vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* INSTANCE_TEMPLATE_NAME is my-instance-template
* VPC is 0738-xxx1xx23-4xx5-6789-12x3-456xx7xx123x
* ZONE_NAME is us-south-3
* PROFILE_NAME is bx2-2x8
* SUBNET_ID is 0076-2249dabc-8c71-4a54-bxy7-953701ca3999
* IMAGE is r008-54e9238a-feaa-4f90-9742-7424cb2b9ff1
* PLACEMENT_GROUP_ID is _r134-953db18c-068c-4a11-9b07-645684b444b2



For this example, you see a response similar to the following output.

The following response varies depending on what values that you use.

ID 0727-0fdac0fb-ad59-4d7b-9f03-604ddc1db002
Name my-instance-template
CRN crn:v1:bluemix:public:is:us-south-2:a/7f75c7b025e54bc5635f754b2f888665::instance-template:0727-0fdac0fb-ad59-4d7b-9f03-604ddc1db002
Resource group Default
Image r006-3fa3bea4-7f9c-4eeb-8248-ab1f6e03185b
VPC r006-212def4b-93f0-4b9a-a331-94178b99d474
Zone us-south-2
Profile bx2-2x8
Boot volume Name Capacity Profile IOPS Attachment name Auto delete Tags
- 100 general-purpose 0 illude-education-spotted-reanalyze true -

Primary Network Interface Name Subnet ID Security Groups Allow source IP spoofing Reserved IP Address Reserved IP ID Reserved IP Name Reserved IP Auto Delete
Encryption Specifies provider-managed or [customer-managed encryption](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-encryption). 
 Encryption instance For customer-managed encryption, link to the Key Protect or Hyper Protect Crypto Services instance. 
 Key ID Copiable customer root key ID. 
 ID For customer-managed encryption, the UUID generated when you created the file share. 
 Size File share size in GB. 
 Created Date the file share was created. 
 Mount target access mode <br><br>New Access to the file share is granted by either a security group within a subnet or to any virtual server instance in the VPC. Click the pencil icon to switch access modes. Security group access is available only to file shares created with the [dp2 profile](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-profiles&interface=uidp2-profile). For more information, see the [Mount target access modes](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-about&interface=apifs-mount-access-mode). 
 Profile, size, and IOPS 
 Size File share size in GB. 
 IOPS tier IOPS tier [profile](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-profiles) that defines the file share performance. For example, a 3 IOPS/GB general-purpose profile. 
 Max IOPS Maximum IOPS for the specified profile. 
 Mount targets Number of mount targets associated with the file share. You can have one mount target per VPC per file share. You can create more mount targets for other VPCs. 
 Name Name of the mount target. 
 Virtual private cloud Click the name to go to the details page for that VPC, where you can see a [list of file shares](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-viewfs-view-shares-vpc) that have a mount target to the VPC.
CM-7 (b) <br><br> * Check whether Security Groups for VPC contains no outbound rules in security groups that specify source IP 8.8.8.8/32 to DNS port<br> * Check whether Virtual Servers for VPC instance doesn't have a floating IP<br> * Check whether App ID Cloud Directory users aren't able to update their own accounts<br> * Check whether App ID email dispatchers are using HTTPS only<br> * Check whether Application Load Balancer for VPC has public access disabled<br> * Check whether Cloud Object Storage is accessible only through HTTPS<br> * Check whether OpenShift clusters are accessible only by using private endpoints<br> * Check whether App ID lockout policy after failed # of sign-in attempts is enabled<br> * Check whether Virtual Private Cloud (VPC) has no public gateways attached<br> * Check whether Virtual Private Cloud (VPC) network access control lists don't allow ingress from 0.0.0.0/0 to any port<br> * Check whether Application Load Balancer for VPC is configured to convert HTTP client requests to HTTPS<br> * Check whether all virtual server instances have at least one Virtual Private Cloud (VPC) security group attached<br> * Check whether Virtual Private Cloud (VPC) has no public gateways attached at the time of provisioning<br> * Check whether App ID redirect URIs are not using wildcards (*)<br> * Check whether DevSecOps Toolchain validates code against Center for Internet Security (CIS) Docker benchmarks to ensure container runtimes are configured securely<br> * Check whether App ID webhooks are using HTTPS only<br> * Check whether Virtual Servers for VPC instance has all interfaces with IP-spoofing disabled<br> * Check whether Virtual Private Cloud (VPC) classic access is disabled<br> * Check whether DevSecOps Toolchain passes dynamic code scan to identify vulnerabilities
curl -X POST "$vpc_api_endpoint/v1/instances?version=2022-08-08&generation=2" -H "Authorization: Bearer $iam_token" -d '{
"image": {
"id": "9aaf3bcb-dcd7-4de7-bb60-24e39ff9d366"
},
"keys": [
{
"id": "363f6d70-0000-0001-0000-00000013b96c"
}
],
"name": "my-instance",
"metadata_service": {
"enabled": true
},
.
.
.
}'
Show more

The response shows that the metadata parameter set to true when you enable the service. You can also verify the metadata service setting by making a GET /instance/{id} call.





 Enable or disable the metadata service for an existing instance from the API 

To enable or disable the service from an existing instance, make a PATCH /instance/{instance_id} call and specify the metadata_service parameter. By default, the enabled property is set to false. To enable the service, set it to true.

This example call shows enabling the metadata service for an instance:

curl -X PATCH "$vpc_api_endpoint/v1/instances/$instance_id?version=2022-08-08&generation=2" -H "Authorization: Bearer $iam_token" -d '{
"metadata_service": {
"enabled": true
}
}'

The response shows that the metadata parameter set to true when you enable the service. You can also verify the metadata service setting by making a GET /instance/{id} call.





 Enable or disable the metadata service when you create new instance templates by using the API 

When you create an instance template, you can set this value by making a POST /instance/templates call. By default, the enabled property is set to false. To enable it, set it to true.
Encryption Specifies provider-managed or [customer-managed encryption](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-encryption). 
 Encryption instance For customer-managed encryption, link to the Key Protect or Hyper Protect Crypto Services instance. 
 Key ID Copiable customer root key ID. 
 ID For customer-managed encryption, the UUID generated when you created the file share. 
 Size File share size in GB. 
 Created Date the file share was created. 
 Mount target access mode <br><br>New Access to the file share is granted by either a security group within a subnet or to any virtual server instance in the VPC. Click the pencil icon to switch access modes. Security group access is available only to file shares created with the [dp2 profile](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-profiles&interface=uidp2-profile). For more information, see the [Mount target access modes](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-about&interface=apifs-mount-access-mode). 
 Profile, size, and IOPS 
 Size File share size in GB. 
 IOPS tier IOPS tier [profile](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-profiles) that defines the file share performance. For example, a 3 IOPS/GB general-purpose profile. 
 Max IOPS Maximum IOPS for the specified profile. 
 Mount targets Number of mount targets associated with the file share. You can have one mount target per VPC per file share. You can create more mount targets for other VPCs. 
 Name Name of the mount target. 
 Virtual private cloud Click the name to go to the details page for that VPC, where you can see a [list of file shares](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-view&interface=apifs-view-shares-vpc) that have a mount target to the VPC.
View details of the default routing table of a VPC.

ibmcloud is vpc-default-routing-table VPC [--output JSON] [-q, --quiet]



 Command options 



* VPC: ID or name of the VPC.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is vpc-routing-tables 

List all routing tables for a VPC.

ibmcloud is vpc-routing-tables VPC [--output JSON] [-q, --quiet]



 Command options 



* VPC: ID or name of the VPC.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is vpc-routing-table 

View details of a VPC routing table.

ibmcloud is vpc-routing-table VPC ROUTING_TABLE [--output JSON] [-q, --quiet]



 Command options 



* VPC: ID or name of the VPC.
* ROUTING_TABLE: ID or name of the VPC routing table.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is vpc-routing-table-create 

Create a VPC routing table.
IBM Cloud® Virtual Private Cloud (VPC) Infrastructure environment introduction 

An Infrastructure-as-a-Service (IaaS) environment consists of many components - primarily compute, storage, and network from a specified region (such as the US) and a designated site location (also referred to as a zone), which is a data center site.



 Deployment and management 

IBM Cloud VPC Infrastructure offerings, such as virtual or bare metal servers, are deployed through the [IBM Cloud VPC Infrastructure console](https://cloud.ibm.com/vpc-ext/overview).

Alternatively, deployments can be made and managed by using:



* IBM Cloud CLI
* IBM Cloud VPC Infrastructure API calls that use an IBM Cloud API key
* [Terraform Provider for IBM Cloud](https://cloud.ibm.com/docs/terraform?topic=terraform-getting-started) by using an IBM Cloud API key



For more information, see [Managing VPC Infrastructure (IAM)](https://cloud.ibm.com/docs/vpc?topic=vpc-iam-getting-started).





 Locations - availability zones 

With availability zones across North and South America, Europe, Asia, and Australia, you can provision cloud resources where (and when) you need them. Many regions are available globally, with multiple availability zones in each region. Each availability zone is connected to the IBM Cloud global private network, making data transfers faster and more efficient anywhere in the world.

For more information about IBM Cloud availability zones, data centers, and Points of Presence (PoPs), see the [global regions, availability zones, and data centers map](https://www.ibm.com/cloud/data-centers/datacentermap).





 Compute Resources 

Two types of compute resource can be deployed in IBM Cloud VPC Infrastructure environment:



* Intel Virtual Server Instances (VSIs)
* Intel Bare Metal Servers



These compute resources are offered in different profiles that define CPU and RAM combinations.

For more information, see [Infrastructure certified for SAP](https://cloud.ibm.com/docs/sap?topic=sap-iaas-offerings).





 Networking
Example taxomony 

The following are examples of cloud deployments and cloud service providers.

Cloud deployment model
: Public, Private, Hybrid, Multi-Cloud, Distributed Cloud

Cloud platform
: IBM Cloud, AWS, Azure, GCP, other cloud

The following table illustrates component options for the Containers domain across various Public Cloud Service Providers. Note that this is just a sample and not a comprehensive list of available services on each cloud provider. How to make component architecture decisions for your solution is covered in [Designing a cloud solution by using the architecture framework](https://cloud.ibm.com/docs/architecture-framework?topic=architecture-framework-create-solution).



Table 1. Component options for Containers domain across various Public Cloud Service Providers

 Aspect Domain IBM Cloud AWS Azure Google Cloud Platform 

 Compute Containers IBM Kubernetes Service <br>Red Hat OpenShift on IBM Cloud Elastic Kubernetes Service <br>Elastic Container Service <br>Red Hat OpenShift on AWS Azure Kubernetes Service <br>Azure Red Hat OpenShift Google Kubernetes Engine <br>Red Hat OpenShift on GCP
Classic Infrastructure environment introduction 

An Infrastructure-as-a-Service (IaaS) environment consists of many components. These components are primarily compute, storage, a network from a specified region (such as the US), and a designated site location (also referred to as zone, which is a data center site).



 Deployment and management 

IBM Cloud Classic Infrastructure offerings (such as Bare Metal Servers) are deployed through the [IBM Cloud Classic Infrastructure console](https://cloud.ibm.com/classic).

Alternatively, deployments can be made and managed by using:



* IBM Cloud CLI
* IBM Cloud Classic Infrastructure API (Softlayer API) calls that use an IBM Cloud Classic Infrastructure API key
* [Terraform Provider for IBM Cloud](https://cloud.ibm.com/docs/terraform) that uses an IBM Cloud Classic Infrastructure API key



For more information, see [Managing IBM Power Systems Virtual Servers (IAM)](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-managing-resources-and-users).





 Locations - Data centers 

With data centers across North and South America, Europe, Asia, and Australia, you can provision cloud resources where (and when) you need them. You can choose from many regions globally, and each region has multiple data centers. Each data center is connected to the IBM Cloud global private network, making data transfers faster and more efficient anywhere in the world.

For more information about IBM Cloud availability zones, data centers, and points of presence (PoPs), see the [global regions and availability zones and data centers map](https://www.ibm.com/cloud/data-centers/datacentermap).





 Networking 

The classic infrastructure network, is robust, secure, and flexible; built upon matured networking principles combined with the latest in networking hardware.



Table 1. Networking component layers overview

 IBM Cloud Classic Infrastructure network 

 Global 
 Region 
 Data center 
 Data center Pod 
 VLAN (Public and Private) 
 Subnet (Public and Private) 



Classic Infrastructure was formerly known as Softlayer.
Deployment options

 Deployment options Description 

 [Virtual Servers for VPC profiles](https://cloud.ibm.com/docs/vpc?topic=vpc-profilesprofiles) IBM Cloud Virtual Servers for VPC provide the advanced security of a private cloud with the agility and ease of a public cloud. Virtual servers for VPC offer the best network performance (up to 80 Gbps), best security, and fastest provisioning times. 
 [Dedicated hosts for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-dedicated-hosts-instances) With dedicated host availability, you can choose to create a single-tenancy environment where you can provision virtual server instances according to your needs. 
 [Virtual Servers for Classic](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-getting-started-tutorial) When you create an x86-based virtual server in classic infrastructure, you have several options. You can choose between a public (multi-tenancy) environment or a dedicated (single-tenancy) environment. Then, depending on the chosen environment, you select hourly, monthly, or transient virtual servers. For public virtual servers, you also choose to use either SAN-based storage or local storage. 



To compare all virtual compute options, see [Compare Virtual Compute options](https://www.ibm.com/cloud/virtual-servers/options).





 Creating virtual servers for VPC 

To continue by creating virtual servers for VPC, see the following topics:



Table 2. Links to provisioning instructions

 Provisioning instructions Description 

 [Planning for instances](https://cloud.ibm.com/docs/vpc?topic=vpc-vsi_best_practices) This configuration checklist is helpful to get the most out of your IBM Cloud VPC deployment. 
 [Creating virtual server instances by using the UI](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-virtual-servers) Provision public instances with various options by using the user interface.
From there, you can replicate similar steps to build the other environments.



1. Create one resource group per environment.
2. Create one VPC per environment in the related resource group, each with a cluster and VSI.
3. Create the required service instances per environment in the related resource group.



The following diagram shows the development, testing, and production resource groups each having the same components with the VPC, cluster and VSI, and services.

Zoom

![Diagram showing separate clusters and resource groups to isolate environments](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/solution20-users-teams-applications/multiple-environments.svg)

Separate clusters and resource groups to isolate environments

Using a combination of tools like the [IBM Cloud ibmcloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli), [Terraform](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-about), the [IBM Cloud provider for Terraform](https://github.com/IBM-Cloud/terraform-provider-ibm), Kubernetes CLI kubectl, you can script and automate the creation of these environments.

The above design utilizes a Kubernetes cluster for each environment. This has the following benefits:



* no matter the environment, all clusters will tend to look the same,
* it is easier to control who has access to a specific cluster,
* it gives flexibility in the update cycles for deployments and underlying resources: When there is a new Kubernetes version, it gives you the option to update the Development cluster first, validate your application then update the other environment,
* it avoids mixing different workloads that may impact each other such as isolating the production deployment from the others.
(https://cloud.ibm.com/docs-content/v1/content/c8335d66af691d19e837116fd633481c477061eb/satellite/images/topology-1.svg)

Figure 1. Compute hosts from third-party infrastructure provider





 2. Compute hosts are located in IBM Cloud and edge or data centers 

In this example, the compute resources are located in both IBM Cloud and any one of the supported infrastructure providers or edge. The hosts that make up the control plane are from IBM Cloud, but the hosts that make up the services are located in separate, customer-owned edge or infrastructure providers. Note that while you can use other IBM Cloud virtual servers, such as Virtual Servers for VPC for test environments, the only supported IBM Cloud infrastructure to use in IBM Cloud Satellite® for production environments is IBM Cloud® Bare Metal Servers for Classic that is running Red Hat CoreOS.

Zoom

![Compute hosts located in IBM Cloud and an edge or data center.](https://cloud.ibm.com/docs-content/v1/content/c8335d66af691d19e837116fd633481c477061eb/satellite/images/topology-2.svg)

Figure 2. Compute hosts from IBM Cloud and other edge or infrastructure provider





 3. Compute hosts are located in IBM Cloud and multiple data centers or edge 

In this example, the compute resources are located in both IBM Cloud and in multiple data center or edge. The hosts that make up the control plane are from IBM Cloud, but the hosts that make up the services are located multiple other customer-owned edge or infrastructure providers. Note that while you can use other IBM Cloud virtual servers, such as Virtual Servers for VPC for test environments, the only supported IBM Cloud infrastructure to use in IBM Cloud Satellite® for production environments is IBM Cloud® Bare Metal Servers for Classic that is running Red Hat CoreOS.

Zoom

![Compute resources in both IBM Cloud and multiple edge or data centers.]
Learning about IBM Cloud Shell architecture and workload isolation 

Review the sample architecture for IBM® Cloud Shell, and learn more about different isolation levels. You can then choose the solution that best meets the requirements of the workloads that you want to run in the cloud.



  IBM Cloud Shell architecture 

IBM Cloud Shell is a public, multi-tenant regional service that is available in IBM Cloud®. With Cloud Shell, you can manage IBM Cloud resources and applications in a cloud-hosted shell environment from any web browser, with one click from the IBM Cloud console.

Zoom

![A diagram that shows a sample Cloud Shell architecture.](https://cloud.ibm.com/docs-content/v1/content/6e73868222d2673c4d974c1cf0452448e1b38054/cloud-shell/images/workload_isolation.png)

Figure 1. Cloud Shell sample architecture

The Cloud Shell control plane is responsible for provisioning Cloud Shell servers and managing the lifecycle.



*  The API server provides an API interface to the Cloud Shell service.
*  The controller manager manages the lifecycle of the Cloud Shell servers.
*  The scheduler finds the best node that the Cloud Shell server is provisioned on.



The Cloud Shell data plane is hosting the user's Cloud Shell servers.



*  The gateway is operating at the edge to manage the access and route the user's requests to the Cloud Shell server that is provisioned for the user.
*  The Cloud Shell server is a virtual machine that is running on a bare metal server.







  IBM Cloud Shell workload isolation 

Each regional deployment of the IBM Cloud Shell serves multiple tenants. It is accessed through public endpoints. All the data at rest is encrypted by IBM keys. Data in transit is encrypted by using TLS.

The user's Cloud Shell server is running in a virtual machine. It is isolated from the other user's Cloud Shell server that is running on the same node. Cloud Shell servers that are running on the same node share physical resources such as CPU, memory, and I/O devices. The guest OS in an individual Cloud Shell server cannot detect any device other than the virtual devices that are made available to it.

The networks of the Cloud Shell servers are isolated from each other. Direct traffic is not allowed between Cloud Shell servers. The Cloud Shell server can access only the public internet.
Virtual Servers and Bare Metal Servers offer the capability to achieve a multi-region architecture. You can provision servers in multiple locations on IBM Cloud.

Zoom

![Server locations](https://cloud.ibm.com/docs-content/v1/content/adcecdbe4e86955f88aac7f3c1e7ec3ff44992ef/overview/images/ServersLocation.png)

Figure 11. Server locations

When preparing for such architecture using Virtual Servers and Bare Metal Servers, consider the following: file storage, backups, recovery, and databases, selecting between a database as service, or installing a database on a virtual server.

The following architecture demonstrates the deployment of a multi-region architecture using Virtual Servers in an active/passive architecture where one region is active and the second region is passive.

Zoom

![VM Architecture](https://cloud.ibm.com/docs-content/v1/content/adcecdbe4e86955f88aac7f3c1e7ec3ff44992ef/overview/images/BCDR-Architecture-Diagram-2.svg)

Figure 12. VM architecture

The components that are required for such architecture are as follows:



1. Users access the application through IBM Cloud Internet Services (CIS).
2. CIS routes traffic to the active location.
3. Within a location, a load balancer redirects traffic to a server.
4. Databases are deployed on a virtual server. Backup is enabled and replication is set up between regions. The alternative would be to use a database-as-service, a topic discussed later in the tutorial.
5. IBM Cloud File Storage for Classic to store the application images and files, File Storage for Classic offers the capability to take a snapshot at a given time and date, this snapshot then can be reused within another region, something that you would do manually.