vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Disaster recovery 

IBM is responsible for the recovery of Red Hat OpenShift on IBM Cloud components in case of disaster. You are responsible for the recovery of the workloads that run the cluster and your application data. If you integrate with other IBM Cloud services such as file, block, object, cloud database, logging, or audit event services, consult those services' disaster recovery information.



Table 6. Responsibilities for disaster recovery

 Resource IBM responsibilities Your responsibilities 

 General <br><br> * Maintain service availability across [worldwide locations](https://cloud.ibm.com/docs/containers?topic=containers-regions-and-zones) so that customers can deploy clusters across zones and regions for higher DR tolerance.<br> * Provision clusters with three replicas of master components for high availability.<br> * In multizone regions, automatically spread the master replicas across zones.<br> * Continuously monitor to work to ensure the reliability and availability of the service environment by site reliability engineers.<br> * Update and recover operational Red Hat OpenShift on IBM Cloud and Kubernetes components within the cluster, such as the Ingress application load balancer and file storage plug-in.<br> * Back up and recover data in etcd, such as your Kubernetes workload configuration files<br> * Provide the ability to integrate with other IBM Cloud services such as storage providers so that data can be backed up and restored.<br><br><br> <br><br> * Set up and maintain disaster recovery capabilities for your apps and data. For example, to prepare your cluster for HA/DR scenarios, follow the guidance in [High availability](https://cloud.ibm.com/docs/containers?topic=containers-ha) for Red Hat OpenShift on IBM Cloud. Note that persistent storage of data such as application logs and cluster metrics are not set up by default.<br><br><br> 







 Applications and data 

You are completely responsible for the applications, workloads, and data that you deploy to IBM Cloud. However, IBM provides various tools to help you set up, manage, secure, integrate and optimize your apps as described in the following table.



Table 7. Applications and data

 Resource How IBM helps What you can do
* UI
* CLI
* API







 Disaster Recovery - Fail over from an inaccessible primary volume 

If a catastrophic failure or disaster causes an outage on the primary site, customers can perform the following actions to quickly access their data on the secondary site. When the primary volume is inaccessible, you can force a failover to the remote replica. Before you start the failover, make sure that all host authorization is in place.

Authorized hosts and volumes must be in the same data center. For example, you can't have a replica volume in London and the host in Amsterdam. Both must be in London or both must be in Amsterdam.

This action breaks the replication relationship and restoring the connection between the primary and the replica location can be time-consuming.



 Fail over to the replica volume in the UI 



1. Go to your list of File Storage for Classic. From the Classic Infrastructure![Classic icon](https://cloud.ibm.com/docs-content/v1/content/04e9937a86546143babfc65ea21fdd4ea2d12d13/icons/classic.svg) menu, click Storage > File Storage for Classic.
2. Locate and click the volume name.
3. Click Actions![Actions icon](https://cloud.ibm.com/docs-content/v1/content/04e9937a86546143babfc65ea21fdd4ea2d12d13/icons/action-menu-icon.svg) > Failover.
4. When the primary location is disabled, the option of Disaster Recovery Failover becomes active.
5. Click Yes to proceed.







 Fail over to the replica volume from the SLCLI 

Use the following command to fail a file volume over to a specific replicant volume.

 slcli file disaster-recovery-failover --help
sage: slcli file disaster-recovery-failover [OPTIONS] VOLUME_ID

Options:
--replicant-id TEXT ID of the replicant volume
-h, --help Show this message and exit.





 Fail over to the replica volume with the API
* All records of device management requests including the history of any initiated requests, for example: the current state of the request
* Definitions of custom device management request bundles



Note: All data for an organization is retained for 14 days after service deprovisioning. Contact support within the 14-day window to have an organization restored.





 What type of data is not backed up? 

The following types of data are not backed up in Watson IoT Platform:



* Device events
* Transient messaging state, for example: data-in-flight
* MQTT messages that are sent and received as part of a device management request







 How frequently is data backed up and where is it stored? 

Data is backed up once every 24 hours.

Data is stored off-site from the main Watson IoT Platform service, providing geographical redundancy and enabling services to be restored in the event of a significant incident. Clients will be contacted if data restoration is ever required. All data is encrypted and complies with local data protection requirements.

The following off-site locations are currently used for data backup:



 Location Backup location 

 IBM Cloud US South (Dallas) Washington 
 IBM Cloud United Kingdom (London) Frankfurt 
 IBM Cloud Germany (Frankfurt) London 
 IBM Cloud Dedicated As per customer request when ordering Watson IoT Platform Dedicated 



Note: Future locations might change to reflect data privacy laws, for example the potential impact of Brexit on EU data sovereignty rules.
Site recovery processes the data and sends it to the target storage account. After the data is processed, recovery points are generated in the target storage account every few minutes.



 Failover process 

When you initiate a failover, the VMs are created in the target resource group, target virtual network, target subnet, and the target availability set. During a failover, you can select to use any recovery point.

The following steps provide a simplified description of a failover event.



* A failover event is triggered on the target host. If possible, it notifies the source host.
* The failover event is completed on the target host. This is a distinct step from the failover start with the purpose of allowing you to cancel a failover operation.
* The replica VM is now the active copy.
* When the primary site is recovered or rebuilt, replica is reestablished in reverse mode.
* A planned failover event makes the rebuilt replica in the primary site into the active copy again.











 The Dashboard 

The web-based central management dashboard provides a unified DR status that regularly monitors recovery posture by server, application, and business process, validating current DR readiness with clear business and operational advantages.

It manages all DR operations including DR tests, reporting, failover, and recovery for physical or virtual systems.

Clients can replicate data, applications, and operating systems from their production environment to a securely managed service-provider facility, where business applications can failover to a production-ready environment in the event of an outage at their primary facility.

Day-to-day DR operations covering monitoring and management are performed by IBM Resiliency Services. In the event of a disruption, the client is notified based on their DR policies and provided with compliance reports in the dashboard.





 Open Adaptable Architecture 

IBM Resiliency Orchestrator architecture is flexible and adaptable through the API extension.

Zoom

![Open adaptable architecture](https://cloud.ibm.com/docs-content/v1/content/adcecdbe4e86955f88aac7f3c1e7ec3ff44992ef/overview/images/BCDR-Architecture-Open-Adaptable-Architecture.svg)

Figure 3.
* --vpc: ID or name of the VPC. It is only required to specify the unique resource by name inside this VPC.
* --force, -f: Force the operation without confirmation.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is vpn-gateway-connection-update 

Update a VPN gateway connection.

ibmcloud is vpn-gateway-connection-update VPN_GATEWAY CONNECTION [--vpc VPC] [--admin-state-up true | false] [--dead-peer-detection-action restart | clear | hold | none] [--dead-peer-detection-interval INTERVAL] [--dead-peer-detection-timeout TIMEOUT] [--ike-policy IKE_POLICY_ID | --reset-ike-policy] [--ipsec-policy IPSEC_POLICY_ID | --reset-ipsec-policy] [--peer-address ADDRESS] [--psk PSK] [--name NEW_NAME] [--output JSON] [-q, --quiet]



 Command examples 



* ibmcloud is vpn-gateway-connection-update fee82deba12e4c0fb69c3b09d1f12345 gfe82deba12e4c0fb69c3b09d1f23456 --admin-state-up true --dead-peer-detection-action clear --dead-peer-detection-interval 33 --dead-peer-detection-timeout 100 --ike-policy 72251a2e-d6c5-42b4-97b0-b5f8e8d1f479 --ipsec-policy 05251a2e-d6c5-42b4-97b0-b5f8e8d1f445 --peer-address 234.3.4.5 -psk rweirjgiort --name my-new-connection --output JSON
* IP addresses, which include individual addresses, ranges, or subnets
* VPCs
* Service references, which allow access from other IBM Cloud® services





 Service references 

A service reference, defined as part of a network zone, allows the given service to talk to the restricted resources or APIs that are targeted by a particular context-based restriction policy. The following table includes service references that need to be included when using context-based restrictions in the context of VPC Infrastructure Services. You can also look at the [service-to-service IAM authorizations](https://cloud.ibm.com/docs/account?topic=account-serviceauth&interface=ui) in your account when deciding which service references to add in your network zone. You can find service-to-service authorization in your account by navigating to Manage -> Access (IAM) and selecting the Authorizations tab.



Table 1. Service references needed for context-based restrictions

 Service with context-based restrictions Impacted service Service reference(s) required in the network zone 

 Cloud Object storage <br><br> * [Image service](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-custom-images)<br> * [Flow logs](https://cloud.ibm.com/docs/vpc?topic=vpc-flow-logs)<br><br><br> VPC Infrastructure Services (is) 
 Key Protect <br><br> * [Snapshot](https://cloud.ibm.com/docs/vpc?topic=vpc-snapshots-vpc-planning)<br> * [Block storage volume](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-block-storage&interface=ui)<br> * [File Storage](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-planning)<br> * [Image service](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-custom-images)<br><br><br> Cloud Block Storage (server-protect)
vpc <br>Required <br>string The VPC the subnet will reside in. <br>One of: VPCIdentityById, VPCIdentityByCRN, VPCIdentityByHref 
 ip_version <br>string The IP version(s) to support for this subnet. Allowable values:[ipv4] 
 name <br>Required <br>string The name for this subnet. The name must not be used by another subnet in the VPC. If unspecified, the name will be a hyphenated list of randomly-selected words. <br>Possible values: 1 ≤ length ≤ 63, Value must match regular expression `^([a-z] 
 network_acl <br>string The network ACL to use for this subnet. If unspecified, the default network ACL for the VPC is used. <br>One of: NetworkACLIdentityById, NetworkACLIdentityByCRN, NetworkACLIdentityHref 
 public_gateway <br>string The public gateway to use for internet-bound traffic for this subnet. If unspecified, the subnet will not be attached to a public gateway. <br>One of: PublicGatewayIdentityById, PublicGatewayIdentityByCRN, PublicGatewayIdentityByHref 
 resource_group <br>ResourceGroupIdentityById The resource group to use. If unspecified, the account’s [default resource group](https://cloud.ibm.com/apidocs/resource-managerintroduction) is used. 
 routing_table <br>string The routing table to use for this subnet. If unspecified, the default routing table for the VPC is used. The routing table properties route_direct_link_ingress, route_internet_ingress, route_transit_gateway_ingress, and route_vpc_zone_ingress must be false. <br>One of: RoutingTableIdentityById, RoutingTableIdentityByCRN, RoutingTableIdentityByHref
Review each service's documentation to learn more about how they integrate with context-based restrictions.

You can also skip APIs to restrict all operations on the service that you select.







 Contexts 

Contexts define where your resource can be accessed. A context is made up of the allowed endpoint types and network zones that you configure.



* If a context includes network zones, then access is granted only when the request is created from within one of those zones.
* If a context includes service endpoint types, then access is granted only when the request is received over a connection that matches one of those types.
* If a context includes multiple restrictions, for example, both zones and endpoint types, then all restrictions must be satisfied for access to be granted.





 Network zone 

A network zone represents an allowlist of IP addresses where an access request is created. It defines a set of one or more network locations that are specified by the following attributes:



* IP addresses, which include individual addresses, ranges, or subnets.
* VPCs
* Service references, which allow access from other IBM Cloud® services.





 IP addresses 

Customers can specify the IP addresses they know that they want to be able to send traffic from. Anything outside of the specified IP addresses is denied.





 VPCs 

If you have apps that are deployed in a VPC that need access to a context-based restricted resource, you can include the VPC IP addresses in your network zone. To do so, select the target VPC in your network zone and add that network zone to your rule. This way, you don’t have to find the IP addresses that the VPC uses. Resources that are contacted see that the request is coming from a set of allowed IP addresses.





 Service references 

A service reference represents the network locations of a service or service instance. Including a service reference in a network zone adds the IP addresses associated with the service to your allowlist without requiring you to know the service's underlying IP addresses. Service references are helpful since the network locations of cloud services are unknown to the context-based restriction administrator and can change over time.

The following is a list of services that you can add to a network zone as a service reference:



Table 1. Services that are compatible with service references.
3000460 - Check whether Virtual Servers for VPC data volumes are enabled with customer-managed encryption and Keep Your Own Key (KYOK)
3000461 - Check whether Virtual Servers for VPC is provisioned from an encrypted image
3000462 - Check whether Virtual Servers for VPC is provisioned from customer-defined list of images
3000463 - Check whether Virtual Servers for VPC instances are identifable by the workload they are running based on the Auto Scale for VPC instance group definition
3000464 - Check whether Application Load Balancer for VPC has application port of the workload that is identifiable by the Auto Scale for VPC instance group definition
3000467 - Check whether Virtual Private Cloud (VPC) has no subnet with public gateway attached
3000469 - Check whether Application Load Balancer for VPC is configured with at least one VPC security group
3000623 - Check whether Container Registry has no more than users with the IAM administrator role
3000628 - Check whether Container Registry has no more than service IDs with the IAM administrator role
3000635 - Check whether Container Registry has at least users with the IAM manager role
3000636 - Check whether Container Registry has at least service IDs with the IAM manager role
3000639 - Check whether Container Registry service access is managed only by IAM access groups
3000622 - Check whether Toolchain has no more than users with the IAM administrator role
3000629 - Check whether Toolchain has no more than service IDs with the IAM administrator role
3000633 - Check whether Continuous Delivery has at least users with the IAM manager role
3000634 - Check whether Continuous Delivery has at least service IDs with the IAM manager role
3000638 - Check whether Toolchain service access is managed only by IAM access groups
3000621 - Check whether Secrets Manager has no more than users with the IAM administrator role
3000630 - Check whether Secrets Manager has no more than service IDs with the IAM administrator role
3000631 - Check whether Secrets Manager has at least users with the IAM manager role
3000632 - Check whether Secrets Manager has at least service IDs with the IAM manager role
A Red Hat Enterprise Linux, CentOS, or Ubuntu virtual server cx2-2x4 profile (2 vCPUs, 4 GB RAM, and 4Gbps) is required to be deployed in the VPC to act as a collector host. A collector is a software module that is packaged as a Docker image.

A profile is a collection of related goals, or security checks, used to validate your resources against to internal and external regulations. Refer to [Monitoring security and compliance posture with VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-manage-security-compliancemonitor-vpc)

A scope is used to narrow the focus of a scan to a specific environment, region, or resource. A scan is then scheduled to discover resources, assess their configuration, and validate their compliance against a predefined profile. Refer to [Getting started with Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started)





 Data encryption 

Primary boot volumes and secondary data volumes are automatically encrypted using IBM-managed encryption, however, you can also choose to manage your own encryption by using customer-managed encryption. Supported key management services are Key Protect and Hyper Protect Crypto Services (HPCS). For more information, see [About data encryption for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-about).





 Security groups 

IBM Cloud Security Groups for VPC allow rules to be applied that enable filtering to each network interface of a virtual server instance, based on its IP address.



* By default, a security group denies all traffic.
* As rules are added it defines the traffic permitted.
* Rules are stateful, therefore, reverse traffic in response to the permitted traffic is automatically permitted.
* Security groups are scoped to a single VPC.
* If you have multiple virtual servers in a security group, traffic between servers still need to be permitted.



For more information, see [About security groups](https://cloud.ibm.com/docs/vpc?topic=vpc-using-security-groups).
* VPC: ID or name of the VPC.
* ROUTING_TABLE1: ID or name of the VPC routing table.
* ROUTING_TABLE2: ID or name of the VPC routing table.
* --output: Specify output format, only JSON is supported. One of: JSON.
* --force, -f: Force the operation without confirmation.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is vpc-routing-table-routes 

List all the routes of a VPC routing table.

ibmcloud is vpc-routing-table-routes VPC ROUTING_TABLE [--output JSON] [-q, --quiet]



 Command options 



* VPC: ID or name of the VPC.
* ROUTING_TABLE: ID or name of the VPC routing table.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is vpc-routing-table-route 

View details of a VPC route.

ibmcloud is vpc-routing-table-route VPC ROUTING_TABLE ROUTE [--output JSON] [-q, --quiet]



 Command options 



* VPC: ID or name of the VPC.
* ROUTING_TABLE: ID or name of the VPC routing table.
* ROUTE: ID or name of the VPC route.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is vpc-routing-table-route-create 

Create a VPC route.
Can I port them to the VPC?

 I have volumes on the Classic infrastructure. Can I port them to the VPC? 

No. The VPC provides access to new availability zones in multi-zone regions. Compute, network, and storage resources are designed to function in the VPC.
* What is image from volume and how does it relate to Block Storage for VPC volumes?

 What is image from volume and how does it relate to Block Storage for VPC volumes? 

With the image from volume feature, you can create a custom image directly from a Block Storage for VPC boot volume. Then, you can use the custom image to provision other virtual server instances. For more information, see [About creating an image from a volume](https://cloud.ibm.com/docs/vpc?topic=vpc-image-from-volume-vpc).
* How is the boot disk created for an instance and how does it relate to the virtual machine image?

 How is the boot disk created for an instance and how does it relate to the virtual machine image? 

The boot disk, also called a boot volume, is created when you provision a virtual server instance. The boot disk of an instance is a cloned image of the virtual machine image. For stock images, the boot volume capacity is 100 GB. If you are importing a custom image, the boot volume capacity can be 10 GB to 250 GB, depending on what the image requires. Images smaller than 10 GB are rounded up to 10 GB. The boot volume is deleted when you delete the instance to which it is attached.
* When can I delete a Block Storage for VPC data volume?

 When can I delete a Block Storage for VPC data volume? 

You can delete a Block Storage for VPC data volume only when it isn't attached to a virtual server instance. [Detach the volume](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-block-storagedetach) before you delete it. Boot volumes are detached and deleted when the instance is deleted.
* What happens to my data when I delete a Block Storage for VPC data volume?
: Optional: The port to which the service directs traffic.

externalTrafficPolicy
: Set to Local to preserve the source IP address of client requests to your apps. This setting also prevents traffic from forwarding to a different zone. You must ensure that an app pod exists on each worker node in the zone that the VPC NLB deploys to, such as by using a DaemonSet. This option also configures HTTP health checks.
: If Cluster is set, DSR is implemented only from the worker node that the VPC NLB initially forwards the incoming request to. After the incoming request arrives, the request is forwarded to a worker node that contains the app pod, which may be in a different zone. The response from the app pod is sent to the original worker node, and that worker node uses DSR to send the response directly back to the client, bypassing the VPC NLB. This option also configures TCP health checks. For UDP load balancers, the service.kubernetes.io/ibm-load-balancer-cloud-provider-vpc-health-check-udp must be set with a TCP port value. For more information, see [Configuring TCP health checks for UDP load balancers](https://cloud.ibm.com/docs/containers?topic=containers-vpc-lbaasvpc_lb_health_udp).
3. Create the Kubernetes LoadBalancer service in your cluster.

kubectl apply -f <filename>.yaml -n <namespace>
4. Verify that the Kubernetes LoadBalancer service is created successfully in your cluster. When the service is created, the LoadBalancer Ingress field is populated with an external IP address that is assigned by the VPC NLB.

The VPC NLB takes a few minutes to provision in your VPC. The external IP address of your Kubernetes LoadBalancer service might be pending until the VPC NLB is fully provisioned.

kubectl describe svc myloadbalancer -n <namespace>

Example CLI output for a public LoadBalancer service: