vania-janet/multiturn-rag-retrieval-data huggingface dataset:
The following will display help:

./apply.sh
5. You could apply all of the layers configured by executing ./apply.sh : :. The colons are shorthand for first (or config_tf) and last (vpe_dns_forwarding_rules_tf). The -p prints the layers:

./apply.sh -p : :

It will look something like:

directories: config_tf enterprise_tf transit_tf spokes_tf test_instances_tf transit_spoke_tgw_tf enterprise_link_tf firewall_tf all_firewall_tf spokes_egress_tf all_firewall_asym_tf dns_tf vpe_transit_tf vpe_spokes_tf vpe_dns_forwarding_rules_tf
6. If you don't already have one, obtain a [Platform API key](https://cloud.ibm.com/iam/apikeys) and export the API key for use by Terraform:

export IBMCLOUD_API_KEY=YourAPIKEy
7. In this first step apply in config_tf, enterprise_tf, transit_tf and spokes_tf:

./apply.sh : spokes_tf







 Step 2: Create test instances 

VPC Virtual Server Instances, VSIs, are provisioned to test the network connectivity. A test instance will be added to each of the worker subnets (one per zone) in the enterprise, transit and each of the spokes. If the default configuration of 3 zones and 2 spokes is used then 12 instances will be provisioned.

Zoom

![Test Instances](https://cloud.ibm.com/docs-content/v1/content/6a28e4ae2660b609a18e90e1239ed772f80373d6/transit-gateway/includes/solution-tutorials/includes/solution-tutorials/images/vpc-transit/vpc-transit-test-instances.svg)
In this tutorial Transit Gateway is used for distribution. The use of Transit Gateway is optional for an on-premises connection.

The enterprise in this tutorial is simulated in the form of another VPC. Connecting this simulated enterprise (actually another VPC) via the Transit Gateway will ensure an experience very close to what you would experience with a Direct Link.



1. Apply the enterprise_link_tf layer:

./apply.sh enterprise_link_tf
2. Run the zone 1 curl tests in the suite my using the -m (markers) flag. Choose the tests marked with curl, lz1 (left zone 1) and rz1 (right zone 1).

Your expected results are: Connectivity within a VPC, transit <-> spoke(s), enterprise <-> transit, spoke(s) <-> spoke(s) pass but enterprise <-> spoke(s) fail.

pytest -m "curl and lz1 and rz1"







 Step 6: Connect Enterprise to Spoke(s) via Transit NFV Firewall-Router 

The incentive for a transit VPC for enterprise <-> cloud traffic is typically to route, inspect, monitor and log network traffic. In this step a firewall-router appliance will be installed in each zone of the transit VPC.



 NFV Router 

Provision the firewall-router appliances. An ingress route table for Transit Gateway has been added to the transit VPC as indicated by the dotted lines. A subnet has been created in each of the zones of the transit VPC to hold the firewall-router.

Zoom

![Firewall](https://cloud.ibm.com/docs-content/v1/content/6a28e4ae2660b609a18e90e1239ed772f80373d6/transit-gateway/includes/solution-tutorials/includes/solution-tutorials/images/vpc-transit/vpc-transit-firewall.svg)

Firewall
Path parameters Details 

 transit_gateway_id <br>Required <br>string The transit gateway identifier 





Table 2. Query parameters for creating a GRE

 Query parameters Details 

 version <br>Required <br>string Requests the version of the API as of a date in the format YYYY-MM-DD. Any date up to the current date may be provided. Specify the current date to request the latest version. <br>Possible values: Value must match regular expression ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ 
 Request Body <br>Required <br>TransitGatewayConnectionTemplate The connection template 
 network_type <br>Required <br>string Defines what type of network is connected via this connection. <br>For access to gre_tunnel connections contact IBM support. <br>Allowable value: [gre_tunnel] <br>Example:gre_tunnel 
 base_connection_id <br>string network_type gre_tunnel connections must be created over an existing network_type classic connection. This field is required for gre_tunnel connections and must specify the ID of an active transit gateway network_type classic connection in the same transit gateway. Omit base_connection_id for any connection type other than gre_tunnel. <br>Example:975f58c1-afe7-469a-9727-7f3d720f2d32 
 local_gateway_ip <br>string Local gateway IP address. This field is required for and only applicable to type gre_tunnel and unbound_gre_tunnel connections. <br>Example:192.168.100.1 
 local_tunnel_ip <br>string Local tunnel IP address. This field is required for and only applicable to type gre_tunnel and unbound_gre_tunnel connections. The local_tunnel_ip and remote_tunnel_ip addresses must be in the same /30 network. Neither can be the network nor broadcast addresses. <br>Example:192.168.129.2
Include specific road adjectives likely to be relevant to the configuration of an accident; omit other adjectives. [two-lane, two-way road], [left lane], eastbound [lane], 2-foot [ditch], [right lane line], [exit ramp], [pole], [tree], steep descending [embankment] 
 VEHICLE Any reference to vehicle other than MODEL, MANUFACTURER, and MODEL_YEAR. Can be plural, in which case coreference is very unlikely and no part-of-group relation. the [truck]", "the [car]", "[V1]'s 







 Relation Types 

The type system uses relation types, but not relation classes or other attributes of relations. Negation is not encoded by a relation class, but rather by the extents of the mentions, for example, [no occupants]PERSON were [hospitalized]ACCIDENT_OUTCOME with the two mentions linked by the relation type sufferedFrom.



 Possible entity types for the first mention Relation type Possible etity types for the second mention 

 VEHICLE, MODEL, MANUFACTURER ^2^ hasProperty MANUFACTURER, MODEL, MODEL_YEAR 
 PERSON occupantOf VEHICLE, MODEL, MANUFACTURER, MODEL_YEAR ^1^, PART_OF_CAR, STRUCTURE 
 PERSON, PART_OF_CAR, STRUCTURE, VEHICLE, MODEL, MANUFACTURER, MODEL_YEAR ^1^ sufferedFrom ACCIDENT_OUTCOME 
 VEHICLE driveUnder CONDITION, ACCIDENT_CAUSE 
 PART_OF_CAR locatedOn VEHICLE, MODEL, MANUFACTURER, MODEL_YEAR ^1^ 
 ACCIDENT_OUTCOME outcomeOf INCIDENT 
 INCIDENT causedBy CONDITION, ACCIDENT_CAUSE (reminder: requires textual evidence of the causality) 
 INCIDENT impactPoint The PERSON, PART_OF_CAR, STRUCTURE, VEHICLE, MANUFACTURER, MODEL, or MODEL_YEAR ^1^ that is hit or involved in the accident. <br> <br>impactPoint for STRUCTURE does not include mere specifying the location of an impact that does not involve that STRUCTURE, so it does not apply to two vehicles colliding in an [intersection]STRUCTURE, but does apply to a vehicle striking an [embankment]STRUCTURE. 







 Table notes 



1. The notation VEHICLE/MODEL/MANUFACTURER/MODEL_YEAR refers to a mention of a vehicle.
The object has the following properties: certIssuerDNLegacy, certIssuerDN, certIssuerDNRFC2253, certSubjectDNLegacy, certVerified, certNotAfter, certSubjectDN, certFingerprintSHA1, certNotBefore, certSerial, certPresented, certSubjectDNRFC2253
* tlsVersion: The TLS version of the connection to CIS (for example, TLSv1.3).



Standard and Enterprise plans have access to:



* requestPriority: The browser-requested prioritization information in the request object (for example, “weight=192;exclusive=0;group=3;group-weight=127”).
* city: City of the incoming request (for example, "Austin").
* continent: Continent of the incoming request (for example, "NA").
* httpProtocol: HTTP Protocol (for example, "HTTP/2").
* latitude: Latitude of the incoming request (for example, "30.27130").
* longitude: Longitude of the incoming request (for example, "-97.74260").
* postalCode: PostalCode of the incoming request (for example, "78701").
* region: If known, the [ISO 3166-2](https://en.wikipedia.org/wiki/ISO_3166-2) name for the first level region associated with the IP address of the incoming request. If it is not known, it is an empty string (for example, "Texas").
* regionCode: If known, the [ISO 3166-2](https://en.wikipedia.org/wiki/ISO_3166-2) code for the first level region associated with the IP address of the incoming request. If it is not known, it is an empty string (for example, "TX").
* timezone: Timezone of the incoming request (for example, "America/Chicago").



All plans can set these features on outbound requests.
"created_at": "2020-03-31T12:08:05Z",
"id": "1a15dca5-7e33-45e1-b7c5-bc690e569531",
"name": "example-connection",
"network_type": "gre_tunnel",
"status": "pending",
"updated_at": "2020-03-31T12:08:05Z"
}

For more information (including Java, Node, Python and Go examples), see "Add Connection to a Transit Gateway" in the [Transit Gateway API reference](https://cloud.ibm.com/apidocs/transit-gateway?code=javacreate-transit-gateway-connection).









 Creating a Generic Routing Encapsulation (GRE) tunnel connection using Terraform 

You can specify the following argument references for your resource when creating a Generic Routing Encapsulation (GRE) tunnel connection:



Table 5. Terraform argument references for creating a GRE

 Argument Details 

 base_connection_id <br>Optional <br>Forces new resource <br>string The ID of a network_type classic connection a tunnel is configured over. <br>This field only applies to network type gre_tunnel connections. 
 gateway <br>Required <br>Forces new resource <br>string Enter the transit gateway identifier. 
 local_gateway_ip <br>Optional <br>Forces new resource <br>string The local gateway IP address. <br>This field is required for and only applicable to gre_tunnel and unbound_gre_tunnel connection types. 
 local_tunnel_ip <br>Optional <br>Forces new resource <br>string The local tunnel IP address. <br>This field is required for, and only applicable, to gre_tunnel and unbound_gre_tunnel type connections. 
 name <br>Optional <br>string Enter a name. If the name is not given, the default name is provided based on the network type, such as gre_tunnel. 
 network_type <br>Required <br>Forces new resource <br>string The network type.
![Direct Link on-premises interconnect use case](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/images/direct-link-dedicated.png)

Figure 3. Direct Link on-premises interconnect use case

See [IBM Cloud Transit Gateway](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-about) and [IBM Cloud Direct Link](https://cloud.ibm.com/docs/dl?topic=dl-get-started-with-ibm-cloud-dl) use case documentation for detailed private connectivity use cases and topologies. For information about native, private connectivity to IBM Cloud services, see [Endpoints available](https://cloud.ibm.com/docs/vpc?topic=vpc-service-endpoints-for-vpc).





 Connecting to Hyper Protect Crypto Services (HPCS) from VPC by using a Private Network 

The HPCS instance can be configured using API requests from both public and private endpoints. You can route traffic from your virtual server instance to the HPCS instance via the private network by configuring the route. You can use the route add -net 166.9.0.0/16 gw <gateway> dev <gateway_interface> command to configure the route. For more information about configuring the private network of IBM Cloud on your virtual server, see [Using service endpoints to privately connect to Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-secure-connectionconfigure-network).
Required.--json: The JSON file or JSON string used to describe a rate limiting rule.
<-- <ul> -->

* The required fields in JSON data are match, threshold, period, action:

<-- <ul> -->

* match: Determines which traffic the rate limiting rule counts towards the threshold.

<-- <ul> -->

* request: Matches HTTP requests.

<-- <ul> -->

* methods: HTTP Methods, can be a subset POST,PUT] or all _ALL_]. This field is not required to create a rate limit rule. Valid values are GET, POST, PUT, DELETE, PATCH, HEAD, _ALL_.
* schemes: HTTP Schemes, can be one HTTPS], both HTTP,HTTPS] or all _ALL_]!!. This field is not required.
* url: The URL pattern to match comprised of the host and path, for instance, example.org/path. Wildcards are expanded to match applicable traffic, query strings are not matched. Use for all traffic to your zone. Max length is 1024.

<-- </ul> -->

* response: Matches HTTP responses before they are returned to the client . If this is defined, then the entire counting of traffic occurs at this stage.

<-- <ul> -->

* status: HTTP Status codes, can be one 403], many 401,403]!!!!!!!!!!!!!!!! or indicate all by not providing this value. This field is not required. Min value: 100, max value: 999.
* headers: Array of response headers to match. If a response does not meet the header criteria then the request is not counted towards the rate limiting rule. The header matching criteria includes following properties.

<-- <ul> -->

* name: The name of the response header to match.
* op: The operator when matching, eq means equals, ne means not equals. Valid values are eq and ne.
* value: The value of the header, which is exactly matched.
With IBM Cloud Transit Gateway, you can create a single transit gateway or multiple transit gateways to connect IBM Cloud VPCs. You can also connect your IBM Cloud classic infrastructure to a transit gateway to provide seamless communication with classic infrastructure resources. Any new resource that you connect to a transit gateway is automatically made available to every other resource connected to it. All data remains within the private IBM Cloud backbone and is optimized for performance.

Zoom

![Sample Transit Gateway use case](https://cloud.ibm.com/docs-content/v1/content/6a28e4ae2660b609a18e90e1239ed772f80373d6/transit-gateway/includes/vpc/includes/vpc/images/TGW_Multi-Multi.png)

Sample Transit Gateway use case

VPC A Networks

VPC B Networks

VPC Z Networks



Table 1. VPC A Networks

 IP Origin 

 10.100.0.0/24 from VPC A subnet 
 13.100.0.0/24 from VPC A subnet 
 10.101.0.0/24 from VPC B through Transit Gateway (local) 
 13.101.0.0/24 from VPC B through Transit Gateway (local) 
 10.111.0.0/24 from VPC Z through Transit Gateway (global) 
 13.111.0.0/24 from VPC Z through Transit Gateway (global) 







 Benefits of using these IBM Cloud options 

Benefits of these interconnectivity offerings include:



* Traffic between your on-premises network and your VPC network doesn't traverse the public internet. Traffic traverses a dedicated connection, or through a service provider with a dedicated connection.
* By bypassing the public internet, your traffic takes fewer hops, so there are fewer points of failure where your traffic might get dropped or disrupted.
* Move data to and from your on-premises data centers into the IBM Cloud with uninterrupted, consistent network performance while protecting sensitive, business-critical data.
* Save on data transfer rates to and from servers in every IBM Cloud data center across our private network, avoiding bandwidth fees.
Required.--json: The JSON file or JSON string used to describe a rate limiting rule.
<-- <ul> -->

* The required fields in JSON data are match, threshold, period, action:

<-- <ul> -->

* match: Determines which traffic the rate limiting rule counts towards the threshold.

<-- <ul> -->

* request: Matches HTTP requests.

<-- <ul> -->

* methods: HTTP Methods, can be a subset POST,PUT] or all _ALL_]. This field is not required to create a rate limit rule. Valid values are GET, POST, PUT, DELETE, PATCH, HEAD, _ALL_.
* schemes: HTTP Schemes, can be one HTTPS], both HTTP,HTTPS] or all _ALL_]!!. This field is not required.
* url: The URL pattern to match comprised of the host and path, for instance, example.org/path. Wildcards are expanded to match applicable traffic, query strings are not matched. Use for all traffic to your zone. Max length is 1024.

<-- </ul> -->

* response: Matches HTTP responses before they are returned to the client . If this is defined, then the entire counting of traffic occurs at this stage.

<-- <ul> -->

* status: HTTP Status codes, can be one 403], many 401,403]!!!!!!!!!!!!!!!! or indicate all by not providing this value. This field is not required. Min value: 100, max value: 999.
* headers: Array of response headers to match. If a response does not meet the header criteria then the request is not counted towards the rate limiting rule. An array of header matching criteria includes following properties.

<-- <ul> -->

* name: The name of the response header to match.
* op: The operator when matching, eq means equals, ne means not equals. Valid values are eq and ne.
Securing your data in IBM Cloud Transit Gateway 

Data about your specific IBM Cloud® Transit Gateway configuration is encrypted in transit and at rest. Transit gateway configuration data is deleted upon your request through API or the user interface.

IBM Cloud Transit Gateway does not store any customer data. Data transmitted through a transit gateway is not encrypted by IBM.



  How your data is stored and encrypted 

All interaction with IBM Cloud Transit Gateway from clients is encrypted. For example, when you use an API or interact with the service through the user interface to configure gateways and connections, all such interactions are fully end-to-end encrypted. Likewise, data elements related to the your configuration are encrypted in transit and at rest. No personal or sensitive data is stored, processed, or transmitted, and data at rest is stored in an encrypted database.

However, the purpose of IBM Cloud Transit Gateway is to join your networks together. Once one VPC is connected to another, the encryption of data that you choose to transmit across the network is your responsibility.





  Protecting your sensitive data 

Data related to IBM Cloud Transit Gateway's configuration is not considered sensitive data. The configuration data is encrypted at rest at database level. The transit gatewat does not manage any customer-managed keys. As a result, there is no need or use for either Key Protect or Hyper Protect Crypto Services.



  About customer-managed keys 

IBM Cloud Transit Gateway does not manage any customer-managed keys. As a result, there is no need or use for either Key Protect or Hyper Protect Crypto Services.





  Enabling customer-managed keys 

IBM Cloud Transit Gateway does not manage any customer-managed keys. As a result, there is no need or use for either Key Protect or Hyper Protect Crypto Services.





  Working with customer-managed keys 

IBM Cloud Transit Gateway does not manage any customer-managed keys. As a result, there is no need or use for either Key Protect or Hyper Protect Crypto Services.







  Deleting your data in IBM Cloud Transit Gateway 

You can delete your transit gateway's configuration through API or with the user interface.



  Deleting IBM Cloud Transit Gateway instances 

You can delete your transit gateway's configuration through API or with the user interface.





  Restoring deleted data for IBM Cloud Transit Gateway 

IBM Cloud Transit Gateway does not support the restoration of deleted data.
IBM Cloud Load Balancer works as a reverse proxy, which terminates incoming traffic from the client. It establishes a separate connection to the back-end server instance by using its own IP address. For HTTP connections with the back-end servers (against front-end HTTP or HTTPS connections), the load balancer preserves the original client IP address by including it inside the X-Forwarded-For HTTP header. For TCP connections, the original client IP information is not preserved.





 Preserving end-client protocol 

IBM Cloud Load Balancer preserves the original protocol that is used by the client for front-end HTTP and HTTPS connections. It does this by including it inside the X-Forwarded-Proto HTTP header. This does not apply to TCP protocols because the load balancer does not look at Layer-7 traffic when the TCP protocol is used.
Comparing Layer-2 and Layer-3 connections for Direct Link 

IBM Cloud® Direct Link accepts OSI Layer-2 and Layer-3 partner interconnections from network service providers (NSPs). Some network service providers offer services for both of these layers on different networks, however, some providers might choose not to interconnect all of their networks into IBM Cloud.

When planning your Direct Link deployment, consider the characteristics that are associated with Layer-2 and Layer-3 connections, so you can create a deployment that best suits your needs.



 Considerations for Layer-2 connections 

For each VLAN-based virtual circuit, which you create with a Layer-2 partner interconnection, you must configure and establish a BGP session between your on-premises routers and the IBM Cloud XCR. IBM Cloud provides you with a /31 IPv4 assignment to establish a BGP session with your router.



* Layer-2 networks offer options for simple one-to-one connections between enterprises and IBM Cloud.
* Layer-2 services rely on VLANs instead of IP addresses.
* Layer-2 services might be lower cost and lower latency, and they might consume less overhead than Layer-3 services.
* Layer-2 networks do not impose restrictions on the Layer-3 features that an enterprise can enable.







 Considerations for Layer-3 connections 

For Layer-3 connections, for each virtual circuit, your service provider establishes a BGP session between IBM Cloud XCRs and the provider's edge routers. You do not need to configure BGP with IBM Cloud for your on-premises router because your service provider manages the BGP configuration to IBM Cloud.

When you order Direct Link Connect via the IBM Cloud console, you need to populate the Layer-3 provider's ASN for the BGP session, not your customer ASN.



* Layer-3 IP VPN or AVPN networks enable "any-to-any" connectivity.
* Layer-3 networks require the network service provider to maintain a BGP session between the enterprise and IBM Cloud.
* Certain network service providers might restrict certain functionalities across their network when using Layer-3 connections, such as ASN prepend, GRE tunneling, and so forth.
For more information, see [About routing tables and routes](https://cloud.ibm.com/docs/vpc?topic=vpc-about-custom-routes).

Support for datapath log forwarding with Log Analysis
: Datapath log forwarding with IBM Log Analysis is now available for IBM Cloud Application Load Balancer for VPC. Data and health check logs are valuable for debugging, analysis, and maintenance purposes. With the datapath logging feature enabled, your load balancer forwards these logs to your account's IBM Log Analysis dashboard. For more information, see [Datapath log forwarding with Log Analysis](https://cloud.ibm.com/docs/vpc?topic=vpc-datapath-loggingdatapath-logging).

UI enhancements
: You can now provision a VPC from the within the New virtual server for VPC page.





 12 November 2020 

Route-based virtual private network (VPN) gateways for VPC
: Use route-based VPN for VPC gateways to manage large, on-premises or cloud-based networks that require the ability to statically route network and connectivity over a secure, encrypted connection. VPN for VPC provides UI, CLI, and API support in all MZRs. For more information, see [About VPN gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-using-vpn).

UI enhancements:
: You can now provision virtual server instances without first creating a VPC. Your virtual server instance is created in a default VPC.
: The refresh data option is removed from all details pages. Instead, users can refresh by using the browser refresh.





 06 November 2020 

Proxy protocol support for IBM Cloud Application Load Balancer for VPC (ALB)
: Proxy protocol provides a way to carry client information across proxies by appending it to the traffic your load balancer sends to the back-end servers. It also allows you to use listeners if incoming traffic contains proxy protocol information set by an intermediate proxy in between the client and your load balancer.