vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Viewer As a viewer, you can view bare metal servers, but not modify them. 







 Dedicated Host for VPC 

Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use is.dedicated-host for the service name.

Platform roles

Actions



Table 85. Platform roles - Dedicated Host for VPC
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the platform role name and the column headers identify the specific information available about each role.

 Role Description 

 Administrator As an administrator, you can perform all platform actions based on the resource this role is being assigned, including assigning access policies to other users. 
 Editor As an editor, you can perform all platform actions except for managing the account and assigning access policies. 
 Operator As an operator, you can perform platform actions required to configure and operate service instances, such as viewing a service's dashboard. 
 Viewer As a viewer, you can view service instances, but you can't modify them. 







 Virtual Private Endpoint for VPC 

Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use is.endpoint-gateway for the service name.

Platform roles

Actions



Table 86. Platform roles - Virtual Private Endpoint for VPC
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the platform role name and the column headers identify the specific information available about each role.

 Role Description 

 Administrator As an administrator you can create, delete, update and view endpoint gateway service instances, and assign access policies to other users. Administrators can also bind and unbind an endpoint gateway to a reserved IP address. 
 Editor As an editor you can create, delete, update and view endpoint gateway service instance. Editors can also bind and unbind an endpoint gateway to a reserved IP address. 
 Operator As an operator you can bind and unbind an endpoint gateway service instance to a reserved IP address.
Working with virtual servers in VPC reference architecture 

The primary compute option for the VPC reference architecture is [Virtual Servers for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-about-advanced-virtual-servers). Virtual Servers for VPC is an infrastructure-as-a-Service (IaaS) offering that gives you access to all of the benefits of IBM Cloud VPC, including network isolation, security, and flexibility.

With virtual server instances for VPC, you can quickly provision instances with high network performance. When you provision an instance, you select a profile that matches the amount of memory and compute power that you need for the application that you plan to run on the instance. Instances are available on the x86 architecture. After you provision an instance, you control and manage those infrastructure resources.

You can optionally use [dedicated hosts for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-dedicated-hosts-instances) to create a single-tenancy environment free from users outside of your organization. Within that dedicated space, you can create virtual server instances according to your needs. Additionally, you can create dedicated host groups that contain dedicated hosts for a specific purpose. Because a dedicated host is a single-tenant space, only users within your account that have the required permissions can create instances on the host.



 Deployment 



1. (Optional) Create a dedicated host if you want to carve out a single-tenant compute node for your virtual servers. See [Creating dedicated hosts and groups](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-dedicated-hosts-instances) for more details.

Dedicated hosts are highly recommended, particularly for any parts of your application that process regulated data and keep it in memory.
2. Create one or more virtual servers.



* If using dedicated hosts, see the following for more details:



* [Creating instances on dedicated hosts](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-instance-on-dh)



* If not using dedicated hosts, see the following for more details:
Table 83. Platform roles - Regional Backup as a Service for VPC
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the platform role name and the column headers identify the specific information available about each role.

 Role Description 

 Administrator As an administrator, you can create, manage, retrieve and delete backup polices and plans, including assigning access policies to other users. 
 Editor As an editor, you can create, manage, retrieve and delete backup polices and plans except for managing the account and assigning access policies. 
 Operator As an operator, you can manage and operate backup polices and plans. 
 Viewer As a viewer, you can retrieve backup polices and plans but you can't modify them. 







 Bare Metal Server for VPC 

Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use is.bare-metal-server for the service name.

Platform roles

Service roles

Actions



Table 84. Platform roles - Bare Metal Server for VPC
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the platform role name and the column headers identify the specific information available about each role.

 Role Description 

 Administrator As an administrator, you can perform all functions of an editor and can also assign access policies to other users. 
 Editor As an editor, you can view, create, edit, delete, update, and perform operator actions on a bare metal server. 
 Operator As an operator, you can view and perform actions (such as restart) on a bare metal server. 
 Viewer As a viewer, you can view bare metal servers, but not modify them. 







 Dedicated Host for VPC 

Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use is.dedicated-host for the service name.

Platform roles

Actions



Table 85. Platform roles - Dedicated Host for VPC
Use the tab buttons to change the context of the table.
* --vpc-id is the ID of the VPC.
* --target is the name, or CRN, of a provider cloud service instance.

You can use command ibmcloud is endpoint-gateway-targets to list the provider cloud and infrastructure services that are qualified to be set as endpoint gateway target.
* --name is the new name of the endpoint gateway.
* --reserved-ip-id is the ID of the reserved IP to be bound to the endpoint gateway.
* -new-reserved-ip: RESERVED_IP_JSON|@RESERVED_IP_JSON_FILE is the new reserved IP configuration in JSON format or a JSON file.
* -security-group is the ID of the security group.

If you do not specify -security-group, the VPC default security group is bound to the endpoint gateway.
* --resource-group-id is the ID of the resource group. This option is mutually exclusive with --resource-group-name.
* --resource-group-name is the name of the resource group. This option is mutually exclusive with --resource-group-id.
* --output is the output format. Only JSON is supported.
* -q, --quiet suppresses verbose output.







 Creating an endpoint gateway with the API 

To create an endpoint gateway by using the API, follow these steps:



1. Set up your [API environment](https://cloud.ibm.com/docs/vpc?topic=vpc-set-up-environmentapi-prerequisites-setup).
2. Store the following values in variables to be used in the API command:



* ResourceGroupId - First, get your resource group and then populate the variable:

export ResourceGroupId=<your_resourcegroup_id>
* VpcId - Find by using the list vpc command (with the preceding variables) and then populate the variable based on the provided ID:

export VpcId=<your_VPC_id>
Issue: Some API implementations have required authorizations that are different from the authorizations requirements that are defined in the [API specification](https://cloud.ibm.com/apidocs/vpc/latest). The following table lists such APIs and the extra permissions that are required in addition to what is already defined in the specification. This table will be continually updated as these issues are resolved.



Table 1. API additional authorization requirements

 API Additional access requirements Action name 

 PATCH /instances/{instance-id} Dedicated Host Operator, Dedicated Host Group Operator is.dedicated-host.dedicated-host-group.operate (conditional) <br>is.dedicated-host.dedicated-host.operate (conditional) 
 POST /instances Subnet Editor is.subnet.subnet.update (conditional) 
 POST /instances/{instance-id}/actions Instance Editor is.instance.instance.update 
 POST /instances/{instance-id}/volume_attachments Instance Editor is.instance.instance.update 
 DELETE /instances/{instance-id}/volume_attachments/{vol-attach-id} Instance Editor is.instance.instance.update 
 GET /network_acls/{nacl-id} VPC Viewer is.vpc.vpc.read 
 POST /network_acls/{nacl-id}/rules VPC Viewer is.vpc.vpc.read 
 GET /subnets/{subnet-id}/network_acl VPC Viewer is.vpc.vpc.read 
 PUT /subnets/{subnet-id}/network_acl VPC Viewer is.vpc.vpc.read 
 PATCH /floating_ips/{fip-id} Subnet Operator is.subnet.subnet.operate 







 Storage known issues 



 Cross-regional copy array issue 

Issue: When you create a snapshot or list details of a snapshot with the API, the copies array in the API response lists only the direct copies of the snapshot that you specified. If you create a copy of a copy, the second copy is not returned when you query the original snapshot.





 Fast restore snapshots with customer-managed encryption issue
Learning about VPC workload isolation architecture and dependencies 

Review the following sample architecture for IBM Cloud® Virtual Private Cloud, and learn more about different isolation levels. The architecture and isolation information helps you choose the solution that best meets your workload requirements.



 VPC workload isolation architecture 

To understand the isolation aspects of your workloads and data, the diagram shows the fundamental components of the VPC service. You can also review the table, which follows the diagram, for an explanation of those isolation characteristics. Currently, access to the VPC service is through regional public endpoints.

For more information about network traffic isolation, see [VPC behind the curtain](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-behind-the-curtain).

Zoom

![VPC Components](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/images/vpc-isolation-architecture-updated.png)

Figure 1. Fundamental VPC components



Table 1. VPC components

 Component Description 

 Control nodes Most VPC control plane services run on control nodes. The VPC control plane data store is also hosted across a distributed set of control nodes. These nodes run a customized, hardened version of the Linux operating system. These nodes never run your workloads. 
 Hypervisor nodes Your virtual service instances run exclusively on hypervisor nodes. These nodes run a customized, hardened version of the Linux operating system. These nodes also run a small set of control plane agent services, as described in this table. 
 Bare metal nodes Bare metal nodes are delivered to you dedicatedly with VMware ESXi installed during provision. The bare metal nodes are equipped with SmartNIC and local storage to support VMware clusters on VPC. Your bare metal server API requests are routed to services deployed across control nodes in the region. All communication between control plane services occurs over a secure, encrypted network.
Image Service for VPC 

Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use is.image for the service name.

Platform roles

Service roles

Actions



Table 89. Platform roles - Image Service for VPC
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the platform role name and the column headers identify the specific information available about each role.

 Role Description 

 Administrator As an administrator, you can perform all platform actions based on the resource this role is being assigned, including assigning access policies to other users. 
 Editor As an editor, you can perform all platform actions except for managing the account and assigning access policies. 
 Operator As an operator, you can perform platform actions required to configure and operate service instances, such as viewing a service's dashboard. 
 Viewer As a viewer, you can view service instances, but you can't modify them. 







 Virtual Server for VPC 

Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use is.instance for the service name.

Platform roles

Service roles

Actions



Table 90. Platform roles - Virtual Server for VPC
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the platform role name and the column headers identify the specific information available about each role.

 Role Description 

 Administrator As an administrator, you can perform all platform actions based on the resource this role is being assigned, including assigning access policies to other users. 
 Editor As an editor, you can perform all platform actions except for managing the account and assigning access policies. 
 Operator As an operator, you can perform platform actions required to configure and operate service instances, such as viewing a service's dashboard. 
 Viewer As a viewer, you can view service instances, but you can't modify them. 







 Auto Scale for VPC 

Review the available platform and service roles and the actions mapped to each to help you assign access.
FAQs for the instance metadata service 

The following questions often arise about the VPC Instance Metadata service. If you have other questions you'd like to see answered here, provide feedback by using the Open doc issue or Edit topic links.



 What is the instance metadata service? 

The instance metadata service is free service that provides a REST API you invoke within an instance to get information about that instance. Access to the API is unavailable from outside the instance. Before you can access the metadata, the service lets you generate an instance identity access token, for accessing the metadata service. You can optionally get an IAM token from this token to access all IAM-enabled services.

The metadata service uses well-known IP address to retrieve instance metadata such as the instance name, CRN, resource groups, user data, as well as SSH key and placement group information. Use the initialization metadata to configure and launch new instances. For more information, see [About Instance Metadata for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-imd-about).

The VPC Instance Metadata service is currently supported only on x86 systems.





 How does the metadata service work? 

By calling the [metadata service APIs](https://cloud.ibm.com/apidocs/vpc-metadata-beta) from within an instance, you can get the instance's initialization data, network interface, volume attachment, public SSH key, and placement group information.

To use the metadata service, you need an instance identity access token. The instance identity token service lets you access the metadata service. For more information, see this [FAQ](https://cloud.ibm.com/docs/vpc?topic=vpc-faqs-for-rmdsfaq-rmds-4).

The metadata service is disabled by default. You can enable it for new and existing instances in the UI, CLI, or API.





 How do I enable the metadata service? Can I later disable it? 

The metadata service is disabled by default. You can enable it on new and existing instances from the UI, CLI, or API.
All of the other configuration files are provided and do not need to be modified.

The IBM Cloud Provider plug-in for Terraform on IBM Cloud uses these configuration files to provision a VPC in your IBM Cloud account.





 What is created 

A VPC is a private space in IBM Cloud where you can run an isolated environment with custom network policies. The variables that you define are used by the scripts to provision the following VPC infrastructure resources for you:



* 1 VPC where you provision your virtual server instance
* 1 security group and rules for this security group to allow DNS and SSH connections to your virtual server instance and all outbound traffic
* 1 subnet to enable networking in your VPC
* 2 virtual server instances (1 SAP App VSI and 1 DB(anydb) instance server VSI)
* 2 storage volumes, 1 for swap and 1 for data for SAP app VSI and 4 storage 1 x SWAP and 3 x DATA volumes for DB VSI
* 2 floating IP address that you use to access your VPC virtual server instances over the public network



The VSIs are configured with Red Hat Enterprise Linux 7.x for SAP Applications (amd64) and they have at least two SSH keys that are configured to access as root user. The VSIs have the following storage volumes:

DB virtual server instance disks: * 1x 40 GB disk with 10 IOPS / GB - SWAP * 1 x 32 GB disk with 10 IOPS / GB - DATA (DB LOG) * 1x 64 GB disk with 10 IOPS / GB - DATA (DB ARCHIVE LOG) * 1 x 128/256 GB disk with 10 IOPS / GB – DATA * 1 floating IP address that you use to access your VPC virtual server instance over the public network

SAP app virtual server instance disks: * 1x 40 GB disk with 10 IOPS / GB - SWAP * 1 x 128 GB disk with 10 IOPS / GB – DATA * 1 floating IP address that you use to access your VPC virtual server instance over the public network





 Support 

There are no warranties of any kind, and there is no service or technical support available for these materials from IBM®. As a recommended practice, review carefully any materials that you download from this site before using them on a live system.
3000425 - Check whether VPN for VPC authentication is configured with a strong pre-shared key with at least 24 alphanumeric characters
3000426 - Check whether VPN for VPC has a Dead Peer Detection policy that is set to ""restart""
3000427 - Check whether Application Load Balancer for VPC has public access disabled
3000428 - Check whether Application Load Balancer for VPC is configured with multiple members in the pool
3000429 - Check whether Application Load Balancer for VPC listener is configured with default pool
3000430 - Check whether Application Load Balancer for VPC has health check configured when created
3000431 - Check whether Application Load Balancer for VPC has a health check protocol that is either HTTP or HTTPS
3000432 - Check whether Application Load Balancer for VPC pool uses the HTTPS protocol for HTTPS listeners
3000433 - Check whether Application Load Balancer for VPC is configured to convert HTTP client requests to HTTPS
3000434 - Check whether Application Load Balancer for VPC uses HTTPS (SSL & TLS) instead of HTTP
3000436 - Check whether Block Storage for VPC is enabled with customer-managed encryption and Bring Your Own Key (BYOK)
3000437 - Check whether Block Storage for VPC is enabled with customer-managed encryption and Keep Your Own Key (KYOK)
3000439 - Check whether data disks are encrypted with customer-managed keys
3000440 - Check whether unattached disks are encrypted with customer-managed keys
3000444 - Check whether Security Groups for VPC contains no outbound rules in security groups that specify source IP 8.8.8.8/32 to DNS port 53
3000446 - Check whether Security Groups for VPC doesn't allow PING for the default security group
3000447 - Check whether Virtual Private Cloud (VPC) classic access is disabled
3000449 - Check whether Virtual Private Cloud (VPC) has no public gateways attached
3000451 - Check whether Virtual Private Cloud (VPC) network access control lists don't allow ingress from 0.0.0.0/0 to any port
VPC CLI reference 

Use the following information as a reference of the command-line interface (CLI) commands that are available for IBM Cloud® Virtual Private Cloud (VPC).

This CLI reference is organized into the following sections:



* [Network commands](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-referencenetwork)
* [Compute commands](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-referencecompute-clis)
* [Regions and zones commands](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-referencegeography)
* [Storage commands](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-referencestorage)





 Prerequisites 



1. Install the [IBM Cloud CLI ![External link icon](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/includes/icons/launch-glyph.svg)](https://cloud.ibm.com/docs/cli).
2. Install or update the VPC infrastructure service plug-in.

ibmcloud plugin install vpc-infrastructure

To update, use the following command:

ibmcloud plugin update

To view installed plug-ins and versions, use the following command:

ibmcloud plugin list



--------------------





 NETWORK COMMANDS 

The following section provides information about CLI commands for network services.





 Flow logs 



 ibmcloud is flow-log-create 

Create a flow log.
VPC concepts 

Now that you've seen the [high-level VPC reference architecture for IBM Cloud for Financial Services](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-about), there are a number of important VPC concepts that will help you understand the components within the management and workload VPCs as we dive into lower-level details. Each VPC is a virtual network that is linked to your customer account. It gives you cloud security, with the ability to scale dynamically, by providing fine-grained control over your virtual infrastructure and your network traffic segmentation.



 Network 



 Regions, zones, and subnets 

All VPCs exist in a single region. A

regionis an abstraction that is related to the geographic area in which a VPC is deployed. Each [multizone region](https://cloud.ibm.com/docs/overview?topic=overview-locations) contains multiple zones. Azoneis another an abstraction that refers to the physical data center that hosts the compute, network, and storage resources, as well as the related cooling and power, which provides services and applications.

VPCs that are created in a one of the multizone regions can span multiple zones to facilitate high availability. For IBM Cloud for Financial Services, it is recommended to use at least three zones in each VPC to help ensure resiliency.

Subnets consist of a specified IP address range (CIDR block). Subnets are bound to a single zone, and they cannot span multiple zones or regions. Subnets in the same VPC are connected to each other.

For more information, see [About networking](https://cloud.ibm.com/docs/vpc?topic=vpc-about-networking-for-vpc).

IBM Cloud for Financial Services that stuff in About networking like Public Gateway and Floating IPs should not generally be used. -->





 Access control lists and security groups 

Access control lists (ACLs) and security groups provide ways to control the traffic across the subnets and instances in your VPC by using rules that you specify.