vania-janet/multiturn-rag-retrieval-data huggingface dataset:
31 July 2021 | Added: Using virtual private endpoints for VPC

If you want to connect to Hyper Protect DBaaS for PostgreSQL from your IBM Cloud Virtual Private Cloud (VPC) network, you can create and configure a virtual private endpoint (VPE) for your VPC.

8 June 2021 | Added: Using Terraform to create a service instance

Terraform is an open source software to configure and automate cloud resource provisioning and management. Now you can provision a Hyper Protect DBaaS service instance with Terraform.

3 June 2021 | Updated: Automatic handling in tolerance situations

In the tolerance situation during creating, disabling, and restoring service instances, operations on the pending node will be completed automatically later (previously by SRE).

3 June 2021 | Updated: PL/Java version

Hyper Protect DBaaS for PostgreSQL supports PL/Java 1.6.2 (previously 1.5.2). Note that for security reasons, only ports 80 and 443 are allowed to connect from PL/Java.

3 June 2021 | Updated: Activity Tracker and Log Analysis are available in Sydney for Hyper Protect DBaaS for PostgreSQL

If you want to integrate Activity Tracker or Log Analysis with your Hyper Protect DBaaS for PostgreSQL service instance in Sydney (au-syd), you need to have an Activity Tracker or Log Analysis service instance also in Sydney (au-syd) (previously Dallas (us-south)).
Terraform samples for Hyper Protect Virtual Servers for VPC 

You can use Terraform to automate operations with Hyper Protect Virtual Servers for VPC.

For more information about Terraform, see [About Terraform on IBM Cloud](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-about).

To explore the Terraform samples for Hyper Protect Virtual Servers for VPC, go to the [repository](https://github.com/ibm-hyper-protect/linuxone-vsi-automation-samples/tree/master/terraform-hpvs).



1.  Make sure you complete the preparation in the readme file first.
2.  The following list gives you an overview of the available samples. See the repo for the latest samples and the readme file in the subdirectory of each sample for detailed instructions.





*  create-contract - creates an encrypted and signed contract.
*  create-contract-dynamic-registry - creates an encrypted and signed contract with a dynamic registry reference. Related tutorial: [Deploying an application on Hyper Protect Virtual Server for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-financial-transaction-confidential-computing-on-hyper-protect-virtual-server-for-vpc).
*  hello-world - deploys the hello-world example as a Hyper Protect Virtual Server for VPC.
*  nginx-hello - deploys the nginx-hello example as a Hyper Protect Virtual Server for VPC.
*  mongodb - deploys three MongoDB instances on Hyper Protect Virtual Servers for VPC in three availability zones.
*  postgresql - deploys a PostgreSQL instance on a Hyper Protect Virtual Server for VPC in a region.
*  postgresql-cluster - deploys a PostgreSQL cluster on Hyper Protect Virtual Servers for VPC in given regions.
*  log-encryption - encrypts selected log messages.
Using Veeam Backup and Replication software 

The Veeam Backup and Replication software offers an optional way of managing backups of IBM Cloud® Virtual Servers for Virtual Private Cloud, although [using the Veeam Agent](https://cloud.ibm.com/docs/vpc?topic=vpc-using-veeam-agent) is the recommended method.

The Veeam Backup and Replication software is supported only on the Microsoft Windows operating system. However, you can use it to manage backups for multiple virtual server instances for IBM Cloud VPC that are deployed with any of the supported Linux® operating systems, including CentOS, RHEL, Ubuntu, and Debian, and with any of the supported Windows operating systems.

The following example provides information on installing, configuring, and using the backup and replication software to perform a backup operation on a volume that is attached to a CentOS instance. It also describes how to restore the backed-up volume data using the Veeam Agent for Linux. In addition, the example provides specific instructions on how to perform a volume backup and restore, but you would use similar instructions if you prefer to do file and folder backup and restore operations.

In general, similar instructions apply to the other Linux operating system types supported for virtual server instances for VPC.



 Before you begin 



* Make sure that you order a [Veeam license](https://cloud.ibm.com/docs/vpc?topic=vpc-ordering-veeam-licenses).
* Provision and set up a Microsoft Windows virtual server instance for VPC. Veeam Backup and Replication software requires a Microsoft Windows instance with at least 8 vCPUs, 32 GB of memory, and a secondary block storage device for the Veeam backup repository.
* Ensure that all instances for VPC to be backed up are in the same VPC as the Microsoft Windows instance.







 Installing and configuring 



1. After you provision your Microsoft Windows instance for VPC, use the Microsoft Remote Desktop to connect to the instance. For more information, see [Connecting to Windows instances](https://cloud.ibm.com/docs/vpc?topic=vpc-vsi_is_connecting_windows).
2.
Advantages of using IBM Cloud Container Registry with the internal registry:



* Local image caching for faster builds via the internal registry.
* Deployments in other projects can see the image stream so that you don't have to copy pull secrets to each project.
* Sharing images across multiple clusters without needing to push images to multiple registries.
* [Automatically scanning](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index) the vulnerability of images.
* Controlling access through [IBM Cloud IAM policies](https://cloud.ibm.com/docs/Registry?topic=Registry-user) and [separate regional registries](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_regions).
* [Retaining images](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_retention) without requiring storage space in your cluster or an attached storage device. You can also set policies to manage the quantity of images to prevent them from taking up too much space.
* Version 4 clusters on VPC infrastructure: Using the private registry service endpoint so that clusters that use only a private cloud service endpoint can still access the registry.
* [Setting storage and image pull traffic quotas](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_quota) to better control image storage, usage, and billing.
* Pulling licensed IBM content from the [entitled registry](https://cloud.ibm.com/docs/openshift?topic=openshift-registrysecret_entitled_software).



: To get started, see the following topics:



* [Getting started with IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-getting-started).
* [Importing images from IBM Cloud Container Registry](https://cloud.ibm.com/docs/openshift?topic=openshift-registryimagestream_registry) into the internal registry image stream.
: You can now access the vRealize Operations Tenant App for a VMware Cloud Director for new and existing organizations through the VMware Cloud Director tenant portal. For more information, see Enabling VMware Chargeback.

Standard - Catalog storage policy availability
: The Standard - Catalog storage policy is now available for storing vApp templates and media files in your VMware Cloud Director catalog. For more information, see VMware Solutions Shared overview.

Private network endpoints for multizone virtual data centers
: Two private network endpoints are ordered to correspond with each VMware NSX Edge™ Service Gateway when you create a private network endpoint for VMware Solutions Shared multizone virtual data centers.

vCPU and RAM limits for on-demand and reserved virtual data centers
: The vCPU and RAM limits for VMware Solutions Shared virtual data center orders are now increased. Beginning with the 4.9 release, the maximum vCPU limit is 1 - 2000 and the maximum RAM limit is 1 - 40 TBs for both on-demand and reserved virtual data center orders.

Updates to VMware vCenter Server instances and VMware vSphere clusters
: The following upgrades are applied to newly deployed instances, clusters, and hosts.



* VMware vSphere ESXi 7.0 Update 3e (build 19898904)
* VMware vSphere ESXi 6.7 P07 (build 19898906)



Considerations for selecting a new NSX Data Center SP edition
: Beginning with the V4.9 release, if your NSX-V instance is using BYOL licenses, you can now order legacy NSX licenses from IBM to replace your own license.

Also, beginning with this release, if your NSX-T instance is using legacy NSX licenses, you can now order NSX Data Center SP licenses to replace your legacy NSX licenses. You are responsible to select the appropriate NSX Data Center SP license edition based on your needs.

Zerto 9.5u1 support
: Zerto 9.5u1 is available to install on deployed instances.

Zerto v9.5u1 is not supported for vSphere 6.5 and 6.7.
For more information, see [Secure access to services by using service endpoints](https://cloud.ibm.com/docs/account?topic=account-service-endpoints-overview).





 More resources 



* [Planning for virtual private endpoint gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-considerations)
* [Creating an endpoint gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-ordering-endpoint-gateway)
* For further assistance, see the [FAQs for virtual private endpoints here](https://cloud.ibm.com/docs/vpc?topic=vpc-faqs-vpe), and the Troubleshooting VPE gateways documentation that includes [how to fix communications issues here](https://cloud.ibm.com/docs/vpc?topic=vpc-troubleshoot-cannot-communicate).
Securing your connection when using the IBM Cloud CLI 

To ensure that you have enhanced control and security over your data when you use the IBM Cloud® Command Line Interface, you have the option of using private routes to IBM Cloud endpoints. Private routes are not accessible or reachable over the internet. By using the IBM Cloud private endpoints feature, you can protect your data from threats from the public network and logically extend your private network.

The CLI uses the private endpoint support that is provided by the IBM Cloud platform. Platform services that are used by the core CLI, such as IAM, provide private endpoint support.

If your deployment uses the VPC environment of IBM Cloud, private endpoints are exposed through global endpoints. If your deployment uses the Classic environment, regional support is provided for a limited number of CLI commands. The following regions support private endpoints in Classic environments:



* us-south
* us-east





 Enabling virtual routing and forwarding 

You must first enable virtual routing and forwarding in your account, and then you can enable the use of IBM Cloud private service endpoints. For more information about setting up your account to support the private connectivity option, see [Enabling VRF and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint).

To learn more about private connections on IBM Cloud, see [Secure access to services using service endpoints](https://cloud.ibm.com/docs/account?topic=account-service-endpoints-overview).





 Logging in to the CLI with a private endpoint 

You can log in to either a private endpoint for Classic or for VPC. To log in using Classic infrastructure, [log in](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_cliibmcloud_login) to a private endpoint by using the CLI by using the following command:

ibmcloud login -a private.cloud.ibm.com
* Understand the [limitations](https://cloud.ibm.com/docs/vpc?topic=vpc-limitations-vpe) of having a virtual private endpoint.
* Ensure that you have [created](https://cloud.ibm.com/docs/vpc?topic=vpc-ordering-endpoint-gateway) and understand how to [access](https://cloud.ibm.com/docs/vpc?topic=vpc-accessing-vpe-after-setup) a VPE gateway.
* Understand how to [view details](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-viewing-details-of-an-endpoint-gateway) of a Virtual Private Endpoint.



Virtual private endpoint settings, specifically the Internet Protocol (IP) address, may need to be manually updated during [Disaster recovery and business continuity actions](https://cloud.ibm.com/docs/key-protect?topic=key-protect-shared-responsibilitiesdisaster-recovery).





 Virtual Private Service Endpoints 

The following table lists regions where Key Protect service supports VPE. It also lists Key Protect endpoints supported from each region. You can connect to Key Protect service in another region using supported endpoints. For example, from the Sydney region, you can use Key Protect service in us-south region using the us-south endpoint.

When connecting to a VPE via [CLI](https://cloud.ibm.com/docs/vpc?topic=vpc-ordering-endpoint-gatewayvpe-ordering-cli) or [API](https://cloud.ibm.com/docs/vpc?topic=vpc-ordering-endpoint-gatewayvpe-ordering-api), you will need to specify the CRN of the region that you will use to connect to the Key Protect service. Use the table below to locate the CRN of the target region.



Table 1. Lists private endpoints for interacting with Key Protect APIs over IBM Cloud's private network

 Region Endpoints Supported in Region CRN 

 Dallas
With IBM Cloud VPC, you can use the UI, CLI, and API to manually provision virtual server instances for VPC with high network performance. VPC infrastructure contains a number of Infrastructure-as-a-Service (IaaS) offerings, including Virtual Servers for VPC. Use the following information to understand a simple use case for planning, creating, and configuring resources for your VPC, and learn about more VPC overviews and VPC tutorials. For more information about VPC, see [Getting started with Virtual Private Cloud (VPC)](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started).





 SAP on IBM Cloud 

SAP NetWeaver is the core foundation of the SAP technology stacks and is the platform that is used for ABAP and Java applications. The SAP system can be installed and configured in IBM Cloud for various system and database types.

For more information about SAP system architectures on IBM Cloud VPC, see the infrastructure reference architectures for SAP for each supported database type. For example, [SAP NetWeaver 7.x on UNIX with ASE SYB on IBM Cloud VPC](https://cloud.ibm.com/docs/sap?topic=sap-sap-refarch-nw-sybase) is the dedicated reference architecture for this SAP solution.

Manually deploying a VPC and installing an SAP system can be time-consuming. The Terraform automation assures not only a much quicker implementation, but also a standardized and less error-prone deployment. Terraform and Ansible are used for automating the deployment processes.

The Terraform scripts solution provides the automated deployment of a single host with SAP NetWeaver with ASE SYB on the Red Hat Enterprise Linux 8 and SUSE 15 for SAP Applications.

The SAP installation media that are used for this deployment are the default media for SAP NetWeaver 7.5 with ASE SYB XXXX.XXX. The media are available at the SAP Support Portal under INSTALLATION AND UPGRADE area. You provide the installation media as an input parameter for Terraform.





 Ansible for SAP installation 

Ansible is an automation tool for the deployment of several IT tasks.
* Enables access to the management VPC from the application provider's enterprise environment through [IBM Cloud® Direct Link Dedicated](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-aboutservices-networking-direct-link) or [IBM Cloud® Virtual Private Network (VPN) for VPC](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-aboutservices-networking-vpn).
* Provides connectivity from the consumer's enterprise environment to the workload VPC through Direct Link or VPN for VPC.
* Connects management VPC and workload VPC by using [IBM Cloud® Transit Gateway](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-aboutservices-networking-transit-gateway).
* Allows connectivity to IBM Cloud services that use [IBM Cloud Virtual Private Endpoints for VPC](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-aboutservices-networking-vpe).
* Encrypts data by using [IBM Cloud Hyper Protect Crypto Services](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-aboutservices-security-hpcs), which enables keep your own key (KYOK) functionality which provides technical assurance that IBM cannot access your keys.







 Variation with edge or transit VPC for public internet access 

The architecture in the previous section is the most secure way of enabling consumers to access the applications that are running in a workload VPC. However, there might be valid cases where it is desirable to allow consumers to access your service through the public internet. The same base architecture can be adapted to securely enable this type of access.

Zoom

!
Flex - Securely migrates the VMs (compute only) to the cloud, by using the hot data set in the cloud cache.





 Key benefits of HDM 

PrimaryIO HDM enables the following use cases:



* VM I/O Profiling. HDM gives visibility into a VM’s disk I/O performance, including read/write patterns and disk access block size histograms for read/write transactions from and to the VMDKs.
* Try-Before-Commit. HDM enables rapid testing of applications in the cloud. It requires only a working set in the cloud cache and it avoids full data replication. The key benefits are reduced time and cost of testing in the cloud.
* Cloud Extension. HDM enables Development and Testing (Dev/Test) and seasonal workloads to use the cloud infrastructure for temporary use with minimal data exposure. Therefore, full replication of production data set in the cloud is avoided. The key benefits are - on-demand capacity, control on data exposure, and reduced costs.
* Agile Migration. HDM provides two different modes to migrate workloads to cloud:



* Warm migration enables VMs to be migrated while the workloads are running in the cloud with only the working set until all the data is transferred. Upon successful transfer of the full data set, all data changes are synced and an updated VM is started in the cloud.
* Cold migration migrates the VM along with data to the cloud. The VM is powered off until the transfer is completed.









 Technical specifications for PrimaryIO HDM 

For more information about resource requirements and capacity checking for some services, see [Resource requirements for add-on services](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_addingservicesvc_addingservices-resource-requirements).

The following technical specifications apply to PrimaryIO HDM.



 HDM deployment configuration 



* Cluster - Requires at least two VMware ESXi™ servers to ensure that HA requirements for the HDM product are met.
* Stand-alone - Requires at least one ESXi server.
Team based privacy using IAM, VPC, Transit Gateway and DNS 

This tutorial may incur costs. Use the [Cost Estimator](https://cloud.ibm.com/estimator/review) to generate a cost estimate based on your projected usage.

Microservices are popular because they allow an enterprise to organize their development teams around the services they deliver. This tutorial walks you through the steps of creating infrastructure for a IBM Cloud® Virtual Private Cloud (VPC) based microservice architecture. In this architecture, VPCs are connected to each other using the IBM Cloud® Transit Gateway. A set of shared microservices is accessed through host names registered in the IBM Cloud® DNS Services. Each VPC is managed by a separate team isolated by IBM Cloud® Identity and Access Management. Optionally a IBM Cloud® Load Balancer can be used to scale out the shared microservice.



 Objectives 



* Learn how to isolate infrastructure using IAM and Resource groups
* Create the VPCs and associated resources such as subnets, network ACLs, security groups, instances.
* Address microservices by DNS name resolution using DNS Services.
* Connect VPCs via Transit Gateway.
* Transparently configure a Load Balancer for an application.





 Abstract Architecture: 

Zoom

![Architecture](https://cloud.ibm.com/docs-content/v1/content/6a28e4ae2660b609a18e90e1239ed772f80373d6/transit-gateway/includes/solution-tutorials/includes/solution-tutorials/images/solution59-vpc-tg-dns-iam/simple.png)

Figure 1. Architecture diagram of the tutorial

In the diagram above the end user is accessing the applications. The applications are leveraging shared microservices. The company has separate DevOps teams that own application1, application2 and shared. A networking team focuses on connectivity and network security. The DevOps teams manage Virtual Service Instances, VSIs, used to implement the services they create and support.





 Concrete Architecture
FAQ for bare metal servers 

You might encounter the following frequently asked questions when you use a Bare Metal Server for VPC.



 What's the difference between Bare Metal Servers (Classic infrastructure) and Bare Metal Servers for VPC? 

Compared to the classic bare metal infrastructure, Bare Metal Servers for VPC provides the following advantages:



* Security and performance of the private cloud with the flexibility and scalability that you expect of the public cloud.
* Integrates with other VPC services such as virtual server, security groups, networking, and more.
* Faster provisioning and deployment and simple hourly billing.



Keep in mind that Bare Metal Servers for VPC is less customizable than classic bare metal servers.

For more information about the differences between the Classic infrastructure and VPC, see [ Comparing IBM Cloud Classic and VPC infrastructure environments](https://cloud.ibm.com/docs/cloud-infrastructure?topic=cloud-infrastructure-compare-infrastructure).





 What operating systems are supported? 

Currently, VMware ESXi, Windows, RHEL, RHELfor SAP, Debian GNU, SUSE Linux Enterprise, Ubuntu Linux, and custom images are supported.





 What storage options are available? 

Two storage options are available that include secondary local NVMe drives.



* The bx2-metal-192x768 profile provides mirrored 960 GB SATA M.2 drives as boot storage only.
* The bx2d-metal-192x768 profile provides mirrored 960 GB SATA M.2 drives as boot storage and 16 3.2 TB U.2 NVMe SSDs as secondary local storage to support vSAN, or user-managed RAID.



VPC Block Storage is not supported. VPC File Storage is compatible when it becomes generally available.

Currently, IBM Cloud® File Storage for VPC is available for customers with special approval to preview this service in the Frankfurt, London, Madrid, Dallas, Toronto, Washington, Sao Paulo, Sydney, Osaka, and Tokyo regions. Contact your IBM Sales representative if you are interested in getting access.