vania-janet/multiturn-rag-retrieval-data huggingface dataset:
create a random, base64-encoded, 32-byte key material
$ KEY_MATERIAL=$(openssl rand -base64 32)

 extract the public key that was created by the "kp import-token create" command
$ PUBLIC_KEY=$(ibmcloud kp import-token show | jq -r '.["payload"]')

 encrypt the key material using the public key
$ ibmcloud kp import-token key-encrypt -k $KEY_MATERIAL -p $PUBLIC_KEY

Encrypted Key
Ela33aTdDiKVUNryLeM/xwUEaKWvzY+u ...<redacted>... Asv7bZxvyZn9KNU=





 Required parameters 

-i, --instance-id
: The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command.

$ export KP_INSTANCE_ID=INSTANCE_ID





 Optional parameters 

-a, --hash
: The hash algorithm used to wrap the key. SHA1 and SHA256 are supported. The default is SHA256. SHA1 is only supported by HPCS.

This option is used to generate an encrypted key that can only be used in a request with the HPCS API. Do not use this option to create Key Protect root keys.

Hyper Protect Crypto Services (HPCS) is a dedicated key management service and hardware security module (HSM). HPCS integrates with Key Protect to generate and encrypt keys. The Keep Your Own Key (KYOK) function is also enabled by HPCS.





 Notes 

For more information about HPCS, see [Getting started with IBM Cloud Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-get-started).







 kp import-token nonce-encrypt 

Encrypt the nonce that is distributed by Key Protect with the key material that you import into to the service.
"created_at": "2021-09-14T22:07:46.898295306Z",
"provisioning_status": "create_pending"
}







 Next steps 

After the NLB with routing mode enabled is in active state, follow these steps to finalize the creation of your NLB:



1. Gather the following information:



* Your subnet CIDR.
* In the load balancer response, you will find a list of private IPs. Make note of the first one.

You can generate this response by performing step 4 of either the [CLI](https://cloud.ibm.com/docs/vpc?topic=vpc-nlb-vnf&interface=clinlb-vnf-cli) or [API](https://cloud.ibm.com/docs/vpc?topic=vpc-nlb-vnf&interface=api) procedures.
* Your back-end workload subnet CIDR.



2. Configure your custom routes as follows:



* For all traffic destined for the back-end customer workload subnet, set the next hop to the NLB private IP.
* For all traffic destined for the client subnet, set the next hop to the NLB private IP.
Now that your configmap is created from the console, go to the Secrets and configmaps page to view a listing of defined secrets and configmaps.







 Create a configmap with the CLI 

Create configmaps with the Code Engine CLI.

You can populate a configmap in several ways. You can populate it by specifying the key-value pairs directly on the command line, or you can point to a file.

Before you begin



* Set up your [Code Engine CLI](https://cloud.ibm.com/docs/codeengine?topic=codeengine-install-cli) environment.
* [Create and work with a project](https://cloud.ibm.com/docs/codeengine?topic=codeengine-manage-project).



When you create (or update) a configmap from a file, the format must be --from-file FILE or --from-file KEY=FILE. In Code Engine, when you use a file to specify configmap values, all the contents within the file become the value for the key-value pair. When you use the option format of --from-file KEY=FILE, the KEY is name of the environment variable that is known to your job or app. When you use the option format of --from-file FILE, FILE is the name of the environment variable that is known to your job or app. If your file contains one or more key-value pairs, use the --from-env-file option to add an environment variable for each key-value pair in the specified file. Any lines in the specified file that are empty or begin with are ignored.



 Creating a configmap with the CLI 

Create a configmap with the configmap create command in one of the following ways,



* Create a configmap directly on the command line by using the --from-literal option in KEY=VALUE format. For example,

ibmcloud ce configmap create --name myliteralconfigmap --from-literal TARGET=Sunshine
d - instance: my-kms-1
 e - key name: my-cos-key
 f - button: Create bucket

 capture the name of the COS bucket that was created
$ COS_BUCKET=my-cos-kms-bucket

 view the KP registration; it's a result of creating the COS bucket
$ ibmcloud kp registrations --output json


{
"keyId": "2cbea94c-6070-4a24-b0f8-7a56e4d7cb6f",
"resourceCrn": "crn:v1:bluemix:public:cloud-object-storage:global:a/ea998d3389c3473aa0987652b46fb146:4b636e74-f3ca-40bb-80b8-3bd21801ccb8:bucket:my-cos-kms-bucket",
"createdBy": "crn-crn:v1:bluemix:public:cloud-object-storage:global:a/ea998d3389c3473aa0987652b46fb146:4b636e74-f3ca-40bb-80b8-3bd21801ccb8::",
"creationDate": "2020-06-15T16:07:37Z",
"lastUpdated": "2020-06-15T16:07:37Z",
"keyVersion": {
"id": "2cbea94c-6070-4a24-b0f8-7a56e4d7cb6f",
"creationDate": "2020-06-15T16:05:53Z"
}
}
] ! ! ! !

 list the bucket
$ ibmcloud cos list-buckets --ibm-service-instance-id $COS_INSTANCE_ID

OK
1 bucket found in your account:
Name Date Created
% ibmcloud kp key create-key-with-policy-overrides test-key -m 2 -r
Creating key with policy overrides: 'test-key', in instance: '47377f07-8721-2O47-f396-ef1982c1e96e'...

OK
Key ID Key Name
076df396-4c90-e008-bf20-f1bb672d465b test-key

 List policies
% ibmcloud kp key policies 076df396-4c90-e008-bf20-f1bb672d465b
Retrieving policy details for key ID: 076df396-4c90-e008-bf20-f1bb672d465b...
OK

Created By IBMid-xxxxnnnnnxxx
Creation Date 2022-10-27T17:48:20Z
Last Updated 2022-10-27T17:48:20Z
Updated By IBMid-xxxxnnnnnxxx
Policy Type Rotation
Interval 2
Enabled true





 Required parameters 



* KEY_NAME

A unique, human-readable identifier to assign to your key.
* -i, --instance-ID

The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.







 Optional parameters 



* -a, --aliases

Alphanumeric human-readable alias names ranging 2-90 characters assigned to your key. Alias cannot contain spaces or special characters other than underscores and dashes. A maximum of 5 aliases are allowed per key.
* -d, --dual-auth-delete-policy-enabled



Enables the dual auth delete policy for a key.



* -k, --key-material

If you generated a key then this is the base64-encoded key material that you store and manage in the service.
* After the key is generated, select option O







 Windows 



 GPG Version > 1.4 

From the Git bash command prompt, run the following command:

gpg --pinentry-mode loopback --passphrase='' --generate-key



* Enter Real name your name
* Enter Email address your email address
* Enter O to initiate key creation
* After the key is generated, select option O







 GPG Version < 1.4 (or any failure with previous command) 

From the Git bash command prompt, run the following command:

gpg --gen-key



* kind of key: select Default option (1) RSA and RSA (default)
* keysize: keep default (2048)
* key validity: keep default (0 = key does not expire)
* Confirm your choice: enter y
* Enter Real name: your name
* Enter Email address: your email address
* Enter comment: any comment of your choice
* Enter O to initiate key creation











 Verify the key creation 

Verify that the GPG key was created. From the command prompt, run the following command:

gpg --list-keys

Ensure that your key is listed. Example output on Windows:

$ gpg --list-keys
/c/Users/FredSmith/.gnupg/pubring.gpg
-------------------------------------
pub 2048R/1BB354B5 2021-06-08
uid Fred Smith <fred@company.com>
sub 2048R/F91C39A6 2021-06-08





 Export the key 

This step is optional. Run this command to ensure that the gpg key can be exported.

gpg --export-secret-key <Email Address>

The raw key that is exported must not be copied directly. It is recommended to securely store the key that is generated in this step in your Key Protect instance or Secrets Manager instance. See the next sections for more details.





 Store the key
For each zone in which you plan to create subnets, create one or more address prefixes. The address prefixes must be within one of the following ranges: 10.0.0.0 - 10.255.255.255, 172.17.0.0 - 172.17.255.255, 172.21.0.0 - 172.31.255.255, 192.168.0.0 - 192.168.254.255.



3. Create subnets that use your address prefixes.



1. From the [VPC subnet dashboard](https://cloud.ibm.com/vpc/network/subnets), click Create.
2. Enter a name for your subnet and select the name of your classic access VPC.
3. Select the location and zone where you want to create the subnet.
4. Select the address prefix that you created for this zone.
5. Specify the number of IP addresses to create. VPC subnets provide IP addresses for your worker nodes and load balancer services in the cluster, so [create a VPC subnet with enough IP addresses](https://cloud.ibm.com/docs/containers?topic=containers-vpc-subnetsvpc_basics_subnets), such as 256. You can't change the number of IPs that a VPC subnet has later.
6. Choose if you want to attach a public network gateway to your subnet. A public network gateway is required when you want your cluster to access public endpoints, such as a public URL of another app, or an IBM Cloud service that supports public cloud service endpoints only.
7. Click Create subnet.



4. Use the subnets to [create a cluster](https://cloud.ibm.com/docs/containers?topic=containers-cluster-create-vpc-gen2). Do not delete the subnets that you attach to your cluster during cluster creation or when you add worker nodes in a zone.
In the service dashboard, click Buckets, then Create bucket followed by choosing Customize your bucket.
2. Set a unique bucket name such as username-mywebsite avoid dots (.) in the bucket name.
3. Set the Resiliency to Regional.
4. Set the Location appropriately. Choose us-south or make substitutions in the instructions below when you see us-south.
5. Pick Smart Tier for Storage class.
6. Scroll down to Static website hosting and click Add.



* Routing rules (individual) should be selected.
* Enter index.html into the Index document text box.
* Click Public access to On.
* Click Save above in the Static website hosting title.



7. Scroll down and click Create bucket.
8. The bucket will be displayed after creation completes. Click on the Configuration tab. Notice the Endpoint section and take note of the Public endpoint which will be needed later to both configure ibmcloud CLI and the CDN. As example for a bucket with resiliency set to Regional in the us-south region, the public endpoint would be s3.us-south.cloud-object-storage.appdomain.cloud.







 Step 3: Upload files to a bucket 

In this section, you will use the Object Storage plugin to upload files to the bucket.



1. Set a variable for the COS endpoint URL and a variable for the bucket name:

PUBLIC_ENDPOINT=s3.us-south.cloud-object-storage.appdomain.cloud

BUCKET_NAME=<YOUR_BUCKET_NAME>
2. If you are not logged in, use ibmcloud login or ibmcloud login --sso to log in interactively. Target the region where the bucket was created. As example for a bucket created in us-south:

ibmcloud target -r us-south
Next, choose a Channel update policy for the channel. This is the policy that will dictate how many organizations will have to approve updates to the channel configuration. Because this tutorial only involves creating a single organization, this policy should be 1 out of 1. As you add organizations to the channel, you should change this policy to reflect the needs of your use case. A sensible standard in a five organization channel is to use a majority of organizations. For example, 3 out of 5.
7. If the ordering service is not using a system channel follow step A, else step B.



* A. On the Orderer organizations page, choose the Ordering Service (osmsp) option from the drop-down. Then select the Administrator checkbox. The orgs selected in this step will be able edit orderer configuration settings, (such as block size, timeouts, consenters, etc) for the channel.
* B. On the Channel creator organization page, pick the channel's creator. Because the console allows multiple organizations to be owned by a single user, it is necessary to specify which organization is creating the channel. Because this tutorial is limited to the creation of a single organization, choose Org1 MSP (org1msp) from the drop-down list. Likewise, choose Org1 MSP Admin as the identity submitting the channel creation request.



8. On the Review channel information page, make sure you have entered the correct values in the correct fields. If a required field is missing, you will see an error notification relating to the field or value that must be corrected. When you are ready, click Create channel.



* If the ordering service has a system channel you will be taken back to the Channels tab and you can see a pending tile of the channel that you just created (under the Peer channels section).
* If the ordering service does not have a system channel you will be taken to the wizard to join orderer nodes. Select the orderer Ordering Service (osmsp) and click Join channel. You will now be taken back to the Channels tab.









 Task: Create a channel 



Table 14. Create a channel

 Field Name 

 Channel name channel1 
 Ordering Service Ordering Service 
 Organizations Org1 MSP
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:a192d603-0b8d-452f-aac3-f9e1f95e7411:key:62ad0cd5-70a4-4c4d-9d87-5f4db620b120"
}

 list keys - verify the key was restored
$ ibmcloud kp keys

Retrieving keys...
OK
Key ID Key Name
62ad0cd5-70a4-4c4d-9d87-5f4db620b120 my-base64-root-key





 Example 2 

This workflow creates a root key using an import token, deletes the key, then restores the key.

This is a two-step process.



1. Create a root key using an import token and then delete the key
2. Create an import token, which is required to restore the key, and restore the key



Creating a root key using an import token has a time limit (the -e, --expiration option). When you restore a key you need an import token. Which is why you need to go through an import token process to restore a key.

Step 1 - create a root key using an import token and then delete the key

 create an import token that expires in 5 minutes and allows 10 retrievals
$ ibmcloud kp import-token create -e 300 -m 10

Created Expires Max Retrievals Remaining Retrievals
2020-06-18 12:21:59 +0000 UTC 2020-06-18 12:26:59 +0000 UTC 10 10

 create a random, base64-encoded, 32-byte key material
$ KEY_MATERIAL=$(openssl rand -base64 32)

$ echo $KEY_MATERIAL

sADDNDE3pcJlbYXu2z5QFORvsxV1PosRiAPERrhYJdk=
[-o, --output OUTPUT]



 Examples 

These are examples of kp key show.



 Example 1 

Create a root key and show the details.

 create a root key
$ ibmcloud kp key create my-root-key

Creating key: 'my-root-key', in instance: '390086ac-76fa-4094-8cf3-c0829bd69526'...
OK
Key ID Key Name
8635b804-9966-4918-a16b-d561fdbf181f my-root-key

 show key details
$ ibmcloud kp key show 8635b804-9966-4918-a16b-d561fdbf181f

Grabbing info for key id: 8635b804-9966-4918-a16b-d561fdbf181f...
OK
Key ID Key Name Description Creation Date Expiration Date
8635b804-9966-4918-a16b-d561fdbf181f my-root-key 2020-05-05 19:58:02 +0000 UTC Key does not expire





 Example 2 

This is an explanation of the JSON keys and values from the kp key show command. In this example the key was rotated to ensure all JSON key/value pairs are shown.

$ ibmcloud kp key show 8635b804-9966-4918-a16b-d561fdbf181f --output json

{
"id": "8635b804-9966-4918-a16b-d561fdbf181f",
"name": "my-root-key",
"type": "application/vnd.ibm.kms.key+json",
"algorithmType": "AES",
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-05-05T19:58:02Z",
"AccessGroupId-985dc0a3-857b-48bd-b6d6-33819da7ba42"
],
"created_by": "iam-ServiceId-b7ebcf90-c7a9-495b-8ce8-bbf33cb95ca0",
"creation_date": "2020-10-09T17:13:47Z",
"crn": "crn:v1:bluemix:public:secrets-manager:us-south:a/791f5fb10986423e97aa8512f18b7e65:e415e570-f073-423a-abdc-55de9b58f54e::",
"description": "My test IAM credential that is assigned to a secret group.",
"id": "091ca93f-5c99-4078-9d7e-4801143030fd",
"labels": [
"test",
"us-south"
],
"last_update_date": "2020-10-09T17:13:47Z",
"name": "test-iam-credential-in-group",
"secret_group_id": "9ab2250f-a369-4e07-ade7-d417d63ad587",
"secret_type": "IAM_CREDENTIALS",
"state": 1,
"state_description": "Active",
"ttl": 3600
},
"warnings": null
}

If the role is created in a secret group, the data.secret_group_id value is included in the response to identify the secret group assignment.







 Generate IAM credentials 

Use the following commands to generate an API key for a role. This command creates a service ID, adds the service ID to the access group that you configured for the role, and then generates an API key for the service ID.
A consortium is the list of organizations that are allowed to create channels on a particular ordering service. Once an organization is added to this list, which is maintained by the admins of the ordering service, an organization will be able to create a channel. To do that, we must click into the Ordering Service and click Add Organization under the Consortium members header. Then we must select the org1msp, as this is our peer organization. Then click submit. Easy as that. Org1 is now a member of the consortium and allowed to create channels on this ordering service.

Now let’s create the channel. Navigate to the channel tab and click create channel. After reviewing the information on the prerequisites panel, decide whether you want to create your channel using any of the advanced options. For the purpose of this demonstration, we will not be modifying any of these fields, so this box will stay unchecked. Note that even if you select 2.x as the Fabric version of your nodes, you will not be able to use the new smart contract lifecycle unless the 2.0 application capability has been selected. If you want to learn more about any of the other advanced options, check out the documentation on advanced channel creation and management. Note that these advanced options can be changed later.

On the channel details page, give this channel a name, channel1. And specify the ordering service it will be hosted on, Ordering Service. These two fields cannot be changed later, so in the case of the channel name make sure to choose a name that will be relevant to the way in which the channel will be used. Also, choose a unique since each channel hosted on an ordering service must have a different name. On the Organizations panel select the organizations who will be joining peers to the channel. In this case that is Org1, so select Org1 MSP from the drop down list. Make this organization an operator. Do not add any ordering service organizations here. Note that during the creation of a channel, all organizations that are added must already be members of the consortium.

The update policy determines how many organizations must sign channel update requests before the channel configuration can be changed. Because we only have one organization, we only have one option, 1 out of 1.
Users who are created from the UI have permissions to ., which means that any newly created user is able to see any database automatically. Use MySQL sh, or modify permissions of a UI-created user to restrict access. To limit permissions, remove global privileges, if enabled, and grant privileges to a database, or database set, to which a given user is expected to have access.





 Other ibm Users 

The ibm and the ibm-replication accounts are the only superusers on your deployment. A superuser account is not available for you to use. These users are internal administrative accounts that manage replication, metrics, and other functions that ensure the stability of your deployment.





 Users created with mysql 

You can bypass creating users through IBM Cloud entirely, and create users directly in MySQL with mysql. This allows you to make use of MySQL's native [role and user management](https://dev.mysql.com/doc/refman/5.7/en/privileges-provided.html). Users/roles created in mysql must have all of their privileges set manually, as well as privileges to the objects that they create.

Users that are created directly in MySQL do not appear in Service Credentials, but you can [add them](https://cloud.ibm.com/docs/databases-for-mysql?topic=databases-for-mysql-connection-stringsadding-users-to-_service-credentials_) if you choose.

Note that these users are not integrated with IAM controls, even if added to Service Credentials.





 User access to tables 

While you cannot delete mysql database, users can drop tables, including the mysql.users table that contains internal users. Clients shouldn't delete any table belonging to mysql database as this action can result in a broken formation, which can only be resolved with a Point-in-time recovery (PITR).

IBM Cloud does not alert on formation breaking because of a system table dropped by a client.





 More Users and Connection Strings 

Access to your Databases for MySQL deployment is not limited to the admin user.
-bash: warning: setlocale: LC_CTYPE: cannot change locale (UTF-8): No such file or directory
[root@vpctestexample-vsi1 ]
2. You can verify that VPC and VSI are created by accessing your [IBM Cloud console](https://cloud.ibm.com).



* Click Navigation Menu icon > VPC Infrastructure > VPCs to view VPC named vpctestexample is created
* Click Navigation Menu icon > VPC Infrastructure > Virtual server instances to view VSI named vsi1 is created









 Step 6: Executing Terraform destroy 

Optional: If you don't want to work with your VPC infrastructure resources anymore, remove them.

terraform destroy





 What's next? 

Explore other [IBM Cloud resources](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/) that you can provision by using Terraform on IBM Cloud.
$ ibmcloud kp import-token create -e 900 -m 10

Created Expires Max Retrievals Remaining Retrievals
2020-08-18 19:12:35 +0000 UTC 2020-08-18 19:27:35 +0000 UTC 10 10

 extract the nonce that was created by the "kp import-token create" command
$ NONCE=$(ibmcloud kp import-token show | jq -r '.["nonce"]')

$ echo $NONCE

N3x8F0ihAZ51nj6M

 extract the public key that was created by the "kp import-token create" command
$ PUBLIC_KEY=$(ibmcloud kp import-token show | jq -r '.["payload"]')

$ echo $PUBLIC_KEY

LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0t ...<redacted>... QyBLRVktLS0tLQo=

 encrypt the key material using the public key
$ ibmcloud kp import-token key-encrypt -k $KEY_MATERIAL -p $PUBLIC_KEY

Encrypted Key
qkhpyERrqgU+q6M0ulCyFLP4/uAyTRNJ ...<redacted>... RvVRAyhPP9civbU=

 capture the encrypted key material
$ ENCRYPTED_KEY=qkhpyERrqgU+q6M0ulCyFLP4/uAyTRNJ ...<redacted>... RvVRAyhPP9civbU=

 encrypt the nonce
$ ibmcloud kp import-token nonce-encrypt -k $KEY_MATERIAL -n $NONCE

Encrypted Nonce IV
nrrCczvYXvc6T7J2G+EOLjHZO1cpPyu/nhsIlA== N6oLJnUqaKF3v5Sd