vania-janet/multiturn-rag-retrieval-data huggingface dataset:
VPE supports both service and IaaS endpoints. For more information about private connectivity and VPE, see [About virtual private endpoint gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe).



 DNS resolver endpoints 

IBM Cloud DNS Services provide private DNS to VPC users. Private DNS zones are resolvable only on IBM Cloud, and only from explicitly permitted networks in an account. For more information about DNS Services, see [Getting started with IBM Cloud DNS Services](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-getting-started).

DNS resolvers use IP address, rather than names. For shared cloud service endpoints, use the DNS server addresses 161.26.0.10 and 161.26.0.11.





 Ubuntu and Debian APT Mirrors 

APT mirrors for updating Ubuntu and Debian images are available from mirrors.adn.networklayer.com, which resolves to 161.26.0.6.

For instances that are provisioned with stock images for CentOS, Red Hat Enterprise Linux, or Windows, update connections are configured as part of the provisioning process.





 NTP servers 

NTP is widely used to synchronize a computer to internet time servers or other sources. The IBM NTP server is available for VPC instances to use for time synchronization.

An NTP server is available from time.adn.networklayer.com, which resolves to 161.26.0.6.





 IBM Cloud Object Storage 

IBM Cloud Object Storage stores encrypted and dispersed data across multiple geographic locations. For more information about IBM Cloud Object Storage, see [Getting started with IBM Cloud Object Storage](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-getting-started-cloud-object-storage).
For instructions, see [Creating a VPC and subnet](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-ibm-cloud-consolecreating-a-vpc-and-subnet) and [Creating a virtual server instance](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-ibm-cloud-consolecreating-a-vsi).
2. Make sure that an IBM Cloud® Object Storage instance with a bucket exists for your flow logs. To create an Object Storage bucket, see the [IBM Cloud Object Storage](https://cloud.ibm.com/catalog/services/cloud-object-storage) ordering page.

The Object Storage bucket must be a single-region bucket in the same region as the target resource. Additionally, it is recommended that you secure the bucket through IAM access groups and audit logging.
3. Authorize resources of type Flow Logs for VPC to use the Object Storage instance created in Step 2.

To do so, enter the following command:

ibmcloud iam authorization-policy-create is cloud-object-storage Writer --source-resource-type flow-log-collector --target-service-instance-id $COS_INSTANCE_GUID

ibmcloud iam authorization-policy-create is cloud-object-storage Reader --source-resource-type image --target-service-instance-id $COS_INSTANCE_GUID

You can obtain the COS_INSTANCE_GUID from the Service credentials section for the Object Storage instance as shown.

Zoom

![Object Storage Service credentials](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/images/flow-logs-service-credentials.png)

Object Storage Service credentials
Enabling the IBM Cloud File Storage for VPC add-on 

Virtual Private Cloud

IBM Cloud File Storage for VPC is persistent, fast, and flexible network-attached, NFS-based File Storage for VPC that you can add to your apps by using Kubernetes persistent volumes (PVs). You can choose between predefined storage tiers with GB sizes and IOPS that meet the requirements of your workloads. To find out if File Storage for VPC is the correct storage option for you, see [Choosing a storage solution](https://cloud.ibm.com/docs/openshift?topic=openshift-storage-plan). For pricing information, see [Pricing](https://cloud.ibm.com/cloud-storage/file/order).

File Storage for VPC is available for allowlisted accounts in Frankfurt, London, Madrid, Dallas, Toronto, Washington, Sao Paulo, Sydney, Osaka, and Tokyo regions. Contact your IBM Sales representative if you are interested in getting access.

File Storage for VPC is available in Beta. Do not use this add-on for production workloads.



  Prerequisites 



1.  Update the container-service plug-in to the most recent version. You can update the plug-in by running the ibmcloud plugin update container-service command.
2.  Get a list of the add-on versions and decide which version to install for your cluster version.

ibmcloud oc cluster addon versions --addon vpc-file-csi-driver

Example output

OK
Name                  Version         Supported Kubernetes Range   Supported Openshift Range
vpc-file-csi-driver   1.0 (default)   >=1.21.0                     >=4.7.0
3.  Enable the add-on. The add-on might take a few minutes to become ready.

ibmcloud oc cluster addon enable vpc-file-csi-driver --version VERSION --cluster CLUSTERID
4.  Verify that the add-on is enabled.

ibmcloud oc cluster addon ls --cluster <cluster_name_or_ID>

Example output

Name                   Version   Health State   Health Status
vpc-file-csi-driver    1.0.0     normal         Addon Ready
* CentOS 7.8, 7.9
* RHEL 7.2, 7.3, 7.4, 8.1
* Ubuntu 18.04, 20.04
* Debian 9.x, 10.x
* Windows 2012, 2012R2, 2016, 2019





The Convert LVM feature is only supported for RHEL 7.x and RHEL 8.x





 Step 1: Order RMM 

The RMM tool is available in the IBM Cloud catalog. After you order, a virtual server with RMM software is installed into your VPC of choice. The RMM server has a public IP address for reachability and a default login.

If public IP address is not attached to RMM server, then its 'Reserved IP' address can be used to access RMM server with [bastion host](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-secure-management-bastion-server).



1. Order the RMM server from the [IBM Cloud catalog tile](https://cloud.ibm.com/catalog/content/Rackware-Golden-Template-1.11-06545490-596b-4133-8516-8425a11b3265-global).
2. After you order, log in to the RMM server.
3. In the RMM server, change the default password, create users, and create an SSH key with the correct name.







 Step 2: Set up and provision VPC, bare metal server, or virtual server instance 

Target bare metal server can only be provided manually. There are two different methods for setting up the target virtual server: manual or the RMM auto-provision feature.



 Option 1: Manual 

The RMM solution handles only the OS, application, and data movement. It does not to set up a VPC on the target side; therefore, you need to set up the VPC infrastructure. At a bare minimum, you need to set up a VPC, subnets, and bare metal or virtual server instances.
[IBM Cloud® Network Load Balancer for VPC (NLB)](https://cloud.ibm.com/docs/vpc?topic=vpc-network-load-balancers) is also IBM Cloud for Financial Services Validated, but does not span zones. So, NLBs are not typically used in applications where high availability is needed.





 IBM Cloud Virtual Private Network (VPN) for VPC 

You can use the [VPN for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-using-vpn) service to securely connect your VPC to another private network. Use a static, route-based VPN or a policy-based VPN to set up an IPsec site-to-site tunnel between your VPC and your on-premises private network, or another VPC.

VPN for VPC is required to connect to the management VPC if not using Direct Link.





 IBM Cloud DNS Services 

[DNS Services](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-about-dns-services) provides private DNS to VPC users. Private DNS zones are resolvable only on IBM Cloud, and only from explicitly permitted networks in an account.





 IBM Cloud Virtual Private Endpoints for VPC 

With [Virtual Private Endpoints (VPE) for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe) you can connect to supported IBM Cloud services from your VPC network by using the IP addresses of your choosing, which is allocated from a subnet within your VPC.

VPE is an evolution of the private connectivity to IBM Cloud services. VPEs are virtual IP interfaces that are bound to an endpoint gateway created on a per service, or service instance, basis (depending on the service operation model). The endpoint gateway is a virtualized function that scales horizontally, is redundant and highly available, and spans all availability zones of your VPC. Endpoint gateways enable communications from virtual server instances within your VPC and IBM Cloud service on the private backbone.
Logging for VPC 

After you provision IBM® Log Analysis to add log management capabilities to your IBM Cloud® architecture, you can enable platform logs to view and analyze VPC logs.



 Platform logs 

Platform logs are logs that are exposed by logging-enabled services and the platform in IBM Cloud. You must configure a Log Analysis instance in a region to monitor these logs.

For more information, see [Configuring IBM Cloud platform logs](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-config_svc_logs).





 Viewing logs 

VPC services generate platform logs in the same region where they are available. You can view, monitor, and manage VPC logs through the IBM Log Analysis instance that is marked as platform logs in the region.

To launch the Log Analysis web UI to view these logs, see [Navigating to the web UI](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-launch).

For more information about the locations where VPC logs are available, see [VPC infrastructure services locations](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-cloud_services_locationscloud_services_locations_vpc_infrastructure).





 Fields per log type 

Table 1 outlines the fields that are included in each log record:



Table 1. Log record fields

 Field Type Description 

 logSourceCRN Required Defines the account and flow log instance where the log is published. 
 saveServiceCopy Required Defines whether IBM saves a copy of the record for operational purposes. 
 message Required Description of the log that is generated. 
 messageID Required ID of the log that is generated. 
 msg_timestamp Required The timestamps when the log is generated. 
 resolution Optional Guidance on how to proceed if you receive this log record. 
 documentsURL Optional More information on how to proceed if you receive this log record. 
 generation Required Defines the VPC source of the log. Valid options are 1 for VPC Classic, and 2 for VPC Gen 2. 







 Log messages
If you would like to use user tags or access management tags to manage your resources, see [Working with tags](https://cloud.ibm.com/docs/account?topic=account-tag&interface=cli).

IBM Cloud CLI is not supported on LinuxONE (s390x processor architecture). However, you can install the CLI on another supported platform and use it with LinuxONE (s390x processor architecture) virtual server instances.



 Before you begin 



* Download, install, and initialize the following CLI plug-ins.



* IBM Cloud CLI
* The infrastructure-service plug-in



For more information, see [Setting up your API and CLI environment](https://cloud.ibm.com/docs/vpc?topic=vpc-set-up-environmentcli-prerequisites-setup).
* Make sure that you [created a VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-vpc-resources-with-cli-and-api&interface=cli).







 Gathering information to create an instance by using the CLI 

Ready to create an instance? Before you can run the ibmcloud is instances command, you need to know the details about the instance, such as what profile or image that you want to use.

Gather the following information by using the associated commands.



Table 1. Required instance details

 Instance details Listing options VPC CLI reference documentation 

 Image ibmcloud is image [List all images](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-referenceimages-list) 
 Boot volume ibmcloud is volumes [List all volumes](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-referencevolumes-list) 
 Profile ibmcloud is instances [List all virtual server instances](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-referenceinstances-list)
Enabling the IBM Cloud File Storage for VPC add-on 

Virtual Private Cloud

IBM Cloud File Storage for VPC is persistent, fast, and flexible network-attached, NFS-based File Storage for VPC that you can add to your apps by using Kubernetes persistent volumes (PVs). You can choose between predefined storage tiers with GB sizes and IOPS that meet the requirements of your workloads. To find out if File Storage for VPC is the correct storage option for you, see [Choosing a storage solution](https://cloud.ibm.com/docs/containers?topic=containers-storage-plan). For pricing information, see [Pricing](https://cloud.ibm.com/cloud-storage/file/order).

File Storage for VPC is available for allowlisted accounts in Frankfurt, London, Madrid, Dallas, Toronto, Washington, Sao Paulo, Sydney, Osaka, and Tokyo regions. Contact your IBM Sales representative if you are interested in getting access.

File Storage for VPC is available in Beta. Do not use this add-on for production workloads.



  Prerequisites 



1.  Update the container-service plug-in to the most recent version. You can update the plug-in by running the ibmcloud plugin update container-service command.
2.  Get a list of the add-on versions and decide which version to install for your cluster version.

ibmcloud ks cluster addon versions --addon vpc-file-csi-driver

Example output

OK
Name                  Version         Supported Kubernetes Range   Supported Openshift Range
vpc-file-csi-driver   1.0 (default)   >=1.21.0                     >=4.7.0
3.  Enable the add-on. The add-on might take a few minutes to become ready.

ibmcloud ks cluster addon enable vpc-file-csi-driver --version VERSION --cluster CLUSTERID
4.  Verify that the add-on is enabled.

ibmcloud ks cluster addon ls --cluster <cluster_name_or_ID>

Example output

Name                   Version   Health State   Health Status
vpc-file-csi-driver    1.0.0     normal         Addon Ready
ibmcloud is vpn-gateway-connection-create my-vpn-conn $vpn_gateway 169.61.161.150 mykey

The status of the VPN connection is down when it is first created and becomes up after the connection is established. To check the status of VPN connections on a VPN gateway, run this command:

ibmcloud is vpn-gateway-connections $vpn_gateway





 Congratulations! 

You've successfully created and configured your VPC using the IBM Cloud CLI. To try out more CLI commands, see the [CLI reference](https://cloud.ibm.com/docs/vpc?topic=vpc-infrastructure-cli-plugin-vpc-referencevpc-reference).







 Using the REST APIs to create VPC resources 

You can create and configure an IBM Cloud® Virtual Private Cloud resources using the REST APIs.

To create and configure your virtual private cloud (VPC) and other attached resources, perform the steps in the sections that follow, in this order:



1. Create a VPC and subnet to define the network.
2. If you want to allow all resources in the subnet to communicate with the public internet, attach a public gateway.
3. Create a virtual server instance. By default, a 100 GB boot volume is attached to the instance.
4. If you want more storage, create a block storage volume and attach it to your instance.
5. To define the inbound and outbound traffic that's allowed for the instance, configure its security group.
6. If you want your instance to be reachable from the internet, reserve and associate a floating IP address.





 Before you begin 

Define variables for the IAM token, API endpoint, and API version. For instructions, see [Setting up your API and CLI environment](https://cloud.ibm.com/docs/vpc?topic=vpc-set-up-environment).

A good way to learn more about the API is to click Get sample API call on the provisioning pages in IBM Cloud console.
Creating an IBM Cloud Kubernetes Service cluster on VPC infrastructure 

Use one of the IBM® provided templates to create an IBM Cloud® Kubernetes Service cluster in a Virtual Private Cloud (VPC). Then, you bind the cluster to an IBM Cloud® Object Storage service instance.



 Description 

In this tutorial, you use the IBM® provided [vpc-gen2-cluster Terraform template](https://github.com/IBM-Cloud/terraform-provider-ibm/tree/master/examples/ibm-cluster/vpc-gen2-cluster) to create a Virtual Private Cloud (VPC) and to provision an IBM Cloud Kubernetes Service cluster on Virtual Servers for VPC. Then, you add the service credentials of an IBM Cloud Object Storage service instance as a Kubernetes secret in your cluster. You can change the default values in this template to spread your cluster across multiple subnets and zones. However, the steps in this tutorial use the default values that are provided in the template.

The following image shows the cloud architecture components that you provision as part of this tutorial.

Zoom

![Provisioning Terraform templates by using IBM Cloud Schematics](https://cloud.ibm.com/docs-content/v1/content/ba89e173287b28d1453d2a327d8a1f74ae2f1662/schematics/images/vpcgen2cluster.png)

Provisioning Terraform templates by using IBM Cloud Schematics



Cloud architecture components

 Component Description 

 Region Region increases the availability of cluster's master node and its nodes by replicating across multiple zones of a region. 
 VPC VPC provides you the security of a private cloud environment with the dynamic scalability of a public cloud. 
 zones You must have one VPC subnet for each zone in your cluster. The available zones depend on the metro location that you created in the VPC. 
 subnet VPC subnets is used to provide private IP addresses for your worker nodes and load balancer services in your cluster. You cannot change the number of IP addresses that a VPC subnet has.
After you enter data on the provisioning pages, you can click the Get sample API call button to view the sequence of API requests that correspond to your settings. Viewing the API calls is a good way to learn about the API and understand actions and their dependencies.





 Audience 

This tutorial is intended for software developers and system administrators who are creating a VPC environment and deploying an instance for the first time.





 Before you begin 

Set up your account to access VPC. Make sure that your account is [upgraded to a paid account](https://cloud.ibm.com/docs/account?topic=account-accountfaqschangeacct).

You can use an existing SSH key, upload a new SSH key, or you can create an SSH key when you create the virtual server instance. For this tutorial, you can either select an existing key or create a new key when you create the virtual server. For more information about uploading an SSH key or creeating an SSH key in IBM Cloud VPC, see [Getting started with SSH keys](https://cloud.ibm.com/docs/vpc?topic=vpc-ssh-keys).

If you plan to create an [application load balancer](https://cloud.ibm.com/docs/vpc?topic=vpc-load-balancers) and use HTTPs for the listener, an SSL certificate is required. You can manage certificates with [IBM Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-getting-started).

You can create an authorization through [IAM Authorizations](https://cloud.ibm.com/iam/authorizations). Make sure to choose VPC Infrastructure Services as the Source service, select Resources based on selected attributes, and click the Resource type checkbox to expose the dropdown menu. Select Load Balancer for VPC as the resource type from the dropdown. For the Target service, select Secrets Manager. Set the Target service instance access to All instances or to your specific Secrets Manager instance. Assign the Writer service access role.
VPN into a secure private network 

This tutorial describes the use of Classic Infrastructure. Most workloads can be implemented using [IBM Cloud® Virtual Private Cloud](https://cloud.ibm.com/docs/vpc) resources. Use IBM Cloud VPC to create your own private cloud-like computing environment on shared public cloud infrastructure. A VPC gives an enterprise the ability to define and control a virtual network that is logically isolated from all other public cloud tenants, creating a private, secure place on the public cloud. Specifically, [Direct Link](https://cloud.ibm.com/docs/vpc?topic=vpc-interconnectivity), [virtual server instances](https://cloud.ibm.com/docs/vpc?topic=vpc-vsi_best_practices), [security groups](https://cloud.ibm.com/docs/vpc?topic=vpc-using-security-groups), [VPN](https://cloud.ibm.com/docs/vpc?topic=vpc-using-vpn), [subnets](https://cloud.ibm.com/docs/vpc?topic=vpc-about-networking-for-vpc) and [network ACLs](https://cloud.ibm.com/docs/vpc?topic=vpc-using-acls).

This tutorial may incur costs. Use the [Cost Estimator](https://cloud.ibm.com/estimator/review) to generate a cost estimate based on your projected usage.

The need to create a private connection between a remote network environment and servers on the private network of the IBM Cloud is a common requirement. Most typically this connectivity supports hybrid workloads, data transfers, private workloads or administration of systems on the IBM Cloud. A site-to-site Virtual Private Network (VPN) tunnel is the usual approach to securing connectivity between networks.

IBM Cloud provides a number of options for site-to-site data center connectivity, either using a VPN over the public internet or via a private dedicated network connection.
ibmcloud oc cluster create classic --zone dal10 --public-vlan my_public_VLAN_ID --private-vlan my_private_VLAN_ID --flavor b3c.4x16 --name my_cluster --hardware shared --workers 2 --operating-system REDHAT_8_64







 ibmcloud oc cluster create vpc-gen2 

Virtual Private Cloud

Create a Virtual Private Cloud (VPC) cluster with worker nodes on Generation 2 infrastructure. When you log in to your IBM Cloud account, target the IBM Cloud region and resource group where you want to create your VPC cluster. For supported regions, see [Creating a VPC in a different region](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-in-a-different-region). The cluster's resource group can differ from the VPC resource group.

VPC Gen 2 cluster flavors with instance storage are available for allowlisted accounts. To get added to the allowlist, [open a case](https://cloud.ibm.com/unifiedsupport/cases/form) with support.

Your VPC cluster is created with both a public and a private cloud service endpoint. Public service endpoints can't later be disabled, and therefore, you can't convert a public cluster to a private cluster.