Using virtual private endpoints for VPC to privately connect to Hyper Protect Crypto Services

Using the VPE with the CLI

• Using the VPE for the TKE CLI plug-in

  1. Update the TKE CLI plug-in to the latest version with the following command:

     ibmcloud plugin update tke
     

  2. To initialize service instances with the TKE CLI plug-in, set the TKE_PRIVATE_ADDR environment variable to target the TKE private endpoint:

     export TKE_PRIVATE_ADDR=https://tke.private.<region>.hs-crypto.cloud.ibm.com
     

• Using the VPE for the Key Protect CLI plug-in

  1. Update the Key Protect CLI plug-in to the latest version with the following command:

     ibmcloud plugin update key-protect -r "IBM Cloud"
     

  2. To perform key management operations with the Key Protect CLI plug-in, set the KP_PRIVATE_ADDR environment variable to target the key management service private endpoint:

     export KP_PRIVATE_ADDR=https://<instance_ID>.api.private.<region>.hs-crypto.appdomain.cloud
     

Using the VPE with the API

• Using the VPE for the key management service API

  To perform key management operations with the key management service API, use the key management service private endpoints in the API request URL to access the service. For example,

  curl GET \
    https://<instance_ID>.api.private.<region>.hs-crypto.appdomain.cloud/api/v2/keys   \
    -H 'authorization: Bearer <IAM_token>'   \
    -H 'bluemix-instance: <instance_ID>'   \
    -H 'accept: application/vnd.ibm.kms.key+json'
  

• Using the VPE for the PKCS #11 API

  To perform cryptographic operations with the PKCS #11 API, set the address field to the EP11 private endpoint in the configuration file. For more information, see Set up the PKCS #11 configuration file.

• Using the VPE for the GREP11 API

  To perform cryptographic operations with the GREP11 API, specify the server address with the EP11 private endpoint in the code. For more information, see Generating a GREP11 API request.

Using the VPE with Terraform

To use VPE with Terraform, set the service_endpoints parameter to private-only in the resource block. For more information, see Setting up Terraform for Hyper Protect Crypto Services.

• If you plan to use private endpoints to initialize your service instance, make sure to set the IBMCLOUD_HPCS_TKE_ENDPOINT environment variable to target the TKE private endpoint. For example,:

  export IBMCLOUD_HPCS_TKE_ENDPOINT=https://tke.private.<region>.hs-crypto.cloud.ibm.com
  

• If you plan to use private endpoints to manage your key management service keys, make sure to set the IBMCLOUD_KP_API_ENDPOINT environment variable to target the key management service private endpoint. For example,:

  export IBMCLOUD_KP_API_ENDPOINT=https://<instance_ID>.api.private.<region>.hs-crypto.appdomain.cloud