vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Install software on virtual server instances in VPC 

This tutorial may incur costs. Use the [Cost Estimator](https://cloud.ibm.com/estimator/review) to generate a cost estimate based on your projected usage.

This tutorial walks you through provisioning IBM Cloud® Virtual Private Cloud (VPC) infrastructure and installing software on virtual server instances (VSI) using Infrastructure as Code (IaC) tools like Terraform and Ansible.

After an [introduction to the tutorial architecture](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-app-deployvpc-app-deploy-objectives), you will [prepare your environment](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-app-deployvpc-app-deploy-before-you-begin) for the tutorial and review the [basics of software installation](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-app-deployvpc-app-deploy-basics) in IBM Cloud. At that point you can decide to evaluate all the technologies or to jump to one of the specific standalone sections like [Terraform](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-app-deployvpc-app-deploy-terraform) or [Ansible](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-app-deployvpc-app-deploy-ansible).



 Objectives 



* Understand operating system software provided by IBM.
* Utilize manual steps for updating the operating system software and installing new software.
* Understand how to use the IBM Cloud CLI, Terraform and Ansible to automate the provisioning of resources and software installation.
End user accesses the LAMP server running on a VPC using a web browser.
2. The VSI is configured to use data from an encrypted Block Storage volume (optional).







 Before you begin 

This tutorial requires:



* An IBM Cloud [billable account](https://cloud.ibm.com/docs/account?topic=account-accounts),
* IBM Cloud CLI,



* IBM Cloud VPC plugin (vpc-infrastructure),



* terraform to use Infrastructure as Code to provision resources,
* jq to query JSON files,
* git to clone source code repository,



You will find instructions to download and install these tools for your operating environment in the [Getting started with solution tutorials](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-tutorials) guide. To avoid the installation of these tools you can use the [Cloud Shell](https://cloud.ibm.com/shell) from the IBM Cloud console.





 Step 1: Create services 

In this section, you will provision a VPC, Subnet, Security Group and a Virtual Server Instance (VSI) using the [IBM Cloud Shell](https://cloud.ibm.com/shell) and the IBM Cloud CLI. VSIs often address peaks in demand after which they can be [suspended or powered down](https://cloud.ibm.com/docs/vpc?topic=vpc-suspend-billingbilling-details) so that the cloud environment perfectly fits your infrastructure needs.

If you prefer to use a Terraform template to generate these resources, you can use the template that is available here: [https://github.com/IBM-Cloud/vpc-tutorials/tree/master/vpc-lamp](https://github.com/IBM-Cloud/vpc-tutorials/tree/master/vpc-lamp) and follow the instructions in the README.md. This template can also be used in [Schematics](https://cloud.ibm.com/schematics/overview).



1.
Install software on virtual server instances in VPC 

This tutorial may incur costs. Use the [Cost Estimator](https://cloud.ibm.com/estimator/review) to generate a cost estimate based on your projected usage.

This tutorial walks you through provisioning IBM Cloud® Virtual Private Cloud (VPC) infrastructure and installing software on virtual server instances (VSI) using Infrastructure as Code (IaC) tools like Terraform and Ansible.

After an [introduction to the tutorial architecture](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-app-deployvpc-app-deploy-objectives), you will [prepare your environment](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-app-deployvpc-app-deploy-before-you-begin) for the tutorial and review the [basics of software installation](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-app-deployvpc-app-deploy-basics) in IBM Cloud. At that point you can decide to evaluate all the technologies or to jump to one of the specific standalone sections like [Terraform](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-app-deployvpc-app-deploy-terraform) or [Ansible](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-app-deployvpc-app-deploy-ansible).



 Objectives 



* Understand operating system software provided by IBM.
* Utilize manual steps for updating the operating system software and installing new software.
* Understand how to use the IBM Cloud CLI, Terraform and Ansible to automate the provisioning of resources and software installation.



In this tutorial, you will deploy the configuration introduced in another tutorial, [Public frontend and private backend in a Virtual Private Cloud](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-public-app-private-backend).
* [IBM Cloud account setup](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-setup)
* [Working with Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-containers-openshift)







 IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



* Check whether Security Groups for VPC contains no outbound rules in security groups that specify source IP 8.8.8.8/32 to DNS port
* Check whether Event Streams network access is restricted to a specific IP range
* Check whether Virtual Servers for VPC instance doesn't have a floating IP
* Check whether Application Load Balancer for VPC has public access disabled
* Check whether OpenShift clusters are accessible only by using private endpoints
* Check whether authorized IP ranges are configured for the account
* Check whether Virtual Private Cloud (VPC) security groups have inbound ports that are open only to permitted IP addresses
* Check whether Hyper Protect DBaaS for MongoDB is accessible only using private endpoints
* Check whether Event Streams is accessible only by using private endpoints
* Check whether Hyper Protect DBaaS for PostgreSQL is accessible only using private endpoints
* Check whether Virtual Private Cloud (VPC) has no public gateways attached
* Check whether Virtual Private Cloud (VPC) network access control lists don't allow ingress from 0.0.0.0/0 to any port
* Check whether all virtual server instances have at least one Virtual Private Cloud (VPC) security group attached
* Check whether Virtual Private Cloud (VPC) has no public gateways attached at the time of provisioning
* Check whether App ID redirect URIs are not using wildcards (*)
* Check whether Virtual Servers for VPC instance has all interfaces with IP-spoofing disabled
Public frontend and private backend in a Virtual Private Cloud 

This tutorial may incur costs. Use the [Cost Estimator](https://cloud.ibm.com/estimator/review) to generate a cost estimate based on your projected usage.

This tutorial walks you through creating your own IBM Cloud® Virtual Private Cloud (VPC) with multiple subnets and a virtual server instance (VSI) in each subnet. A VPC is your own, private cloud on shared cloud infrastructure with logical isolation from other virtual networks.

A subnet is an IP address range. It is bound to a single zone and cannot span multiple zones or regions. For the purposes of VPC, the important characteristic of a subnet is the fact that subnets can be isolated from one another, as well as being interconnected in the usual way. Subnet isolation can be accomplished by Security Groups that act as firewalls to control inbound and outbound traffic for one or more virtual server instances.

A good practice is to have a subnet used for resources that must be exposed to the outside world. Resources with restricted access that should never be directly accessed from the outside world are placed within a different subnet. Instances on such a subnet could be your backend database or some secret store that you do not want to be publicly accessible. You will define Security Groups to allow or deny traffic to the VSIs.

In short, using VPC you can:



* create a software-defined network (SDN),
* isolate workloads,
* have fine control of inbound and outbound traffic.





 Objectives 



* Understand the infrastructure objects available for virtual private clouds
* Learn how to create a virtual private cloud, subnets and server instances
* Know how to apply security groups to secure access to the servers



Zoom

![Architecture](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/solution40-vpc-public-app-private-backend/Architecture.svg)

Figure 1. Architecture diagram of the tutorial
Use a VPC/VPN gateway for secure and private on-premises access to cloud resources 

This tutorial will incur costs. Use the [Cost Estimator](https://cloud.ibm.com/estimator/review) to generate a cost estimate based on your projected usage.

IBM offers a number of ways to securely extend an on-premises computer network with resources in the IBM Cloud. This allows you to benefit from the elasticity of provisioning cloud resources when you need them and removing them when no longer required. Moreover, you can easily and securely connect your on-premises capabilities to the IBM Cloud services.

This tutorial provides the automation to create resources that demonstrate Virtual Private Network (VPN) connectivity between on-premises servers and cloud resources like IBM Cloud® Virtual Private Cloud Virtual Service Instances (VSIs) and IBM Cloud data services. DNS resolution to cloud resources is also configured. The popular [strongSwan](https://www.strongswan.org/) VPN Gateway is used to represent the on-premises VPN gateway.



 Objectives 



* Access a virtual private cloud (VPC) environment from an on-premises data center
* Securely reach cloud services using private endpoint gateways
* Use DNS on-premises to access cloud resources over VPN



The following diagram shows the resources created by this tutorial

Zoom

![Architecture](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/includes/solution-tutorials/includes/solution-tutorials/images/solution46-vpc-vpn/vpc-site2site-vpn-tutorial.png)

Figure 1. Architecture diagram of the tutorial

A terraform configuration will create the following resources:



1. The infrastructure (VPC, Subnets, Security Groups with rules, Network ACL and VSIs).
2. The Object Storage and Databases for PostgreSQL private endpoint gateways to data services.
3.
Virtual Private Endpoints 

IBM Cloud

IBM Cloud® Virtual Private Endpoints (VPE) for VPC enables you to connect to supported IBM Cloud® services from your VPC network by using the IP addresses of your choosing, allocated from a subnet within your VPC. See more details [here](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe).

This document applies to Watson Assistant, Discovery, Speech to Text, and Text to Speech. Virtual Private Endpoints (VPEs) are available for these services in the Dallas, Washington, Frankfurt, London, Sydney, and Tokyo locations.



 Prerequisites 



* Have a [Virtual Private Cloud (VPC)](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started)
* Have [private endpoints enabled](https://cloud.ibm.com/docs/watson?topic=watson-public-private-endpointsrequirements-endpoints) for your service instance







 Instructions 



* Create a VPE Gateway (VPEG) through the [UI](https://cloud.ibm.com/docs/vpc?topic=vpc-ordering-endpoint-gateway&interface=ui), [CLI](https://cloud.ibm.com/docs/vpc?topic=vpc-ordering-endpoint-gateway&interface=cli), or [API](https://cloud.ibm.com/docs/vpc?topic=vpc-ordering-endpoint-gateway&interface=api).
The VSI is configured with Red Hat Enterprise Linux 8.4 (amd64), has a minimal of two SSH keys that are configured to be accessed by the root user and one storage volume.





 Software configuration 



* Terraform - an open source infrastructure as code software tool created by HashiCorp
* Ansible - an open source software provisioning and configuration management tool.
* The IBM Cloud Command Line Interface provides commands for managing resources in IBM Cloud.









 Bastion input variables 



 Parameter Description 

 ibmcloud_api_key IBM Cloud API key (Sensitive* value). 
 private_ssh_key The id_rsa private key content from your local machine (Sensitive* value). 
 REGION The cloud region where to deploy the resources. For more information about regions and zones for VPC, see [Locations](https://cloud.ibm.com/docs/containers?topic=containers-regions-and-zoneszones-vpc). Review the supported locations in IBM Cloud Schematics that are listed in [Locations and endpoints](https://cloud.ibm.com/docs/schematics?topic=schematics-locations). Sample value: eu-de. 
 ZONE The cloud zone where to deploy the solution. Sample value: eu-de-2. 
 VPC_EXISTS Specify whether the chosen VPC exists (enter 'yes' or 'no'). If you choose 'no', the VPC is created. 
 SUBNET_EXISTS Specify whether the chosen SUBNET/SECURITYGROUP exist (use 'yes' or 'no'). If you choose 'no', a SUBNET/SECURITYGROUP with OPEN PORTS is created in the specified VPC. 
 ADD_OPEN_PORTS_IN_NEW_SUBNET Create new port/s only if a NEW SUBNET is created, use 'yes' or 'no'. 
 OPEN_PORT_MINIMUM (Required, Integer) The TCP port range that includes the minimum value. Valid values are 1 - 65535. 
 OPEN_PORT_MAXIMUM (Required, Integer) The TCP port range that includes the maximum value. Valid values are 1 - 65535. 
 VPC The name of the VPC.
VPC: Why is no VPC available when I create a cluster in the console? 

Infrastructure provider: VPC

  What’s happening 

You try to create a VPC cluster by using the [IBM Cloud Kubernetes Service console](https://cloud.ibm.com/kubernetes/catalog/create).

You have an existing [VPC](https://cloud.ibm.com/vpc) in your account, but when you try to select an existing Virtual Private Cloud to create the cluster in, you see the following error message:

No VPC is available. Create a VPC.

  Why it’s happening 

During cluster creation, the IBM Cloud Kubernetes Service console uses the API key that is set for the default resource group to list the VPCs that are available in your IBM Cloud account.

If no API key is set for the default resource group, no VPCs are listed in the IBM Cloud Kubernetes Service console, even if your VPC exists in a different resource group and an API key is set for that resource group.

  How to fix it 

To set an API key for the default resource group, use the IBM Cloud Kubernetes Service CLI.



1.  Log in to the command line as the account owner. If you want a different user than the account owner to set the API key, first [ensure that the API key owner has the correct permissions](https://cloud.ibm.com/docs/containers?topic=containers-access-credsowner_permissions).

ibmcloud login [--sso]
2.  Target the default resource group.

ibmcloud target -g default
3.  Set the API key for the region and resource group.

ibmcloud ks api-key reset --region <region>
4.  In the [IBM Cloud Kubernetes Service console](https://cloud.ibm.com/kubernetes/catalog/create), click Refresh VPCs. Your available VPCs are now listed in a drop-down menu.
Make sure you understand the [IBM Cloud VPC concepts](https://cloud.ibm.com/vpc-ext/overview) and [IBM Cloud Bare Metal Servers for Virtual Private Cloud capabilities](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-for-bare-metal-servers). Also, review [VMware Solution Architectures for IBM Cloud VPC](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vpc-ryo-overview).

This tutorial requires:



* An IBM Cloud [billable account](https://cloud.ibm.com/docs/account?topic=account-accounts),



* Setup up an IBM Cloud account, see [Getting Started](https://cloud.ibm.com/docs/account?topic=account-account-getting-started).
* Check for user permissions. Be sure that your user account has sufficient permissions to create and manage IBM Cloud VPC resources and managing Bare Metal Servers for VPC. See the list of [required permissions for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-user-permissions-for-vpc-resources) and [prerequisites for creating Bare Metal Servers for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-bare-metal-serversprereq).
* [Setup](https://cloud.ibm.com/docs/account?topic=account-userapikey&interface=ui) an API key.



* IBM Cloud CLI,



* Install IBM Cloud command line (CLI) tooling. See [Getting started with the IBM Cloud CLI](https://cloud.ibm.com/docs/cli).
* Install IBM Cloud VPC plugin (vpc-infrastructure)
* Install DNS Services plugin (cloud-dns-services)
Use the [VPC create instance API](https://cloud.ibm.com/apidocs/vpc-betacreate-instance) or the [VPC update instance API](https://cloud.ibm.com/apidocs/vpc-betaupdate-instance) to enable or disable the metadata service endpoint for a particular instance. For more information, see [About VPC Instance Metadata](https://cloud.ibm.com/docs/vpc?topic=vpc-imd-about).







 27 July 2021 



 For all API version dates 

GPU instances. Accounts that have been granted special approval to preview this feature can now view new instance profiles, which include GPUs attached to the instance. These attached GPUs allow for accelerated computing to run workloads with more powerful compute capabilities.

The following API methods have been enhanced:



* [List instances](https://cloud.ibm.com/apidocs/vpc-betalist-instances) returns a new gpu property with four additional sub-properties: count, manufacturer, model, and memory
* [Retrieve an instance profile](https://cloud.ibm.com/apidocs/vpc-betaget-instance-profile) returns four new properties: gpu_count, gpu_manufacturer, gpu_model, and gpu_memory



For more information, see [Managing GPUs](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-gpus).

This feature is now generally available. See the [VPC API change log](https://cloud.ibm.com/docs/vpc?topic=vpc-api-change-log19-october-2021).







 20 July 2021 



 For all version dates 

Bare metal servers for VPC. Accounts that have been granted special approval to preview this feature can now create bare metal servers to host VMware clusters in IBM Cloud VPC. You can set up VMware management applications and create VMware virtual machines on the bare metal servers. As bare metal servers are integrated with the VPC platform, you can take advantage of the network and security capabilities of IBM Cloud VPC.
Using Virtual Private Endpoints 

IBM Cloud® Virtual Private Endpoint (VPE) for IBM Cloud® Object Storage provides connection points to IBM services on the IBM private network from your VPC network.



 Using Virtual Private Endpoints 

Virtual Private Endpoints (VPEs) are generally available in all regions.



 Before you begin 



* You need to have an [IBM Cloud account](https://cloud.ibm.com/registration)
* You also need an [instance of IBM Cloud Object Storage](http://cloud.ibm.com/catalog/services/cloud-object-storage)







 Setting up your VPE 



1. Create an IBM Cloud® Virtual Private Cloud. Follow the Getting started[instructions here](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started).
2. Make sure that your VPC has at least one VSI (virtual server instance), and can connect to the VSI. You can use the UI, CLI, and API to quickly provision IBM Cloud® Virtual Private Cloud from the Virtual server instances page in IBM Cloud console:



1. Use this information when you're creating [generation 1 virtual server instances](https://cloud.ibm.com/docs/vpc-on-classic-vsi?topic=vpc-on-classic-vsi-creating-virtual-servers).
2. Use this information when you're creating [generation 2 virtual server instances](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-virtual-servers).



3. Find the [location and the corresponding direct endpoint](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-endpoints) where your bucket is located.
4. In the IBM Cloud console, click the menu icon and select -> VPC Infrastructure -> Network -> Virtual private endpoint gateways. Create a VPE for your IBM Cloud instances with the [following instruction](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe).
5.
An application that is configured for the private network can be accessed through the VPE or by other Code Engine applications. Applications that are accessed through the VPE do not leave the IBM network and stay within the IBM Cloud network.



 Using your VPE to manage project resources securely 

Before you begin, you must have an [IBM Cloud account](https://cloud.ibm.com/registration).



1. Create an IBM Cloud® Virtual Private Cloud. Follow the [Getting started](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started) instructions.
2. Make sure that your VPC has at least one VSI (virtual server instance) and can connect to the VSI. You can use the UI, CLI, and API to quickly provision IBM Cloud® Virtual Private Cloud from the Virtual server instances page in the IBM Cloud console.



1. Create an [SSH key](https://cloud.ibm.com/docs/vpc?topic=vpc-ssh-keys) to access the VSI.
2. [Create a virtual server instance by using the UI](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-virtual-servers).
3. [Reserve a floating IP address](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-ibm-cloud-consolereserving-a-floating-ip-address) so your instance is reachable from the internet.
4. [Connect to your VSI](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-ibm-cloud-consoleconnecting-to-your-instance).



3. In the IBM Cloud console, click the Menu icon and select VPC Infrastructure -> Network -> Virtual private endpoint gateways.
Isolating workloads with a secure private network 

This tutorial describes the use of Classic Infrastructure. Most workloads can be implemented using [IBM Cloud® Virtual Private Cloud](https://cloud.ibm.com/docs/vpc) resources. Use IBM Cloud VPC to create your own private cloud-like computing environment on shared public cloud infrastructure. A VPC gives an enterprise the ability to define and control a virtual network that is logically isolated from all other public cloud tenants, creating a private, secure place on the public cloud. Specifically, [Direct Link](https://cloud.ibm.com/docs/vpc?topic=vpc-interconnectivity), [virtual server instances](https://cloud.ibm.com/docs/vpc?topic=vpc-vsi_best_practices), [security groups](https://cloud.ibm.com/docs/vpc?topic=vpc-using-security-groups), [VPN](https://cloud.ibm.com/docs/vpc?topic=vpc-using-vpn) and [flow logs](https://cloud.ibm.com/docs/vpc?topic=vpc-flow-logs)

This tutorial may incur costs. Use the [Cost Estimator](https://cloud.ibm.com/estimator/review) to generate a cost estimate based on your projected usage.

The need for isolated and secure private network environments is central to the IaaS application deployment model on public cloud. Firewalls, VLANs, routing, and VPNs are all necessary components in the creation of isolated private environments. This isolation enables virtual machines and bare-metal servers to be securely deployed in complex multi-tier application topologies while proving protection from risks on the public internet.