vania-janet/multiturn-rag-retrieval-data huggingface dataset:
The example steps that follow skip the prerequisite steps of using the [IBM Cloud console](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-ibm-cloud-console), [CLI](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-cli), or [API](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-rest-apis) to provision a VPC, subnets, and instances.

You can also create a load balancer using the UI or CLI. For instructions, see [Creating an IBM Cloud Application Load Balancer for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-load-balancer) or the [CLI reference](https://cloud.ibm.com/docs/vpc?topic=vpc-infrastructure-cli-plugin-vpc-reference).



 Step 1. Create a load balancer with a listener, pool, and attached server instances (pool members) 

curl -H "Authorization: $iam_token" -X POST
"$vpc_api_endpoint/v1/load_balancers?version=$api_version&generation=2" -d '{
"name": "example-balancer",
"logging": {
"datapath": {
"active": true
}
},
"is_public": true,
"listeners": [
{
"certificate_instance": {
"crn": "crn:v1:staging:public:cloudcerts:us-south:a/123456:b8877ea4-b8eg-467e-912a-da1eb7f031cg:certificate:43219c4c97d013fb2a95b21dddde1234"
},
"port": 443,
If you want to try IBM Cloud Kubernetes Service, [contact IBM Sales](https://www.ibm.com/account/reg/us-en/signup?formid=MAIL-wcp).

Free clusters are automatically deleted after 30 days.

If you have a free cluster and want to upgrade to a standard cluster, you can [create a standard cluster](https://cloud.ibm.com/docs/containers?topic=containers-clusters). Then, [copy your deployment configuration files](https://cloud.ibm.com/docs/containers?topic=containers-update_appcopy_apps_cluster) from your free cluster into the standard cluster.



Characteristics of free and standard clusters

 Characteristics Free clusters Standard clusters 

 [In-cluster networking](https://cloud.ibm.com/docs/containers?topic=containers-securitynetwork) Yes Yes 
 [Public network app access by a NodePort service to a non-stable IP address](https://cloud.ibm.com/docs/containers?topic=containers-nodeport) Yes Yes 
 [User access management](https://cloud.ibm.com/docs/containers?topic=containers-access-overviewaccess_policies) Yes Yes 
 [IBM Cloud service access from the cluster and apps](https://cloud.ibm.com/docs/containers?topic=containers-service-bindingbind-services) Yes Yes 
 [Disk space on worker node for non-persistent storage](https://cloud.ibm.com/docs/containers?topic=containers-storage-plan) Yes Yes 
 [Provision Red Hat OpenShift clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-getting-started) Yes 
 [Create clusters in a Virtual Private Cloud (VPC)](https://cloud.ibm.com/docs/containers?topic=containers-vpc_ks_tutorial) Yes 
 [Ability to create cluster in every IBM Cloud Kubernetes Service region](https://cloud.ibm.com/docs/containers?topic=containers-regions-and-zones) Yes
Direct endpoints provide your servers with high-speed, direct connections to IBM Cloud services, which incur no added bandwidth costs. With the Cloud Object Storage direct endpoint, a VPC can connect to a Cloud Object Storage bucket located anywhere in the world.

You don't incur charges for traffic from your VPCs to all Cloud Object Storage endpoints that are listed in the following tables.



* A VPC client also has access to the Cloud Object Storage bucket over the public endpoint.
* A VPC client has access to the [Cloud Object Storage configuration API](https://cloud.ibm.com/apidocs/cos/cos-configuration) over the public endpoint and direct endpoint. You can use the Cloud Object Storage configuration API to configure some Cloud Object Storage features on buckets, and to view bucket metadata.
* A VPC client can access a Cloud Object Storage bucket when [context-based restrictions are in place](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-setting-a-firewall) by setting the network zone to the VPC ID. VPC clients can't access buckets that are restricted to using a traditional bucket firewall.









 How to connect to IBM Cloud Object Storage from a VPC 



1. Provision a Cloud Object Storage instance. For more information, see [Getting started with Cloud Object Storage](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-getting-started-cloud-object-storage).
2. Create a Cloud Object Storage bucket in one of the regions listed in the following section.
3. Use the endpoint to communicate with your Cloud Object Storage bucket.





 Regional endpoints 

Buckets that are created at a regional endpoint distribute data across three data centers, which are spread across a metropolitan area. Any one of these data centers can suffer an outage, or even destruction, without affecting availability.

Americas

Europe

Asia Pacific



Table 1. VPC regional endpoints for North and South America
This table displays the VPC Regional Endpoints.

 Location Region Endpoint
04 October 2022 

Catalog integration with Virtual Private Cloud custom images
: ISV Partners and IBM Cloud customers can now import custom VPC images directly to their account or enterprise, or sell on the IBM Cloud catalog without depending on Terraform. For more information, see [Onboarding a virtual server image for VPC](https://cloud.ibm.com/docs/account?topic=account-catalog-vsivpc-tutorial).







 September 2022 



 29 September 2022 

Enabling IBM Cloud Event Notifications for the notification distribution list
: You can now easily add Event Notifications instances to the notification distribution list and receive account-wide IBM Cloud notifications. With Event Notifications, you can choose to deliver your notifications to different destinations, including email, SMS, or webhooks. When an event of interest occurs on the IBM Cloud platform and an event is generated, the notification distribution list communicates with a connected Event Notifications instance to forward a notification to the supported destination.

For more information, see [Enabling Event Notifications for the notification distribution list](https://cloud.ibm.com/docs/account?topic=account-add-users-distribution-listevent-notifications-distribution-list).





 26 September 2022 

Identifying inactive policies
: To reduce the number of policies in your account and keep only the minimum access that is necessary for each user, you can now identify the infrequently used access policies on the [Inactive policies](https://cloud.ibm.com/iam/inactive-policies) page in the console. You can determine whether to remove the inactive policies, or in some cases, you might expect an infrequently used policy. For more information, see [Managing inactive policies](https://cloud.ibm.com/docs/account?topic=account-iam-audit-policies&interface=uiiam-audit-policies-list).

Exporting user access reports
: Make sure that users have only the access that they need. Export an access policy report for any user in your account to view all of the access policies that they are assigned.
Only one public gateway per zone is allowed in a VPC, but that public gateway can be attached to multiple subnets in the zone. To find the public gateway for a zone, run the ibmcloud is public-gateways command and look for the particular VPC and Zone values.





 Adding an SSH key 

Add your public SSH key to your IBM Cloud account. This key is specified when you create the instance, and you need it later to log in to the instance. You can use one key to provision multiple instances.

To see the available keys in your IBM Cloud account, run this command:

ibmcloud is keys

To add a key, run the following command. Substitute the path to your SSH key file. For an RSA SSH key, you can use the path to your id_rsa.pub file. For an Ed25519 SSH key, you can use the path to your id_ed25519.pub file.

ibmcloud is key-create my-key @$HOME/.ssh/id_rsa.pub

From the returned output, save the ID in a variable so you can use it later, for example:

key="0738-859b4e97-7540-4337-9c64-384792b85653"





 Select a profile for the instance 

To list all available instance profiles, run the following command:

ibmcloud is instance-profiles

Save the profile you plan to use as a variable, which will be used later to provision an instance.





 Select an image for the instance 

You can create an instance using a stock image, a custom image from your account, or an image that was shared with your account from a private catalog. Run one of the following commands based on the image you plan to use.



* Select a stock image or a custom image from your account for your instance.

To list all available images, run the following command:

ibmcloud is images

Deprecated images do not include the most current support.

Let's pick image ibm-debian-11-3-minimal-amd64-1. To get the image ID, run the following command:
For more information, see the tutorial [Onboarding a virtual server image for VPC](https://cloud.ibm.com/docs/account?topic=account-catalog-vsivpc-tutorial) and the [Import offering](https://cloud.ibm.com/apidocs/resource-catalog/private-catalogimport-offering) method in the Catalog Management API.

This feature is now generally available. The catalog_offering.published property in the beta API definition has been renamed to catalog_offering.managed. See the [VPC API change log](https://cloud.ibm.com/docs/vpc?topic=vpc-api-change-log27-september-2022).







 12 July 2022 



 For all version dates 

File storage cross-account encryption. Accounts that have been granted special approval to preview this feature can now use cross-account customer-managed encryption keys (CRKs) when [creating a file share](https://cloud.ibm.com/apidocs/vpc-betacreate-share) with [customer-managed encryption](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-aboutvpc-customer-managed-encryption). With this feature, the CRK account owner [invites you](https://cloud.ibm.com/docs/account?topic=account-iamuserinv) and sets the IAM delegated policy to the CRKs. Afterward, specify your IAM token to create a file share with an encryption_key CRN from the CRK account. For more information, see [Cross-account encryption for multitenant file storage resources](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-byok-cross-acct-key-file).







 5 July 2022 



 For all version dates 

Client VPN for VPC. Client-to-site connectivity is now generally available. See the [VPC API change log](https://cloud.ibm.com/docs/vpc?topic=vpc-api-change-log5-july-2022).
* ibmcloud is security-group-create my-sg 72b27b5c-f4b0-48bb-b954-5becc7c1dcb3 --resource-group-name Default
* ibmcloud is security-group-create my-sg 72b27b5c-f4b0-48bb-b954-5becc7c1dcb3 --output JSON







 Command options 



* GROUP_NAME: Name of the security group.
* VPC: ID or name of the VPC.
* --resource-group-id: ID of the resource group. This ID is mutually exclusive with --resource-group-name.
* --resource-group-name: Name of the resource group. This name is mutually exclusive with --resource-group-id.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is security-group-delete 

Delete one or more security groups.

ibmcloud is security-group-delete (GROUP1 GROUP2 ...) [--vpc VPC] [--output JSON] [-f, --force] [-q, --quiet]



 Command options 



* GROUP1: ID or name of the security group.
* GROUP2: ID or name of the security group.
* --vpc: ID or name of the VPC. It is only required to specify the unique resource by name inside this VPC.
* --output: Specify output format, only JSON is supported. One of: JSON.
* --force, -f: Force the operation without confirmation.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is security-group-rule 

View details of a security group rule.
* [Virtual Servers for VPC](https://cloud.ibm.com/vpc-ext/compute/vs)
* [IBM® VPN](https://cloud.ibm.com/vpc-ext/network/vpngateways)
* [VPE for VPC](https://cloud.ibm.com/vpc-ext/network/endpointGateways)
* [Databases for PostgreSQL instance in Databases](https://cloud.ibm.com/resources)
* [Object Storage](https://cloud.ibm.com/objectstorage/)







 Step 2: Verify connectivity 

The Schematics workspace output contains variables that can be used to verify the VPN connectivity.



1. Get the list of workspaces, note the ID column, set the shell variable:

ibmcloud schematics workspace list
2. Set the WORKSPACE_ID variable:

WORKSPACE_ID=YOUR_WORKSPACE_ID
3. Get the environment variables for the cloud resources:

ibmcloud schematics output --id $WORKSPACE_ID --output json | jq -r '.[0].output_values[].environment_variables.value'
4. The output will look something like the following. Copy/paste these results into your shell in order to set them in the environment:

IP_FIP_ONPREM=169.48.x.x
IP_PRIVATE_ONPREM=10.0.0.4
IP_PRIVATE_CLOUD=10.1.1.4
IP_FIP_BASTION=52.118.x.x
IP_PRIVATE_BASTION=10.1.0.4
IP_DNS_SERVER_0=10.1.0.5
IP_DNS_SERVER_1=10.1.1.6
IP_ENDPOINT_GATEWAY_POSTGRESQL=10.1.1.9
IP_ENDPOINT_GATEWAY_COS=10.1.1.5
* ibmcloud is instance-template-create --interactive Create instance template interactively.







 Command options 



* INSTANCE_TEMPLATE_NAME: Name of the instance template.
* VPC: ID or name of the VPC.
* ZONE_NAME: Name of the zone.
* PROFILE_NAME: Name of the profile.
* SUBNET: ID or name of the subnet.
* --image: ID or name of the image.
* --catalog-offering: The CRN for the IBM Cloud catalog offering. If specified, the latest version of that offering is used. For more information about creating a catalog offering, see [Onboarding software to your account](https://cloud.ibm.com/docs/account?topic=account-create-private-catalog&interface=cli).
* --catalog-offering-version: The CRN for the version of a IBM Cloud catalog offering. For more information about creating a version for the catalog offering, see [Onboarding software to your account](https://cloud.ibm.com/docs/account?topic=account-create-private-catalog&interface=cli).
* --total-volume-bandwidth: The amount of bandwidth (in megabits per second) that is allocated exclusively to instance storage volumes. An increase in this value results in a corresponding decrease to total network bandwidth.
* --boot-volume: BOOT_VOLUME_JSON|@BOOT_VOLUME_JSON_FILE, boot volume attachment in JSON or JSON file. For the data schema, see the boot_volume_attachment property in the [API documentation](https://cloud.ibm.com/apidocs/vpccreate-instance).
* --volume-attach: VOLUME_ATTACH_JSON|@VOLUME_ATTACH_JSON_FILE, volume attachment in JSON or JSON file, list of volumes. For the data schema, see the volume_attachments property in the [API documentation](https://cloud.ibm.com/apidocs/vpccreate-instance).
* --keys: Comma-separated IDs or names of SSH keys.
For more information, see [Deploy isolated workloads across multiple locations and zones](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-multi-region). 
 Bring your own CIDR IBM provides the ability to bring your own CIDR block to a subnet. The Customer ensures the CIDR blocks that they specify for their VPC do not conflict with CIDR blocks that are used by any other network that they plan to connect to their VPC. 
 Monitoring IBM provides built-in virtual server instance monitoring and IBM Cloud Monitoring. The Customer monitors the health of their workload by using either the built-in virtual server instance monitoring or IBM Cloud Monitoring. 
 Logs IBM provides access to logs for debugging purposes. The Customer uses IBM Log Analysis to check logs, as needed. 
 Workloads IBM provides tools and features for customer use. The Customer uses the provided tools and features to configure and deploy their highly available and resilient workloads by setting up permissions, integrating with other services, externally serving and monitoring health, as well as saving, backing up, and restoring data. 
 Flow logs IBM provides the ability to collect flow log data from various endpoints. The Customer understands the IBM Cloud Flow Logs for VPC data retention process and ensures that their destination Cloud Object Storage bucket is properly secured and encrypted. 







 Change management 

Change management includes tasks such as deployment, configuration, upgrades, patching, configuration changes, and deletion.



Table 3. Responsibilities for change management

 Task IBM Responsibilities Your Responsibilities 

 OS-based update repositories IBM provides private network access to OS-based update repositories. The Customer maintains OS patches, version updates, and security updates. 







 Identity and access management 

Identity and access management includes tasks such as authentication, authorization, access control policies, as well as approving, granting, and revoking access.



Table 4. Responsibilities for identity and access management

 Task IBM Responsibilities Your Responsibilities 

 IBM Cloud IAM IBM provides the function to restrict access to resources through the IBM Cloud console and REST APIs. The Customer is responsible for managing access to resources through IBM Cloud Identity and Access Management (IAM). 







 Security and regulation compliance
This diagram is applicable for bare metal to bare metal, bare metal to virtual server, and virtual server to virtual server in AWS, Azure, GCP, and OCI workloads to IBM Cloud VPC migration.





 Step 1: Order RMM 

The RMM tool is available in the IBM Cloud catalog. After you order, a virtual server with RMM software is installed into your VPC of choice. The RMM server has a public IP address for reachability and a default login.

If public IP address is not attached to RMM server then, its 'Reserved IP' address can be used to access RMM server with [bastion host](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-secure-management-bastion-server).



1. Order the RMM server from the [IBM Cloud catalog](https://cloud.ibm.com/catalog/content/IBM-MarketPlace-P2P-1.3-22935832-bd76-49ab-b53e-12fc5d04c266-global).
2. After you order, log in to the RMM server.
3. In the RMM server, change the default password, create users, and create an SSH key.
4. Upload the SSH key to IBM Cloud VPC.







 Step 2: Bring Your Own License (BYOL) from RackWare 

The license required for migration to IBM Cloud is Bring Your Own License (BYOL). You need to purchase the license directly from RackWare.

Complete the following steps to get a license:



1. Order your license from RackWare.
2. Run the following command on the RMM CLI to generate a preinstall file:

rwadm relicense
3. After you generate a preinstall file, send a license generation request to the RackWare licensing team with the following information:



* RMM License (subject line)
* Company name
* License count
* Preinstall file (attached)
* Purchase order (attached)



4. Install the license.

a.
VPC infrastructure resources are integrated into IAM and as such, you must have the IBM Cloud IAM Administrator platform access role to the [VPC Infrastructure service](https://cloud.ibm.com/docs/vpc?topic=vpc-iam-getting-started) to create and list VPC resources.

For both [classic and VPC clusters](https://cloud.ibm.com/docs/containers?topic=containers-infrastructure_providers), the credentials to access infrastructure resources are stored in an API key for the region and resource group of the cluster. To create and manage clusters after the infrastructure permissions are set, assign users IAM access roles to IBM Cloud Kubernetes Service.

Unlike classic, VPC does not support manually setting infrastructure credentials (ibmcloud ks credential set) to use another IBM Cloud infrastructure account to provision worker nodes. You must use your IBM Cloud account's linked infrastructure account.

Does my account already have access to the IBM Cloud infrastructure portfolio?
: To access the IBM Cloud infrastructure portfolio, you use an IBM Cloud Pay-As-You-Go or Subscription account. If you have a different type of account, view your options in the following list.

Lite accounts
: Lite accounts can't provision clusters. To create a standard cluster, upgrade your Lite account to an IBM Cloud [Pay-As-You-Go](https://cloud.ibm.com/docs/account?topic=account-accountspaygo) or [Subscription](https://cloud.ibm.com/docs/account?topic=account-accountssubscription-account) account.

Pay-As-You-Go
: You can create standard clusters. Use an API key to set up infrastructure permissions for your clusters.

To use a different classic infrastructure account for classic clusters, [manually set IBM Cloud infrastructure credentials for your IBM Cloud account](https://cloud.ibm.com/docs/containers?topic=containers-access-credscredentials). You can't set up your IBM Cloud account to use the VPC infrastructure of a different account.

Subscription
: Subscription accounts come with access to the infrastructure portfolio. You can create standard clusters.
Using a virtual private endpoint 

After you created your IBM Cloud® Virtual Private Cloud (VPC) and you want to connect to VMware as a Service APIs to create or manage your instance, you can create a Virtual Private Endpoint (VPE) in your VPC to access VMware as a Service APIs within your VPC network.

You can configure the VPE to use the IP addresses of your choice from a subnet within your VPC. VPEs are bound to a [VPE gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe) and serve as an intermediary that enables your workload to interact with VMware as a Service.

To connect to VMware as a Service by using a VPE, you must use the VMware as a Service API. You must access the VMware Solutions console through a public network from your VPC.



 Before you begin 

You must complete the following before you target a VPE for VMware as a Service.



* Ensure that you have [provisioned a Virtual Private Cloud](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started).
* Ensure that you have reviewed [planning for Virtual Private Endpoints](https://cloud.ibm.com/docs/vpctopic=vpc-planning-considerations).
* Ensure that [correct access controls](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-configuring-acls) are set for your VPE.
* Understand the [limitations](https://cloud.ibm.com/docs/vpc?topic=vpc-limitations-vpe) of having a VPE.
* Ensure that you have [created](https://cloud.ibm.com/docs/vpc?topic=vpc-ordering-endpoint-gateway) and understand how to [access](https://cloud.ibm.com/docs/vpc?topic=vpc-accessing-vpe-after-setup) a VPE gateway.
Provision IBM Cloud VPC for a VMware Deployment 

This tutorial may incur costs. Use the [Cost Estimator](https://cloud.ibm.com/estimator/review) to generate a cost estimate based on your projected usage.

This tutorial is part of [series](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-bm-vmwarevpc-bm-vmware-objectives), and requires that you have completed the related tutorials in the presented order.

In this tutorial, you will deploy a IBM Cloud VPC for a VMware Deployment and a jump machine for configuration tasks.



 Objectives 

In this tutorial, you will create a IBM Cloud VPC for your VMware Deployment. The following diagram shows the IBM Cloud VPC layout and subnets to be provisioned. NSX-T subnets are optional for NSX-T based deployments.

In this tutorial, a dedicated IBM Cloud VPC for VMware is used, but you can alter and modify the deployment based on your needs.

Zoom

![IBM Cloud VPC Subnets for VMware Deployment](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/solution63-ryo-vmware-on-vpc/Self-Managed-Simple-20210813v1-VPC-subnets.svg)

Figure 1. IBM Cloud VPC Subnets for VMware Deployment





 Before you begin 

This tutorial requires:



* Common [prereqs](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-bm-vmwarevpc-bm-vmware-prereqs) for VMware Deployment tutorials in IBM Cloud VPC