vania-janet/multiturn-rag-retrieval-data huggingface dataset:
$ curl -X DELETE "https://<region>.kms.cloud.ibm.com/api/v2/keys/<keyID_or_alias>?force=true" -H "authorization: Bearer <IAM_token>" -H "bluemix-instance: <instance_ID>" -H "prefer: <return_preference>"

Replace the variables in the example request according to the following table.





Table 2. Describes the variables that are needed to delete keys with the Key Protect API.

 Variable Description 

 region Required. The region abbreviation, such as us-south or eu-gb, that represents the geographic area where your Key Protect instance resides. <br> <br>For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/key-protect?topic=key-protect-regionsservice-endpoints). 
 keyID_or_alias Required. The unique identifier or alias for the key that you would like to delete. 
 IAM_token Required. Your IBM Cloud access token. Include the full contents of the IAM token, including the Bearer value, in the curl request. <br> <br>For more information, see[Retrieving an access token](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-access-token). 
 instance_ID Required. The unique identifier that is assigned to your Key Protect service instance. <br> <br>For more information, see [Retrieving an instance ID](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-instance-ID). 
 return_preference Optional. A header that alters server behavior for POST and DELETE operations. <br> <br>When you set the return_preference variable to return=minimal, the service returns a successful deletion response. When you set the variable to return=representation, the service returns both the key material and the key metadata.
List your PVs and note the name of the PVs that you want to remove.

oc get pv
12. Delete the PVs. Deleting your PVs will make your disks available for other workloads.

oc delete pv <pv-name>
13. Verify that your PV is removed.

oc get pv









 Parameter reference 



 4.8 parameter reference 



Table 1. 4.8 parameter reference

 Display name CLI option Type Description Required? Default value 

 Node Label Key label-key Config The key of the worker node key=value label. true N/A 
 Node Label Key Value label-value Config The value of the worker node key=value label. true N/A 
 Device Path devicepath Config The local storage device path. Example: /dev/sdc. true N/A 
 File System type fstype Config The file system type. Specify ext3, ext4, or xfs. true ext4 







 4.9 parameter reference 



Table 2. 4.9 parameter reference

 Display name CLI option Type Description Required? Default value 

 Automatic storage volume discovery auto-discover-devices Config Set to true if you want to automatically discover and use the storage volumes on your worker nodes. true false 
 Node Label Key label-key Config The key of the worker node key=value label. true N/A 
 Node Label Key Value label-value Config The value of the worker node key=value label. true N/A 
 Device Path devicepath Config The local storage device path. Example: /dev/sdc. Required when auto-discover-devices is set to false. false N/A 
 File System type fstype Config The file system type. Specify ext3, ext4, or xfs. true ext4 







 4.10 parameter reference 



Table 3. 4.10 parameter reference

 Display name CLI option Type Description Required? Default value
For more information, see [Generating an authorization token or API key](https://www.ibm.com/docs/en/cloud-paks/cp-data/4.6.x?topic=resources-generating-authorization-token-api-key).

For more information about authentication methods that are supported by the Watson SDKs for services installed on IBM Cloud Pak for Data, see the Authentication section of the [API reference](https://cloud.ibm.com/docs?tab=api-docs&category=ai) for your service and SDK.







 About API keys 

Three types of API keys are supported by Watson services:



* Service-specific API keys

Service-specific keys are generated with the service. This kind of API key has access only to a specific service instance. To view service-specific keys, click the name of a Watson service from your [resource list](https://cloud.ibm.com/resources?groups=resource-instance).
* IBM Cloud API keys

IBM Cloud API keys are associated with a user's identity. Only the user who is associated with the key can delete it. The same IBM Cloud API key can be used to access different services. For more information about working with IBM Cloud API keys, see [Managing user API keys](https://cloud.ibm.com/docs/account?topic=account-userapikey).
* Service ID API keys

Service IDs enable access to your IBM Cloud services by applications hosted both inside and outside of IBM Cloud. API keys that are associated with service IDs are granted the access that is associated with that service ID. For more information about service ID keys, see [Managing service ID API keys](https://cloud.ibm.com/docs/account?topic=account-serviceidapikeys).







 API key best practices 

Keep your API keys secure to reduce the chance of publicly exposing credentials that compromise your account and applications. To help keep your API keys secure, follow these guidelines.



* Assign the most restrictive service role that works for the level of access you need.

For example, assign the Reader service role for calls from your application to GET API methods.
For a list of supported attributes, see [supported attributes table](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-pkcs11-api-refpkcs-attribute-list) and [supported curve names for Elliptic Curve keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-pkcs11-api-refsupported-pkcs11-ec-curve-name).

Add and set the CKA_MODIFIABLE attribute to true if you want to modify the added key later.
3. (Optional) You can delete more attributes by clicking the Trash can icon ![Trash can icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/icon_trash.svg). The required attributes cannot be deleted.
4. Click Next to continue.



* If you are creating a symmetric key, such as an AES key, a DES key, and a Generic key, specify key attributes on the Key attributes page:



1. The required attributes are listed with the default values. To modify the attribute values, click the Edit icon ![Edit icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/edit-tagging.svg).
2. To add more attributes, click Add attributes. For a list of supported attributes, see [supported attributes table](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-pkcs11-api-refpkcs-attribute-list).
3. (Optional) You can delete more attributes by clicking the Trash can icon !
The App Configuration service never sees the root (KEK) key. Its storage, management, and use to wrap and unwrap the DEK is performed entirely within the key management service. If you disable or delete the key, the data can no longer be decrypted.





 Enabling a customer-managed key for App Configuration 

Complete the following steps to provision your App Configuration instance to use a customer-managed key:



1. Provision an instance of [Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-provision) or [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-provision).
2. Create an authorization policy to allow the App Configuration service to access the key management service instance as a Reader. For more information, see [Using authorizations to grant access between services](https://cloud.ibm.com/docs/account?topic=account-serviceauth).
3. Create or import a root key into your key management service instance.
4. Retrieve the Cloud Resource Name (CRN) of the key using the View CRN option in the key management service instance GUI.
5. Provision an instance of [App Configuration](https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-ac-create-an-instance). This feature is supported on the Enterprise plan only.







 Using a customer-managed key 

After a customer-managed key is enabled, the cluster operates as normal, but with the following additional capabilities:



 Preventing access to data 

To temporarily prevent access, you can disable your root key. As a consequence, App Configuration can no longer access the data because it can no longer access the key.

To remove access permanently, you can delete the key. However, you must take extreme caution because this operation is non-recoverable. You will lose access to any data stored in your App Configuration instance. There is no way to recover this data.

In both cases, the App Configuration instance shuts down and no longer accepts or processes connections.
* -i, --instance-id

The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.







 Optional parameters 



* -d, --dual-auth

Show policies that have a dual-auth-delete policy.
* -o, --output

Set the CLI output format. By default, all commands print in table format. To change the output format to JSON, use --output json.
* -r, --rotation

Show policies that have a rotation policy.
* --key-ring

A unique, human readable name for the key-ring. Required if the user doesn't have permissions on the default key ring.









 kp key policy-update dual-auth-delete 

You can use Key Protect to safely delete encryption keys by using a dual authorization process. When you delete a key, you shred its contents and associated data. Any data that is encrypted by the key becomes inaccessible.

Deleting a key that has a [dual authorization policy](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-dual-auth) requires an authorization from two users. With the Key Protect API, you can provide the first authorization by [setting the key for deletion](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-dual-auth-keysset-key-deletion-api). Then, a different user provides a second authorization by using the [GUI](https://cloud.ibm.com/login/) or [API](https://cloud.ibm.com/apidocs/key-protect) to delete the key.

ibmcloud kp key policy-update dual-auth-delete KEY_ID_OR_ALIAS
-i, --instance-id INSTANCE_ID
-e, --enable
[--key-ring KEY_RING_ID]
vault kv metadata delete ibmcloud/kv/GROUP_ID/SECRET_NAME



 Prerequisites 

You need the [Manager service role](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam) to delete the metadata of key-value secrets.





 Command options 

-format
: Prints the output in the format that you specify. Valid formats are table, json, and yaml. The default is table. You can also set the output format by using the VAULT_FORMAT environment variable.





 Example 

Delete permanently the data and metadata of a key-value secret.

vault kv metadata delete ibmcloud/kv/my-test-kv-secret

Delete permanently the data and metadata of a key-value secret in a custom secret group.

vault kv metadata delete ibmcloud/kv/9426e546-83de-4da5-9631-d70c993186c8/my-test-kv-secret





 Output 

The command to delete the metadata of a kv secret returns the following output:

Success! Data deleted (if it existed) at: ibmcloud/kv/metadata/my-test-kv-secret







 List key names of a key-value secret 

Get a list of key names of a key-value secret. Do not encode sensitive information in key names. The values of the keys are not accessible by using this command.

vault kv list ibmcloud/kv

List the key names of key-value secrets that are stored in a custom secret group.

vault kv list ibmcloud/kv/GROUP_ID



 Prerequisites 

You need the [Reader or Writer service role](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam) to read the key names of key-value secrets.





 Command options 

-format
: Prints the output in the format that you specify. Valid formats are table, json, and yaml. The default is table. You can also set the output format by using the VAULT_FORMAT environment variable.





 Example
Use [this method](https://cloud.ibm.com/apidocs/log-analysisget-v1-config-archiving) to get the details about an existing streaming configuration.

curl -X GET https://<ENDPOINT>/v1/config/archiving
-H "content-type: application/json"
-H "servicekey: <SERVICE_KEY>"



* Replace <ENDPOINT> with the IBM Log Analysis API endpoint. To see the list of endpoints, see [Endpoints](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-endpointsendpoints_api).
* Replace the <SERVICE_KEY> with a valid service key for the IBM Log Analysis instance where you plan to configure archiving. For more information, see [Service keys by using the API](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-service_keysservice_keys_api).



For example, the following is a sample get request:

curl -X GET https://api.us-south.logging.cloud.ibm.com/v1/config/archiving
-H "content-type: application/json"
-H "servicekey: xxxxxxxx"

The response will be similar to the following:

{"integration":"ibm","bucket":"my-bucket","endpoint":"s3.private.us-south.cloud-object-storage.appdomain.cloud","apikey":"xxxxxxxxx>","resourceinstanceid":"crn:v1:bluemix:public:cloud-object-storage:global:a/yyyyyyy::"}





 Delete the archiving configuration 

Use [this method](https://cloud.ibm.com/apidocs/log-analysisdelete-v1-config-archiving) to delete an existing archiving configuration.
serviceInstanceId: 'crn:v1:bluemix:public:cloud-object-storage:global:a/SAMPLE253abf6e65dca920c9d58126b:3f656f43-5c2a-941e-b128-DO-NOT-USE::',
};

var cosClient = new myCOS.S3(config);

function logDone() {
console.log('COMPLETE!n');
}

function logError(e) {
console.log(ERROR: ${e.code} - ${e.message}n);
}

// Retrieve the list of contents from a bucket for deletion
function deleteContents(bucketName) {
var returnArr = new Array();

console.log(Retrieving bucket contents from: ${bucketName}n);
return cosClient.listObjects(
{Bucket: bucketName},
).promise()
.then((data) => {
if (data != null && data.Contents != null) {
for (var i = 0; i < data.Contents.length; i++) {
returnArr.push(data.Contents[i].Key);
var itemKey = data.Contents[i].Key;
var itemSize = data.Contents[i].Size;
console.log(Item: ${itemKey} (${itemSize} bytes).n)
}
deleteItem(bucketName, itemName);
logDone();
}
})
.catch(logError);
}

// Delete item
function deleteItem(bucketName, itemName) {
console.log(Deleting item: ${itemName});
return cosClient.deleteObject({
Bucket: bucketName,
Key: itemName
}).promise()
.then(() =>{
The VPN and VPN policy configurations are deleted on request through the API or user interface.





 Restoring deleted data for VPC 

You can restore deleted root keys that you imported to the KMS within 30 days of deletion. For more information, see [Restoring deleted root keys](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managingbyok-restore-root-key).

VPN for VPC does not support the restoration of deleted data.





 Deleting all VPC data 

To delete all persisted data that IBM Cloud VPC stores, choose one of the following options.

Removing your personal and sensitive information requires all of your IBM Cloud VPC resources to be deleted as well. Make sure that you back up your data before you proceed.



* Open an IBM Cloud support case. Contact IBM Support to remove your personal and sensitive information from IBM Cloud VPC. For more information, see [Getting support](https://cloud.ibm.com/docs/get-support?topic=get-support-getting-customer-support).
* End your IBM Cloud subscription. After you end your IBM Cloud subscription, IBM Cloud VPC deletes all service resources that you created, which includes all persisted data that is associated with those resources.
Copy and paste the [Delete a workspace using Schematics Python API](https://cloud.ibm.com/docs/ibm-spectrum-lsf?topic=ibm-spectrum-lsf-deleting-workspaceexample-request-delete-workspace) example request to your Python file.
3. Change the following parameters as part of the request:



* Replace your IBM Cloud key to the authenticator = IAMAuthenticator('<ibm-api-key>') variable.
* Change the API endpoint to the endpoint mentioned in [API endpoints](https://cloud.ibm.com/apidocs/schematics?code=pythonapi-endpoints) according to the location that you want your Schematics workspace to reside, for example, schematics_service.set_service_url('https://us.schematics.cloud.ibm.com').



4. Inside the schematics_service.delete_workspace function, provide the following parameters:



* Provide the workspace ID that you generated in the [Creating a workspace](https://cloud.ibm.com/docs/ibm-spectrum-lsf?topic=ibm-spectrum-lsf-creating-workspace) task, for example, us-south.workspace.Terraform-Schematics-Python-Workspace.b3bbc9f5.
* Export your IBM Cloud API key by using the following command:

export IBMCLOUD_API_KEY =”<ibm-cloud-api-key>”
* Run the following curl command to create a refresh token:

curl -X POST "https://iam.cloud.ibm.com/identity/token" -H "Content-Type: application/x-www-form-urlencoded" -d "grant_type=urn:ibm:params:oauth:grant-type:apikey&apikey=$IBMCLOUD_API_KEY" -u bx:bx
* Note: If you want to destroy the resources as well as delete the workspace, then set the destroy_resources parameter value to True.
"type": "application/vnd.ibm.kms.key+json",
"id": "eb086d96-3b2c-48b5-bf31-c8f0305eea77",
"name": "root-example-key",
"description": "root-example-key",
"state": 1,
"extractable": false,
"crn":"crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:a192d603-0b8d-452f-aac3-f9e1f95e7411:key:eb086d96-3b2c-48b5-bf31-c8f0305eea77",
"imported": false,
"deleted": false
}
]
}

Authorize deletion for a key with a dual authorization policy.

 set the KEY_ID
$ KEY_ID=eb086d96-3b2c-48b5-bf31-c8f0305eea77

 this request fails because the key DOES NOT have a dual authorization policy
$ curl -X POST "https://us-south.kms.cloud.ibm.com/api/v2/keys/$KEY_ID/actions/setKeyForDeletion" -H "authorization: Bearer $ACCESS_TOKEN" -H "bluemix-instance: $KP_INSTANCE_ID" -H "content-type: application/vnd.ibm.kms.key_action+json"





 JSON response 

{
"metadata": {
"collectionType": "application/vnd.ibm.kms.error+json",
"collectionTotal": 1
},
"resources": [
{
"errorMsg": "Conflict: Action could not be performed on key.
To remove the route for 192.168.1.0/24 the command delete protocols static route 192.168.1.0/24 is used. If 192.168.1.0/24 was left off the command, then both route nodes are marked for deletion.

Remember that the configuration is not actually changed until the commit command is issued. To compare the current running configuration to any changes that are present in the configuration buffer, use the compare command. To flush the configuration buffer, use discard.





 Users and Role-based Access Control (RBAC) 

User accounts can be configured with three levels of access:



* Admin
* Operator
* Superuser



Operator level users can run show commands to view the running status of the system and issue reset commands to restart services on the device. Operator level permissions do not imply read-only access.

Admin level users have full access to all configurations and operations for the device. Admin users can view running configurations, change configuration settings for the device, restart the device, and shutdown the device.

Superuser level users are able to run commands with root privileges through the sudo command, in addition to having admin level privileges.

Users can be configured for password or public key authentication styles or both. Public key authentication is used with SSH and allows users to log in using a key file on their system. To create an operator user with a password:

set system login user [account] authentication plaintext-password [password]
set system login user [account] level operator
commit

When no level is specified, a user is considered admin level. The user passwords in this case display as encrypted in the configuration file.

RBAC is a method of restricting access to part of the configuration to authorized users. RBAC allows admins to define rules for a user group that restrict the commands they can run.

RBAC is performed by creating a group assigned to the Access Control Management (ACM) rule set, adding a user to the group, creating a rule set to match the group to the paths in the system, then configuring the system to allow or deny those paths that are applied to the group.
$ ibmcloud cos delete-object --bucket $COS_BUCKET --key '/cos-file.txt' --force

OK
Delete '/cos-file.txt' from bucket 'my-cos-kms-bucket' ran successfully.

 delete the bucket
$ ibmcloud cos delete-bucket --bucket $COS_BUCKET --force

OK
Successfully deleted bucket 'my-cos-kms-bucket'. The bucket 'my-cos-kms-bucket' will be available for reuse after 15 minutes.

 list the bucket (it should no longer exist)
$ ibmcloud cos list-buckets --ibm-service-instance-id $COS_INSTANCE_ID

OK
No buckets found in your account.

 view the KP registration (it should no longer exist)
$ ibmcloud kp registrations --output json

 delete the KP root key; COS no longer uses it
$ ibmcloud kp key delete $MY_COS_KEY_ID --output json

{
"id": "2cbea94c-6070-4a24-b0f8-7a56e4d7cb6f"
}

 delete the authorization policy between COS AND KMS
$ ibmcloud iam authorization-policy-delete $COS_KMS_AUTHORIZATION --force

Deleting authorization policy 18cfc980-4458-4313-972e-93f312cdcd81 under account ea998d3389c3473aa0987652b46fb146...
OK
Authorization policy 18cfc980-4458-4313-972e-93f312cdcd81 is deleted successfully

 view the authorization policy (it should no longer exist)
$ ibmcloud iam authorization-policies

Getting authorization policies under account ea998d3389c3473aa0987652b46fb146 as <email address>...
OK
No policy found
The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.







 Optional parameters 



* -d, --dual-auth

Show policies that have a dual-auth-delete policy.
* -o, --output

Set the CLI output format. By default, all commands print in table format. To change the output format to JSON, use --output json.
* -r, --rotation

Show policies that have a rotation policy.
* --key-ring

A unique, human readable name for the key-ring. Required if the user doesn't have permissions on the default key ring.









 kp key policy-update dual-auth-delete 

You can use Key Protect to safely delete encryption keys by using a dual authorization process. When you delete a key, you shred its contents and associated data. Any data that is encrypted by the key becomes inaccessible.

Deleting a key that has a [dual authorization policy](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-dual-auth) requires an authorization from two users. With the Key Protect API, you can provide the first authorization by [setting the key for deletion](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-dual-auth-keysset-key-deletion-api). Then, a different user provides a second authorization by using the [GUI](https://cloud.ibm.com/login/) or [API](https://cloud.ibm.com/apidocs/key-protect) to delete the key.

ibmcloud kp key policy-update dual-auth-delete KEY_ID_OR_ALIAS
-i, --instance-id INSTANCE_ID
-e, --enable
[--key-ring KEY_RING_ID]
[-o, --output OUTPUT]
Logs and support data that is associated with the instance are retained by IBM Cloud policy for 1 year unless requested for deletion through an IBM Support ticket.





 Deleting VMware as a Service customer data 

IBM Cloud for VMware as a Service customer data is deleted including any customer backups of data by using the service in association with the deletion of the service instance. The cloud service provided data encryption key used by customers to encrypt data is destroyed on deletion. This event renders the data unusable there forward.







 Related links 



* [Data protection](https://cloud.ibm.com/docs/vmware-service?topic=vmware-service-architecture-workload-isolation-learningarchitecture-workload-isolation-data-protection)
* [Data and data protection for client-owned data](https://cloud.ibm.com/docs/vmware-service?topic=vmware-service-architecture-workload-isolation-learningarchitecture-workload-isolation-data-client)