vania-janet/multiturn-rag-retrieval-data huggingface dataset:
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-22T18:45:14Z",
"lastUpdated": "2020-06-22T18:45:14Z",
"updatedBy": "user id ...<redacted>...",
"policy_type": "dualAuthDelete",
"policy_data": { "enabled": true
}
}
]

 disable the instance dual authorization policy
$ ibmcloud kp instance policy-update dual-auth-delete --disable

Updating instance policy...
OK

 list the instance policies
$ ibmcloud kp instance policies --output json

[
{
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-22T18:45:14Z",
"lastUpdated": "2020-06-22T18:51:33Z",
"updatedBy": "user id ...<redacted>...",
"policy_type": "dualAuthDelete",
"policy_data": { "enabled": false
}
}
]





 Example 2 

This example enables the dual authorization delete policy and creates a new key to show how a new key inherits the instance policy.

Disabling the dual authorization policy for an instance does not change the policy for existing keys. The instance policy applies to new keys created after the policy is updated.

 enable the instance dual authorization policy
$ ibmcloud kp instance policy-update dual-auth-delete --enable

Updating instance policy...
OK

 create a new key
$ ibmcloud kp key create my-protected-key
"maxAllowedRetrievals": 1
}' > createImportTokenResponse.json

In the request body, you can specify a policy on the import token that limits its use based on time and usage count. In this example, you set the expiration time for the import token to 1200 seconds (20 minutes), and you also allow only one retrieval of that token within the expiration time.
3. View details for the import token.

jq '.' createImportTokenResponse.json

The output displays the metadata that is associated with your import token, such as its creation date and policy details. The following snippet shows example output.

{
"creationDate": "2019-04-08T16:58:29Z",
"expirationDate": "2019-04-08T17:18:29Z",
"maxAllowedRetrievals": 1,
"remainingRetrievals": 1
}







 Step 4. Retrieve the import token 

In the previous step, you created an import token and you viewed the metadata that is associated with the token.

{
"creationDate": "2019-04-08T16:58:29Z",
"expirationDate": "2019-04-08T17:18:29Z",
"maxAllowedRetrievals": 1,
"remainingRetrievals": 1
}

In this step, you retrieve the public encryption key and nonce value that are associated with the import token. You need the public key to encrypt data in a later step, and the nonce to verify your secure import request to the Key Protect service.

To retrieve the import token contents:



1. Retrieve the import token that you generated the previous step, and then save the response to a JSON file.
ibmcloud cos bucket-create --bucket BUCKET_NAME [--class CLASS_NAME] [--ibm-service-instance-id ID] [--region REGION] [--output FORMAT]

Parameter values:



* BUCKET_NAME: Any name of your choice
* ID: The value of GUID from the response the of Cloud Object Storage creation call
* REGION: The IBM Cloud region in which the Cloud Object Storage instance was created
* FORMAT: Output format can be JSON or text.



Example
: Enter:

ibmcloud cos bucket-create --bucket test-cos-storage-bucket --region us-south --ibm-service-instance-id ebad3176-8a1a-41f2-a803-217621bf6309 --output json
7. Create Cloud Object Storage service keys:

Action
: Enter:

ibmcloud resource service-key-create NAME [ROLE_NAME] ( --instance-id SERVICE_INSTANCE_ID | --instance-name SERVICE_INSTANCE_NAME | --alias-id SERVICE_ALIAS_ID | --alias-name SERVICE_ALIAS_NAME) [--service-id SERVICE_ID] [-p, --parameters @JSON_FILE|JSON_TEXT] [-g RESOURCE_GROUP] [--service-endpoint SERVICE_ENDPOINT_TYPE] [--output FORMAT] [-f, --force] [-q, --quiet]

Parameter values:



* NAME: Any name of your choice
* [ROLE_NAME]: This parameter is optional. The access role, for example, Writer or Reader
* SERVICE_INSTANCE_ID: The value of GUID from the response the of Cloud Object Storage creation call
* SERVICE_INSTANCE_NAME: The value of NAME from the response the of Cloud Object Storage creation call
* JSON_TEXT: The authentication to access Cloud Object Storage. Currently only HMAC keys are supported.



Example
: Enter:
Then, click Show to display the API key. Or, click Copy to copy and save it for later, or click Download.



For security reasons, the API key is only available to be copied or downloaded at the time of creation. If the API key is lost, you must create a new API key.





 Creating an API key by using the CLI 

To create an API key by using the CLI, use the following command:



1. Enter ibmcloud iam api-key-create NAME [-d DESCRIPTION] [-f, --file FILE] in your command prompt, and specify a name, description, and file for saving your key. See the following example:



ibmcloud iam api-key-create MyKey -d "this is my API key" --file key_file





 Creating an API key by using the API 

To create an API key, call the [IAM Identity Service API](https://cloud.ibm.com/apidocs/iam-identity-token-api?code=gocreate-api-key) as shown in the following example:



* Curl
* Java
* Python
* Go
* Node



curl -X POST 'https://iam.cloud.ibm.com/v1/apikeys' -H 'Authorization: Bearer TOKEN' -H 'Content-Type: application/json' -d '{
"name": "My-apikey",
"description": "my personal key",
"iam_id": "IBMid-123WEREW",
"account_id": "ACCOUNT_ID"
"store_value": false
}'

CreateApiKeyOptions createApiKeyOptions = new CreateApiKeyOptions.Builder()
.name(apiKeyName)
.iamId(iamId)
.description("Example ApiKey")
.build();

Response<ApiKey> response = service.createApiKey(createApiKeyOptions).execute();
ApiKey apiKey = response.getResult();
b - location: us-south (same region as KP)
 c - checkbox: Key Protect
 d - instance: my-kms-1
 e - key name: my-cos-key
 f - button: Create bucket

 capture the name of the COS bucket that was created
$ COS_BUCKET=my-cos-kms-bucket

 view the KP registration; it's a result of creating the COS bucket
$ ibmcloud kp registrations --output json

[
{
"keyId": "2cbea94c-6070-4a24-b0f8-7a56e4d7cb6f",
"resourceCrn": "crn:v1:bluemix:public:cloud-object-storage:global:a/ea998d3389c3473aa0987652b46fb146:4b636e74-f3ca-40bb-80b8-3bd21801ccb8:bucket:my-cos-kms-bucket",
"createdBy": "crn-crn:v1:bluemix:public:cloud-object-storage:global:a/ea998d3389c3473aa0987652b46fb146:4b636e74-f3ca-40bb-80b8-3bd21801ccb8::",
"creationDate": "2020-06-15T16:07:37Z",
"lastUpdated": "2020-06-15T16:07:37Z",
"keyVersion": { "id": "2cbea94c-6070-4a24-b0f8-7a56e4d7cb6f", "creationDate": "2020-06-15T16:05:53Z"
}
}
]

 list the bucket
$ ibmcloud cos list-buckets --ibm-service-instance-id $COS_INSTANCE_ID

OK
"created_by": "iam-ServiceId-9ca2000007-f0000d-400000e-8b02-ed6b000000",
"creation_date": "2022-01-25T19:22:04Z",
"downloaded": true,
"id": "00000ea00-7d0000-0000ce-c0002a-0a0000f4b3ee",
"payload_available": false
},
{
"created_by": "iam-ServiceId-9ca2000007-f0000d-400000e-8b02-ed6b000000",
"creation_date": "2022-01-27T21:05:25Z",
"downloaded": false,
"id": "00000ea00-7d0000-0000ce-c0002a-0a0000f4b3ee",
"payload_available": true
}
],
"versions_total": 2
},
"wrap_info": null,
"warnings": null,
"auth": null
}

A request to rotate a kv secret in an existing secret group returns the following response:

{
"request_id": "e00000b-0000-0ad1-beb0-00000d0000",
"lease_id": "",
"renewable": false,
"lease_duration": 0,
"data": {
"created_by": "IBMid-662001YC6X",
"creation_date": "2022-01-26T20:11:29Z",
Create keys and generate the Certificate Signing Request (CSR) 

You can create a key pair to generate a Certificate Signing Request (CSR). In addition, you'll need the key pair to order or request a certificate to further configure the HSM for the Citrix Netscaler VPX.



1. First, confirm the object list in VPX. Use the specified password for this partition during creation.

root@IBMADC690867-s6dr cmu list
Please enter password for token in slot 0 : 	

This output confirms no objects exist as the output is blank/empty.

Then verify the object count is 0 in the HSM by displaying the partition details:

[jpmongehsm2] lunash:>partition show -p partition6

Partition Name: partition6
Partition SN: 534071053
Partition Label: partition6
Partition Owner Locked Out: no
Partition Owner PIN To Be Changed: no
Partition Owner Login Attempts Left: 10 before Partition Owner is Locked Out
Legacy Domain Has Been Set: no
Partition Storage Information (Bytes): Total=207559, Used=0, Free=207559
Partition Object Count: 0

Command Result : 0 (Success)

The command listed in the previous example uses the following syntax:

partition show -p <partition_name>
2. Using the Certificate Management Utility (CMU) in VPX, create a key pair using the command shown in the following example. Once again, use the designated partition password.

root@IBMADC690867-s6dr cmu gen -modulusBits=2048 -publicExponent=65537 -sign=T -verify=T -label=NSkey_s6dr
Please enter password for token in slot 0 : 

Select RSA Mechanism Type -
[1] PKCS [2] FIPS 186-3 Only Primes [3] FIPS 186-3 Auxiliary Primes : 1
csi:
driver: efs.csi.aws.com
volumeHandle: <aws_efs_fileshare_ID>
2. Create the PV in your cluster.

oc apply -f pv.yaml
3. Verify that the PV is created. Note that the PV remains in an Available status as no matching PVC is found yet.

oc get pv

Example output

NAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS CLAIM STORAGECLASS REASON AGE
efs 5Gi RWO Retain Available sat-aws-file-gold 34m



3. Create a persistent volume claim (PVC) that matches the PV that you created.



1. Create a YAML configuration file for your PVC. In order for the PVC to match the PV, you must use the same values for the storage class and the size of the storage.

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: efs
spec:
accessModes:
- ReadWriteOnce
storageClassName: Enter the custom storage class that you created earlier.
resources:
requests:
storage: 5Gi
2. Create the PVC in your cluster.

oc apply -f pvc.yaml
3. Verify that the PVC is created. Make sure that the PVC is in a Bound status and that the name of the PV that you created earlier is listed in the VOLUME column.

oc get pvc

Example output

NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS AGE
efs Bound efs 5Gi RWO sat-aws-file-gold 36m



4. Create a YAML configuration file for a pod that mounts the PVC that you created. The following example creates an nginx pod that writes the current date and time to a test.txt file on your AWS EFS volume mount path.

apiVersion: v1
kind: Pod
metadata:
name: app
spec:
containers:
- name: app
image: nginx
command: ["/bin/sh"]
Snapshot Optionally, click Select snapshot to create the volume with data from the selected snapshot. You can create data volumes with Nonbootable snapshots, and boot volumes with Bootable snapshots. For more information, see [Create a stand-alone Block Storage for VPC volume from a snapshot](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-block-storagecreate-vol-from-snapshot-ui). 
 Profile IOPS tiers are shown by default. Click the tab for Custom IOPS. 
 For [IOPS tiers](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-profilestiers), select the tile with the performance level that you require and specify the volume size in GBs. Volume sizes can be 10 - 16,000 GB. 
 For [Custom](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-profilescustom) IOPS, specify the size of your volume and IOPS range based on the size of the volume. As you type the IOPS value, the UI shows the acceptable range. You can also click the storage size link to see a table of size and IOPS ranges. For more information, see [Custom IOPS profile](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-profilescustom). 
 Encryption Encryption with IBM-managed keys is enabled by default on all volumes. You can also choose Customer Managed and use [your own encryption key](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-vpc-encryption). 



4. When you're finished, click Create volume. You're returned to the Block Storage for VPC volumes page, where a message indicates that the volume is being created (volume status is pending). A second message displays when the volume is created (volume status is available).
5. To see details of the new volume, select the View resource link in the second message to go to the Volume details page.
show the created token
$ ibmcloud kp import-token show

{
"nonce": "8rf2ldP/zWm1Tjrb",
"payload":
"LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0t ...<redacted>... QyBLRVktLS0tLQo="
}

 extract the nonce that was created by the "kp import-token create" command
$ ibmcloud kp import-token show | jq -r '.["nonce"]'

8rf2ldP/zWm1Tjrb

 extract the public key that was created by the "kp import-token create" command
$ ibmcloud kp import-token show | jq -r '.["payload"]'

LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0t ...<redacted>... QyBLRVktLS0tLQo=





 Required parameters 



* -i, --instance-id

The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.









 kp instance policies 

Retrieve details about instance policies, such as allowed networks (public-and-private or private-only), allowed IP policies, key create import access, metrics, and dual-authorization delete (deleting a key requires an authorization from two users).

ibmcloud kp instance policies
[-i, --instance-id INSTANCE_ID]
[-p, --allowed-ip]
[-a, --allowed-network]
[-d, --dual-auth-delete]
[-k, --key-create-import-access]
[-m, --metrics]
[-o, --output OUTPUT]
[-r, --rotation]



 Example
For more information, see [Create a agent](https://cloud.ibm.com/apidocs/schematics/schematics_internal_v1create-agent-data) using API.

Example

POST /v2/agents HTTP/1.1
Host: schematics.cloud.ibm.com
Content-Type: application/json
Authorization: Bearer

{
"name": "agentb1-gsmforvpc-mar17",
"description": "Create Agent",
"resource_group": "Default",
"tags": [
"env:prod",
"mytest"
],
"version": "v1.0.0",
"schematics_location": "eu-de",
"agent_location": "Frankfurt MZR",
"agent_infrastructure": {
"infra_type": "ibm_kubernetes",
"cluster_id": "cg3fgvad0dak571op4g0",
"cluster_resource_group": "Default",
"cos_instance_name": "agent-beta-1-cos-instance",
"cos_bucket_name": "agent-beta-1-cos-bucket"
},
"user_state": {
"state": "enable"
}
}

Verify that the agent definition is created successfully as shown in the output. Record the agent ID for use in subsequent commands. For example, agentb1-gsmforvpc-mar17.soA.115c.

Output

{
"name": "agentb1-gsmforvpc-mar17",
"description": "Create Agent",
"resource_group": "aac37f57b20142dba1a435c70aeb12df",
"tags": [
"env:prod",
"mytest"
],
Create your PVC.

oc apply -f pvc.yaml
3. Verify that your PVC is created and bound to a persistent volume (PV). This process might take a few minutes.

oc get pvc









 Mounting the volume to your app 

To access the storage from your app, you must mount the PVC to your app.



1. Create a configuration file for a deployment that mounts the PVC.

For tips on how to deploy a stateful set with Portworx, see [StatefulSets](https://portworx.com/blog/cassandra-openshift-run-ha-cassandra-red-hat-openshift/). The Portworx documentation also includes examples for how to deploy [Cassandra](https://portworx.com/blog/cassandra-openshift-run-ha-cassandra-red-hat-openshift/), [Kafka](https://docs.portworx.com/portworx-install-with-kubernetes/application-install-with-kubernetes/kafka-with-zookeeper/), [ElasticSearch with Kibana](https://docs.portworx.com/operations/operate-kubernetes/application-install-with-kubernetes/elastic-search-and-kibana/), and [WordPress with MySQL](https://docs.portworx.com/portworx-install-with-kubernetes/application-install-with-kubernetes/wordpress/).

apiVersion: apps/v1
kind: Deployment
metadata:
name: <deployment_name>
labels:
app: <deployment_label>
spec:
selector:
matchLabels:
app: <app_name>
template:
metadata:
labels:
app: <app_name>
spec:
schedulerName: stork
containers:
- image: <image_name>
name: <container_name>
securityContext:
When all the steps are successfully completed, create the toolchain by clicking Create on the Summary step.

You can always go back to previous steps in the guided installer. The toolchain installer retains all the configuration settings from the successive steps.





 Step 1: Start the CI toolchain setup 

Use one of the following options to access the template for the CI toolchain:



* Click Create toolchain.

[![Create toolchain](https://cloud.ibm.com/docs-content/v1/content/5eb88a2575e30e316dbb83829c7f4c8b1ddbc67c/devsecops/images/create_toolchain_button.png)](https://cloud.ibm.com/devops/setup/deploy?repository=https://github.ibm.com/one-pipeline/iac-compliance-ci-toolchain&env_id=ibm:yp:us-south)
* From the [IBM Cloud console](https://cloud.ibm.com/), click Menu![Menu icon](https://cloud.ibm.com/docs-content/v1/content/5eb88a2575e30e316dbb83829c7f4c8b1ddbc67c/icons/icon_hamburger.svg) and select DevOps. On the Toolchains page, click Create toolchain. On the Create a Toolchain page, click CI - Develop secure infrastructure as code with DevSecOps practices.







 Step 2: Set up the CI toolchain name and region 

The Welcome page summarizes the purpose of the toolchain that is created, along with links to documentation and related materials. When you are ready to proceed, click Start to begin configuring the toolchain.

Review the default information for the toolchain settings:



1. The toolchain's name identifies it in IBM Cloud. Make sure that the toolchain's name is unique within your toolchains for the same region and resource group in IBM Cloud.
2.
accessModes:
- ReadWriteOnce
resources:
requests:
storage: <vpc_block_storage_size>
storageClassName: ""
9. Create your PVC.

kubectl apply -f pvc.yaml
10. Verify that your PVC is created and bound to the PV that you created earlier. This process can take a few minutes.

kubectl describe pvc <pvc_name>
11. Create a deployment or a pod that uses your PVC.

apiVersion: apps/v1
kind: Deployment
metadata:
name: <deployment_name>
labels:
app: <deployment_label>
spec:
selector:
matchLabels:
app: <app_name>
template:
metadata:
labels:
app: <app_name>
spec:
containers:
- image: <image_name>
name: <container_name>
volumeMounts:
- name: <volume_name>
mountPath: /<file_path>
volumes:
- name: <volume_name>
persistentVolumeClaim:
claimName: <pvc_name>
nodeSelector:
kubernetes.io/hostname: "<worker_node_primary_IP>"
Show more







 Updating the Block Storage for VPC add-on 

You can update the Block Storage for VPC add-on by disabling and re-enabling the add-on in your cluster. When you disable the add-on, PVC creation and app deployment are not disrupted. Existing volumes and data are not impacted.

Before updating the add-on review the [change log](https://cloud.ibm.com/docs/containers?topic=containers-vpc_bs_changelog).



1. Check to see if an update is available. If an update is available, the plug-in version is flagged with an asterisk and the latest version is shown.
"database": "dev-backup",
"username": "my-username",
"password": "my-password"
}





 Example 7 

Create a root key with an alias, then use that alias to identify the key to show the key details.

 create a root key with an alias
$ ibmcloud kp key create root-key-with-alias -a example-alias --output json

{
"id": "b3660416-4186-4587-b528-484886a4731b",
"name": "root-key-with-alias",
"type": "application/vnd.ibm.kms.key+json",
"extractable": false,
"state": 1,
"aliases": [
"example-alias"
],
"keyRingID": "default",
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:390086ac-76fa-4094-8cf3-c0829bd69526:key:b3660416-4186-4587-b528-484886a4731b",
"deleted": false
}

 show key details using the alias as identifier
$ ibmcloud kp key show example-alias --output json

{
"id": "b3660416-4186-4587-b528-484886a4731b",
"name": "root-key-with-alias",
"type": "application/vnd.ibm.kms.key+json",
"algorithmType": "AES",
"createdBy": "user id ...<redacted>...",
"creationDate": "2022-06-09T21:21:55Z",
Externally signed If you created a parent CA offline or in another Secrets Manager service instance, you can use the external CA to sign and issue an intermediate certificate authority. 









 Creating an intermediate CA with internal signing in the UI 

An intermediate CA with internal signing uses a parent CA that was previously created in your Secrets Manager instance as its trust anchor. You can create an intermediate CA with internal signing by using the Secrets Manager UI.



1. In the console, click the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/icon_hamburger.svg)> Resource List.
2. From the list of services, select your Secrets Manager instance.
3. In the Secrets engines page, click the Private certificates tab.
4. In the Certificate authorities table, click Create certificate authority to start the creation wizard.
5. Specify the certificate authority type and options.



1. Select Intermediate certificate authority as the authority type.
2. Select Internal signing. From the list of configured CAs, choose the CA that you want to use as the issuer of the intermediate CA certificate.
3. Enter a name to easily identify your certificate authority.
4. Select a maximum time-to-live (TTL) for the certificate to be generated for this CA. The TTL determines how long the CA certificate remains valid.
5. Select the maximum number of end-entity certificates that can exist in the chain.
6. To encode the issuing CA certificate URL into end-entity certificates, set the Encode URL option to Enabled.



6. Enter the subject name fields for your root CA certificate.
7. [Select the key algorithm](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-prepare-create-certificateschoose-key-algorithm) that you want to use to generate the public and private key for your CA certificate.
8.
createAccessGroupOptions := iamAccessGroupsService.NewCreateAccessGroupOptions(testAccountID, "Managers")
createAccessGroupOptions.SetDescription("Group for managers")
group, response, err := iamAccessGroupsService.CreateAccessGroup(createAccessGroupOptions)
if err != nil {
panic(err)
}
b, _ := json.MarshalIndent(group, "", " ")
fmt.Println(string(b))

const params = {
accountId: testAccountId,
name: 'Managers',
description: 'Group for managers'
};

iamAccessGroupsService.createAccessGroup(params)
.then(res => {
testGroupId = res.result.id;
console.log(JSON.stringify(res.result, null, 2));
})
.catch(err => {
console.warn(err)
});

A unique name is required to differentiate access groups in the account.





 Creating an access group by using Terraform 

Use the following steps to create access groups by using Terraform:



1. Create an argument in your main.tf file. The following example creates an access group by using the ibm_iam_access_group resource, where name is a unique name to identify the access group.

resource "ibm_iam_access_group" "accgrp" {
name = "test"
description = "New access group"
}

You can also specify the description of the access group on the description option. For more information, see the argument reference details on the [Terraform Identity and Access Management (IAM)](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/iam_access_group) page.
2. After you finish building your configuration file, initialize the Terraform CLI.