vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Using your VPE to access an app securely 

Before you begin, you must have an [IBM Cloud account](https://cloud.ibm.com/registration).

You can only use your VPE to access your app with a private endpoint if your selected project supports [application private visibility](https://cloud.ibm.com/docs/codeengine?topic=codeengine-application-workloadsapp-endpoint-private). To confirm if the project supports application private visibility, use the [ibmcloud ce project get](https://cloud.ibm.com/docs/codeengine?topic=codeengine-clicli-project-get) command to verify the output for Application Private Visibility Supported is set to true.



1. Create an IBM Cloud® Virtual Private Cloud. Follow the [Getting started](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started) instructions.
2. Make sure that your VPC has at least one VSI (virtual server instance) and can connect to the VSI. You can use the UI, CLI, and API to quickly provision IBM Cloud® Virtual Private Cloud from the Virtual server instances page in the IBM Cloud console.



1. Create an [SSH key](https://cloud.ibm.com/docs/vpc?topic=vpc-ssh-keys) to access the VSI.
2. [Create a virtual server instance by using the UI](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-virtual-servers).
3. [Reserve a floating IP address](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-ibm-cloud-consolereserving-a-floating-ip-address) so your instance is reachable from the internet.
4.
Connectivity For IBM Cloud® Hyper Protect Virtual Server for IBM Cloud® Virtual Private Cloud instances, make sure that you either [enable a public gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-about-networking-for-vpcpublic-gateway-for-external-connectivity) in the subnet, or [reserve a floating IP address](https://cloud.ibm.com/docs/vpc?topic=vpc-about-networking-for-vpcfloating-ip-for-external-connectivity) and associate it with the network interface of the instance just after instance creation. 







 Next steps 

When you're ready to get started, see the following tutorials:



* [Using the IBM Cloud console to create VPC resources](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-ibm-cloud-console)
* [Creating VPC resources with CLI and API](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-vpc-resources-with-cli-and-api&interface=cli)
* You can optionally secure access to your private cloud service endpoint by creating a subnet allowlist. Only authorized requests to your cluster master that originate from subnets in the allowlist are permitted through the cluster's private cloud service endpoint. For more information, see [Creating an allowlist for the private cloud service endpoint](https://cloud.ibm.com/docs/containers?topic=containers-access_clusterprivate-se-allowlist).







 Private service endpoint only 

To make your master only privately accessible, you can enable the private cloud service endpoint. VRF is required in your IBM Cloud account, and you must enable your account to use service endpoints. To enable VRF and service endpoints, run ibmcloud account update --service-endpoint-enable true. Note that using private cloud service endpoint only incurs no billed or metered bandwidth charges.



* Communication between worker nodes and master is established over the private network through the private cloud service endpoint.
* The master is privately accessible if authorized cluster users are in your IBM Cloud private network or are connected to the private network through a VPN connection or DirectLink. Note that you must [expose the master endpoint through a private load balancer](https://cloud.ibm.com/docs/containers?topic=containers-access_clusteraccess_private_se) so that users can access the master through a VPN or DirectLink connection.
* You can optionally secure access to your private cloud service endpoint by creating a subnet allowlist. Only authorized requests to your cluster master that originate from subnets in the allowlist are permitted through the cluster's private cloud service endpoint. For more information, see [Creating an allowlist for the private cloud service endpoint](https://cloud.ibm.com/docs/containers?topic=containers-access_clusterprivate-se-allowlist).









 Worker communication to other IBM Cloud services or on-premises networks 

Allow your worker nodes to securely communicate with other IBM Cloud services and to an on-premises network.



 Communication with other IBM Cloud services over the private or public network
From IBM Cloud Identity and Access Management (IAM), create an authorization between the Virtual Private Cloud (VPC) Infrastructure (source service) > Image Service for VPC (resource type) and Cloud Object Storage (target service). For more information, see [Create an authorization](https://cloud.ibm.com/docs/iam?topic=iam-serviceauthserviceauth).

Important: The configuration must be set up as this example or permissions can fail.

Zoom

![Figure showing example IAM authorization.](https://cloud.ibm.com/docs-content/v1/content/b6066ebcc4ff31f2a8b558531f2ee791d108a7e1/cloud-pak-multicloud-management/images/service_auth_vpc_v2.png)

Figure 5. Example IAM authorization
4. Create a generation 2 Virtual Private Cloud (Must be generation 2). For more information, see [Create a VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-startedcreate-and-configure-vpc)

a. Create a VPC - The VPC must be in the same resource group and region as your bucket.

b. Create subnets in one or more zones. You can create subnets in suggested prefix ranges or in your own IP ranges that you bring to IBM Cloud.

c. Attach a public gateway if you want to allow all resources in a subnet to communicate with the public internet.

Zoom

![Figure showing example VPC.](https://cloud.ibm.com/docs-content/v1/content/b6066ebcc4ff31f2a8b558531f2ee791d108a7e1/cloud-pak-multicloud-management/images/vpc_details_v2.png)

Figure 6. Example VPC
5.
* CLI
* API







 Setting up your API and CLI environment 

Before you can create an IBM Cloud® Virtual Private Cloud (VPC) by using the API or CLI, set up your environment.



 General prerequisites 



1. Set up your account to access VPC. Make sure that your account is [upgraded to a paid account](https://cloud.ibm.com/docs/account?topic=account-accountfaqschangeacct).
2. Make sure that you have a public SSH key, which will be used to connect to the virtual server instance. For example, generate an SSH key on your Linux server by running the following command:

ssh-keygen -t rsa

This command generates two files. The generated public key is in the id_rsa.pub file under an .ssh directory in your home directory, for example, .../.ssh/id_rsa.pub.

For more information, see [SSH keys](https://cloud.ibm.com/docs/vpc?topic=vpc-ssh-keys).







 CLI prerequisites 

Before you can use the CLI to create your VPC, you must install the IBM Cloud CLI and the VPC CLI plug-in.

IBM Cloud CLI is not supported on LinuxONE (s390x processor architecture). However, you can install the CLI on another supported platform and use it with LinuxONE (s390x processor architecture) virtual server instances.



1. Install the [IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-getting-started).
2. Install the VPC CLI plug-in.

ibmcloud plugin install vpc-infrastructure

The VPC CLI actions use the extension is. To learn how to use the CLI commands, you can run:

ibmcloud is help
ibmcloud is help vpc-create
ibmcloud is help instance-create
1. To complete this procedure, you need a general understanding of IBM Cloud VPC and VSIs. To run the example in IBM Cloud Schematics, you need an IBM Cloud account. The deployed resources are chargeable.
2. [Create or retrieve an IBM Cloud API key](https://cloud.ibm.com/docs/account?topic=account-userapikeycreate_user_key). The API key is used to authenticate with the IBM Cloud platform and to determine your permissions for IBM Cloud services.
3. Be sure that you have the [required IBM Cloud IAM permissions](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-user-permissions-for-vpc-resources) to create and work with VPC infrastructure and you are [assigned the correct permissions](https://cloud.ibm.com/docs/schematics?topic=schematics-access) to create the workspace and deploy resources.
4. [Generate an SSH key](https://cloud.ibm.com/docs/vpc?topic=vpc-ssh-keys). The SSH key is required to access the provisioned VPC virtual server instances through the bastion host. After you create your SSH key, make sure to [upload this SSH key to your IBM Cloud account](https://cloud.ibm.com/docs/vpc-on-classic-vsi?topic=vpc-on-classic-vsi-managing-ssh-keysmanaging-ssh-keys-with-ibm-cloud-console) in the VPC region and resource group where you want to deploy the bastion server.
5. Verify that you can access the URL used for this solution [Automation script for SAP solutions using a BASTION & STORAGE setup deployment through Terraform and IBM Schematics](https://github.com/IBM-Cloud/sap-bastion-setup).







 Procedure 



1. From the IBM Cloud menu, select [Schematics](https://cloud.ibm.com/schematics/overview).
2.
* [Creating an instance by using the UI](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-virtual-servers&interface=ui). On the [provisioning page](https://cloud.ibm.com/vpc-ext/provision/vs?architecture=s390x&secureExecution=true), make sure that you select IBM Z, LinuxONE for Architecture, and turn on the Run your workload with an OS and a profile protected by Secure Execution toggle under Confidential computing.
* [Creating an instance by using the CLI](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-virtual-servers&interface=cli)



See the [troubleshooting documentation](https://cloud.ibm.com/docs/vpc?topic=vpc-hyper-protect-virtual-server-shutdown) or [get support](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-help&interface=cli) if you have any problems with the instance.

You can use [Terraform](https://cloud.ibm.com/docs/vpc?topic=vpc-terraform-for-hyper-protect-virtual-servers-for-vpc) to automate operations with Hyper Protect Virtual Servers for VPC.

You can use your Hyper Protect Virtual Servers for VPC instance in private-only network configurations, in which the VPC doesn't have a public gateway and the virtual server instance doesn't have a floating IP. You can connect to private endpoints of other services, including container registry and [IBM Log Analysis](https://cloud.ibm.com/docs/vpc?topic=vpc-logging-for-hyper-protect-virtual-servers-for-vpc). The prerequisite is to have a DNS server attached to your virtual server instance. You don't need to do any additional configurations.





 Recovering or upgrading a Hyper Protect Virtual Servers for VPC instance by using IBM Cloud VPC Snapshots.
FAQs for virtual private endpoints 

You might encounter the following frequently asked questions when you use IBM Cloud Virtual Private Endpoints (VPE) for VPC.



  Can I map IBM Cloud services to a VPE from the service catalog? 

IBM Cloud services cannot be mapped to a VPE from the service catalog during the time of purchase.





  Can I map an IBM Cloud service to a Public endpoint? 

Public endpoints of IBM Cloud services are not eligible for VPE. VPE can be mapped only to a private endpoint of IBM Cloud services.





  Is a VPE created in high-availability mode? 

A VPE is not created in high-availability (HA) mode, by default. HA comes primarily from the IBM Cloud service.





  Can I access an IBM Cloud service by using a private service endpoint IP address? 

When an IBM Cloud service is created, IBM Cloud DNS Services are automatically set up to resolve the IBM Cloud service FQDN to the IBM Cloud private service address.

When a VPE is created, VPE assigns a reserved IP with which you can access the IBM Cloud service. It is recommended to use the reserved IP instead of the IBM Cloud private service endpoint.





  Does mapping an IBM Cloud service to an IP address on a VPC network make the service private? 

Mapping an IBM Cloud service to an IP address on a VPC network does not make the service private. For example, if a service has a public endpoint, you can still access the public endpoint after the service is mapped.





  Does controlling access to an IP on a VPC network that is mapped to a service control access to the mapped service? 

Controlling access to an IP address on a VPC network that is mapped to an IBM Cloud service does not control the access to the mapped service itself.





  Is there a limit to the number of IP addresses I can bind to an endpoint gateway? 

When the reserved IP address that is bound to the endpoint gateway is source NATed on the VPC gateway, it is done by using IP masquerading on the port. As the number of IP addresses bound to the endpoint gateway grows, the number of available ports to masquerade might become a concern.





  How many IP addresses can I use for NAT operations on the VPC gateway? 

A finite pool of IP addresses is used for NAT operations on the VPC gateway. One IP address is required per VPC per zone.
Benefits 



 BYOL 

Renting licenses can get expensive. Bringing your own license is an option for IBM Cloud Bare Metal Servers for VPC.





 Rapid scaling 

Scale your dedicated, bare metal server environment for your needs quickly. Often, in 10 minutes or less when resources are available.





 Network orchestration 

A network orchestration layer handles the networking for all bare metal servers that are within an IBM Cloud VPC across regions and zones. Create multiple, virtual private clouds in multizone regions. Network orchestration also helps improve security, reduce latency, and increase high availability.

You are responsible for security on your bare metal server. That means upgrading or patching the operating system as needed to make sure that vulnerabilities are addressed in a timely manner. Bare metal servers with associated floating IP addresses are internet-facing and you need to take appropriate precautions. For more information, see [Understanding your responsibilities](https://cloud.ibm.com/docs/vpc?topic=vpc-responsibilities-vpcsecurity-compliance).







 Pricing options 

Pay-as-you-go bandwidth is per gigabyte. Your billing charges accrue from provision to cancellation, and are billed in arrears. Total pricing includes bare metal server instance profiles and software, internet data transfers, and optional VPC services. Each additional component is priced separately and included as part of your total IBM Cloud VPC charge. Service tiers are bound to your account, not to any specific VPC.

For more information about pricing, see [Pricing](https://www.ibm.com/cloud/vpc/pricingtab_2651670).





 Bare Metal Servers for VPC versus bare metal server on classic infrastructure 

With Bare Metal Servers for VPC, you can enjoy the security and performance of the private cloud with the flexibility and scalability of the public cloud. Compared to the classic bare metal infrastructures, Bare Metal Servers for VPC provides better connectivity and networking throughput by using VPC concepts.

Bare Metal Servers for VPC has local NVMe, which you can use to create VMWare vSAN.
In the [IBM Cloud console](https://cloud.ibm.com/login), go to menu icon ![menu icon](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/icons/icon_hamburger.svg) > VPC Infrastructure > Compute > Virtual server instance.
2. In the Virtual server instances for VPC list, click the overflow button of the instance that you need to access, then click Open VNC Console or Open serial Console. Alternatively, on the instance details page, click Action on the upper right then click Open VNC Console or Open Serial Console.
3. (For serial console only) If the serial console is being used, you are prompted to confirm whether to force open a session. This action disconnects the other user's session.
4. Enter the credentials and follow the prompts to log in to your instances.



You can stop or restart the instance by clicking Shutdown instance or Reboot instance on the upper right of the console's window.





 Using API to connect to a console 

Before you can use the API requests to connect to a VNC or serial console, you need to get an IAM token, store the endpoint as a variable, and verify that you have access to the VPC API service. For more information, see [API prerequisites](https://cloud.ibm.com/docs/vpc?topic=vpc-set-up-environmentapi-prerequisites-setup).



 Using API to connect to a VNC console 



1. Create a console access token for the instance. Specify "console_type"："VNC" in the payload.

curl -X POST "$vpc_api_endpoint/v1/instances/$instance_id/console_access_token?version=2021-01-26&generation=2" -H "Authorization: $iam_token" -d '{
"console_type": "vnc"
}'

The access token will be invalid after 3 minutes.
For a full list of command options, see [ibmcloud is floating-ip-reserve](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-referencefloating-ip-reserve).

Need more help? You can always run ibmcloud is instance-create --help to display help for creating an instance.







 Create a boot volume from a snapshot and use it to provision a new instance with the CLI 

You can create a boot volume from a bootable [snapshot](https://cloud.ibm.com/docs/vpc?topic=vpc-snapshots-vpc-restore&interface=uisnapshots-vpc-restore-concepts) and use that for your image. When you run the ibmcloud is instance-create command, specify the source_snapshot subproperty in the boot volume JSON and the ID or name of a bootable snapshot. For an example, see [Create a boot volume from a snapshot for a new instance from the CLI](https://cloud.ibm.com/docs/vpc?topic=vpc-snapshots-vpc-restore&interface=clisnapshots-vpc-restore-boot-CLI).







 Next steps after an instance is created from the CLI 

A series of emails is sent to your administrator: Acknowledgment of the virtual server instance order, order approval and processing, and a message that the instance is created.

If you choose a GPU profile, see [Managing GPUs](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-gpus).

After the instance is created, associate a floating IP address to the instance. Then, you can connect to your instance. For more information, see [Connecting to your Linux instance](https://cloud.ibm.com/docs/vpc?topic=vpc-vsi_is_connecting_linux) or [Connecting to your Windows instance](https://cloud.ibm.com/docs/vpc?topic=vpc-vsi_is_connecting_windows).
[Architecture](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/includes/solution-tutorials/includes/solution-tutorials/images/solution46-vpc-vpn/vpc-site2site-vpn-tutorial.png)

Figure 1. Architecture diagram of the tutorial

A terraform configuration will create the following resources:



1. The infrastructure (VPC, Subnets, Security Groups with rules, Network ACL and VSIs).
2. The Object Storage and Databases for PostgreSQL private endpoint gateways to data services.
3. The strongSwan open source IPsec gateway software is used on-premises to establish the VPN connection with the cloud environment.
4. A VPC/VPN Gateway is provisioned to allow private connectivity between on-premises resources and cloud resources.
5. The on-premises DNS resolver is connected to the cloud DNS Resolver Location to allow TLS access to cloud resources including [access to virtual private endpoint gateways](https://cloud.ibm.com/cloud/blog/creating-virtual-private-endpoint-gateways-with-terraform) through a VPN.







 Before you begin 

This tutorial requires:



* IBM Cloud CLI,



* IBM Cloud Schematics plugin (schematics),



* jq to query JSON files,
* git to optionally clone source code repository,
* Terraform CLI to optionally run Terraform on your desktop instead of the Schematics service.



You will find instructions to download and install these tools for your operating environment in the [Getting started with tutorials](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-tutorials) guide.

The on-premises data center in this tutorial will be simulated using a VSI within a VPC.
* ibmcloud is instance-create-from-template --template my-template --name new-instance-name --subnet my-subnet --image ibm-ubuntu-20-04-2-minimal-amd64-1 --volume-attach '[{"volume": {"name":"my-vol-1"}}]' Create instance from instance template with existing volume in volume attachment by using resource name.
* ibmcloud is instance-create-from-template --template my-template --name new-instance-name --primary-network-interface '{"name": "primary-nic", "allow_ip_spoofing": true, "subnet": {"name":"my-subnet"}, "primary_ip": {"name": "my-reserved-ip"}, "security_groups": [{"name": "my-security-group-1"}, {"name": "my-security-group-2"}]}' Create instance from instance template with primary network interface configuration by using resource name.







 Command options 



* --template: ID or name of the instance template.
* --name: Name of the instance.
* --profile: Name of the instance profile.
* --zone: Name of the zone.
* --vpc: The ID or name of the VPC. It is only required to specify the unique resource by name that is inside this VPC or to override the VPC value in the template.
* --image: ID or name of the image.
* --catalog-offering: The CRN for the IBM Cloud catalog offering. If specified, the latest version of that offering is used. For more information about creating a catalog offering, see [Onboarding software to your account](https://cloud.ibm.com/docs/account?topic=account-create-private-catalog&interface=cli).
* --catalog-offering-version: The CRN for the version of a IBM Cloud catalog offering.
If you want to access the VSIs directly later, you can optionally [create an SSH key](https://cloud.ibm.com/vpc-ext/compute/sshKeys) and set ssh_keyname to the name of the VPC SSH Key.



1. Go to the Settings tab of your Schematics workspace, click the action menu for step2_create_vpc,uncheck Use default, change the override value to true and Save the setting.
2. Click on Apply plan to provision the VPC resources.

There are multiple Terraform modules involved in provisioning the VPC resources. To understand better, check the [main.tf](https://github.com/IBM-Cloud/vpc-scaling-dedicated-host/blob/master/modules/create_vpc/main.tf) file.
3. Follow the status logs by clicking on Show more. After the apply is successful, you should see the following resources provisioned:



* a VPC
* two subnets (one in each zone)
* a public load balancer with a [security group](https://cloud.ibm.com/docs/vpc?topic=vpc-alb-integration-with-security-groups) driving traffic to the frontend application
* a private load balancer with a security group driving requests from frontend to the backend
* an instance template and an instance group for provisioning and scaling the instances
* Initially, two VSIs (one frontend instance and one backend instance) with respective security groups attached

The frontend instance runs an Nginx server to serve a PHP web application that talks to the backend to store and retrieve data. The backend instance runs a NodeJS and GraphQL API wrapper for IBM Cloud Databases for PostgreSQL and IBM Cloud Object Storage.



4. Copy the public load balancer hostname from the log output and paste the hostname in a browser by prefixing http:// to see the frontend application. As shown in the diagram below, enter the balance, e.g.,10 and click Submit to see the details of the VSIs serving the request.