
"host": "localhost",
"database": "dev-backup",
"username": "my-username",
"password": "my-password"
}

 encode the credentials (or any string) to a base64 string
$ ENCODED=$(base64 -i credentials.json)

$ echo $ENCODED

ewoJImhvc3QiOiAibG9jYWxob3N0IiwK...<redacted>...cGFzc3dvcmQiCn0K

 create a new key that contains the base64-encoded credentials
$ ibmcloud kp key create credentials-key -i $KP_INSTANCE_ID --key-material $ENCODED --standard-key --output json

 OR... CAPTURE THE KEY_ID
$ KEY_ID=$(ibmcloud kp key create credentials-key -i $KP_INSTANCE_ID --key-material $ENCODED --standard-key --output json | jq -r '.["id"]')

{
"id": "8480e26f-3add-4fff-bca7-8cf908894b7c",
Click Jobs to load the job options.
3. Click Select job Task and select *Restore.
4. Confirm the vault, computer, and job information and click Okay.
5. Enter the encryption password of the previous backup.
6. The Restore Options window appears. By default, it displays the most recent safe set. To choose a different date, click the Calendar icon and view other safe sets.
7. Select the files and directories that you want to include. Then, click Include to save your choices.

Default restore options place the files in their original location. If files exist in the destination folder with the same name, the incoming file is renamed. These options can be changed and alternative restore location can be selected from Restore Destination options.
8. When your restore set is configured the way that you want it, click Apply Now.
9. Then, click Run Restore.
10. The files are restored when the Status displays Restore completed on the Process Details screen.
* Error: The utility does not complete successfully and the following message is written to the log: preBackupViaConfigHookRule on backupconfig/watson-discovery in namespace cpd (status=error)
* Cause: Discovery cannot be backed up and restored by using the OADP backup and restore utility. When the Discovery service is present, and an administrator attempts to backup an entire IBM Cloud Pak for Data instance, Discovery prevents the utility from completing successfully.
* Solution: Apply a patch that stops Discovery from preventing the utility from completing successfully.



1. Download the wd-aux-br-patch.zip file from the [Watson Developer Cloud Github](https://github.com/watson-developer-cloud/doc-tutorial-downloads/blob/master/discovery-data/latest/wd-aux-br-patch.zip) repository.
2. Extract the wd-aux-br-patch.yaml file from the ZIP file.
3. Run the following command in a terminal that is logged in to the cluster:

oc create -f wd-aux-br-patch.yaml





The issue is fixed with the 4.0.8 release. (You still cannot back up the Discovery service by using the OADP utility, but the OADP utility can back up other services when Discovery is installed.)
* Deployed status of resources fluctuates after the 4.0.7 upgrade is completed.



* Error: When you check the status by submitting the oc get WatsonDiscovery command, the ready status of the resources toggles between showing 23/23 and 20/23 components as being ready for use.
* Cause: The readiness state of the resources is not reported consistently after a migration.
* Solution: Typically, the instance is ready for use despite the ready state instability. To manually refresh the status information, run the following commands in a terminal that is logged in to the cluster:

oc proxy &
Provision a service instance 

To deploy an IBM® Db2® on Cloud service, you need to create a Db2 on Cloud service instance.

You can provision a deployment by visiting the service's catalog page or by specifying the service ID to the command line, or to the API. The deployment type is determined by the service ID, which you must specify when you create a Db2 on Cloud deployment by using the command line or API.



 Deployment Type Catalog Page Service ID Plan IDs 

 Db2 on Cloud [Link](https://cloud.ibm.com/catalog/services/db2) dashdb-for-transactions dashDBNebula, dashDBStandard 





 Using the catalog 

When you create the deployment from the catalog, you need to specify the following parameters.



1. Service name - The name can be any string and is the name that is used on the web and in the command line to identify the new deployment.
2. Region - The region in which the deployment resides.
3. Backup Location - The location of the deployment's backups. Users can choose Cross Regional or Regional backups. Cross Regional backups can be stored across multiple regions in one zone. Whereas, Regional backups can be stored in one region only.
4. Resource group - If you are organizing your services into resource groups, you can specify the resource group in this field. Otherwise, you can leave it at default.
5. KMS instance and disk encryption key - If you use Key Protect or Hyper Protect Crypto Services, an instance and key can be selected to encrypt the deployment's disk. If you do not use your own key, the deployment automatically creates and manages its own disk encryption key using the Key Protect service. If you would like to use HPCS for encryption, you must [provision an HPCS instance](https://cloud.ibm.com/docs/docs/hs-crypto?topic=hs-crypto-provision&interface=ui) and generate or import a key. Currently, HPCS is not EU-Cloud enabled.
6.
$kb exec -it $Mongo_container -- sh -c 'mongorestore --username='${MONGO_USER}' --password='${MONGO_PASS}' --nsInclude=ibm.* --verbose --authenticationDatabase=admin /tmp/dump'
}

 Restore DSB Manager
RestoreBM()
{
echo "BM Restore..."
BM_FILE=$(basename $BM_DUMP_FILE)
echo "BM_FILE ==> "$BM_FILE
$kb cp $BM_DUMP_FILE $NAMESPACE/$BM_container:/tmp/$BM_FILE
$kb exec -it $BM_container -- sh -c 'tar -xmvf /tmp/'$BM_FILE

$kb exec -it $BM_container -- sh -c 'cp -pr /tmp/opt/dsb/dsb-manager/config /opt/dsb/dsb-manager/'
}

RestoreMongo
RestoreBM
Show more



1. Open a new browser tab and log into Data Security Broker Manager after you have finished executing the script. Verify that the original configurations of the applications, databases, and key stores have been restored.
2. For all of the applications of Data Security Broker Manager, with data security policies, deploy new Data Security Broker Shields by adhering to the deployment procedures. Ensure that the Helm chart is updated with the appropriate Sync ID for each application.
3. Log into Data Security Broker Manager after the Data Security Broker Shield have been deployed to ensure that the newly installed Data Security Broker Shields are in the RUNNING status.







 Best Practices for backups and restore: 





 Setting Up Configuration backup in IBM Cloud Object Storage 

It is recommended to store the database configuration and the backup objects in a Object Storage instance. The backup is stored in a separate cloud account with Object Storage buckets created.
Hyper Protect Crypto Services Unified Key Orchestrator API change log 

In this change log you can learn about the latest changes, improvements, and updates for the IBM Cloud® Hyper Protect Crypto Services Unified Key Orchestrator API. The change log lists changes that have been made, ordered by the date they were released. Changes to existing API versions are designed to be compatible with existing client applications.



  API versioning 

The latest released version is 4.9.5. The Unified Key Orchestrator API version is aligned with the IBM Enterprise Key Management Foundation - Web Edition (EKMF Web) API version.





  December 2022 

The following methods are added:



*  Rotate a managed key
*  List managed key versions







  October 2022 

The following methods are added or updated:



*  (Added) Sync a managed key in keystores
*  (Updated) Create an internal keystore or a keystore connection - Add Google Cloud KMS keystore support
*  (Updated) Create a key template - Add Google Cloud KMS key template support







  July 2022 

The following methods are added:



*  List associated resources for a manged key
*  List associated resources for a target keystore







  June 2022 

A software development kit (SDK) for Golang is provided along with API method examples.





  March 2022 

The following methods are introduced:



*  List managed keys
*  Create a managed key
*  Delete a managed key
*  Retrieve a managed key
*  Update a managed key
*  Retrieve distribution status for all keystores
*  Update a managed key to match the key template
*  Activate a managed key
*  Deactivate a managed key
*  Destroy a managed key
*  List key templates
*  Create a key template
*  Delete a template
*  Retrieve a key template
*  Update a key template
*  List all target keystores
*  Create an internal keystore or a keystore connection
*  Delete an internal keystore or a connection to an external keystore
*  Retrieve a target keystore
*  Update an internal keystore or a keystore connection
*  Retrieve target keystore status
*  List managed keys on the target keystore
*  List all vaults
*  Create a vault
*  Delete an existing vault
*  Retrieve a vault
*  Update a vault
Encryption 

IBM Cloud® for VMware® Regulated Workloads relies upon VMware vSphere® encryption to secure management and production VMs while at-rest or in-transit. VMware vSphere encryption applies to all types of VMware storage, including vSAN storage. With vSphere encryption solution, VMware vCenter Server® and your ESXi™ hosts connect to a key management server to get the required encryption keys. These keys are used to protect individual virtual machine (VM) disks, according to your VM storage policies.

As vSphere encryption operates at the VM disk level, it can prevent regulated data exposure if loss of physical disk drives or loss of VM disks occurs. Many backup and replication technologies cannot back up or replicate effectively if the VM is encrypted. It is also notable, that vSphere encryption is not compatible with cross-vCenter vMotion, VMware HCX™, or Zerto. However, when properly configured, Veeam Backup and Replication is compatible with vSphere encryption.



 Hyper Protect Crypto Services 

IBM Cloud Hyper Protect Crypto Services (HPCS) is a key management service (KMS) that supports Keep Your Own Key (KYOK). HPCS is accessible through

[Enterprise PKCS#11 (EP11)](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-use-casesvmware-encryption-kyok), but VMware vSphere encryption supports only a key management system (KMS) that uses the KMIP standard. Therefore, the KMIP adapter is required to act as an adapter between the vCenter Server appliance and HPCS.

IBM Cloud HPCS is backed by a FIPS 140-2 level 4 certified hardware security module (HSM). At a high level, the IBM HPCS consists of the following components.



* Crypto unit - a singular unit that represents a piece of hardware, the HSM, and the corresponding software stack, both are dedicated to a single tenant.
* Service instance - a cluster of crypto units, which operates as a single logical entity to provide redundancy and scalability.
Key alias (Optional) One or more unique, human-readable aliases that you want to assign to your key for easy recognition. Alias size can be 2 - 90 characters. You can set up to five key aliases for the key, with each separated by a comma.<br><br>Note: Each alias must be alphanumeric, case-sensitive, and cannot contain spaces or special characters other than dashes (-) or underscores (_). The alias cannot be a version 4 UUID and must not be a Hyper Protect Crypto Services reserved name: allowed_ip, key, keys, metadata, policy, policies, registration, registrations, ring, rings, rotate, wrap, unwrap, rewrap, version, versions. 
 Key ring ID Select a key ring from the list that contains the existing key rings. If you don't assign a key ring, the key is added to the default key ring. For more information about key rings, see [Managing key rings](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-managing-key-rings). 
 Key material The base64 encoded key material, such as a symmetric key, that you want to manage in the service. For more information, see [Base64 encoding your key material](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-import-standard-keysencode-key-material-standard-key). Ensure that the key material meets the following requirements:<br><br><br><br> * The key can be up to 7,500 bytes.<br> * The key must be base64-encoded.<br><br><br> 
 Expiration date (Optional) Set the date and time when the key gets expired. After the expiration date, the key moves into the Deactivated state. For more information about key state, see [Monitoring the lifecycle of encryption keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-key-states). 
 Description (Optional) Add an extended description for your key.