vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* [Enabling KMS encryption for the cluster through the console](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionkms_ui)
* [Rotating the root key for your cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionkms_rotate)



* [Verifying secret encryption](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionverify_kms)
* [Managing encryption for the worker nodes in your cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionworker-encryption)



* [Classic worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionworker-encryption-classic)
* [VPC worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionworker-encryption-vpc)
* [Satellite worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionworker-encryption-satellite)





[Configuring security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_sccopenshift_scc)



* [Customizing security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_scccustomize_sccs)
* [Default Red Hat OpenShift security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_sccoc_sccs)
* [Default IBM security context constraints](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_sccibm_sccs)
SC-12 (2) - Symmetric Keys 



  Control requirements 

SC-12 (2) - 0
:   The organization produces, controls, and distributes symmetric cryptographic keys using [IBM Assignment: Refer to Supplemental Guidance for Cryptography Governance] key management technology and processes.





  Implementation guidance 

See the resources that follow to learn more about how to implement this control.



*  [Data encryption at rest](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-encryption-at-rest)
*  [Data encryption in transit](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-encryption-in-transit)







  IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



*  Check whether Hyper Protect Crypto Services encryption keys that are generated by the service are rotated automatically at least every # months
*  Check whether Hyper Protect Crypto Services instance is enabled with a dual authorization deletion policy
For more information, check out [Managing retired key versions](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-rotationkey-rotation-managing).

For more information about how key rotation works, check out [Understanding the key rotation process](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-rotationunderstand-key-rotation-process).

To enable key rotation options for your IBM Cloud data service, the data service must be integrated with Key Protect. Refer to the documentation for your IBM Cloud data service, or [check out our list of integrated services to learn more](https://cloud.ibm.com/docs/key-protect?topic=key-protect-integrate-services).



 Monitoring key rotations 

After you rotate a root key, Key Protect notifies the IBM Cloud data services that use the key to protect your data. This notification triggers actions in those services to rewrap the key's associated data encryption keys (DEKs) with the latest key version.

After Key Protect receives confirmation from those services that all associated DEKs are rewrapped, you receive an event in your IBM Cloud Activity Tracker UI to show that the rotation is complete.





 Managing retired key versions 

Key Protect creates a new version of the root key with each rotation request. The service retires the old key versions and retains them until the key is deleted. The retired key versions can no longer be used to wrap keys, but they remain available for unwrap operations.

If Key Protect detects that you're using a retired root key version to unwrap DEKs, the service provides a newly wrapped DEK that's based on the latest key version.



 Rewrapping data after rotating a key 

Because retired key versions can only be used to access older DEKs, to secure your envelope encryption workflow, [rewrap your DEKs](https://cloud.ibm.com/docs/key-protect?topic=key-protect-rewrap-keys) after you rotate a key so that your at rest data is protected by the newest key.
When you use the root key for envelope encryption, Hyper Protect Crypto Services uses only the latest key material that is associated with the key. The retired key material can no longer be used to protect keys, but it remains available for unwrap operations. If Hyper Protect Crypto Services detects that you're using retired key material to unwrap DEKs, the service provides a newly wrapped DEK that's based on the latest root key material.

Enabling root key rotation for IBM Cloud data services
: To enable these root key rotation options for your data service on IBM Cloud, the data service must be integrated with Hyper Protect Crypto Services. Refer to the documentation for your IBM Cloud data service, or check out our list of [integrated services to learn more](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-integrate-services).

When you rotate a root key in Hyper Protect Crypto Services, you're not charged extra fees. You can continue to unwrap your wrapped data encryption keys (WDEKs) with retired key material at no extra cost. For more information about our pricing options, see the [Hyper Protect Crypto Services catalog page](https://cloud.ibm.com/catalog/services/hyper-protect-crypto-services).





 Understanding the root key rotation process 

Behind the scenes, the Hyper Protect Crypto Services key management service API drives the key rotation process.

The following diagram shows a contextual view of the key rotation functionality.

Zoom

![The diagram shows a contextual view of key rotation.](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/hs-crypto//images/key-rotation.svg)

Figure 1. Key rotation

With each rotation request, Hyper Protect Crypto Services associates new key material with your root key.

Zoom

![The diagram shows a micro view the root key stack.]
* [Updating secrets with the CLI](https://cloud.ibm.com/docs/codeengine?topic=codeengine-secretsecret-update-cli)



* [Referencing secrets](https://cloud.ibm.com/docs/codeengine?topic=codeengine-secretsecret-ref)



* [Referencing secrets from the console](https://cloud.ibm.com/docs/codeengine?topic=codeengine-secretsecret-ref-ui)
* [Referencing secrets with the CLI](https://cloud.ibm.com/docs/codeengine?topic=codeengine-secretsecret-ref-cli)



* [Deleting secrets](https://cloud.ibm.com/docs/codeengine?topic=codeengine-secretsecret-delete)



* [Deleting secrets from the console](https://cloud.ibm.com/docs/codeengine?topic=codeengine-secretsecret-delete-ui)
* [Deleting secrets with the CLI](https://cloud.ibm.com/docs/codeengine?topic=codeengine-secretsecret-delete-cli)





[Working with configmaps](https://cloud.ibm.com/docs/codeengine?topic=codeengine-configmapconfigmap)



* [What are configmaps and why would I use them?](https://cloud.ibm.com/docs/codeengine?topic=codeengine-configmapconfigmap-whatwhy)
* [I see configmaps that I didn't create. Can I delete them?](https://cloud.ibm.com/docs/codeengine?topic=codeengine-configmapinside-configmaps)
For more information about the access management, see Managing user access [for the standard plan](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-access) or [for the Unified Key Orchestrator plan](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-manage-access).
* Configure all crypto units in the service instance the same.



Key objects in the in-memory keystore are not automatically rotated after the master key rotation. If PKCS #11 keystores are enabled in your service instance, you need to restart all active PKCS #11 applications to clear the in-memory keystore after the master key rotation is complete. For more information, see

[PKCS #11 implementation components](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-pkcs11-introuko-pkcs11-components).



 Before you begin 

Before you start, make sure to do the following steps:



1. Complete the [steps to set up the IBM Cloud CLI with TKE plug-in](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm-prerequisite).
2. Check and make sure that the current master key register is in Valid state with [the current master key loaded](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsmload-master-keys), the new master key register is empty, and the crypto units of the service instance are not in imprint mode by running the following command:

ibmcloud tke cryptounit-compare
3. The new master key parts are prepared for rotation.
SC-12 (3) - Asymmetric Keys 



  Control requirements 

SC-12 (3) - 0
:   The organization produces, controls, and distributes asymmetric cryptographic keys using [IBM Assignment: Refer to Supplemental Guidance for Cryptography Governance].





  Implementation guidance 

See the resources that follow to learn more about how to implement this control.



*  [Data encryption at rest](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-encryption-at-rest)
*  [Data encryption in transit](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-encryption-in-transit)







  IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



*  Check whether Hyper Protect Crypto Services encryption keys that are generated by the service are rotated automatically at least every # months
*  Check whether Hyper Protect Crypto Services instance is enabled with a dual authorization deletion policy
"value": "crn:v1:bluemix:public:cloud-object-storage:global:a/1d524cd94a0dda86fd8eff3191340732:8888b05b-a143-4917-9d8e-9d5b326a1604::",
"type": "string",
"description": ""
},
{
"id": "f06bc8b2-3476-47a6-aacb-c603dd808310",
"key": "iamtoken",
"value": "eyJraWQiOiIyMDE3MTAzMC0wMDowMDowMCIsImFsZyI6IlJTMjU2In0.eyJpYW1faWQiOiJJQk1pZC01MFkxNjdNOFRZIiwiaWQiOiJJQk1pZC01MFkxNjdNOFRZIiwicmVhbG1pZCI6IklCTWlkIiwiaWRlbnRpZmllciI6IjUwWTE2N004VFkiLCJnaXZlbl9uYW1lIjoiSmFtZXMiLCJmYW1pbHlfbmFtZSI6IlNhaXRvIiwibmFtZSI6IkphbWVzIFNhaXRvIiwiZW1haWwiOiJKYW1lcy5TYWl0bzFAaWJtLmNvbSIsInN1YiI6IkphbWVzLlNhaXRvMUBpYm0uY29tIiwiYWNjb3VudCI6eyJic3MiOiIxZDUyNGNkOTRhMGRkYTg2ZmQ4ZWZmMzE5MTM0MDczMiJ9LCJpYXQiOjE1Mjg2MDk0ODIsImV4cCI6MTUyODYxMzA4MiwiaXNzIjoiaHR0cHM6Ly9pYW0uYmx1ZW1peC5uZXQvaWRlbnRpdHkiLCJncmFudF90eXBlIjoidXJuOmlibTpwYXJhbXM6b2F1dGg6Z3JhbnQtdHlwZTphcGlrZXkiLCJzY29wZSI6ImlibSBvcGVuaWQiLCJjbGllbnRfaWQiOiJieCIsImFjciI6MSwiYW1yIjpbInB3ZCJdfQ.iG5ey13QlXHu3OH81v8J5sduKv3NzSqCFng_DlpNglPo07K-nWst3O9o6iEJfm0AzJwYNTZqWVru1pjI-KcAPXFBe503DPIf6cYolAw4rarU5booW-pdzk8-R5HZ7MJK7b8sxJtm7PAilXVZvl5yFE-tJsFkeMH6XCIj_R9i6dwSemDBL3Juq79_x3KsgJGFg37p5f2vck1_7gR7nSb03m8m3mCvrrx7zGkLDuM8NXAVlwwxKcitwlG_UfEBwSbX3krF04zF2tFCpGkcWAnuaFdaVTOL6uaULxCi5BWHqzLXIPhAoyfnVGNv0TBJtyFcpJ1LdlsBmz7RS2fROlDf2w",
"type": "string",
"description": ""
},
{
Endpoint string // Required if AccessToken is not specified - IBM Cloud IAM endpoint
}

// GetRequestMetadata is used by GRPC for authentication
func (cr IAMPerRPCCredentials) GetRequestMetadata(ctx context.Context, uri ...string) (map[string]string, error) {
// Set token if empty or Set token if expired
if len(cr.APIKey) != 0 && len(cr.Endpoint) != 0 && time.Now().After(cr.expiration) {
if err := cr.getToken(ctx); err != nil {
return nil, err
}
}

return map[string]string{
"authorization": cr.AccessToken,
}, nil
}

// RequireTransportSecurity is used by gRPC for authentication
func (cr IAMPerRPCCredentials) RequireTransportSecurity() bool {
return true
}

// getToken obtains a bearer token and the expiration
func (cr IAMPerRPCCredentials) getToken(ctx context.Context) (err error) {
cr.updateLock.Lock()
defer cr.updateLock.Unlock()

// Check if another thread has updated the token
if time.Now().Before(cr.expiration) {
return nil
}

var req http.Request
client := http.Client{}
requestBody := []byte("grant_type=urn:ibm:params:oauth:grant-type:apikey&apikey=" + cr.APIKey)

req, err = http.NewRequest("POST", cr.Endpoint+"/identity/token", bytes.NewBuffer(requestBody))
if err != nil {
return err
}
},
"direct":{
"par01":"s3.direct.par01.cloud-object-storage.appdomain.cloud"
}
},
"sng01":{
"public":{
"sng01":"s3.sng01.cloud-object-storage.appdomain.cloud"
},
"private":{
"sng01":"s3.private.sng01.cloud-object-storage.appdomain.cloud"
},
"direct":{
"sng01":"s3.direct.sng01.cloud-object-storage.appdomain.cloud"
}
}
}
},
"resource-configuration-endpoints":{
"global":{
"public":"config.cloud-object-storage.cloud.ibm.com/v1",
"private":"config.private.cloud-object-storage.cloud.ibm.com/v1",
"direct":"config.direct.cloud-object-storage.cloud.ibm.com/v1"
}
}
}
Show more

When creating a client by using a library that requires an "auth" endpoint value, you need to add /oidc/token to end of the iam-token URL provided above.





 Using service credentials for single-bucket access 

When a service credential is created, the underlying Service ID is granted a role on the entire instance of Object Storage. If the intention that the credential be used to grant, access to a subset of buckets and not the entire instance, this policy needs to be edited. See the [Bucket permissions](https://cloud.ibm.com/docs/cloud-object-storage/iam?topic=cloud-object-storage-iam-bucket-permissions) page for more details.





 API Key vs HMAC 

In general IAM API Keys are the preferred method of authentication for IBM Cloud® Object Storage.
.then(res => {
instanceKeyGuid = res.result.guid;
console.log('createResourceKey() response:n' + JSON.stringify(res.result, null, 2));
})
.catch(err => {
console.warn(err)
});





 Adding a credential when binding an IAM-enabled service by using Terraform 

Before you can add a credential when binding an IAM-enabled service by using Terraform, make sure that you have completed the following:



* Install the Terraform CLI and configure the IBM Cloud Provider plug-in for Terraform. For more information, see the tutorial for [Getting started with Terraform on IBM Cloud®](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-getting-started). The plug-in abstracts the IBM Cloud APIs that are used to complete this task.
* Create a Terraform configuration file that is named main.tf. In this file, you define resources by using HashiCorp Configuration Language. For more information, see the [Terraform documentation](https://www.terraform.io/docs/language/index.html).



Use the following steps to add a crednetial when binding an IAM-enabled service:



1. Create an argument in your main.tf file. The following example creates credentials for a resource without a service ID by using the ibm_resource_instance resource, where name is a unique name to identify the credential.

data "ibm_resource_instance" "resource_instance" {
name = "myobjectsotrage"
}

resource "ibm_resource_key" "resourceKey" {
name = "myobjectkey"
role = "Viewer"
resource_instance_id = data.ibm_resource_instance.resource_instance.id

//User can increase timeouts
timeouts {
create = "15m"
delete = "15m"
}
Create a user credential with an expiration date and two labels.

vault write -format=json ibmcloud/username_password/secrets name="my-test-user-credential" expiration_date="2020-12-31T23:59:59Z" username="user123" password="window-steel-dogs-coffee" labels=label-1,label-2

Create an arbitrary secret with an expiration date and two labels.

vault write -format=json ibmcloud/arbitrary/secrets name="my-test-arbitrary-secret" expiration_date="2020-12-31T23:59:59Z" payload="this is my secret data" labels=label-1,label-2

Create an arbitrary secret with binary payload.

base64 -w0 <filename> | vault write ibmcloud/arbitrary/secrets name="my-test-arbitrary-secret" payload=- labels="encode:base64"

Import an SSL/TLS certificate with a matching private key.

vault write -format=json ibmcloud/imported_cert/secrets name="my-test-imported-certificate" certificate=@cert.pem private_key=@key.pem

Order a public SSL/TLS certificate by specifying a certificate authority and DNS provider configuration.

vault write -format=json ibmcloud/public_cert/secrets name="my-test-public-certificate" ca="my-configured-certificate-authority" dns="my-configured-dns-provider" common_name="example.com" key_algorithm=RSA2048

Create a private SSL/TLS certificate by specifying the certificate template to use.

vault write -format=json ibmcloud/private_cert/secrets name="my-test-private-certificate" certificate_template="my-configured-certificate-template" common_name="example.com"





 Output 

The command to create a username_password secret returns the following output:

{
fs.cos.<identifier>.access.key=<Access Key ID>
fs.cos.<identifier>.endpoint=<EndPoint URL>
fs.cos.<identifier>.secret.key=<Secret Access Key>

Note that the endpoint URL has the format s3.direct.us.cloud-object-storage.appdomain.cloud and doesn't require the prefix https://.





 Structure of API key credentials 

For IAM API key style authentication, you must define the following parameters in IBM Analytics Engine:

fs.cos.<identifier>.iam.api.key=<IAM API Key>
fs.cos.<identifier>.endpoint=<EndPoint URL>

Like for HMAC credentials, the endpoint URL has the format s3.direct.us.cloud-object-storage.appdomain.cloud and doesn't require the prefix https://.
"iam_role_crn": "crn:v1:bluemix:public:iam::::serviceRole:Writer",
"iam_serviceid_crn": "crn:v1:staging:public:iam-identity::a/abcdabcd719f45b98a931f6e20db1bd8::serviceid:ServiceId-6d7087e5-0611-4240-9e46-af8a4c15cba4",
"managementUrl": "https://us-south.appid.test.cloud.ibm.com/management/v4/xxxxxxxx",
"oauthServerUrl": "https://us-south.appid.test.cloud.ibm.com/oauth/v4/xxxxxxxx",
"profilesUrl": "https://us-south.appid.test.cloud.ibm.com",
"secret": "abcdabcdYTAtZmU0MC00YTQ1LTliY2YtMDk0ODg0NDMyNDgw",
"tenantId": "xxxxxxxx",
"version": 4
},
"name": "App ID-yn",
"plan": "c0258a22-160a-403b-845d-1588ad61204c",
"resourcekey_name": "ce-service-access-abcd",
"resourcekey_id": "abcdabcd-xxxxxxxx"
}
],
"cloud-object-storage": [
{
"credentials": {
"apikey": "xxxxxx",
"endpoints": "https://control.cloud-object-storage.test.cloud.ibm.com/v2/endpoints",
Decide if you want to use the Profile ID or an API key in the Kubernetes secret that the add-on uses. Save the following text and enter your credentials. You can follow the steps to create the secret manually or you can use the shell script to [automatically create the secret in your cluster](https://cloud.ibm.com/docs/containers?topic=containers-storage-block-vpc-trusted-profilessecret-create-truted-profile).

Example credentials with pod identity

IBMCLOUD_AUTHTYPE=pod-identity
IBMCLOUD_PROFILEID=<TRUSTED-PROFILE-ID>

Example credentials with an API key.

IBMCLOUD_AUTHTYPE=iam
IBMCLOUD_APIKEY=<API-KEY>
4. Encode the credentials to base64.

echo -n "IBMCLOUD_AUTHTYPE=<IAM-OR-POD-IDENTITY>
IBMCLOUD_APIKEY=<API-KEY>" | base64
5. Create a secret in your cluster that contains the credentials for the trusted profile. You can create the secret by using the ID or API key for the trusted profile. Save the following YAML to a file called ibm-cloud-credentials.yaml. In the ibm-credentials.env: field, enter the base64 encoded API key or the ID of trusted profile.

apiVersion: v1
data:
ibm-credentials.env: Trusted profile ID
kind: Secret
metadata:
name: ibm-cloud-credentials
namespace: kube-system
type: Opaque
6. [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)
7. Create the secret in your cluster.

kubectl apply -f ibm-cloud-credentials.yaml
8. Restart the driver pods by disabling and re-enabling the add-on.



1. Disable the add-on.
Make sure to give the trusted profile the following access.



* Resource group - Viewer
* Service access - Reader and Writer
* Platform access - Viewer, Operator, Editor



2. After you create your trusted profile, copy the ID from the Trusted profiles page in the console.
3. Decide if you want to use the Profile ID or an API key in the Kubernetes secret that the add-on uses. Save the following text and enter your credentials. You can follow the steps to create the secret manually or you can use the shell script to [automatically create the secret in your cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-storage-block-vpc-trusted-profilessecret-create-truted-profile).

Example credentials with pod identity

IBMCLOUD_AUTHTYPE=pod-identity
IBMCLOUD_PROFILEID=<TRUSTED-PROFILE-ID>

Example credentials with an API key.

IBMCLOUD_AUTHTYPE=iam
IBMCLOUD_APIKEY=<API-KEY>
4. Encode the credentials to base64.

echo -n "IBMCLOUD_AUTHTYPE=<IAM-OR-POD-IDENTITY>
IBMCLOUD_APIKEY=<API-KEY>" | base64
5. Create a secret in your cluster that contains the credentials for the trusted profile. You can create the secret by using the ID or API key for the trusted profile. Save the following YAML to a file called ibm-cloud-credentials.yaml. In the ibm-credentials.env: field, enter the base64 encoded API key or the ID of trusted profile.

apiVersion: v1
data:
ibm-credentials.env: Trusted profile ID
kind: Secret
metadata:
name: ibm-cloud-credentials
namespace: kube-system
type: Opaque
6. [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.]
From the command line, run the following command to create a new access group called test-cos-admin-group.

export ACCESS_GROUP_ID=ibmcloud iam access-group-create test-storage-admin-group -d "An access group for testing Secrets Manager and Cloud Object Storage." --output json | jq -r ".id"; echo $ACCESS_GROUP_ID
2. Set up your account credentials.

Create a service ID and set it as an environment variable.

export SERVICE_ID=ibmcloud iam service-id-create test-service-id-secrets --description "A service ID for testing Secrets Manager." --output json | jq -r ".id"; echo $SERVICE_ID

Assign the service ID permissions to create and manage other service IDs.

ibmcloud iam service-policy-create $SERVICE_ID --roles Operator --service-name "IAM Identity Service"

Assign the service ID permissions to view and update access groups in your account.

ibmcloud iam access-group-policy-create $SERVICE_ID --roles Editor --service-name "IAM Access Groups"

Add the service ID to your access group.

ibmcloud iam access-group-service-id-add test-secrets-admin-group $SERVICE_ID

Create an IBM Cloud API key for your service ID.

export IBM_CLOUD_API_KEY=ibmcloud iam service-api-key-create test-storage-read-write $SERVICE_ID --description "An API key for testing Secrets Manager and Cloud Object Storage." --output json | jq -r ".apikey"

You use this API key later to enable the Secrets Manager IAM secrets engine.







 Prepare your Cloud Object Storage instance 

Next, create a bucket in your Cloud Object Storage instance and set up access.



1. Create a test bucket in your instance.



1. In the IBM Cloud console, go to your Resource List.
2. From your list of storage services, select test-cos-instance-tutorial.
3.