vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* ibmcloud is vpc-routing-table-update 979b4bc6-f018-40a2-92f5-0b1cf777b55d 27415d55-9d3b-4adb-a993-236ef59a45ec --direct-link-ingress false --internet-ingress false --transit-gateway-ingress false --vpc-zone-ingress false







 Command options 



* VPC: ID or name of the VPC.
* ROUTING_TABLE: ID or name of the VPC routing table.
* --name: New name of the routing table.
* --direct-link-ingress, --direct-link: If set to "true", this routing table is used to route traffic that originates from Direct Link to this VPC. For the routing to succeed, the VPC must not already have a routing table with this property set to "true". One of: false, true.
* --internet-ingress, --internet: Indicates whether this routing table is used to route traffic that originates from the internet. Updating to "true" selects this routing table, provided no other routing table in the VPC already has this property set to "true". Updating to "false" deselects this routing table. One of: false, true.
* --transit-gateway-ingress, --transit-gateway: If set to "true", this routing table is used to route traffic that originates from Transit Gateway to this VPC. For the routing to succeed, the VPC must not already have a routing table with this property set to "true". One of: false, true.
* --vpc-zone-ingress, --vpc-zone: If set to "true", this routing table is used to route traffic that originates from subnets in other zones in this VPC. For the routing to succeed, the VPC must not already have a routing table with this property set to "true". One of: false, true.
The following table lists the main dependencies of the VPC service and the purpose of each one:



Table 2. VPC dependencies

 Service Purpose 

 IBM Cloud® Identity and Access Management Provides authentication and authorization for all VPC requests. For more information about required IAM permissions, see [Required permissions for VPC resources](https://cloud.ibm.com/docs/vpc?topic=vpc-resource-authorizations-required-for-api-and-cli-calls). 
 IBM Cloud Kubernetes Service (IKS) Hosts clusters of containers which run the regional microservices of the VPC service. 
 IBM Cloud Catalog Provides structured, globally consistent metadata for VPC resource profiles. 
 IBM Cloud CLI (ibmcloud) Provides access to the VPC APIs via a command line interface. The plugin is is available for VPC Infrastructure. 
 Private Catalog Provides central access management to products in the global catalog and your own catalogs. 
 Resource Controller and Resource Manager Provides structured, globally consistent metadata for VPC resource profiles, resource quota, resource group information for VPC services. 
 IBM Cloud Metering (Usage) Collects usage metrics on the VPC services to generate bills for customer accounts. 
 IBM Account Management Provides information on customer accounts, including entitlements and user relationships within the account. 
 IBM Cloud® Container Registry Hosts and validates the container images that are used by the internal components of the VPC microservices. 
 IBM Cloud Kubernetes Service (IKS) Hosts clusters of containers that run the regional microservices of the VPC service. 
 Red Hat Licensing Service Activates a compute instance that was provisioned with an IBM-provided RHEL image. 
 Windows Licensing Service Activates a compute instance that was provisioned with an IBM-provided Windows image. 
 Ubuntu Package Update Service Provides OS packages to a compute instance provisioned with an IBM-provided CentOS image. 
 CentOS Package Update Service Provides OS packages to a compute instance provisioned with an IBM-provided CentOS image. 
 Debian Package Update Service Provides OS packages to a compute instance provisioned with an IBM-provided Debian image.
VPC CLI reference 

Use the following information as a reference of the command-line interface (CLI) commands that are available for IBM Cloud® Virtual Private Cloud (VPC).

This CLI reference is organized into the following sections:



* [Network commands](https://cloud.ibm.com/docs/cli?topic=cli-vpc-referencenetwork)
* [Compute commands](https://cloud.ibm.com/docs/cli?topic=cli-vpc-referencecompute-clis)
* [Regions and zones commands](https://cloud.ibm.com/docs/cli?topic=cli-vpc-referencegeography)
* [Storage commands](https://cloud.ibm.com/docs/cli?topic=cli-vpc-referencestorage)





 Prerequisites 



1. Install the [IBM Cloud CLI ![External link icon](https://cloud.ibm.com/docs-content/v1/content/c169dfbb5a2bb64d01f8c6ca8d8691910f0a702e/cli/includes/icons/launch-glyph.svg)](https://cloud.ibm.com/docs/cli).
2. Install or update the VPC infrastructure service plug-in.

ibmcloud plugin install vpc-infrastructure

To update, use the following command:

ibmcloud plugin update

To view installed plug-ins and versions, use the following command:

ibmcloud plugin list



--------------------





 NETWORK COMMANDS 

The following section provides information about CLI commands for network services.





 Flow logs 



 ibmcloud is flow-log-create 

Create a flow log.
Instance identity certificates can be used when the traffic between an authorized client and the mounted file share is [encrypted in transit](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-eit). For more information, see [Data encryption in transit for file shares](https://cloud.ibm.com/docs/vpc?topic=vpc-api-change-log-beta11-july-2023-beta).







 16 August 2022 



 For all version dates 

Sharing images across an enterprise account. For accounts that have been granted special approval to preview this feature, if a virtual server instance was provisioned from a catalog offering, [retrieving the instance](https://cloud.ibm.com/apidocs/vpc-metadataget-instance) will now include a catalog_offering property in the response. For more information, see the [Virtual Private Cloud Instance Metadata API](https://cloud.ibm.com/apidocs/vpc-metadata).

See also [Onboarding a virtual server image for VPC](https://cloud.ibm.com/docs/account?topic=account-catalog-vsivpc-tutorial) and the [Import offering](https://cloud.ibm.com/apidocs/resource-catalog/private-catalogimport-offering) method in the Catalog Management API.

This feature is now generally available. See the [VPC Instance Metadata API change log](https://cloud.ibm.com/docs/vpc?topic=vpc-metadata-api-change-log27-september-2022).







 1 March 2022 



 For all version dates 

VPC instance metadata service. The [VPC Instance Metadata API](https://cloud.ibm.com/apidocs/vpc-metadata) is now generally available in all regions.
The VPC API automatically creates a floating IP along with the public gateway if an existing floating IP is not specified. And yes, that floating IP shows up in the list.
* Who enforces that only one public gateway can exist per zone for a VPC?

The VPC API service enforces this limit.
* Does the VPC public gateway have a timeout function?

Yes, the VPC public gateway has a fixed, 4-minute timeout for TCP connections, and it is not configurable.
* How do you obtain the Cloud Resource Name (CRN) of a VPC?

To obtain the CRN of a VPC, click menu![Menu icon](https://cloud.ibm.com/images/icon_hamburger.svg) > Resource list from the IBM Cloud console. Expand VPC Infrastructure to list your VPCs. Select a VPC and then click the Status entry to view its details. Use the icon to copy the CRN and paste it where needed.
* Can a vNIC have both a floating IP and private IP address?

Yes, a vNIC on a virtual server instance has a private IP and can be attached to floating IP.
* Instance1 has two vNICs, called vNIC1 and vNIC2. Can these two vNICs be attached to the same subnet?

Yes, you can attach multiple network interfaces of an instance to the same subnet.
* Can an instance be created without a subnet, such as with only a floating IP address?

No, a virtual server instance must be provisioned in a subnet.
* Can an instance be attached to multiple VPCs?

No, a virtual server instance can be provisioned in only one VPC.
* During floating IP assignment in a VPC, a customer must specify the network interface of the instance, is that correct?

Yes. Initially, assigning the floating IP to the primary network interface of a server helps establish the data path. Later, you can associate the floating IP to a different network interface if you want. Alternatively, you can manually configure routing for the interface in the guest operating system.
For more information, including how to retrieve this information from within your virtual server, see [Retrieving the virtual server instance identifier](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-virtual-server-instancesretrieve-VSI-instance-identifer) section in Managing virtual server instances.





 6 July 2021 

File storage for VPC
: The file storage general purpose 3 IOPS/GB profile is expanded so you can create file shares up to 32 TB with potential max IOPS performance of 96,000 IOPS. For more information, see [File storage profiles](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-profiles). File Storage for VPC is available to customers with special approval to preview this service in the Washington, Dallas, and Frankfurt regions.







 June 2021 



 30 June 2021 

Placement groups (Beta)
: Placement groups for IBM Cloud® Virtual Private Cloud are used to create placement group strategies for managing high availability workloads. A placement group contains virtual server instances that share a common placement strategy. Placement strategies influence the physical placement of select VPC resources to meet certain workload demands. For more information about placement groups, see [About placement groups](https://cloud.ibm.com/docs/vpc?topic=vpc-about-placement-groups).





 17 June 2021 

UI enhancement
: When you provision a VPC, you can now create multiple subnets from the default address prefix. When you create a VPC, one subnet is created in each zone of the VPC region. You can add up to a maximum of nine subnets.”

Application Load Balancer (ALB) support for cookie-based session persistence
: ALBs now supports HTTP-cookie persistence and application-cookie persistence. For more information, see [Advanced traffic management](https://cloud.ibm.com/docs/vpc?topic=vpc-advanced-traffic-managementsession-persistence).





 03 June 2021 

UI enhancement
: When you delete a virtual server, you must now confirm that you want to delete an instance by typing delete.
VPC design for VMware deployment 

The topic provides an overview to the VPC architecture for a VMware® deployment. You might alter this architecture for your needs, but it is important to understand the separation of VMware infrastructure networking requirements and the need to separate it from other workload traffic.



 VPC subnets 

The VMkernel networking in VMware provides connectivity to hosts and handles the standard system traffic of vSphere® vMotion, IP storage, Fault Tolerance, vSAN™, and others. You can also create VMkernel adapters (VMK) on the source and target vSphere Replication hosts to isolate the vSphere replication data traffic.

It is recommended to take appropriate security measures to prevent unauthorized access to the management and system traffic in your vSphere environment, such as:



* Isolate the vMotion traffic in a separate network that includes only the ESXi hosts that participate in the migration.
* Isolate the management traffic in a network that only network and security administrators can access.
* Isolate the NSX-T™ TEP traffic only to the Transport Nodes and to interfaces that need access to TEP traffic.



As there are various System Traffic Types in VMware, it is recommended to dedicate a separate VMkernel adapter for every System Traffic Type. And also, isolate traffic in logical segments in the underlying network infrastructure and dedicate a distributed port group in distributed switches.

In IBM Cloud VPC, there are multiple ways to do logical segmentation or isolation. The architecture represented here uses a traditional VLAN segmentation analogy. Each System Traffic Type or VMK has its own VPC subnet that can then be controlled with subnet ACLs.

Zoom

![VPC design for VMware deployment](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/vpc-ryo-diagrams-vpc-physical.svg)

Figure 1. VPC network design for VMware deployment

For this architecture, a new VPC is created for VMware workloads for simplicity.
* RULE_ID2: ID of the security group rule.
* --vpc: ID or name of the VPC. It is only required to specify the unique resource by name inside this VPC.
* --output: Specify output format, only JSON is supported. One of: JSON.
* --force, -f: Force the operation without confirmation.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is security-group-rule-update 

Update a rule of a security group.

ibmcloud is security-group-rule-update GROUP RULE_ID [--vpc VPC] [--direction inbound | outbound] [--remote REMOTE_ADDRESS | CIDR_BLOCK | SECURITY_GROUP] [--icmp-type ICMP_TYPE | --reset-icmp-type] [--icmp-code ICMP_CODE | --reset-icmp-code] [--port-min PORT_MIN | --reset-port-min] [--port-max PORT_MAX | --reset-port-max] [--output JSON] [-q, --quiet]



 Command examples 



* ibmcloud is security-group-rule-update 72b27b5c-f4b0-48bb-b954-5becc7c1dcb3 8daca77a-4980-4d33-8f3e-7038797be8f9 --direction inbound
* ibmcloud is security-group-rule-update my-sg 8daca77a-4980-4d33-8f3e-7038797be8f9 --direction inbound --icmp-type 8 --icmp-code 0
: The ID or name of the routing table.

--resource-group-id
: The ID of the resource group. This ID is mutually exclusive with --resource-group-name.

--resource-group-name
: Name of the resource group. This name is mutually exclusive with --resource-group-id.

--output
: Specify output format, only JSON is supported. One of: JSON.

-q, --quiet
: Suppress verbose output.





 Creating subnets in VPC using the API 

Follow these instructions to create a subnet in your VPC by using the API:



1. Set up your [API environment](https://cloud.ibm.com/docs/vpc?topic=vpc-set-up-environmentapi-prerequisites-setup).
2. Store any additional variables to be used in API commands.





Table 1. Parameters for creating a subnet

 Query parameters Information 

 version <br>Required <br>string Requests the version of the API as of a date in the format YYYY-MM-DD. Any date up to the current date may be provided. Specify the current date to request the latest version. <br>Possible values: Value must match regular expression ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ 
 generation <br>Required <br>int32 The infrastructure generation. <br>Possible values:2 
 Request Body <br>Required The subnet prototype object. 
 vpc <br>Required <br>string The VPC the subnet will reside in. <br>One of: VPCIdentityById, VPCIdentityByCRN, VPCIdentityByHref 
 ip_version <br>string The IP version(s) to support for this subnet. Allowable values:[ipv4] 
 name <br>Required <br>string The name for this subnet. The name must not be used by another subnet in the VPC.
"name":"general-purpose"
},
"encryption_key":{
"crn":"crn:[...key:...]"
}
},
"delete_volume_on_instance_delete":true
}





 Example secondary volume JSON file 

This example defines two general-purpose secondary (data) volumes with customer-managed encryption.

{
"name":"volume-attachment-2",
"volume":{
"name":"data-volume-2",
"capacity":200,
"profile":{
"name":"general-purpose"
},
"encryption_key":{
"crn":"crn:[...key:...]"
}
},
"delete_volume_on_instance_delete":true
}







 Step 3 - Create a new instance with customer-managed encrypted volumes from the CLI 

Use the [ibmcloud is instance-create](https://cloud.ibm.com/docs/vpc?topic=vpc-infrastructure-cli-plugin-vpc-referenceinstance-create) command to create an instance with customer-managed encryption for your boot and data volumes. Specify the --boot-volume and --volume-attach parameters to reference JSON files that define volume encryption.

ibmcloud is instance-create INSTANCE_NAME VPC ZONE_NAME PROFILE_NAME SUBNET --image-id IMAGE_ID [--boot-volume @BOOT_VOLUME_JSON_FILE] [--volume-attach @VOLUME_ATTACH_JSON_FILE]...







 Provisioning instances with customer-managed encryption volumes with the API 

You can provision instances with customer-managed encryption volumes by calling the Virtual Private Cloud (VPC) API.

Make a POST/instances request to create an instance and new volume encrypted using your own encryption keys. The encryption_key parameter identifies the CRN of your customer root key, shown in the example as crn:[...key:...]
Block Storage for VPC PVC creation fails after API key reset 

Infrastructure provider: VPC

  What’s happening 

After you reset your API key, Block Storage for VPC PVC creation fails with an IAM permission error.

  Why it’s happening 

Resetting your API key means the credentials the Block Storage for VPC add-on uses to provision volumes are no longer valid. After resetting your API key, you must reset the Block Storage for VPC controller to use the latest API key for volume provisioning.

  How to fix it 

After resetting your API key, you must re-create the Block Storage for VPC controller pod. To re-create the controller pod, delete it by running the following command:



1.  Get the Block Storage for VPC controller pod name.

kubectl get pods -n kube-system | grep ibm-vpc-block-csi-controller
2.  Delete the Block Storage for VPC controller pod.

kubectl delete pod -n kube-system POD_NAME
The VPC API automatically creates a floating IP along with the public gateway if an existing floating IP is not specified. And yes, that floating IP shows up in the list.
* Who enforces that only one public gateway can exist per zone for a VPC?

The VPC API service enforces this limit.
* Does the VPC public gateway have a timeout function?

Yes, the VPC public gateway has a fixed, 4-minute timeout for TCP connections, and it is not configurable.
* How do you obtain the Cloud Resource Name (CRN) of a VPC?

To obtain the CRN of a VPC, click menu![Menu icon](https://cloud.ibm.com/docs/images/icon_hamburger.svg) > Resource list from the IBM Cloud console. Expand VPC Infrastructure to list your VPCs. Select a VPC and then click the Status entry to view its details. Use the icon to copy the CRN and paste it where needed.
* Can a vNIC have both a floating IP and private IP address?

Yes, a vNIC on a virtual server instance has a private IP and can be attached to floating IP.
* Instance1 has two vNICs, called vNIC1 and vNIC2. Can these two vNICs be attached to the same subnet?

Yes, you can attach multiple network interfaces of an instance to the same subnet.
* Can an instance be created without a subnet, such as with only a floating IP address?

No, a virtual server instance must be provisioned in a subnet.
* Can an instance be attached to multiple VPCs?

No, a virtual server instance can be provisioned in only one VPC.
* During floating IP assignment in a VPC, a customer must specify the network interface of the instance, is that correct?

Yes. Initially, assigning the floating IP to the primary network interface of a server helps establish the data path. Later, you can associate the floating IP to a different network interface if you want. Alternatively, you can manually configure routing for the interface in the guest operating system.
Considerations when deleting a VPC 

An IBM Cloud® Virtual Private Cloud resource cannot be deleted if it contains other resources, or if it is attached to another resource. This document describes the relationships between VPC resources, and it provides information about deleting a VPC.

The following table summarizes the types of VPC resources and the relationships to consider when you delete those resources.



Table 1. Types of resources and relationships that affect deletions

 Resource Before it can be deleted... After it is deleted... 

 VPC All subnets and public gateways in the VPC must be deleted. All security groups and address prefixes are deleted automatically. 
 Subnet All instances and any network interfaces in subnet must be deleted. Any public gateway that serves the subnet is detached. Any network ACL associated with the subnet is detached. 
 Instance All network interfaces are deleted automatically and the boot volume is deleted with the instance. Secondary data volumes are preserved unless the default setting is changed to auto-delete. A floating IP address must be unassociated or released before the instance is deleted. 
 Network interface Any floating IP attached to the network interface is released. 
 Key After you delete a key, it can no longer be used to provision a new instance, or to perform an OS reload on an existing instance. However, the key is still available on any instances that you provisioned with it, and you can continue to use it to log in. 
 Image The image cannot be used to provision a new instance, but existing instances with the image are not affected. 
 Volume The volume must be detached from all instances. 
 Network ACL The network ACL must be detached from all subnets. Default network ACLs for a VPC cannot be deleted. 
 Security group The security group must be detached from all network interfaces. The default security group for a VPC cannot be deleted. 
 Floating IP The floating IP must be detached from any network interface. 
 Public gateway The public gateway must be detached from all subnets. 
 Load balancer 
 VPN gateway Because IKE and IPsec policies can be shared between gateways, these policies are not deleted when a VPN Gateway is deleted. These policies must be removed manually.
--vpc-zone-ingress, --vpc-zone
: Optional. If set to true, this routing table is used to route traffic that originates from the public internet. For the routing to succeed, the VPC must not have an existing routing table with this property set to true. One of: false, true.

--accept-routes-from-resource-type-filters, --ar-rtf
: Comma-separated resource type filters that can create routes in this routing table. One of: vpn_server, vpn_gateway.

--output
: Is the output format. One of: JSON.

-q, --quiet
: Suppresses verbose output.

Routes with an action of deliver are treated as drop unless the next-hop is an IP address that is bound to a network interface on a subnet in the route’s zone. Hence, if an incoming packet matches a route with a next-hop of an internet-bound IP address or a VPN gateway connection, the packet is dropped.

You can set an ingress option to true on only one routing table per VPC, and then only if that routing table is not attached to any subnets.



 CLI examples 

ibmcloud is vpc-routing-table-create 72b27b5c-f4b0-48bb-b954-5becc7c1dcb3 --name my-vpc-routing-table --direct-link-ingress true -—output JSON

ibmcloud is vpc-routing-table-create my-vpc --name my-vpc-routing-table —-transit-gateway-ingress true --output JSON

ibmcloud is vpc-routing-table-create my-vpc --name my-vpc-routing-table --direct-link-ingress true --transit-gateway-ingress true -—output JSON
Block Storage for VPC PVC creation fails after API key reset 

Infrastructure provider: VPC

  What’s happening 

After you reset your API key, Block Storage for VPC PVC creation fails with an IAM permission error.

  Why it’s happening 

Resetting your API key means the credentials the Block Storage for VPC add-on uses to provision volumes are no longer valid. After resetting your API key, you must reset the Block Storage for VPC controller to use the latest API key for volume provisioning.

  How to fix it 

After resetting your API key, you must re-create the Block Storage for VPC controller pod. To re-create the controller pod, delete it by running the following command:



1.  Get the Block Storage for VPC controller pod name.

oc get pods -n kube-system | grep ibm-vpc-block-csi-controller
2.  Delete the Block Storage for VPC controller pod.

oc delete pod -n kube-system POD_NAME