vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* Instance - Shows all flow log collectors that are attached directly to a virtual server instance within the specified VPC.
* Interface - Shows all flow log collectors that are attached directly to a network interface of a virtual server instance within the specified VPC.







 Using the CLI 

To list all your flow logs, run the following command:

ibmcloud is flow-logs [--resource-group-id RESOURCE_GROUP_ID | --resource-group-name RESOURCE_GROUP_NAME]
[--json]

Where:



* --resource-group-id is the ID of the resource group. This option is mutually exclusive with --resource-group-name.
* --resource-group-name is the name of the resource group. This option is mutually exclusive with --resource-group-id.
* --json formats the output in JSON.







 Using the API 

To list flow log collectors by using the API, follow these steps:



1. Set up your [API environment](https://cloud.ibm.com/docs/vpc?topic=vpc-set-up-environmentapi-prerequisites-setup) with the right variables.
2. When all variables are initiated, list your flow log collectors:



curl -sS -X GET -H "Authorization: $iam_token" "$vpc_api_endpoint/v1/flow_log_collectors?version=$api_version&generation=2" | jq
console.log(JSON.stringify(res.result, null, 2));
})
.catch(err => {
console.warn(err)
});





 Assigning access to VPC Infrastructure Services by using Terraform 

The following example is for assigning the Viewer role for VPC Infrastructure Services:

Use is for the service name.

resource "ibm_iam_user_policy" "policy" {
ibm_id = "test@example.com"
roles = ["Viewer"]

resources {
service = "is"
}
}

For more information, see [ibm_iam_user_policy](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/iam_user_policy).



 Tips 



* Access to a container resource doesn't automatically grant access to its subresources. For example, granting access to a VPC doesn't grant access to subnets in that VPC.
* Similarly, access to a subresource does not grant access to its container resource. For example, granting access to a subnet doesn't grant access to that subnet's VPC.
* In general, to change the relationship between multiple resources, the user must have access to each resource. For example, to attach a network interface to a security group, the user must have access to both the network interface and the security group. For more information, see [Required permissions for VPC resources](https://cloud.ibm.com/docs/vpc?topic=vpc-resource-authorizations-required-for-api-and-cli-calls).



For more information about assigning user roles in the UI, see [Managing user permissions for VPC resources](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-user-permissions-for-vpc-resources).

You can also assign user roles by using IBM Cloud® Command Line Interface (CLI). You can select resources by using resource attributes.
curl -X GET "$vpc_api_endpoint/v1/volumes/$volume_id?version=$api_version&generation=2" -H "Authorization: $iam_token"

Create a volume attachment to attach the new data volume to the virtual server instance. Use the instance ID variable that you created earlier in the request. Use the volume ID variable to specify the volume.

Create the volume attachment:

curl -X POST "$vpc_api_endpoint/v1/instances/$instance/volume_attachments?version=$version&generation=2" -H "Authorization: $iam_token" -d '{
"name": "my-volume-attachment",
"volume": {
"id": "'$volume_id'"
}
}'





 Add rules to the default security group 

You can configure the security group to define the inbound and outbound traffic that is allowed for the instance. For example, you can add a rule to allow SSH traffic.

Find the security group for the VPC:

curl -X GET "$vpc_api_endpoint/v1/vpcs/$vpc/default_security_group?version=$api_version&generation=2" -H "Authorization:$iam_token"

Save the ID of the security group in a variable, for example:

sg=0738-2d364f0a-a870-42c3-a554-000000981149

Now create a rule to allow inbound SSH traffic so that you'll be able to connect to the instance:

curl -X POST "$vpc_api_endpoint/v1/security_groups/$sg/rules?version=$api_version&generation=2" -H "Authorization: $iam_token" -d '{
"direction": "inbound",
"protocol": "tcp",
"port_min": 22,
"port_max": 22
}'
* CLI
* API







 Creating a VPC in a different region 

A region is a specific geographical location where you can deploy apps, services, and other IBM Cloud® resources. Regions consist of one or more zones, which are physical data centers that house the compute, network, and storage resources, with related cooling and power, for host services and applications. Zones are isolated from each other, which makes sure that no shared single point of failure within a region occurs.

The IBM Cloud® VPC service is regional. To allow for disaster recovery (DR), you must provide the ability for recovery by using failover to an alternative region, by establishing a VPC in one of our other regions.

Virtual Private Cloud is available in the following IBM Cloud® regions.

Americas

Europe

Asia Pacific



Table 1. IBM Cloud regions for North and South America
This table displays the IBM Cloud regions and is organized by geographical location. Click on the tab for the geographical location you are interested in. You then see all the IBM Cloud regions for that geographical location.

 Location Region API Endpoint 

 US South (Dallas) us-south us-south.iaas.cloud.ibm.com 
 US East (Washington DC) us-east us-east.iaas.cloud.ibm.com 
 Brazil (São Paulo) br-sao br-sao.iaas.cloud.ibm.com 
 Canada (Toronto) ca-tor ca-tor.iaas.cloud.ibm.com 



The Madrid region only supports dedicated host profiles with instance storage. For more information, see [Dedicated host profiles](https://cloud.ibm.com/docs/vpc?topic=vpc-dh-profiles&interface=ui).

The Regional API (VPC) endpoint is automatically set by the IBM Cloud® CLI when you log in to a specific region.



 Logging in to a specific region by using the CLI 

When you log in to IBM Cloud®, you can specify a region or choose it later. For example, to log in to the global API endpoint in the Dallas (us-south) region directly, run the following commands.
Instance Metadata is.metadata.instance-volume-attachment.list Volume attachments were listed for the calling instance 







 Bare metal server events 

Some fields for Bare Metal Servers for VPC AT events will be changing between the Beta and Limited Available (LA) releases. For more information, see [Analyzing events](https://cloud.ibm.com/docs/vpc?topic=vpc-at-eventsat_events_iam_analyze).



Table 15. Actions that generate events for Bare Metal Server

 Resource Action Description 

 Bare Metal Server is.bare-metal-server.bare-metal-server.read One or more bare metal servers was retrieved 
 Bare Metal Server is.bare-metal-server.bare-metal-server.create Bare metal server was created 
 Bare Metal Server is.bare-metal-server.bare-metal-server.update Bare metal server was updated 
 Bare Metal Server is.bare-metal-server.bare-metal-server.delete Bare metal server was deleted 
 Bare Metal Server is.bare-metal-server.bare-metal-server.restart Bare metal server was restarted 
 Bare Metal Server is.bare-metal-server.bare-metal-server.start Bare metal server was started 
 Bare Metal Server is.bare-metal-server.bare-metal-server.stop Bare metal server was stopped 
 Bare Metal Server is.bare-metal-server.console.read Bare metal server console connection was retrieved 
 Bare Metal Server is.bare-metal-server.console-access-token.create Bare metal server console access token was created 
 Bare Metal Server is.bare-metal-server.disk.read One or more disks on a bare metal server was retrieved 
 Bare Metal Server is.bare-metal-server.disk.update Disk on a bare metal server was updated 
 Bare Metal Server is.bare-metal-server.initialization.read Bare metal server's initialization data was retrieved 
 Bare Metal Server is.bare-metal-server.network-interface.read One or more network interfaces on a bare metal server was retrieved 
 Bare Metal Server is.bare-metal-server.network-interface.create Network interface was created on a bare metal server
"href": "$vpc_api_endpoint/v1/shares/90c4bb62-1724-47bd-8c45-f7d37d7c3508/mount_targets/7e5bdb52-676d-43b2-991f-2053cf6855eb",
"id": "7e5bdb52-676d-43b2-991f-2053cf6855eb",
"lifecycle_state": "pending",
"mount_path": "",
"name": "myshare-1",
"primary_ip": {
"address": ""
},
"resource_type": "share_target",
"subnet": {
"crn": "crn:[...]",
"href": "$vpc_api_endpoint/v1/subnets/4e95744c-7e64-48c9-b5d2-3b6481b1dfde",
"id": "4e95744c-7e64-48c9-b5d2-3b6481b1dfde",
"name": "subnet-2",
"resource_type": "subnet"
},
"transit_encryption": "none",
"virtual_network_interface": {
"crn": "crn:[...]",
"href": "$vpc_api_endpoint/v1/virtual_network_interface/710y-b8aa945c-7eac-4c15-bad6-a56db9d1e9bd",
"id": "710y-b8aa945c-7eac-4c15-bad6-a56db9d1e9bd",
"name": "enlace-traverse-oat-console",
For more information, see [Connecting to your Linux instance](https://cloud.ibm.com/docs/vpc?topic=vpc-vsi_is_connecting_linux) or [Connecting to your Windows instance](https://cloud.ibm.com/docs/vpc?topic=vpc-vsi_is_connecting_windows). If you have an existing instance with a floating IP address, then it is not necessary to assign a second floating IP to another instance. You can connect to the first with a floating IP, then SSH to the second instance by using the private subnet IP address that is automatically assigned to it.







 Provisioning a Virtual Server Instance with instance storage from the CLI 

To provision a virtual server instance with instance storage, follow the instructions for [Creating virtual servers by using the CLI](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-virtual-servers&interface=cli). Choose a profile that includes an instance storage disk. For more information about profiles, see [Instance profiles](https://cloud.ibm.com/docs/vpc?topic=vpc-profiles).





 Provisioning a Virtual Server Instance with instance storage with the API 

To provision a virtual server instance with instance storage, follow the instructions for [Using the REST APIs to create VPC resources](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-rest-apiscreate-instance-api-tutorial). Choose a profile that includes an instance storage disk. For more information about profiles, see [Instance profiles](https://cloud.ibm.com/docs/vpc?topic=vpc-profiles).

The API (or CLI) is useful for determining the interface type that is used for attaching the instance storage disks. The instance object that is returned from a create operation (or get) reports the instance disks in the disks array as shown in the following example partial output.

"disks": [
{
"created_at": "2022-04-19T17:13:28Z",
Various configurations for CPU, RAM, and storage are available to satisfy different requirements. These predefined configurations are called profiles, for example bx2d-metal-192x768. The following information describes the naming rule of the profiles:



* b represents a Balanced family profile.
* x represents the x86_64 CPU architecture.
* 2 represents the current generation of processors (Cascade Lake).
* d represents NVMe U.2 SSDs.
* The field between the two dashes is "metal" for IBM Cloud bare metal server.
* The field after the second dash contains information on the number of vCPU and the memory size (in GB). For example, "192x768" means that this profile has 192 vCPU and a memory of 768 GB.



The previous example shows a Balanced bare metal profile with 192 vCPU and 768 GB memory. The profile has the Cascade Lake processors and NVMe U.2 SSDs for additional storage. For a detailed listing of available profiles with their specifications for the VMware IBM Cloud bare metal server for IBM Cloud VPC, see the [Profiles for IBM Cloud Bare Metal Servers for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-bare-metal-servers-profile&interface=ui).

Each bare metal server for IBM Cloud VPC is located in the IBM Cloud VPC in IBM Cloud multizone region in a specified zone.





 Physical network design 

Physical networking is provided by IBM Cloud VPC. Each bare metal server for VPC provides full support for VPC networking capabilities and features. The VPC network is fully software-defined, so you can configure it through the GUI, CLI, API, or by using IBM Cloud Terraform provider.





 Physical network segmentation 

The VMkernel networking in VMware provides connectivity to hosts, and handles the standard system traffic of vSphere vMotion, IP storage, Fault Tolerance, vSAN™, and others. It is recommended to take appropriate security measures to prevent unauthorized access to the management and system traffic in your vSphere environment. In IBM Cloud VPC, you can do logical segmentation or isolation in many ways.
Specify Image Service for VPC as the resource type. Specify IBM Cloud Object Storage as the target service. The authorization is so that the Image Service for VPC can access images in IBM Cloud Object Storage. For more information, see [Granting access to IBM Cloud Object Storage to import images](https://cloud.ibm.com/docs/vpc?topic=vpc-object-storage-prereq).







 Next steps 

When your image is successfully encrypted, your KMS is set up, and you created the required keys, you can [import](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-custom-imagescustom-image-using-COS) the image to IBM Cloud VPC. When the image is available in IBM Cloud VPC, you can use it to provision instances. Make sure that you have [Granted access to IBM Cloud Object Storage to import images](https://cloud.ibm.com/docs/vpc?topic=vpc-object-storage-prereq).

When you are ready to provision a new virtual server instance with the encrypted image, no encryption information is needed. The wrapped data encryption key (WDEK) and the CRN of the customer root key (CRK) are stored as metadata with the image.
Encryption Specifies provider-managed or [customer-managed encryption](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-encryption). 
 Encryption instance For customer-managed encryption, link to the Key Protect or Hyper Protect Crypto Services instance. 
 Key ID Copiable customer root key ID. 
 ID For customer-managed encryption, the UUID generated when you created the file share. 
 Size File share size in GB. 
 Created Date the file share was created. 
 Mount target access mode <br><br>New Access to the file share is granted by either a security group within a subnet or to any virtual server instance in the VPC. Click the pencil icon to switch access modes. Security group access is available only to file shares created with the [dp2 profile](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-profiles&interface=uidp2-profile). For more information, see the [Mount target access modes](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-about&interface=apifs-mount-access-mode). 
 Profile, size, and IOPS 
 Size File share size in GB. 
 IOPS tier IOPS tier [profile](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-profiles) that defines the file share performance. For example, a 3 IOPS/GB general-purpose profile. 
 Max IOPS Maximum IOPS for the specified profile. 
 Mount targets Number of mount targets associated with the file share. You can have one mount target per VPC per file share. You can create more mount targets for other VPCs. 
 Name Name of the mount target. 
 Virtual private cloud Click the name to go to the details page for that VPC, where you can see a [list of file shares](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-view&interface=clifs-view-shares-vpc) that have a mount target to the VPC.
Encryption Specifies provider-managed or [customer-managed encryption](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-encryption). 
 Encryption instance For customer-managed encryption, link to the Key Protect or Hyper Protect Crypto Services instance. 
 Key ID Copiable customer root key ID. 
 ID For customer-managed encryption, the UUID generated when you created the file share. 
 Size File share size in GB. 
 Created Date the file share was created. 
 Mount target access mode <br><br>New Access to the file share is granted by either a security group within a subnet or to any virtual server instance in the VPC. Click the pencil icon to switch access modes. Security group access is available only to file shares created with the [dp2 profile](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-profiles&interface=uidp2-profile). For more information, see the [Mount target access modes](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-about&interface=apifs-mount-access-mode). 
 Profile, size, and IOPS 
 Size File share size in GB. 
 IOPS tier IOPS tier [profile](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-profiles) that defines the file share performance. For example, a 3 IOPS/GB general-purpose profile. 
 Max IOPS Maximum IOPS for the specified profile. 
 Mount targets Number of mount targets associated with the file share. You can have one mount target per VPC per file share. You can create more mount targets for other VPCs. 
 Name Name of the mount target. 
 Virtual private cloud Click the name to go to the details page for that VPC, where you can see a [list of file shares](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-view&interface=terraformfs-view-shares-vpc) that have a mount target to the VPC.
Encryption Specifies provider-managed or [customer-managed encryption](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-encryption). 
 Encryption instance For customer-managed encryption, link to the Key Protect or Hyper Protect Crypto Services instance. 
 Key ID Copiable customer root key ID. 
 ID For customer-managed encryption, the UUID generated when you created the file share. 
 Size File share size in GB. 
 Created Date the file share was created. 
 Mount target access mode <br><br>New Access to the file share is granted by either a security group within a subnet or to any virtual server instance in the VPC. Click the pencil icon to switch access modes. Security group access is available only to file shares created with the [dp2 profile](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-profiles&interface=uidp2-profile). For more information, see the [Mount target access modes](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-about&interface=apifs-mount-access-mode). 
 Profile, size, and IOPS 
 Size File share size in GB. 
 IOPS tier IOPS tier [profile](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-profiles) that defines the file share performance. For example, a 3 IOPS/GB general-purpose profile. 
 Max IOPS Maximum IOPS for the specified profile. 
 Mount targets Number of mount targets associated with the file share. You can have one mount target per VPC per file share. You can create more mount targets for other VPCs. 
 Name Name of the mount target. 
 Virtual private cloud Click the name to go to the details page for that VPC, where you can see a [list of file shares](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-view&interface=uifs-view-shares-vpc) that have a mount target to the VPC.
rule-65b61a0f-ffdb-41ba-873d-ad329e7fc0ee - Check whether Application Load Balancer for VPC is configured to convert HTTP client requests to HTTPS
rule-d544f217-3723-4376-b3aa-037c5f201e8d - Check whether Application Load Balancer for VPC uses HTTPS (SSL & TLS) instead of HTTP
rule-773385ab-4654-4088-883d-fe9d58bc4ecb - Check whether Block Storage for VPC is enabled with customer-managed encryption and Bring Your Own Key (BYOK)
rule-8ffe83cb-0ba1-47d6-a1e0-53e9932a5691 - Check whether Block Storage for VPC is enabled with customer-managed encryption and Keep Your Own Key (KYOK)
rule-f87929f7-0787-4749-a1ce-35c1f2320401 - Check whether data disks are encrypted with customer-managed keys
rule-390aa9af-c497-4ebc-9958-d572a5b7be3d - Check whether unattached disks are encrypted with customer-managed keys
rule-0f7e7e60-a05c-43a7-be74-70615f14a342 - Check whether Security Groups for VPC contains no outbound rules in security groups that specify source IP 8.8.8.8/32 to DNS port
rule-c4d50b06-9331-4f5c-a3f8-9fe8060efc9b - Check whether Security Groups for VPC doesn't allow PING for the default security group
rule-936158a6-40ff-48ca-91a1-f184aa9b0dff - Check whether Virtual Private Cloud (VPC) classic access is disabled
rule-64c0bea0-8760-4a6b-a56c-ee375a48961e - Check whether Virtual Private Cloud (VPC) has no public gateways attached
See the list of [required permissions](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-user-permissions-for-vpc-resources) for VPC.
* Understand the capability differences between VMware and VPC infrastructures (the following list is not exhaustive):



* VPC does not support shared volumes or file-based volumes
* GPU is not supported in VPC
* Encrypted volumes are not supported





To improve data transfer rate, adjust the bandwidth allocation of the RMM server. For more information, see [Adjusting bandwidth allocation using the UI](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-virtual-server-instances&interface=uiadjusting-bandwidth-allocation-ui).





 Step 1: Order RMM 

The RMM tool is available in the IBM Cloud catalog. After you order, a virtual server with RMM software is installed into your VPC of choice. The RMM server has a public IP address for reachability and a default login.

If public IP address is not attached to RMM server then, its 'Reserved IP' address can be used to access RMM server with [bastion host](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-secure-management-bastion-server).



1. Order the RMM server from the [IBM Cloud catalog](https://cloud.ibm.com/catalog/content/IBM-MarketPlace-P2P-1.3-22935832-bd76-49ab-b53e-12fc5d04c266-global).
2. After you order, log in to the RMM server.
3. In the RMM server, change the default password, create users, and create an SSH key.
4. Upload the SSH key to IBM Cloud VPC.







 Step 2: Bring Your Own License (BYOL) from RackWare 



1. Generate a license file in /etc/rackware by running the following command:

rwadm relicense
ibmcloud is vpn-server-clients VPN_SERVER [--vpc VPC] [--output JSON] [-q, --quiet]



 Command options 



* VPN_SERVER: ID or name of the VPN server.
* --vpc: ID or name of the VPC. It is only required to specify the unique resource by name inside this VPC.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is vpn-server-client 

View details of a VPN client.

ibmcloud is vpn-server-client VPN_SERVER CLIENT_ID [--vpc VPC] [--output JSON] [-q, --quiet]



 Command options 



* VPN_SERVER: ID or name of the VPN server.
* CLIENT_ID: ID of the VPN client.
* --vpc: ID or name of the VPC. It is only required to specify the unique resource by name inside this VPC.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is vpn-server-client-delete 

Delete one or more VPN clients for a VPN server.

ibmcloud is vpn-server-client-delete VPN_SERVER (CLIENT_ID1 CLIENT_ID2 ...) [--vpc VPC] [-f, --force] [-q, --quiet]



 Command options 



* VPN_SERVER: ID or name of the VPN server.
* CLIENT_ID1: ID of the VPN client.
* CLIENT_ID2: ID of the VPN client.
* --vpc: ID or name of the VPC.