vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Provisioning the Key Protect service 

You can create an instance of IBM® Key Protect for IBM Cloud® by using the IBM Cloud console or the IBM Cloud CLI.



 Overview 

In Key Protect, an instance (sometimes referred to as a service instance) is a namespace.

A namespace organizes keys into logical groups and provides isolation and protection between namespaces.



* For example, you may choose to have two Key Protect instances - one for the finance department and one for manufacturing. Two instances provides isolation so keys in one business unit are not accessible from other business units.



The term instance is sometimes used to describe compute resources, such as [virtual servers](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-getting-started-tutorial) or [virtual server instances for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-about-advanced-virtual-servers). An instance, in Key Protect should not be equated with compute resources. A Key Protect instance is a namespace.





 Provisioning Key Protect from the IBM Cloud console 

To provision an instance of Key Protect from the IBM Cloud console, complete the following steps.



1. [Log in to your IBM Cloud account](https://cloud.ibm.com/login/).
2. Click Catalog to view the list of services that are available on IBM Cloud.
3. Search for "Key Protect" in the Search the catalog... field and click Key Protect.
4. Select a service plan, and click Create to provision an instance of Key Protect in the account, region, and resource group where you are logged in.







 Provisioning Key Protect from the IBM Cloud CLI 

You can also provision an instance of Key Protect by using the IBM Cloud CLI.



 Login using the CLI 

Login to IBM Cloud through the [IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-getting-started). This is the account used for this instance of Key Protect.







 Login 

Login with the login command.
For more information, see [ibmcloud iam user-policy-create](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iamibmcloud_iam_user_policy_create). The following example command assigns a policy with the User API key creator role for the IAM Identity account management service.

ibmcloud iam user-policy-create name@example.com --roles "User API key creator" --service-name iam-identity

For service names to use in the CLI command for each account management service, see Table 1. However, for a policy on all account management services in the CLI, use --account-management instead of --service-name SERVICE_NAME. For roles that are more than one word, use the display name with quotations.

The following example command assigns a policy with the Administrator role for All Account Management services.

ibmcloud iam user-policy-create name.example.com --roles Administrator --attributes serviceType=service





 Actions and roles for account management services 

The following tables outline the actions that users can take when they are assigned a specific role for each account management service. Review the information to ensure that you are assigning the correct level of access to your users.



 All Account Management services 

To quickly give users a wide-ranging set of account management access, you can assign a policy on all account management services. When a user is assigned a role on All Account Management services, they can complete all of the actions that are associated with that role for each individual service.

The group of All Account Management services includes the following services:



* IAM Access Groups
* IAM Identity service
* IAM Access Management



* Role management



* User Management
* Billing
* Catalog management
* Context-based restrictions
* Enterprise
* Global catalog
* IBM Cloud shell settings
* License and entitlement
* Partner Center
* Partner Center - Sell
* Projects
* Security and Compliance Center
* Software instance
* Support center





Table 2. Roles and example actions for a policy on all account management services

 Roles Actions
,
"rotation": {
"interval_month": 2
}
}

 list the policies
$ ibmcloud kp key policies $KEY_ID --output json

[
{
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-18T20:35:41Z",
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:a192d603-0b8d-452f-aac3-f9e1f95e7411:policy:06a40fd6-6fd7-460a-87d7-8388fc1be057",
"lastUpdateDate": "2020-06-18T20:35:41Z",
"updatedBy": "user id ...<redacted>...",
"rotation": { "interval_month": 2
}
}
]





 Required parameters 



* KEY_ID_OR_ALIAS

The v4 UUID or alias of the key that you want to query. To retrieve a list of your available keys, run the [kp keys](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-keys) command.
* -i, --instance-id

The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.







 Optional parameters 



* -d, --dual-auth

Show policies that have a dual-auth-delete policy.
* -o, --output

Set the CLI output format. By default, all commands print in table format.
If you create your instance in either of the two regions, the failover region is automatically set to the other region.
* Under Allowed network, choose the network access to your service instance:



* Public and private: Manage your instance through both public and private network using the IBM Cloud console, CLI, or API. This is the default option.
* Private only: Access your service instance only through private network using CLI or API. The IBM Cloud console is not available for the private-only network access.



A private instance accepts API requests through only the private endpoints. The private endpoints are only accessible when your IBM Cloud account, along with all associated resources, is enabled with [virtual routing and forwarding (VRF) and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint). You cannot access your private only instance through the CLI or API if your server or machine is outside the IBM Cloud network.



After you provision the service instance, you can still [update the network access policy](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-managing-network-access-policies).
7. Click Create to provision an instance of Hyper Protect Crypto Services in the account, region, and resource group where you are logged in.







 Using the IBM Cloud CLI 

To provision an instance of Hyper Protect Crypto Services Standard Plan with the IBM Cloud CLI, complete the following steps:



1. Download and install the [IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-getting-started).
2. Log in to IBM Cloud through the IBM Cloud CLI with the following command:

ibmcloud login

If the login fails, run the ibmcloud login --sso command to try again. The --sso parameter is required when you log in with a federated ID. If this option is used, go to the link listed in the CLI output to generate a one-time passcode.
3.
* [ibmcloud sat subscription identity set](https://cloud.ibm.com/docs/satellite?topic=satellite-satellite-cli-referencecli-config-subscription-identity-set)
* [ibmcloud sat subscription ls](https://cloud.ibm.com/docs/satellite?topic=satellite-satellite-cli-referencecli-config-subscription-ls).
* [ibmcloud sat subscription rm](https://cloud.ibm.com/docs/satellite?topic=satellite-satellite-cli-referencecli-config-subscription-rm).
* [ibmcloud sat subscription update](https://cloud.ibm.com/docs/satellite?topic=satellite-satellite-cli-referencecli-config-subscription-update).







 ibmcloud sat messages 

[View current messages from IBM Cloud Satellite](https://cloud.ibm.com/docs/satellite?topic=satellite-satellite-cli-referencecli-messages).
The following example shows how to use the CLI to update your network load balancer pool to use the algorithm least_connections and the port of the member:

ibmcloud is load-balancer-pool-update r134-99b5ab45-6357-42db-8b32-5d2c8aa62776 r134-3b66d605-6aa5-4166-9f66-b16054da3cb0 --algorithm least_connections

Sample output:

Updating pool r134-3b66d605-6aa5-4166-9f66-b16054da3cb0 of load balancer r134-99b5ab45-6357-42db-8b32-5d2c8aa62776 under account IBM Cloud Network Services as user test@ibm.com...

ID r134-3b66d605-6aa5-4166-9f66-b16054da3cb0
Name nlb-pool
Protocol tcp
Algorithm least_connections
Instance group ID Name
- -

Health monitor Type Port Health monitor URL Delay Retries Timeout
http 8080 / 10 2 5

Session persistence type source_ip
Members r134-61f8b000-a90d-4abe-909e-c507dffec565
Provision status update_pending
Created 2020-08-27T14:45:42.038-05:00

ibmcloud is load-balancer-pool-member-update r134-99b5ab45-6357-42db-8b32-5d2c8aa62776 r134-3b66d605-6aa5-4166-9f66-b16054da3cb0 r134-61f8b000-a90d-4abe-909e-c507dffec565 --port 6060

Sample output:
The following example shows how to use the CLI to update your ALB pool to use the algorithm least_connections and the port of the member:

ibmcloud is load-balancer-pool-update r134-99b5ab45-6357-42db-8b32-5d2c8aa62776 r134-3b66d605-6aa5-4166-9f66-b16054da3cb0 --algorithm least_connections

Sample output:

Updating pool r134-3b66d605-6aa5-4166-9f66-b16054da3cb0 of load balancer r134-99b5ab45-6357-42db-8b32-5d2c8aa62776 under account IBM Cloud Network Services as user test@ibm.com...

ID r134-3b66d605-6aa5-4166-9f66-b16054da3cb0
Name alb-pool
Protocol tcp
Algorithm least_connections
Instance group ID Name
- -

Health monitor Type Port Health monitor URL Delay Retries Timeout
http 8080 / 10 2 5

Session persistence type source_ip
Members r134-61f8b000-a90d-4abe-909e-c507dffec565
Provision status update_pending
Created 2020-08-27T14:45:42.038-05:00

ibmcloud is load-balancer-pool-member-update r134-99b5ab45-6357-42db-8b32-5d2c8aa62776 r134-3b66d605-6aa5-4166-9f66-b16054da3cb0 r134-61f8b000-a90d-4abe-909e-c507dffec565 --port 6060

Sample output:
* ibmcloud is instance-create my-instance-name my-vpc us-south-1 bx2-2x8 my-subnet --boot-volume '{"name": "boot-vol-attachment-name", "volume": {"name": "boot-vol-name", "profile": {"name": "general-purpose"}, "source_snapshot": {"name": "my-snapshot-name"}}}' Create instance with boot volume attachment from volume snapshot by using resource name.







 Command options 



* INSTANCE_NAME: Name of the instance.
* VPC: ID or name of the VPC.
* ZONE_NAME: Name of the zone.
* PROFILE_NAME: Name of the profile.
* SUBNET: ID or name of the subnet.
* --image: ID or name of the image.
* --catalog-offering: The CRN for the IBM Cloud catalog offering. If specified, the latest version of that offering is used. For more information about creating a catalog offering, see [Onboarding software to your account](https://cloud.ibm.com/docs/account?topic=account-create-private-catalog&interface=cli).
* --catalog-offering-version: The CRN for the version of a IBM Cloud catalog offering. For more information about creating a version for the catalog offering, see [Onboarding software to your account](https://cloud.ibm.com/docs/account?topic=account-create-private-catalog&interface=cli).
* --total-volume-bandwidth: The amount of bandwidth (in megabits per second) that is allocated exclusively to instance storage volumes. An increase in this value results in a corresponding decrease to total network bandwidth.
* --boot-volume: BOOT_VOLUME_JSON|@BOOT_VOLUME_JSON_FILE, boot volume attachment in JSON or JSON file. For the data schema, see the boot_volume_attachment property in the [API documentation](https://cloud.ibm.com/apidocs/vpccreate-instance).
For more information, see the [CLI reference](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iamibmcloud_iam_trusted_profile_policy_create).







 Establishing trust with compute resources by using the CLI 

Complete the following steps to set up better control over granting access to compute resources.

IBM Cloud Kubernetes Service supports only trusted profiles for versions 1.21 and newer. Free IBM Cloud Kubernetes Service clusters create only earlier versions. You have the choice to create clusters with an earlier version with the standard plan, so be sure to select version 1.21 or newer.



1. Create a trusted profile by running the following command:

ibmcloud iam trusted-profile-create sample-compute-profile -d "sample trusted profile for compute resources"

For more information, see the [CLI reference](https://cloud.ibm.com/docs/account?topic=cli-ibmcloud_commands_iamibmcloud_iam_trusted_profile_create).
2. Create conditions for your trusted profile by using the ibmcloud iam trusted-profile-rule-create command:

ibmcloud iam trusted-profile-rule-create sample-compute-profile --name cr-rule --type Profile-CR --conditions claim:namespace,operator:EQUALS,value:default --conditions claim:crn,operator:EQUALS,value:crn:test:bluemix:public:containers-kubernetes:us-south:a/test:: --cr-type IKS_SA

For more information, see the [CLI reference](https://cloud.ibm.com/docs/account?topic=cli-ibmcloud_commands_iamibmcloud_iam_trusted_profile_rule_create).

You can also create a direct link:

ibmcloud iam trusted-profile-link-create sample-compute-profile --name my_link --cr-type IKS_SA --link-name default --link-namespace default --link-crn my_compute_resource_crn
Log in to IBM Cloud with the [IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-getting-started).

ibmcloud login

If the login fails, run the ibmcloud login --sso command to try again. The --sso parameter is required when you log in with a federated ID. If this option is used, go to the link listed in the CLI output to generate a one-time passcode.
2. Select the account, region, and resource group that contain your provisioned instance of Key Protect.
3. Retrieve the Cloud Resource Name (CRN) that uniquely identifies your Key Protect instance.

ibmcloud resource service-instance <instance_name> --id

Replace <instance_name> with the unique alias that you assigned to your Key Protect instance. If you do not know the name of your instance, run the [ibmcloud resource service-instances command](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_resourceibmcloud_resource_service_instances) to retrieve a list of instance names that you provisioned in the selected region.

The following truncated example shows the CLI output.

crn:v1:bluemix:public:kms:us-south:a/f047b55a3362ac06afad8a3f2f5586ea:42454b3b-5b06-407b-a4b3-34d9ef323901:: 42454b3b-5b06-407b-a4b3-34d9ef323901

The 42454b3b-5b06-407b-a4b3-34d9ef323901 value is an example instance ID.







 Retrieving an instance ID with the API 

You might want to retrieve the instance ID programmatically to help you build and connect your application.
* "o": storage optimized family of profiles, 1 vCPU to 8 GiB memory ratio and 1 vCPU to 300 GB instance storage ratio



The second character represents the CPU architecture.



* "x": x86_64



The third character represents the generation of the IBM Cloud infrastructure where the profile is provisioned.



* "1": IBM Cloud Virtual Servers for Classic
* "2": IBM Cloud Virtual Servers for VPC



If the fourth character is a "d", such as bx2d, then a defined quantity of instance storage is provisioned with the virtual server.

The characters after "-" represents the number of vCPUs and the size of RAM (GiB). For example, "2x8" means that this profile has 2 vCPU and 8 GiB of RAM.

Using “bx2-4x16” as an example, you can know from the name that it is a balanced profile that provides 4 vCPUs of compute and 16 GiB of memory. The profile is deployed on an x86-based host and is for the second-generation VPC.





 Viewing instance profiles in the UI 



1. In the IBM Cloud console, go to Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/icons/icon_hamburger.svg) > VPC Infrastructure > Compute > Virtual server instances.
2. From the Virtual server instances page, click New instance.
3. You can either select a profile configuration from Popular profiles or click All profiles to view more configurations.







 Viewing instance profiles from the CLI 

To view the list of available instance profiles by using the CLI, run the following command:

ibmcloud is instance-profiles





 Viewing instance profiles with the API 

To view the list of available instance profiles by using the API, you can call the [List all instance profiles API](https://cloud.ibm.com/apidocs/vpclist-instance-profiles).

The following request example lists the available instance profiles.
Creating listener of load balancer r134-99b5ab45-6357-42db-8b32-5d2c8aa62776 under account IBM Cloud Network Services as user test@ibm.com...

ID r134-2847a948-f9b6-4fc1-91c6-f1c49dac3eba
Certificate instance -
Connection limit -
Port 7070
Protocol tcp
Default pool r134-3b66d605-6aa5-4166-9f66-b16054da3cb0
Provision status create_pending
Created 2020-08-27T15:16:08.643-05:00
7. Get details about your load balancer:

ibmcloud is load-balancer r134-99b5ab45-6357-42db-8b32-5d2c8aa62776

Sample output:

Getting load balancer r134-99b5ab45-6357-42db-8b32-5d2c8aa62776 under account IBM Cloud Network Services as user test@ibm.com...

ID r134-99b5ab45-6357-42db-8b32-5d2c8aa62776
Name nlb-test
CRN crn:v1:public:is:us-south-1:a/6266f0fbb7df487d8438b9b31d24cd96::load-balancer:r134-99b5ab45-6357-42db-8b32-5d2c8aa62776
Family Network
Host name 99b5ab45-us-south.lb.test.appdomain.cloud
Subnets ID Name
0896-b1f24514-89dc-4afd-b0e2-5489a43cf45c nlb

Public IPs 150.238.50.78, 150.238.54.95
Private IPs 10.240.0.58, 10.240.0.59
Use <programmatic_service_name> for the service name, and refer to the Role ID values table to ensure that you're using the correct value for the CRN.

curl -X POST 'https://iam.cloud.ibm.com/v1/policies' -H 'Authorization: Bearer $TOKEN' -H 'Content-Type: application/json'
-d '{
"type": "access",
"description": "Viewer role for vmware solutions service instance",
"subjects": [
{
"attributes":
{
"name": "iam_id",
"value": "IBMid-123453user"
}
]
}'
],
"roles":[
{
"role_id": "crn:v1:bluemix:public:iam::::role:Viewer"
}
],
"resources":[
{
"attributes":
{
"name": "accountId",
"value": "$ACCOUNT_ID"
},
{
"name": "serviceName",
"value": "vmware-solutions"
}
]
}
]
}





 Migrating existing instances to IBM Cloud accounts 

Because of the integration of IBM Cloud for VMware Solutions with IAM, instances that are deployed in V2.5 and later releases in your IBM Cloud account are automatically added to your account and are managed by IAM.

For your existing instances that were deployed in V2.4 and earlier releases, you can migrate them to specified IBM Cloud accounts for IAM-enabled management. For more information, see [Migrating pre-V2.5 vCenter Server instances to IBM Cloud accounts](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_addinstancetousraccount).





 Related links 



* [Setting up user access](https://cloud.ibm.com/docs/account?topic=account-access-getstarted)
To retrieve the cluster name or ID, run ibmcloud oc clusters. This value is required.

--instance LOGGING_INSTANCE
: The ID or name of the IBM Log Analysis service instance that you used in your logging configuration. To retrieve the service instance name, run ibmcloud resource service-instances. This value is required.

Example command

ibmcloud ob logging config delete --cluster mycluster --instance mylogginginstance





 ibmcloud ob logging config list 

Virtual Private Cloud

Classic infrastructure

List all Log Analysis configurations that were created for your cluster with the Red Hat OpenShift on IBM Cloud observability plug-in.

To list logging configurations that you manually set up without using the Red Hat OpenShift on IBM Cloud observability plug-in, you must first make this configuration available to the plug-in by using the [ibmcloud ob logging agent discover](https://cloud.ibm.com/docs/openshift?topic=openshift-observability_clilogging_agent_discover) command.

ibmcloud ob logging config list --cluster CLUSTER

Minimum required permissions:



* Administrator platform access role and Manager service access role for the ibm-observe Kubernetes namespaces in IBM Cloud Kubernetes Service.
* Viewer platform access role for IBM Log Analysis



Command options:

--cluster CLUSTER
: The name or ID of the cluster for which you want to list existing Log Analysis configurations. This value is required.





 ibmcloud ob logging config enable public-endpoint|private-endpoint 

Virtual Private Cloud

Classic infrastructure

Use the public or private cloud service endpoint to send data from your cluster to your Log Analysis service instance.

To use the private cloud service endpoint, your cluster must be enabled for using private cloud service endpoints. Red Hat OpenShift on IBM Cloud clusters don't support private cloud service endpoints.

ibmcloud ob logging config enable public-endpoint|private-endpoint --cluster CLUSTER --instance LOGGING_INSTANCE

Minimum required permissions:
ibmcloud is instance create vsi-1 vpc-1 us-south-1 bx2-2x8 subnet-1 --image ibm-ubuntu-20-04-3-minimal-amd64-1 --boot-volume '{"name": "my-boot-vol-1", "volume": {"capacity": 190, "profile": {"name": "general-purpose"}}}'

Creating instance cli-vsi-1 under account VPC1 as user myuser@mycompany.com...

ID 0716_84f99419-554d-4c05-bea0-7034d1c40ed3
Name vsi-1
CRN crn:v1:staging:public:is:us-south-1:a/efe5afc483594adaa8325e2b4d1290df::instance:0716_84f99419-554d-4c05-bea0-7034d1c40ed3
Status pending
Availability policy on host failure restart
Startable true
Profile bx2-2x8
Architecture amd64
vCPU Manufacturer Intel
vCPUs 2
Memory(GiB) 8
Bandwidth(Mbps) 4000
Volume bandwidth(Mbps) 1000
Network bandwidth(Mbps) 3000
Metadata service enabled false
Image ID Name
9f6b534b-6061-40f4-ac42-5aba4dd0da7f ubuntu-20-04-3-minimal-amd64-1

VPC ID Name
r134-42ebadb6-65f8-4b2f-923b-50b0e44670df vpc-1

Zone us-south-1
Resource group ID Name
11caaa983d9c4beb82690daab08717e9 Default

Created 2022-02-24T16:43:47+05:30
Boot volume ID Name Attachment ID Attachment name
Managing IAM access for Discovery 

Share a preview of your search application or build a team to work on a project. You can give team members access to your Discovery service instance through IBM Cloud.

IBM Cloud

The information in this topic applies to managed deployments only.

Access to IBM Cloud service instances is controlled by IBM Cloud® Identity and Access Management (IAM). Every person who accesses Discovery in your account must be assigned an access policy with an IAM role.

Only an owner of the service account can add users. For more information, see [Managing access to resources](https://cloud.ibm.com/docs/account?topic=account-assign-access-resources).



  Platform roles 

A platform role controls a person's ability to access a service instance in IBM Cloud.

To give someone access to your service instance, assign them any platform role other than Viewer. A person with the Viewer role cannot access the product user interface. All of the other roles allow users to perform all tasks.





  Service roles 

A service role controls what a person can do in Discovery.

With Discovery, anyone who can access a Discovery instance can perform all actions. The only limitation is with the Reader role; anyone with reader-level access cannot submit API POST requests.
* ibmcloud is instance-create my-instance-name 72b27b5c-f4b0-48bb-b954-5becc7c1dcb8 us-south-1 bx2-2x8 72b27b5c-f4b0-48bb-b954-5becc7c1dcb8 --catalog-offering-version crn:v1:bluemix:public:globalcatalog-collection:global:a/efe5afc483594adaa8325e2b4d1290df:2497ae83-40cb-46ba-ac7f-5303514a2669:offering:54372a73-7a0a-4799-ac9c-8736620c67f1 Create instance from catalog offering version.
* ibmcloud is instance-create --interactive Create instance interactively.
* ibmcloud is instance-create my-instance-name my-vpc us-south-1 bx2-2x8 my-subnet --boot-volume '{"name": "boot-vol-attachment-name", "volume": {"name": "boot-vol-name", "capacity": 150, "profile": {"name": "general-purpose"}, "source_snapshot": {"id": "150847e3-ef0d-4927-9341-6d0a7bae424f"}}}' Create instance from snapshot with boot volume capacity. The capacity value can range from snapshot's minimum capacity to 250