vania-janet/multiturn-rag-retrieval-data huggingface dataset:
For more information, see [Understanding compliance in IBM Cloud](https://cloud.ibm.com/docs/overview?topic=overview-compliance). 







 Manage billing and usage 

Account owners and users with the administrator role on the [billing account management service](https://cloud.ibm.com/docs/account?topic=account-account-services&interface=uibilling-acct-mgmt) have access to monitor and manage billing, usage, invoices, payments, and more. Complete the following checklist to get familiar with the best practices and tools that you use to manage and track billing and usage in the account.



Table 4. Getting started tasks for managing billing and usage

 Task Description 

 <br><br> * How to manage billing and usage<br><br><br> Learn about the IBM Cloud billing options and tools that you can use to track your usage and manage invoicing and payments. Check out the [How can I manage billing and usage in IBM Cloud](https://cloud.ibm.com/docs/billing-usage?topic=billing-usage-overview) video. 
 <br><br> * Understand suspended billing on Virtual Servers for VPC<br><br><br> Suspended billing is an option that is available for virtual server instances running on VPC. It is not available for bare metal or dedicated hosts on VPC. With suspended billing, there are some resources, for example network and storage that continue billing. Learn more about [suspended billing for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-suspend-billing). 
 <br><br> * Configure spending alerts for your account<br><br><br> You can enable spending notifications for Pay-As-You-Go or Subscription accounts, these alerts are configurable for the entire account or for individual services. [Set up spending notifications](https://cloud.ibm.com/docs/billing-usage?topic=billing-usage-spending).
* [Virtual Server for VPC](https://cloud.ibm.com/docs/account?topic=account-iam-service-roles-actionsvirtual-server-for-vpc)







 Storage IAM roles and actions 



* [Block Storage for VPC](https://cloud.ibm.com/docs/account?topic=account-iam-service-roles-actionsblock-storage-for-vpc)
* [Block Storage Snapshots for VPC](https://cloud.ibm.com/docs/account?topic=account-iam-service-roles-actionsblock-storage-snapshots-for-vpc)
* [File Storage for VPC](https://cloud.ibm.com/docs/account?topic=account-iam-service-roles-actionsfile-storage-for-vpc)
* [Regional Backup as a Service for VPC](https://cloud.ibm.com/docs/account?topic=account-iam-service-roles-actionsregional-backup-as-a-service-for-vpc)



Some VPC tasks require authorizations for multiple IAM actions. For example, create virtual server instance not only requires is.instance.instance.create, it also requires is.vpc.vpc.operate, is.subnet.subnet.operate, is.security-group.security-group.operate, and is.volume.volume.create. Additional conditional actions might be required. For example, if you provision an instance on a dedicated host, you need is.dedicated-host.dedicated-host-group.operate and is.dedicated-host.dedicated-host.operate. The Virtual Private Cloud API reference includes an Authorization section for each API call, for example, [Create an instance](https://cloud.ibm.com/apidocs/vpc/latestcreate-instance).





 Assigning access to VPC Infrastructure Services in the console 

You have two common ways to assign access in the console:



* Access policies per user. You can manage access policies per user from the Manage > Access (IAM) > Users page in the console.
To avoid billing issues later, make sure that you use only what you are entitled to use. For example, you might have an entitlement for the OCP licenses for two worker nodes of 4 CPU and 16 GB memory, and you create this worker pool with two worker nodes of 4 CPU and 16 GB memory. You used your entire entitlement, and you can't use the same entitlement for other worker pools, cloud providers, or environments.

-q
: Optional: Do not show the message of the day or update reminders.



 Example cluster create classic commands 

Create your first cluster: The first standard cluster that is created in a zone also creates a private VLAN. Therefore, don't include the --public-vlan option.

ibmcloud oc cluster create classic --zone dal10 --private-vlan my_private_VLAN_ID --flavor b3c.4x16 --name my_cluster --hardware shared --workers 2 --operating-system REDHAT_8_64

Create subsequent standard clusters: If you already created a standard cluster in this zone or created a public VLAN in IBM Cloud infrastructure before, specify that public VLAN with the --public-vlan option. To find out whether you already have a public VLAN for a specific zone or to find the name of an existing public VLAN, run ibmcloud oc vlan ls --zone <zone>.

ibmcloud oc cluster create classic --zone dal10 --public-vlan my_public_VLAN_ID --private-vlan my_private_VLAN_ID --flavor b3c.4x16 --name my_cluster --hardware shared --workers 2 --operating-system REDHAT_8_64







 ibmcloud oc cluster create vpc-gen2 

Virtual Private Cloud

Create a Virtual Private Cloud (VPC) cluster with worker nodes on Generation 2 infrastructure. When you log in to your IBM Cloud account, target the IBM Cloud region and resource group where you want to create your VPC cluster.
* [Deploying an app that uses File Storage for VPC with dynamic provisioning](https://cloud.ibm.com/docs/openshift?topic=openshift-storage-file-vpc-appsvpc_add_file_dynamic)
* [Deploying an app that uses File Storage for VPC with static provisioning](https://cloud.ibm.com/docs/openshift?topic=openshift-storage-file-vpc-appsvpc_add_file_static)



[Managing IBM Cloud File Storage for VPC](https://cloud.ibm.com/docs/openshift?topic=openshift-storage-file-vpc-managingstorage-file-vpc-managing)



* [Creating a custom storage class](https://cloud.ibm.com/docs/openshift?topic=openshift-storage-file-vpc-managingstorage-file-vpc-custom-sc)
* [Updating the File Storage for VPC add-on](https://cloud.ibm.com/docs/openshift?topic=openshift-storage-file-vpc-managingstorage-file-vpc-update)
* [Understanding your storage removal options](https://cloud.ibm.com/docs/openshift?topic=openshift-storage-file-vpc-managingvpc_storage_delete_options_file)
* [Cleaning up persistent storage](https://cloud.ibm.com/docs/openshift?topic=openshift-storage-file-vpc-managingvpc-storage-remove-file)



[Storage class reference](https://cloud.ibm.com/docs/openshift?topic=openshift-storage-file-vpc-sc-refstorage-file-vpc-sc-ref)





 IBM Cloud storage utilities 

[IBM Cloud storage utilities](https://cloud.ibm.com/docs/openshift?topic=openshift-utilitiesutilities)
1. Go to Placement groups.
2. Click the actions button for web-group1 and select New instance.
3. On the New virtual server for VPC page:



1. Enter vpc-region1-zone1-ui1 as your virtual server's unique name.
2. Verify the VPC your created earlier, resource groups and the Location, and the zone.



4. Set the image to Ubuntu Linux and pick any version of the image.
5. Select Compute with 2vCPUs and 4 GB RAM as your profile. To check other available profiles, click View all profiles.
6. Under SSH keys, select the SSH key that you created earlier.
7. Under Networking select the VPC that you created.
8. Under Network interfaces, click the Edit icon for Security Groups.



1. Select vpc-region1-zone1-ui as the subnet.
2. Clear the default security group and check vpc-region1-ui-sg.
3. Click Save.



9. Click Create virtual server instance.
10. Repeat steps 1-8 to provision a second virtual server instance and for the other availability zones:



1. Create another virtual server instance for the second ui (vpc-region1-zone1-ui2).
2. Create two virtual server instances for zone 2 (vpc-region1-zone2-ui1 and vpc-region1-zone2-ui2).



11. Install necessary packages to support your front-end server such as php, node.js.



Virtual server instance for app

Use this task to provision virtual server instances for application:



1. Go to Placement groups.
2. Click the actions button for app-group1 and select New instance.
3. On the New virtual server for VPC page:



1. Enter vpc-region1-zone1-app1 as your virtual server's unique name.
2. Verify the VPC your created earlier, resource groups and the Location, and the zone.
"more_info": "https://cloud.ibm.com/docs/vpc?topic=vpc-imd-configure-service",
"target": {
"name": "expires_in",
"type": "field",
"value": "7200"
}
}
],
"status_code": 400,
"trace": "e37872f6-f9a4-4084-a1a8-e56a1c8c8d3d"
}
Show more

Error codes can be added, removed, or modified in subsequent releases, with updates announced in the VPC Instance Metadata API change log. If you use error codes programmatically, we recommend that you code defensively. Any code that checks for specific error codes must always have a "default" or "catch-all" clause. So it can handle the case where the returned error code does not match any of the ones the code expected.



 invalid_request 

Used when the request cannot be parsed, such as when the JSON request is malformed or the request body is too large.

invalid_request error code can accompany a 400 HTTP status code.

Example message: The request body was malformed.





 invalid_value 

Used for invalid values for headers, query parameters, path parameters, or properties (identified by the target). Includes integer values that are out of range, string values that have invalid characters, enumerations values out of the listed set, and so on.

invalid_value error code can accompany the following HTTP status codes:



* 404 for path parameters
* 400 for all other cases



Example message: The value provided for the expires_in field must be between 5 and 3600.





 missing_field 

Used in any situation where a required header, query parameter, or property is not provided.

missing_field error code can accompany a 400 HTTP status code.

Example message: A trusted profile ID was not passed in the request body.





 missing_value 

Used for missing required headers, query parameters, or body properties (identified by the target).
For more information, see [Regional and cross regional considerations](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-aboutbyok-cross-region-keys).

With Key Protect or HPCS you can create, import, and manage your root keys. You can assign access policies to the keys, assign users or service IDs to the keys, or give the key access only to a specific service. The first 20 keys are without cost.





 About customer-managed encrypted volumes and images 

With customer-managed encryption, you provision root keys to protect your encrypted resources in the cloud. Root keys serve as key-wrapping keys that encrypt the encryption keys that protect your data. You decide whether to import your existing root keys, or have a supported KMS create one for you.

Block storage volumes are assigned a unique data encryption key that is generated by the instance's host hypervisor. The data encryption key for each volume is encrypted with a unique KMS-generated LUKS passphrase, which is then encrypted by the root key and stored in the KMS.

Custom images are encrypted by your own LUKS passphrase you create by using QEMU. After the image is encrypted, you wrap the passphrase with your CRK stored in the KMS. For more information, see [Encrypted custom images](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-aboutbyok-about-encrypted-images).





 Enabling customer-managed keys for VPC 

See the following procedures for creating block storage volumes with customer-managed encryption and virtual server instances with customer-managed encryption volumes:



* [Creating block storage volumes with customer-managed encryption](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-vpc-encryption)
* [Creating virtual server instances with customer-managed encryption volumes](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-instances-byok)







 Working with customer-managed keys for VPC
* UI







 Pricing for Key Protect on IBM Cloud 

Pricing in Key Protect on IBM Cloud is based on the number of key versions in your account. The first five key versions are free, after which keys cost USD1.045 per key version per month.

Creating or importing a key initiates the first version of that key. As a result, a newly created or imported key has one version. Each time a key is rotated, a new version is created. A key that has been rotated 10 times, then, has 11 versions (10 versions created by rotations plus the initial version). To discover how many versions you have of each non-deleted key, check out [How many key versions do you have?](https://cloud.ibm.com/docs/key-protect?topic=key-protect-pricing-planpricing-plan-how-many-keys). For more information about rotating keys, check out [Rotating your root keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-rotation). Note that only root keys can be rotated. For the purpose of Key Protect pricing, the [data encryption keys (DEKs)](https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryption) used by services or applications to encrypt the data are not counted as key versions in terms of pricing.

While Key Protect does not charge a monthly fee for the maintenance of deployed instances, it does charge for the usage of its service through keys that are created, imported, rotated and otherwise managed. Note that "non-deleted" keys refers to any key that has not been moved into the Destroyed state. Deactivated and Suspended keys have not been deleted, and still count as non-deleted versions. For more information about key states, check out [Key states and transitions](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-stateskey-transitions).



 Pricing scenarios 



* Scenario: You have one non-deleted key that has been rotated 19 times, which means it has 20 total versions.
Provision IBM Cloud DNS Services for VMware deployment 

This tutorial may incur costs. Use the [Cost Estimator](https://cloud.ibm.com/estimator/review) to generate a cost estimate based on your projected usage.

This tutorial is part of [series](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-bm-vmwarevpc-bm-vmware-objectives), and requires that you have completed the related tutorials in the presented order.

In this tutorial, you will deploy IBM Cloud DNS Services for a VMware Deployment in IBM Cloud VPC. IBM Cloud DNS Services will be used and your IBM Cloud VPC will be configured to access and use the deployed DNS serrvice.



 Objectives 

In this tutorial [IBM Cloud DNS Services](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-getting-started) is used as the IBM Cloud DNS Services solution for the VMware Deployment.

Zoom

![Deploying DNS service for a VMware Deployment](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/solution63-ryo-vmware-on-vpc/Self-Managed-Simple-20210813v1-DNS.svg)

Figure 1. Deploying DNS service for a VMware Deployment





 Before you begin 

This tutorial requires:



* Common [prereqs](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-bm-vmwarevpc-bm-vmware-prereqs) for VMware Deployment tutorials in IBM Cloud VPC



This tutorial is part of series, and requires that you have completed the related tutorials. Make sure you have successfully completed the required previous steps:
How does Security and Compliance Center calculate pricing? 

Pricing for IBM Cloud® Security and Compliance Center is based on the number of evaluations performed. An evaluation is the check of one assessment against one resource.

For the most up-to-date pricing information, you can create a cost estimate by clicking Add to estimate from either the [provisioning](https://cloud.ibm.com/security-compliance/catalog) or [plan page](https://cloud.ibm.com/security-compliance/plan).



  Plan types 

The service offers two pricing plans.

Trial
:   To try out the service, you can enroll in a Trial period where you have access the full capabilities of the Posture Management component for 30 days at no charge. You can create profiles, set up credentials, and configure your account to evaluate your resources, among other things. Each account can have 1 instance of the trial service for the lifetime of the account.

Standard
:   With a Standard plan, you are able to access the full capabilities of the service without limitations. However, you are charged per evaluation.





  When am I charged? 

You are charged if an evaluation produces a result of pass or fail. You are not charged for the evaluation if the check cannot be performed or is not applicable. Each scan that is run provides you with the number of billable evaluations in the results UI.





  How do I stop getting charged for Security and Compliance Center? 

You are charged when an evaluation takes place. If you no longer want to be charged for a specific evaluation, stop the scan or scans that you do not want to be charged for from running by deleting your attachment. This does not remove your historical results, but it does stop future scans from being run.
Setting up Block Storage for VPC 

[Block Storage for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-aboutvpc-storage-encryption) provides hypervisor-mounted, high-performance data storage for your virtual server instances that you can provision within a VPC.

You can choose between predefined storage tiers with GB sizes and IOPS that meet the requirements of your workloads. To find out if Block Storage for VPC is the right storage option for you, see [Choosing a storage solution](https://cloud.ibm.com/docs/containers?topic=containers-storage-plan). For pricing information, see [Pricing for Block Storage for VPC](https://cloud.ibm.com/vpc-ext/provision/vs).

The Block Storage for VPC add-on is installed and enabled by default on VPC clusters. Later, you can disable or reenable the add-on by using the [addon disable](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_cluster_addon_disable) or [addon enable](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_cluster_addon_enable) command in the CLI. PVC creation and app deployment are not disrupted when the add-on is disabled. Existing volumes and data are not impacted.



 Quick start for IBM Cloud Block Storage for VPC 

In this quick start guide, you create a 10Gi 5IOPS tier Block Storage for VPC volume in your cluster by creating a PVC to dynamically provision the volume. Then, you create an app deployment that mounts your PVC.

Your Block Storage for VPC volumes can be mounted by multiple pods as long as those pods are scheduled on the same node.



1. Create a file for your PVC and name it pvc.yaml.

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: my-pvc
spec:
<br> For more information about catalog images, see [Custom images in a private catalog](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-custom-images&interface=uicustom-image-cloud-private-catalog). <br> Note If you select a catalog image that belongs to a different account, there are additional considerations and limitations to review. See [Using cross-account image references in a private catalog in the UI](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-custom-images&interface=uiprivate-catalog-image-reference-vpc-ui). To create a private catalog, see the tutorial [Onboarding a virtual server image for VPC](https://cloud.ibm.com/docs/account?topic=account-catalog-vsivpc-tutorial&interface=ui).<br><br><br> 
 Profile Select from popular profiles or all available vCPU and RAM combinations. The profile families are Balanced, Compute, Memory, and GPU. For more information, see [Profiles](https://cloud.ibm.com/docs/vpc?topic=vpc-profiles). 
 SSH Key You must select an existing public SSH key or click Create an SSH key to create a new one. You can create only RSA SSH keys. For Ed25519 SSH keys, you must upload the key information. For more information on creating a SSH key, see [Creating your SSH key using the UI](https://cloud.ibm.com/docs/vpc?topic=vpc-ssh-keys&interface=uigenerate-ssh-keys-ui). SSH keys are used to securely connect to the instance after it's running.<br><br>Note: Alpha-numeric combinations are limited to 100 characters. SSH keys can either be RSA or Ed25519. Ed25519 can only be used if the operating system supports this key type.
Use this task to provision virtual server instances for application:



1. Go to Placement groups.
2. Click the actions button for app-group1 and select New instance.
3. On the New virtual server for VPC page:



1. Enter vpc-region1-zone1-app1 as your virtual server's unique name.
2. Verify the VPC your created earlier, resource groups and the Location, and the zone.



4. Set the image to Ubuntu Linux and pick any version of the image.
5. Select Memory with 2vCPUs and 16 GB RAM as your profile. To check other available profiles, click View all profiles.
6. Under SSH keys, select the SSH key that you created earlier.
7. Under Networking select the VPC that you created.
8. Under Network interfaces, click the Edit icon for Security Groups.



1. Select vpc-region1-zone1-app1 as the subnet.
2. Clear the default security group and check vpc-region1-app-sgc.
3. Click Save.



9. Click Create virtual server instance.
10. Repeat steps 1-7 to provision a second virtual server instance and for the other availability zones:



1. Create another virtual server instance for the second app (vpc-region1-zone1-app2).
2. Create two virtual server instances for zone 2 (vpc-region1-zone2-app1 and vpc-region1-zone2-app2).



11. Install the necessary packages to support your application server such as tomcat.



Use this task to provision virtual server instances for db:



1. Go to Subnets.
2. Verify that the vpc-region1-zone1-db status is available.
3. Click vpc-region1-zone1-db.
4. Click Attached resources.
5. In Attached instances, click Create.



1.
Securely access remote instances with a bastion host 

This tutorial may incur costs. Use the [Cost Estimator](https://cloud.ibm.com/estimator/review) to generate a cost estimate based on your projected usage.

This tutorial walks you through the deployment of a bastion host to securely access remote instances within a Virtual Private Cloud (VPC). A bastion host is an instance that is provisioned with a public IP address and can be accessed via SSH. Once set up, the bastion host acts as a jump server, allowing secure connection to instances provisioned without a public IP address.

To reduce exposure of servers within the VPC, you will create and use a bastion host. Administrative tasks on the individual servers are going to be performed using SSH, proxied through the bastion. Access to the servers and regular internet access from the servers, e.g., for software installation, will only be allowed with a special maintenance security group attached to those servers.



 Objectives 



* Learn how to set up a bastion host and security groups with rules
* Securely manage servers via the bastion host



Zoom

![Architecture](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/includes/solution-tutorials/includes/solution-tutorials/images/solution47-vpc-secure-management-bastion-server/ArchitectureDiagram.png)

Figure 1. Architecture diagram of the tutorial



1. After setting up the required infrastructure (subnets, security groups with rules, virtual server instances) on the cloud, the admin (DevOps) connects (SSH) to the bastion host using the private SSH key.
2. The admin assigns a maintenance security group with proper outbound rules.
3. The admin connects (SSH) securely to the instance's private IP address via the bastion host to install or update any required software eg., a web server
4. The internet user makes an HTTP/HTTPS request to the web server.







 Before you begin