vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Attach security groups when you create an endpoint gateway, or modify security groups that are bound to an endpoint gateway after provisioning. For more information, see [Configuring ACLs and security groups for use with endpoint gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-configure-acls-sgs-endpoint-gateways).

Update to Snapshots for VPC
: When you view details of a snapshot from the [UI](https://cloud.ibm.com/docs/vpc?topic=vpc-snapshots-vpc-view&interface=uisnapshots-vpc-view-snapshot-ui), [CLI](https://cloud.ibm.com/docs/vpc?topic=vpc-snapshots-vpc-view&interface=clisnapshots-vpc-view-details-cli), or [API](https://cloud.ibm.com/docs/vpc?topic=vpc-snapshots-vpc-view&interface=apisnapshots-vpc-view-api), a new field shows when the snapshot was captured from the volume. This feature applies to snapshots created after January 2022.





 21 January 2022 

New stock images for virtual servers
: The following stock images are now available for virtual servers:



* Red Hat 8.4 for SAP
* SLES 12 SP5 for SAP
* SLES 15 SP3 for SAP







 14 January 2022 

Application Load Balancer (ALB) for VPC
: Application load balancers now support HTTP/HTTPS compression, which you use to compress data that is transmitted to your users. For more information, see [Compression (HTTP/HTTPS only)](https://cloud.ibm.com/docs/vpc?topic=vpc-advanced-traffic-managementcompression).

High Availability (HA) Virtual Network Function (VNF) support
For more information, see [Cross-account encryption for multitenant file storage resources](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-byok-cross-acct-key-file).







 5 July 2022 



 For all version dates 

Client VPN for VPC. Client-to-site connectivity is now generally available. See the [VPC API change log](https://cloud.ibm.com/docs/vpc?topic=vpc-api-change-log5-july-2022).

The following updates have been made since the [beta release](https://cloud.ibm.com/docs/vpc?topic=vpc-api-change-log-beta24-august-2021):



* You can use IBM Cloud Secrets Manager for server authentication when [creating a VPN server](https://cloud.ibm.com/apidocs/vpc/latestcreate-vpn-server)
* You can specify a VPN server when [adding a security group target](https://cloud.ibm.com/apidocs/vpc/latestadd-security-group-target)
* You can [update a VPN server](https://cloud.ibm.com/apidocs/vpc/latestupdate-vpn-server) to be highly available, or detach a subnet to downgrade to a stand-alone deployment









 14 June 2022 



 For all version dates 

File storage adjustable IOPS. Accounts that have been granted special approval to preview this feature can now [update the IOPS of an existing file share](https://cloud.ibm.com/apidocs/vpc-betaupdate-share). For a file share using a custom profile, specify the iops property. For a file share using a profile in the tiered profile family, specify another tier within the tiered family, which will set the iops based on the share's size.

You can also change a share between the tiered and custom profile families so long as the requested iops and size are supported by the requested profile.
[IBM Cloud image templates](https://cloud.ibm.com/docs/image-templates?topic=image-templates-getting-started-with-image-templatesgetting-started-with-image-templates) You can use IBM Cloud image templates to capture an image of a virtual server to quickly replicate its configuration with minimal changes in the order process. With the End to End (E2E) Encryption feature, you can bring your own encrypted, cloud-init enabled operating system image. [Using End to End Encryption to provision an encrypted instance](https://cloud.ibm.com/docs/image-templates?topic=image-templates-using-end-to-end-e2e-encryption-to-provision-an-encrypted-instanceusing-end-to-end-e2e-encryption-to-provision-an-encrypted-instance) 
 [IBM Cloud Virtual Servers for Virtual Private Cloud (VPC)](https://cloud.ibm.com/docs/vpc?topic=vpc-about-advanced-virtual-servers) Virtual Servers for VPC is an Infrastructure-as-a-Service (IaaS) offering that gives you access to all of the benefits of IBM Cloud VPC, including network isolation, security, and flexibility. By integrating with Hyper Protect Crypto Services, you can create an encrypted block storage volume when you create a virtual server instance and use your own root keys to protect the data encryption keys that encrypt your data at rest. [Creating virtual server instances with customer-managed encryption volumes](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-instances-byok) 
 [Key Management Interoperability Protocol (KMIP) for VMware® on IBM Cloud](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-kmip_standalone_considerations) KMIP for VMware® works together with VMware native vSphere encryption and vSAN encryption to provide simplified storage encryption management.
For more information about the health states and reason codes in the API, see the [API reference](https://cloud.ibm.com/apidocs/vpc/latestcreate-volume) for creating, listing, and updating volumes.





 Volume performance when you restore from a snapshot 

Boot and data volume performance is initially degraded when you restore them from a snapshot. During the restoration, your data is copied from IBM Cloud® Object Storage to Block Storage for VPC. After the restoration process is complete, full IOPS can be realized on the new volume.

Restoring a boot volume from a "bootable" snapshot and then provisioning an instance with it results in slower performance because restored boot volume is not yet fully hydrated (that is, fully provisioned). Performance is slower than creating an instance from a regular boot volume.
Business continuity and disaster recovery for VPC reference architecture 

As described in [Business continuity and disaster recovery (BCDR) overview](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-bcdr), BCDR is important for all cloud-based applications. In this article, you will learn about specifics of BCDR in the Satellite reference architecture.



 Workloads in VPC reference architecture 



 Workloads on virtual server instances 

If you are running virtual server instances and not trying to get your application designated as Financial Services Validated, then you can consider [Snapshots for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-snapshots-vpc-about). Snapshots for VPC is a regional offering that lets you create a point-in-time copy of your block storage boot or data volumes. The initial snapshot you take is a full backup of the volume. Subsequent snapshots of the same volume are incremental; only the changes since the last snapshot are captured. You can select a snapshot during instance provisioning, and restore a new, fully-provisioned boot volume to start the instance. You can also create and attach a data volume from a snapshot within a running virtual server instance.

For more information, see [General procedure for creating and using snapshots](https://cloud.ibm.com/docs/vpc?topic=vpc-snapshots-vpc-aboutsnapshots-vpc-procedure-overview).





 Workloads on Red Hat OpenShift on IBM Cloud 

If you are running Red Hat OpenShift on IBM Cloud and not trying to get your application designated as Financial Services Validated, then you can consider [Portworx](https://portworx.com/products/portworx-enterprise//). Portworx is a highly available software-defined storage solution that you can use to manage local persistent storage for your containerized databases and other stateful apps, or to share data between pods across multiple zones.
You can connect to private endpoints of other services, including container registry and [IBM Log Analysis](https://cloud.ibm.com/docs/vpc?topic=vpc-logging-for-hyper-protect-virtual-servers-for-vpc). The prerequisite is to have a DNS server attached to your virtual server instance. You don't need to do any additional configurations.





 Recovering or upgrading a Hyper Protect Virtual Servers for VPC instance by using IBM Cloud VPC Snapshots. 

If your Hyper Protect Virtual Servers for VPC fails for any reason, you can create a new instance and attach the data volume that was attached to the failed instance (within 15 minutes of creating the new instance). Ensure that you use the same contract that was used originally to create the instance.

Alternatively, [create a snapshot](https://cloud.ibm.com/docs/vpc?topic=vpc-snapshots-vpc-create&interface) of the data volume that was attached to the failed instance. Then create a new instance. When you attach the data volume, choose [restoring a volume from a snapshot](https://cloud.ibm.com/docs/vpc?topic=vpc-snapshots-vpc-restore&interface) and select the snapshot that you took earlier to restore the volume from. Ensure that you use the same contract that was used originally to create the instance.

When you want to use a new Hyper Protect Container Runtime image whenever IBM makes it available, you can follow either of the procedures that are mentioned that uses snapshots. You must use the same contract that you used for creating the original instance.
To route between Pods and data centers, all VLANs requiring connectivity must be associated with the gateway device and an overlay, typically GRE tunnels, established between the gateway devices.



Virtual Private Cloud (VPC)



* What is the VPC backup service?

With the VPC backup service, you can create backup policies for your Block Storage for VPC volumes. A backup policy contains a backup plan, where you set a scheduled backup of your volumes. You can create up to four backup plans per policy. When a backup is triggered, it creates a snapshot of the volume contents. You can also set a retention period for your backups so that the oldest ones are deleted either by date or total count. For more information, see [Backup service concepts](https://cloud.ibm.com/docs/vpc?topic=vpc-backup-service-aboutbackup-service-concepts).
* How do I set up the backup service?

Before you can create backup policies, you need to grant [service-to-service authorizations](https://cloud.ibm.com/docs/vpc?topic=vpc-backup-s2s-auth&interface=api), and specify user roles to enable the backup service. Then, you add user tags for new or existing data volumes that you associate with a backup policy. Finally, you create backup policies and plans to schedule automatic backups. For more information, see [Creating a backup policy](https://cloud.ibm.com/docs/vpc?topic=vpc-backup-policy-create&interface=ui).
* How does the backup service work?

You add [user tags](https://cloud.ibm.com/docs/vpc?topic=vpc-backup-service-about&interface=uibackup-service-about-tags) to your volumes and specify the same tags in a backup policy. When the tags match, a backup is triggered based on the backup plan schedule. You can [view backup jobs](https://cloud.ibm.com/docs/vpc?topic=vpc-backup-view-policy-jobs) to see the progress of the operation.
Beta VPC API change log 

Read this change log to learn about updates and improvements to the beta IBM Cloud® Virtual Private Cloud (VPC) [API](https://cloud.ibm.com/apidocs/vpc-beta). The change log lists changes that are ordered by the date they were released.

Some beta features are for accounts that have been granted special approval to preview a particular beta feature. Contact your IBM sales representative if you are interested in getting access.

There are no backward-compatibility guarantees as a feature progresses through its beta phase or from the final beta release to its initial GA release. Using non-GA-mature features could introduce the risk of corrupting resources in your account. IBM strongly recommends that you do not use non-GA-mature features on production accounts.

To review the change log of generally available API features, see the [VPC API change log](https://cloud.ibm.com/docs/vpc?topic=vpc-api-change-log).



 11 July 2023 



 For version 2023-07-11 or later 

Data encryption in transit for file shares. For users with accounts that have access to file shares, you can now enable secure end-to-end encryption of your data in transit between the file share and the authorized client.

When [creating a mount target for a file share](https://cloud.ibm.com/apidocs/vpc-betacreate-share-mount-target) with a virtual network interface, you can now specify a transit_encryption property value of none (default) or user_managed, which encrypts the data in transit by using IPsec with an instance identity certificate. For more information, see [Encryption in transit - Securing mount connections between file share and host](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-about&interface=apifs-eit) and [Creating instance identity certificates](https://cloud.ibm.com/docs/vpc?topic=vpc-metadata-beta-api-change-log11-july-2023-metadata-beta).

File share access control modes.
[Block Storage for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-about) provides hypervisor-mounted, high-performance data storage for your virtual server instances that you can provision within a VPC. The VPC infrastructure provides rapid scaling across zones and extra performance and security.

Block Storage for VPC provides primary boot volumes and secondary data volumes. Boot volumes are automatically created and attached during instance provisioning. Data volumes can be created and attached during instance provisioning as well, or as stand-alone volumes that you can later attach to an instance. To protect your data, you can use your own encryption keys with Hyper Protect Crypto Services.





 IBM Cloud Object Storage 

[Object Storage](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-about-cloud-object-storage) stores encrypted and dispersed data across multiple geographic locations. Object Storage is available with three types of resiliency: Cross Region, Regional, and Single Data Center. Cross Region provides higher durability and availability than using a single region at the cost of slightly higher latency. Regional service reverses those tradeoffs, and distributes objects across multiple availability zones within a single region. If a given region or availability zone is unavailable, the object store continues to function without impediment. Single Data Center distributes objects across multiple machines within the same physical location.

Users of Object Storage refer to their binary data, such as files, images, media, archives, or even entire databases as objects. Objects are stored in a bucket, the container for their unstructured data. Buckets contain both inherent and user-defined metadata. Finally, objects are defined by a globally unique combination of the bucket name and the object key, or name.







 Security 



 IBM Cloud Hyper Protect Crypto Services 

[Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-overview) is a dedicated key management service and hardware security module (HSM) based on IBM Cloud.
You can now specify an existing snapshot in one region to [create](https://cloud.ibm.com/apidocs/vpc/latestcreate-snapshot) a copy of the snapshot in another region. When you [list all snapshots](https://cloud.ibm.com/apidocs/vpc/latestlist-snapshots), you can see the direct snapshot copies in the other regions and you can use them to restore volumes in the other regions. You can create copies in multiple regions, but only one copy of the snapshot can exist in each region. The cross-region snapshot copy contains the same data as the source snapshot, but the cross-region snapshot copy has its own, independent lifecycle and is billed independently. For more information, see [Cross-regional snapshots](https://cloud.ibm.com/docs/vpc?topic=vpc-snapshots-vpc-aboutsnapshots_vpc_crossregion_copy) and [Cross-regional copy array issue](https://cloud.ibm.com/docs/vpc?topic=vpc-known-issuessnapshots-CRC-known-issue).

You can now [create a backup policy](https://cloud.ibm.com/apidocs/vpc/latestcreate-backup-policy) that creates backup copies in other regions, in addition to creating a backup snapshot in the current region. [Listing all backup policy plans](https://cloud.ibm.com/apidocs/vpc/latestlist-backup-policy-plans) or a specific [plan details](https://cloud.ibm.com/apidocs/vpc/latestget-backup-policy-plan) shows the copies of the snapshot in other regions. For more information, see [Cross-regional backup copies](https://cloud.ibm.com/docs/vpc?topic=vpc-backup-service-aboutbackup-service-crc).

Extended SSH key encryption.
However, you can specify a larger volume size, different IOPS profile, and different CRK if you prefer.



You can restore volumes from a manually created snapshot or from a snapshot that was created by a backup policy. This type of snapshot is called a backup. For more information, see [Restoring a volume from a backup snapshot](https://cloud.ibm.com/docs/vpc?topic=vpc-baas-vpc-restore).

You can restore a volume in a different region by using a cross-regional copy of a snapshot. For more information, see [Cross-regional snapshots](https://cloud.ibm.com/docs/vpc?topic=vpc-snapshots-vpc-aboutsnapshots_vpc_crossregion_copy).

You can also choose to restore a volume by using a fast restore snapshot clone. For more information about fast restore, see the [FAQs](https://cloud.ibm.com/docs/vpc?topic=vpc-snapshots-vpc-faqs&interface=uifaq-snapshot-fr).

You can restore volumes at various stages of the VPC lifecycle.



* When you provision a virtual server instance, you can specify a snapshot of a boot or a snapshot of data volume. The restored boot volume is used to start the new instance. Restored data volumes are automatically attached to the instance as auxiliary storage.
* When you want to add a new auxiliary storage to your existing instance, you can restore a data volume from a nonbootable snapshot.
* When you create an unattached (stand-alone) Block Storage for VPC volume from a snapshot, you can still attach the volume to an instance later.







 Limitations of restoring a volume from a snapshot 

The following limitations apply when you restore a volume from a snapshot.



* To restore a volume, the snapshot must be in a stable state.
* You can delete the new volume at any time. However, you can't delete the snapshot from which the volume is restored from unless the hydration is complete or the volume is deleted.
For more information, see [Pricing](https://www.ibm.com/cloud/vpc/pricing).





 Restoring a volume from a snapshot in the UI 

You can create volumes from various pages in the IBM Cloud console. During the "create and attach" phase of virtual server instance provisioning, you can select a snapshot to restore the volume. Restoring from a bootable snapshot creates a boot volume that you use to provision the virtual server instance. The boot volume uses a general-purpose profile and is limited to 250 GB. Data volumes are created and attached to the instance. You can restore volumes from a snapshot outside of instance provisioning as well, you can create stand-alone volumes and new auxiliary volumes for existing instances.



 Creating a volume from the list of snapshots in the UI 

From the list of Block Storage for VPC snapshots, you can create an Block Storage for VPC volume and specify whether it's to be attached to a virtual server instance or unattached (stand-alone). If you choose to attach a data volume, you can select an existing virtual server instance or choose to create an instance. The new volumes are added to the [list of Block Storage for VPC volumes](https://cloud.ibm.com/docs/vpc?topic=vpc-viewing-block-storage&interface=uiviewvols-ui).



1. Go to the list of Block Storage for VPC snapshots. In the [IBM Cloud console)](https://cloud.ibm.com/login), click the menu ![menu icon](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/icons/icon_hamburger.svg) > VPC Infrastructure > Storage > Block storage snapshots.
2. Select a snapshot from the list. It must be in a stable state.
3. From the overflow menu, select Create volume.
4.
* To address Denial-of-Service attacks, the requests to [verify disk encryption status](https://cloud.ibm.com/docs/vpc?topic=vpc-hpvs-disks-encryption-validate) are throttled at three per five minutes.







 27 January 2023 

Context-based restrictions
: Context-based restrictions are now available for IBM Cloud VPC resources. With context-based restrictions, account owners and administrators can define and enforce network access policies. For more information, see [Protecting Virtual Private Cloud (VPC) Infrastructure Services with context-based restrictions](https://cloud.ibm.com/docs/vpc?topic=vpc-cbr).





 17 January 2023 

Application Load Balancer and VPN for VPC
: As a reminder, end of support for IBM Cloud Certificate Manager was 31 December 2022. Remaining instances of Certificate Manager were deleted. If any user-provided Ingress secrets are stored in Certificate Manager, they are no longer valid.

End of support (EOS) for deprecated VPN for VPC IKE and IPsec ciphers
: On 20 September 2022, the following VPN IKE and IPsec ciphers were deprecated:



* Authentication algorithms md5 and sha1
* Encryption algorithm triple_des
* Diffie–Hellman groups 2 and 5



Effective today, these ciphers are no longer supported in the UI and EOS for use with the CLI and API is forthcoming. If you didn't upgrade to more secure ciphers, do so now. For more information, see [Upgrading weak cipher suites on a VPN gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-upgrading-weak-ciphers).







 December 2022 



 20 December 2022 

Instance provision by volume (Beta)
: By default, when a virtual server instance is deleted attached boot volumes are deleted. You can disable this behavior, causing the boot volume to instead be detached when the virtual server instance is deleted. You can then attach the boot volume to a new virtual server instance.
* CLI
* API
* Terraform







 Using virtual private endpoints for VPC to privately connect to Hyper Protect Crypto Services 

IBM Cloud® Virtual Private Endpoints (VPE) for Virtual Private Cloud (VPC) enables you to connect to Hyper Protect Crypto Services from your VPC network by using the IP addresses of your choosing, allocated from a subnet within your VPC.

VPEs are virtual IP interfaces that are bound to an endpoint gateway created on a per service, or service instance, basis (depending on the service operation model). The endpoint gateway is a virtualized function that scales horizontally, is redundant and highly available, and spans all availability zones of your VPC. Endpoint gateways enable communications from virtual server instances within your VPC and IBM Cloud® service on the private backbone. VPE for VPC gives you the experience of controlling all the private addressing within your cloud. For more information, see [About virtual private endpoint gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe).

To connect to Hyper Protect Crypto Services by using a virtual private endpoint, you must use the Hyper Protect Crypto Services API, CLI, or Terraform. The Hyper Protect Crypto Services UI needs to be accessed through the public network from your VPC.



 Before you begin 

Before you target a virtual private endpoint for Hyper Protect Crypto Services, you must complete the following tasks:



* Ensure that you have [provisioned a Virtual Private Cloud](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started).
* Make a [plan for your virtual private endpoints](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-considerations).
* Ensure that [correct access controls](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-configuring-acls) are set for your virtual private endpoint.
* Understand the [limitations](https://cloud.ibm.com/docs/vpc?topic=vpc-limitations-vpe) of having a virtual private endpoint.