vania-janet/multiturn-rag-retrieval-data huggingface dataset:
[2019-04-18 16:01:54,358] [backup : 166] [INFO] Schedule info is: ['daily']
[2019-04-18 16:01:54,358] [backup : 172] [INFO] Scheduled for daily!!!



7. Verify that your data is successfully backed up or restored.



* Backup:



1. Find your IBM Cloud Object Storage service instance in the [IBM Cloud resource list](https://cloud.ibm.com/resources).
2. From the navigation, select Buckets and click on the bucket that you used in your backup configuration. Your backup is displayed as an object in your bucket.
3. Review the compressed files. You can download the .gz file, extract the file, and verify the backed-up data.



* Restore:



1. Create a deployment.yaml file with a pod that mounts the PVC that contains your restored data. The following example deploys an nginx pod that mounts the PVC on the /test mount directory.

apiVersion: apps/v1
kind: Deployment
metadata:
name: restore
labels:
app: nginx
spec:
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
spec:
containers:
- image: nginx
name: nginx
volumeMounts:
- name: my-volume Example: my_volume
mountPath: /test Example: /test
volumes:
- name: my-volume Example: my_volume
persistentVolumeClaim:
claimName: my-actual-pvc-name Example: my_pvc
Show more

spec.containers.image
: The name of the image that you want to use. To list available images in your IBM Cloud Container Registry account, run ibmcloud cr image-list.

spec.containers.name
: The name of the container that you want to deploy to your cluster.

spec.containers.volumeMounts.mountPath
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:a192d603-0b8d-452f-aac3-f9e1f95e7411:key:c42c6f2c-8b67-4016-b2c3-99fba9490f5d"
}

 list keys - verify the key was restored
$ ibmcloud kp keys

Retrieving keys...
OK
Key ID Key Name
c42c6f2c-8b67-4016-b2c3-99fba9490f5d my-imported-root-key







 Required parameters 



* KEY_ID_OR_ALIAS

The v4 UUID or alias of the key that you want to restore.
* -i, --instance-ID

The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.







 Optional parameters 



* -k, --key-material

Deprecated The key material from a previously imported base64-encoded key.

If you created the root key using an import token, then the value of the -k, --key-material option is the encrypted material key. See example 2, which uses an import token to create the root key and it uses an import token to restore the root key.
* -n, --encrypted-nonce

Deprecated Verify a request to import a key by providing an encrypted nonce.

For more information, see [kp import-token nonce-encrypt](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-import-token-nonce-encrypt).
* -o, --output

Set the CLI output format.
Replication status shows when a replica file share is being created, when failover is underway, and when a split operation is creating independent file shares. For more information, see [File share lifecycle states](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-managing&interface=apifile-storage-vpc-status).





 Verify replication with the API 

You can use the API to verify that the replication succeeded, is pending, or failed. Make either a GET /shares/{share_id} request or a GET /shares/{replica_id) request to see the status. The following example request specifies the replica ID:

curl -X GET "$vpc_api_endpoint/v1/shares/$replica_id?version=2023-07-11&generation=2&maturity=beta" -H "Authorization: $iam_token"

In the response, look at the latest_job property. The example shows the replication failover succeeded:

"created_at": "2023-07-11T23:31:59Z",
"crn": "crn:[...]",
"encryption": "provider_managed",
"href": "$vpc_api_endpoint/v1/shares/199d78ec-b971-4a5c-a904-8f37ae710c63",
"id": "199d78ec-b971-4a5c-a904-8f37ae710c63",
"iops": 3000,
"lifecycle_state": "stable",
"name": "share-name1",
.
.
.
"latest_job": {
"status": "succeeded",
"status_reason": {
"code": "",
"message": "",
"more_info": ""
},
"type": "replication_failover"
}
}
Show more
Replication status shows when a replica file share is being created, when failover is underway, and when a split operation is creating independent file shares. For more information, see [File share lifecycle states](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-managing&interface=apifile-storage-vpc-status).





 Verify replication with the API 

You can use the API to verify that the replication succeeded, is pending, or failed. Make either a GET /shares/{share_id} request or a GET /shares/{replica_id) request to see the status. The following example request specifies the replica ID:

curl -X GET "$vpc_api_endpoint/v1/shares/$replica_id?version=2023-07-11&generation=2&maturity=beta" -H "Authorization: $iam_token"

In the response, look at the latest_job property. The example shows the replication failover succeeded:

"created_at": "2023-07-11T23:31:59Z",
"crn": "crn:[...]",
"encryption": "provider_managed",
"href": "$vpc_api_endpoint/v1/shares/199d78ec-b971-4a5c-a904-8f37ae710c63",
"id": "199d78ec-b971-4a5c-a904-8f37ae710c63",
"iops": 3000,
"lifecycle_state": "stable",
"name": "share-name1",
.
.
.
"latest_job": {
"status": "succeeded",
"status_reason": {
"code": "",
"message": "",
"more_info": ""
},
"type": "replication_failover"
}
}
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:a192d603-0b8d-452f-aac3-f9e1f95e7411:key:c42c6f2c-8b67-4016-b2c3-99fba9490f5d"
}

 list keys - verify the key was restored
$ ibmcloud kp keys

Retrieving keys...
OK
Key ID Key Name
c42c6f2c-8b67-4016-b2c3-99fba9490f5d my-imported-root-key







 Required parameters 



* KEY_ID_OR_ALIAS

The v4 UUID or alias of the key that you want to restore.
* -i, --instance-ID

The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.







 Optional parameters 



* -k, --key-material

Deprecated The key material from a previously imported base64-encoded key.

If you created the root key using an import token, then the value of the -k, --key-material option is the encrypted material key. See example 2, which uses an import token to create the root key and it uses an import token to restore the root key.
* -n, --encrypted-nonce

Deprecated Verify a request to import a key by providing an encrypted nonce.

For more information, see [kp import-token nonce-encrypt](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-import-token-nonce-encrypt).
* -o, --output

Set the CLI output format.
curl -X DELETE "$vpc_api_endpoint/v1/backup_policies/5063bfe5-c16f-4606-ba26-fba0f099b97d/plans/4cf9171a-0043-4434-8727-15b53dbc374c?version=2022-06-28&generation=2" -H "Authorization: $iam_token"

The response shows that the backup plan was deleted.

{
"active": true,
"attach_user_tags": [
"my-daily-backup-plan"
],
"copy_user_tags": true,
"created_at": "2022-06-22T01:44:49.070Z",
"cron_spec": "/5 1,2,3 * * ",
"deletion_trigger": {
"delete_after": 20
"href": "https://us-south.iaas.cloud.ibm.com/v1/backup_policies/0fe9e5d8-0a4d-4818-96ec-e99708644a58/plans/4cf9171a-0043-4434-8727-15b53dbc374c",
"id": "4cf9171a-0043-4434-8727-15b53dbc374c",
"lifecycle_state": "deleted",
"name": "my-policy-plan",
"resource_type": "backup_policy_plan"
}
}







 Managing backup policies and plans with Terraform 

You can manage backup policies by using Terraform.

To use Terraform, download the Terraform CLI and configure the IBM Cloud Provider plug-in. For more information, see [Getting started with Terraform](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-getting-started).
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:a192d603-0b8d-452f-aac3-f9e1f95e7411:key:c42c6f2c-8b67-4016-b2c3-99fba9490f5d"
}

 list keys - verify the key was restored
$ ibmcloud kp keys

Retrieving keys...
OK
Key ID Key Name
c42c6f2c-8b67-4016-b2c3-99fba9490f5d my-imported-root-key







 Required parameters 



* KEY_ID_OR_ALIAS

The v4 UUID or alias of the key that you want to restore.
* -i, --instance-ID

The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.







 Optional parameters 



* -k, --key-material

Deprecated The key material from a previously imported base64-encoded key.

If you created the root key using an import token, then the value of the -k, --key-material option is the encrypted material key. See example 2, which uses an import token to create the root key and it uses an import token to restore the root key.
* -n, --encrypted-nonce

Deprecated Verify a request to import a key by providing an encrypted nonce.

For more information, see [kp import-token nonce-encrypt](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-import-token-nonce-encrypt).
* -o, --output

Set the CLI output format. By default, all commands print in table format.
* ibmcloud is backup-policy-jobs r134-0703cdf1-48bb-4af2-9ceb-1edbe8fcb818 --volume r134-1a1e25f2-3fc3-4507-8725-e5f1d07256ea --snapshot r143-1a1e25f2-3fc3-4507-8725-e5f1d08956ea --status running --plan r136-3a3e25f2-3fc3-4507-8725-e5f1d08496ea
* ibmcloud is backup-policy-jobs bkp-policy-do-not-delete --snapshots r134-f1d9b974-14e5-4a2e-8e38-c023164be316,r134-b11f1540-288d-4331-97ab-f565ca15a3b8,r134-ab3147a3-715f-4017-8fed-ea3ddadeeb1d,r134-435b8414-dae2-4026-847f-a73162105e5f
* ibmcloud is backup-policy-jobs bkp-policy-do-not-delete --snapshots bkp-plan-do-not-delete-31addff28e2b-422b,bkp-plan-do-not-delete-f37bc1f19123-4995
Hyper Protect Crypto Services integration 

Hyper Protect DBaaS for PostgreSQL is deprecated. As of 15 April 2023, you can't create new instances, and access to free instances will be removed. Existing paid instances are supported until 30 November 2023. Existing instances will be deleted on 1 March 2024.

Migration options: (a) [Hyper Protect Virtual Servers](https://www.ibm.com/cloud/hyper-protect-virtual-servers) with client managed databases and (b) [IBM Cloud Databases](https://www.ibm.com/cloud/free/databases) with optional additional services for security, such as [Hyper Protect Crypto Services](https://www.ibm.com/cloud/hyper-protect-crypto) and Data Security Broker ([Baffle](https://baffle.io/)). To migrate your data, you can use common dump and restore utilities (follow similar steps in the [migration documentation](https://cloud.ibm.com/docs/hyper-protect-dbaas-for-postgresql?topic=hyper-protect-dbaas-for-postgresql-migration_postgre)).

The data that you store in IBM Cloud® Hyper Protect DBaaS for PostgreSQL databases is encrypted by default by randomly generated keys. If you need full control over your encryption keys, you can use [IBM Cloud Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-overview) to create, add, and manage encryption keys and associate the keys with your Hyper Protect DBaaS for PostgreSQL service instance to encrypt your databases.

The following diagram shows how Hyper Protect DBaaS for PostgreSQL integrates with Hyper Protect Crypto Services.

Zoom

!
[show](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-show) Retrieve a key 
 [sync](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-sync) Synchronize a key's associated resources 
 [unwrap](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-unwrap) Unwrap a data encryption key 
 [update](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-update) Update a key, transferring it to a new key ring 
 [versions](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-versions) updated List all key versions 
 [wrap](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-wrap) Wrap a data encryption key 







 kp key-ring command 

Key Ring support allows for managing groups of keys for best practices using kp key-ring.



Table 4. Sub-commands for managing key-rings

 Sub-command Status v0.8 Description 

 [create](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-ring-create) Creates a key ring within a kp instance 
 [delete](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-ring-delete) Deletes a key ring within a kp instance 







 Other kp commands 

More commands for managing Key Protect resources could support best practices.



Table 5. Commands for managing other resources
"last_heartbeat": "2022-01-26T00:56:01Z",
"health_status": "ok",
"message": "Ping executed successfully."
}







 hpcs uko managed-keys-from-keystore 

List all managed keys that are activated in the target keystore.

If the --all-pages option is not set, the command only retrieves a single page of the collection.

ibmcloud hpcs uko managed-keys-from-keystore --uko-vault UKO-VAULT --id ID [--algorithm ALGORITHM] [--state STATE] [--limit LIMIT] [--offset OFFSET] [--sort SORT] [--label LABEL] [--activation-date ACTIVATION-DATE] [--activation-date-min ACTIVATION-DATE-MIN] [--activation-date-max ACTIVATION-DATE-MAX] [--deactivation-date DEACTIVATION-DATE] [--deactivation-date-min DEACTIVATION-DATE-MIN] [--deactivation-date-max DEACTIVATION-DATE-MAX] [--expiration-date EXPIRATION-DATE] [--expiration-date-min EXPIRATION-DATE-MIN] [--expiration-date-max EXPIRATION-DATE-MAX] [--created-at CREATED-AT] [--created-at-min CREATED-AT-MIN] [--created-at-max CREATED-AT-MAX] [--updated-at UPDATED-AT] [--updated-at-min UPDATED-AT-MIN] [--updated-at-max UPDATED-AT-MAX] [--size SIZE] [--size-min SIZE-MIN] [--size-max SIZE-MAX]



* Command options

--uko-vault (string)
: Required. The UUID of the vault where the update is to take place. You can use the ibmcloud hpcs uko vaults command to retrieve the UUID.

--id (string)
: Required. The UUID of the keystore. You can use the ibmcloud hpcs uko keystores command to retrieve the UUID.
Copying blob sha256:dcef409117430ed9906a59ad0a3ea0752061fbf8a9e544f4edd77667a25d85ae
Copying blob sha256:a1f889dd610c6510c7fc091a51c247463f3cc9a7c67bdc397c9632168808f7d2
Copying blob sha256:bd278801acd18ada10f43b732113a6fffc163011862ea6cde729f8dc59e64222
Copying blob sha256:2d6c03ed5d15be86cdef7d9c0c9fea40a3f6b89662bca59680d037074f52bb38
Copying blob sha256:fa2ef7f80d6fc9543f6eb472846931ed1cec2b5f776d1b67bcb1b9942e1a947e
Copying blob sha256:ff5a4e4d3690ccc931900b63714d326cc53a58e644f8d0a4f06bf8c62f11c5c7
Copying config sha256:01aa1ebb7be74529867106100c4e699ca2ae87f8242460771527f772e6a3d174
Writing manifest to image destination
Storing signatures
Successfully pushed us.icr.io/mods15/vmac-openshift-app-registry@sha256:6847b889397704b9fb8c3122c84b505c3dc5f99a0669fb69f534d3504eec385d
Push successful
3. You can check the status of deployment and service using

oc status
"creationDate": "2020-03-12T03:50:12Z",
"createdBy": "...",
"algorithmType": "Deprecated",
"algorithmMetadata": {
"bitLength": "256",
"mode": "Deprecated"
},
"algorithmBitSize": 256,
"algorithmMode": "Deprecated",
"lastUpdateDate": "2020-03-12T03:50:12Z",
"dualAuthDelete": {
"enabled": false
},
"deleted": false
}
]
}





 Next steps 

Need to retrieve the payload value for a standard key? To learn more, see [Retrieving a key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-key).

For a detailed description of the response parameters, see the Key Protect [REST API reference doc](https://cloud.ibm.com/apidocs/key-protect).
The following example updates the my-policy-plan-b plan that is part of the new-policy-23. It specifies the us-east region as the destination of the remote region copy. Optionally, you can add the --encryption-key option to provide the CRN of the root key to be used to decrypt the snapshot in the remote region.

cloudshell:$ ibmcloud is backup-policy-plan-update new-policy-23 my-policy-plan-b --remote-region-policies '[
{
"delete_over_count": 99,
"region": {
"name": "us-east"
}
}
]'
Updating plan r138-6f4f08ba-e0bb-470f-bbfb-f3a22aebbfa9 of the backup policy r138-0521986d-963c-4c18-992d-d6a7a99d115f under account Test Account as user test.user@ibm.com...

ID r138-6f4f08ba-e0bb-470f-bbfb-f3a22aebbfa9
Name my-policy-plan-b
Active true
Lifecycle state updating
Clone policy Max snapshots Zones
5 eu-de-1

Deletion trigger Delete after Delete over count
20 20

Remote Region Policies Region Encryption Key Delete over count
us-east - 99

Attached tags daily-backup-plan
Copy tags true
Cron specification 10 20 * * 
Created at 2023-05-05T22:42:32+00:00
Resource type backup_policy_plan

For more information about available command options, see [ibmcloud is backup-policy-plan-update](https://cloud.ibm.com/docs/cli?topic=cli-vpc-referencebackup-policy-plan-update).





 Deleting a backup plan from the CLI
Why is the status of my OpenShift Data Foundation storage cluster stuck at Progressing? 

When you run oc describe noobaa or oc describe ocscluster <ocscluster_name>, the status is stuck at Progressing.

To determine why your storage cluster status is stuck, describe your storage cluster resources and review the Status.



1.  [Access your Red Hat OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-access_cluster).
2.  Run the command to describe NooBaa. Note any error messages in the Events section of the output.

oc describe noobaa -n openshift-storage
3.  List the name of your ODF storage cluster.

oc get ocscluster

Example output:

NAME             AGE
ocscluster-vpc   71d
4.  Describe your ODF storage cluster. Note any error messages in the Events section of the output.

oc describe ocscluster <ocscluster_name>



Review the following common storage cluster error messages for steps to resolve the issue.



  Error: Cloud credentials secret "ibm-cloud-cos-creds" is not ready yet 

When you run oc describe noobaa or oc describe ocscluster <ocscluster_name>, the status is stuck at Progressing and you see the following error message:

Error: Cloud credentials secret "ibm-cloud-cos-creds" is not ready yet

You want to use IBM Cloud Object Storage as a backing store for your ODF cluster, but the credentials specified in the ibm-cloud-cos-creds secret are invalid.

Verify your Object Storage credentials and [update the Kubernetes secret for your Object Storage service credentials](https://cloud.ibm.com/docs/openshift?topic=openshift-storage-cos-understandcreate_cos_secret).
The keystore group must match the key template that is associated with the managed key.

https://uko.<region>.hs-crypto.cloud.ibm.com:<port>/api/v4/keystores/<id>

Replace <id> with the ID of your keystore.
3. Update the managed key to match the latest version of the associated key template by making a POST call to the following endpoint.

https://uko.<region>.hs-crypto.cloud.ibm.com:<port>/api/v4/managed_keys/<id>/update_from_template

Replace <id> with the ID of your managed key.

For detailed instructions and code examples about using the API method, check out how to [Update an internal keystore or a keystore connection](https://cloud.ibm.com/apidocs/ukoupdate-keystore) and [Update a managed key to match the key template](https://cloud.ibm.com/apidocs/ukoupdate-managed-key-from-template) in the Hyper Protect Crypto Services Unified Key Orchestrator API reference doc.







 What's next 



* To find out instructions on creating a managed key, check out [Creating managed keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-managed-keys).
* To find out instructions on deleting a managed key, check out [Deleting managed keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-managed-keys).
* To find out more about managing your key list, check out [Viewing a list of keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-key-list) or [Filtering and searching keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-search-key-list).
When the service credential is rotated, make sure the [API Key is updated with the new API Key.](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-archivingarchiving_step8) Archiving will stop if the API Key is not updated.







 Activity Tracker events 

The following Activity Tracker events are generated when you configure archiving:



Table 3. Archiving Activity Tracker events

 Action Description 

 logdnaat.account-archive-setting.configure This event is generated when an administrator configures archiving for an auditing instance.
"updated": "2016-08-17T19:11:16.003Z",
"status": "completed"
}
]
}
Show more







 Deleting a job 

You can use the DELETE /v1/recognitions/{id} method to delete the job that is specified with the id path parameter. You typically delete a job after you obtain its results from the service. Once you delete a job, its results are no longer available. You cannot delete a job that the service is actively processing.

By default, the service maintains the results of each job until the job's time to live expires. The default time to live is one week, but you can use the results_ttl parameter of the POST /v1/recognitions method to specify the number of minutes that the service is to maintain the results.



 Delete a job example 

The following example deletes the job with the specified ID:

IBM Cloud

curl -X DELETE -u "apikey:{apikey}" "{url}/v1/recognitions/{job_id}"

IBM Cloud Pak for Data

curl -X DELETE --header "Authorization: Bearer {token}" "{url}/v1/recognitions/{job_id}"
To delete it later, data must be labeled with a customer_id.



1. Use the DELETE /v1/user_data operation and provide the customer_id of the data you wish to delete. DELETE /v1/user_data deletes all data associated with a particular customer_id within that service instance, as specified in [Methods that support labeling data](https://cloud.ibm.com/docs/discovery?topic=discovery-information-securitypi_methods). Also see the [API reference](https://cloud.ibm.com/apidocs/discoverydelete-labeled-data)



Deletions are performed asynchronously. You cannot track the progress of deletions.

To ensure all labeled content is correctly removed, run user_delete after the processing and pending counts for all collections in your environment return 0.

If a non-existent customer_id is provided, nothing is deleted, but a 200 - OK response is returned.

Environments and Collections are not labeled with a customer_id, even if a X-Watson-Metadata header is included in the request to create the environment or collection. Only the individual documents within a collection within an environment are labeled. Therefore when data is deleted, individual environments and collections are NOT deleted.

You cannot delete labeled data using the Discovery tooling.





 Health Insurance Portability and Accountability Act (HIPAA) 

US Health Insurance Portability and Accountability Act (HIPAA) support is available for Premium plans in the Washington, DC location created on or after 1 April 2019. See [Enabling EU and HIPAA supported settings](https://cloud.ibm.com/docs/account?topic=account-eu-hipaa-supportedeu-hipaa-supported) for more information.

There are several scenarios where you must use extra care to protect personal health information (PHI) in Discovery:



* Avoid importing any files that contain PHI from external data sources, such as Box, SharePoint, Salesforce, Web Crawl, IBM Cloud Object Storage. Avoid importing files with PHI from external data sources because data in transit between the source and the service cannot be isolated.