vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Team based privacy using IAM, VPC, Transit Gateway and DNS 

This tutorial may incur costs. Use the [Cost Estimator](https://cloud.ibm.com/estimator/review) to generate a cost estimate based on your projected usage.

Microservices are popular because they allow an enterprise to organize their development teams around the services they deliver. This tutorial walks you through the steps of creating infrastructure for a IBM Cloud® Virtual Private Cloud (VPC) based microservice architecture. In this architecture, VPCs are connected to each other using the IBM Cloud® Transit Gateway. A set of shared microservices is accessed through host names registered in the IBM Cloud® DNS Services. Each VPC is managed by a separate team isolated by IBM Cloud® Identity and Access Management. Optionally a IBM Cloud® Load Balancer can be used to scale out the shared microservice.



 Objectives 



* Learn how to isolate infrastructure using IAM and Resource groups
* Create the VPCs and associated resources such as subnets, network ACLs, security groups, instances.
* Address microservices by DNS name resolution using DNS Services.
* Connect VPCs via Transit Gateway.
* Transparently configure a Load Balancer for an application.





 Abstract Architecture: 

Zoom

![Architecture](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/includes/solution-tutorials/includes/solution-tutorials/images/solution59-vpc-tg-dns-iam/simple.png)

Figure 1. Architecture diagram of the tutorial

In the diagram above the end user is accessing the applications. The applications are leveraging shared microservices. The company has separate DevOps teams that own application1, application2 and shared. A networking team focuses on connectivity and network security. The DevOps teams manage Virtual Service Instances, VSIs, used to implement the services they create and support.





 Concrete Architecture
ibmcloud is subnet SUBNET [--vpc VPC] [--show-attached] [--output JSON] [-q, --quiet]

Where:

SUBNET
: ID or name of the subnet.

--vpc
: ID or name of the VPC. It is only required to specify the unique resource by name inside this VPC.

--show-attached
: View details of resources (instances, load balancers, VPN gateways) attached to the subnet.

--output
: Specify output format, only JSON is supported. One of: JSON.

-q, --quiet
: Suppress verbose output.





 Viewing subnets in VPC using the API 

To call this method, you must be assigned one or more IAM access roles that include the following action. You can check your access by going to [Users](https://cloud.ibm.com/iam/users) > User > Access



* is.subnet.subnet.read



Follow these instructions to retrieve a subnet in your VPC by using the API:



1. Set up your [API environment](https://cloud.ibm.com/docs/vpc?topic=vpc-set-up-environmentapi-prerequisites-setup).
2. Store any additional variables to be used in API commands.





Table 4. Parameters for retrieving a subnet

 Query parameters Information 

 id <br>Required <br>string The subnet identifier. <br>Possible values: 1 ≤ length ≤ 64, Value must match regular expression ^[-0-9a-z_]+$ 
 version <br>Required <br>string Requests the version of the API as of a date in the format YYYY-MM-DD. Any date up to the current date may be provided. Specify the current date to request the latest version. <br>Possible values: Value must match regular expression ^[0-9]{4}-[0-9]{2}-[0-9]{2}$
Team based privacy using IAM, VPC, Transit Gateway and DNS 

This tutorial may incur costs. Use the [Cost Estimator](https://cloud.ibm.com/estimator/review) to generate a cost estimate based on your projected usage.

Microservices are popular because they allow an enterprise to organize their development teams around the services they deliver. This tutorial walks you through the steps of creating infrastructure for a IBM Cloud® Virtual Private Cloud (VPC) based microservice architecture. In this architecture, VPCs are connected to each other using the IBM Cloud® Transit Gateway. A set of shared microservices is accessed through host names registered in the IBM Cloud® DNS Services. Each VPC is managed by a separate team isolated by IBM Cloud® Identity and Access Management. Optionally a IBM Cloud® Load Balancer can be used to scale out the shared microservice.



 Objectives 



* Learn how to isolate infrastructure using IAM and Resource groups
* Create the VPCs and associated resources such as subnets, network ACLs, security groups, instances.
* Address microservices by DNS name resolution using DNS Services.
* Connect VPCs via Transit Gateway.
* Transparently configure a Load Balancer for an application.





 Abstract Architecture: 

Zoom

![Architecture](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/solution59-vpc-tg-dns-iam/simple.png)

Figure 1. Architecture diagram of the tutorial

In the diagram above the end user is accessing the applications. The applications are leveraging shared microservices. The company has separate DevOps teams that own application1, application2 and shared. A networking team focuses on connectivity and network security. The DevOps teams manage Virtual Service Instances, VSIs, used to implement the services they create and support.





 Concrete Architecture 

The following architecture implements the isolation and connectivity requirements set by the company.
(https://cloud.ibm.com/docs-content/v1/content/8aa0853d34cf2349f1d2db8e5c61e6422a580169/cloud-infrastructure/images/P2V-Private-1.svg)

Figure 2. Migrating classic bare metal to virtual server instance on VPC over private interface

This architecture diagram is also applicable for classic bare metal to VPC bare metal.





 Before you begin 



* Check for correct IBM Cloud VPC user permissions. Be sure that your user account has sufficient permissions to create and manage VPC resources. See the list of [required permissions](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-user-permissions-for-vpc-resources) for VPC.
* Understand the differences between classic and VPC infrastructures (the following list is not exhaustive):



* VPC does not support shared volumes or file-based volumes
* VPC does not support snapshot or replication
* GPU is not supported in VPC



* For more information, see [Comparing IBM Cloud classic and VPC infrastructure environments](https://cloud.ibm.com/docs/cloud-infrastructure?topic=cloud-infrastructure-compare-infrastructure).
* Plan for your target server. For more information, see [Planning for Bare Metal Servers on VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-for-bare-metal-servers&interface=ui).







 Supported Operating Systems 



* For classic bare metal to VPC bare metal



* Ubuntu 20.04



* For bare metal to VPC virtual server instance



* CentOS 7.8, 7.9
* RHEL 7.2, 7.3, 7.4, 8.1
* Ubuntu 18.04, 20.04
* Debian 9.x, 10.x
* Windows 2012, 2012R2, 2016, 2019





The Convert LVM feature is only supported for RHEL 7.x and RHEL 8.x





 Step 1: Order RMM
* Private cloud service endpoint only: To access the master through the private cloud service endpoint, authorized cluster users must either be in your VPC network or connected through a [VPC VPN connection](https://cloud.ibm.com/docs/containers?topic=containers-vpc-vpnaas).



You can secure access to your private cloud service endpoint by creating a subnet allowlist. Only authorized requests to your cluster master that originate from subnets in the allowlist are permitted through the cluster's private cloud service endpoint. Use of the allowlist function helps prevent unauthorized scanning activities. For more information, see [Creating an allowlist for the private cloud service endpoint](https://cloud.ibm.com/docs/containers?topic=containers-access_clusterprivate-se-allowlist).





 Worker communication to other services or networks 

Allow your worker nodes to securely communicate with other IBM Cloud services, on-premises networks, other VPCs, and IBM Cloud classic infrastructure resources.





 Communication with other IBM Cloud services over the private or public network 

Your worker nodes can automatically and securely communicate with other [IBM Cloud services that support private cloud service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint), such as IBM Cloud® Container Registry, over the private network. If an IBM Cloud service does not support private cloud service endpoints, your worker nodes must be connected to a subnet that has a public gateway attached to it. The pods on those worker nodes can securely communicate with the services over the public network through the subnet's public gateway.

Note that if you use [access control lists (ACLs)](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-acls) for your VPC subnets, you must create inbound or outbound rules to allow your worker nodes to communicate with these services.



* If you don't attach public gateways to your subnets, you can create inbound rules to allow ingress from services that support private cloud service endpoints.
* 1 hour
* 2023-05-05



[Provision vCenter Appliance](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-bm-vmware-vcenter)Provision vCenter Appliance

In this tutorial, you will deploy a vCenter for a VMware Deployment in IBM Cloud VPC and a floating VLAN interface for it.

VMware Solutions Virtual Private Cloud (VPC)



* 2 hours
* 2023-05-05



[Provision IBM Cloud VPC for a VMware Deployment](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-bm-vmware-vpc)Provision IBM Cloud VPC for a VMware Deployment

In this tutorial, you will deploy a IBM Cloud VPC for a VMware Deployment and a jump machine for configuration tasks.

VMware Solutions Virtual Private Cloud (VPC)



* 2 hours
* 2023-05-05



[Provision vSAN storage cluster](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-bm-vmware-vsan)Provision vSAN storage cluster

In this tutorial, a vSAN cluster is created using the local disks attached the Bare Metal Servers for VPC. This phase is optional, if you use NFS.

VMware Solutions Virtual Private Cloud (VPC)



* 1 hour
* 2023-05-05



[Deploying Roll Your Own VMware on IBM Cloud Bare Metal Servers for Virtual Private Cloud](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-bm-vmware)Deploying Roll Your Own VMware on IBM Cloud Bare Metal Servers for Virtual Private Cloud

This tutorial walks you through creating your own IBM Cloud VPC with multiple subnets as required to support vSphere networking and the provisioning of IBM Cloud Bare Metal Servers for Virtual Private Cloud (BMS) for a basic VMware vSphere deployment.
* [Provision vCenter Appliance](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-bm-vmware-vcentervpc-bm-vmware-vcenter)



[Login](https://cloud.ibm.com/docs/cli?topic=cli-getting-started) with IBM Cloud CLI with username and password, or use the API key. Select your target region and your preferred resource group.

When advised to use Web browser, use the Jump machine provisioned in the [IBM Cloud VPC provisioning tutorial](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-bm-vmware-vpcvpc-bm-vmware-vpc). This Jump machine has network access to the hosts, the private DNS service and vCenter IP to be provisioned. Use url with FQDN, e.g. https://vcenter.vmware.ibmcloud.local as used in this example.

The used variables e.g. $VMWARE_VPC are defined in the previous steps of this tutorial.





 Step 1: Create file share in IBM Cloud VPC 

To Create a file share in IBM Cloud VPC you can use either CLI or UI (or API).



1. The following provides the reference when using CLI:

ibmcloud is share-create --help
2. Check the available share profiles, and you can use the following command.

ibmcloud is share-profiles

Example:

ibmcloud is share-profiles
Listing file share profiles in region eu-de under account IBM Cloud Acc as user xxx@yyy.com...
Name Family
custom-iops custom
tier-3iops tiered
tier-5iops tiered
tier-10iops tiered
3. Create a file share.

In this example, a 1TB with 10IOPS/GB file share is created with using the previously created IBM Cloud VPC as a targe.
SAP NetWeaver deployment to Intel Virtual Server on VPC Infrastructure that uses RHEL 

A Quick Study, someone who is able to learn new things quickly.

These Quick Study Tutorials provide a single sample configuration with less detailed instructions to provide an introduction for customers who prefer hands-on tasks to increase their pace of learning.

The following information provides an introduction for customers who are new to IBM Cloud® Virtual Private Cloud (VPC) Gen 2 environment. Two sample configurations are provided to help you through the ordering process to the start of the SAP installation.

The first configuration sample is simple, a single node 128 GB, 32 vCPU server. The second is an advanced configuration of two nodes by adding a second virtual server to the landscape. The sample layouts might not be your preferred layout. The purpose of this guidance is to show you two possibilities if you are not experienced with the Linux® operating system or with VPC Gen 2.

Zoom

![Figure 1. IBM Cloud VPC](https://cloud.ibm.com/docs-content/v1/content/f89cc64b006ca59b35404693959c83d5747fee3e/sap//images/quickstudy-intel-vs-gen2-image1.png)

Figure 1. IBM Cloud



 Step 1: Securing Access 

Security is one of the biggest concerns when you run your business-critical applications in a cloud environment. To secure your connection to your IBM® Virtual Servers, a public SSH key can be uploaded to your account, per region. These public keys are deployed to your virtual servers instances to allow access to the servers.

Before you continue, create an SSH public key that you can upload later to the region of your choice when you are creating the virtual server instance. Follow the steps that are [documented here](https://cloud.ibm.com/docs/vpc?topic=vpc-ssh-keys).

You use security groups to restrict access to and from IP ranges, protocols, and ports. Security groups aren't within the scope of this guidance, and the default security group that is deployed with your sample VPC can suffice.
Provision Bare Metal Servers for VPC for VMware deployment 

This tutorial may incur costs. Use the [Cost Estimator](https://cloud.ibm.com/estimator/review) to generate a cost estimate based on your projected usage.

This tutorial is part of [series](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-bm-vmwarevpc-bm-vmware-objectives), and requires that you have completed the related tutorials in the presented order.

This tutorial will show how to [provision Bare Metal Servers for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-bare-metal-servers) into IBM Cloud VPC, and how to provision network interfaces for vSphere VMkernel adapters (VMK) adapters.

You need to plan and decide your VMware deployments storage solution before you order the bare metal servers. If you use NFS backed IBM Cloud VPC file share as the primary storage, you can start with a minimum of 2 bare metal servers with and select a [profile](https://cloud.ibm.com/docs/vpc?topic=vpc-bare-metal-servers-profile) starting with bx2-, which includes a local SATA M.2 mirrored drive. If you plan to use vSAN, you need to select a minimum of 3 bare metal servers with and select a [profile](https://cloud.ibm.com/docs/vpc?topic=vpc-bare-metal-servers-profile) starting with bx2d-, which includes a local SATA M.2 mirrored drive and a number of NVMe U.2 SSDs.

In IBM Cloud® Virtual Private Cloud, you can create two types of network interfaces on a Bare Metal Servers for VPC: PCI (peripheral component interconnect) and VLAN (virtual LAN) interface. Before provisioning Bare Metal Servers for VPC, it is important to understand how these two interface types work.

The PCI interface is a physical network interface.
For more information, see [Getting started with Virtual Private Cloud (VPC)](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started).



1. Create a VPC.
2. Create subnets.
3. Order virtual server instance.



* SSH key
* Operating system name (Linux or Windows and their respective versions)
* Security groups
* Secondary volume (optional)



Encrypted volumes are not supported.







 Option 2: Auto-provision 



 Setting up a cloud user 



1. Log in to the RackWare web console.
2. In the RackWare web console, navigate to Configuration > Clouduser.
3. When you add a cloud user, enter a name and select IBM Cloud VPC for the Cloud Provider. Select the region where you want to auto-provision the virtual server instance, and enter your IBM Cloud API key.
4. Click Add.







 Creating a wave and replication 

A wave contains a single host or multiple hosts that will be migrated. For this migration, you need to create one or more waves, provide information about the hosts in the wave, and then start the wave.



1. In the RackWare web console, nagivate to Replication > Waves.
2. When you create a wave, select Target Type as Autoprovision.
3. Enter source and target details.



If source machine has Linux operating system and it has a boot volume greater than 100 GB then leave ‘Provision disk’ textbox empty and select ‘Convert to LVM’ option. This will create additional disk of required size and will convert all eligible volumes to LVM on the target.’ In case of Windows no action is required. It will be taken care automatically by RMM.



4. After you enter your source and target information, you need to provide your IBM Cloud VPC information.
5. From the edit option in Actions menu of your source, select the IBM Cloud VPC Options tab, enter the relevent information, and click Modify.
6. Run the replication.
[Kubernetes Service](https://cloud.ibm.com/docs/containers?topic=containers-cbr&interface=ui) / [Red Hat OpenShift](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr&interface=ui) IAM-enabled 
 [Messages for RabbitMQ](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-cbr) IAM-enabled 
 Secrets Manager IAM-enabled 
 [VPC Infrastructure Services](https://cloud.ibm.com/docs/vpc?topic=vpc-cbr&interface=clinetwork-zone) IAM-enabled 
 [Schematics](https://cloud.ibm.com/docs/schematics?topic=schematics-access-control-cbr&interface=ui) IAM-enabled 



In table 1, All Account Management services refers to the grouping of Account Management type services that are listed in the table. For example, if there are two Account Management services listed in table 1, All Account Management services includes those two services. As more Account Management services become available as service references, network zones that specify All Account Management services as a service reference automatically include the newly added account management services.

Refer to each service offering's documentation for more information about which services to add as a service reference for the service offering that you target in a rule.







 Endpoint types 

An endpoint type represents the connection over which an access request is received. It corresponds to the endpoint that receives the connection. You can allow access from all endpoint types that are supported by the service or specific service endpoint types.

The three common endpoint types are as follows:



* Public endpoints can accept requests from anywhere.
* Private endpoints are available for most requests, that originate from within IBM Cloud®.
* Direct endpoints are used in Bring-Your-Own-IP scenarios, generally for requests, that originate from resources within VPCs.



Some endpoint types might not be supported by the selected service.







 Access requirements 

To complete rule actions, you must be assigned an IAM policy on the target service.
About IBM Cloud Flow Logs for VPC 

IBM Cloud® Flow Logs for VPC enable the collection, storage, and presentation of information about the Internet Protocol (IP) traffic going to and from network interfaces within your Virtual Private Cloud (VPC).

Flow logs can help with a number of tasks, including:



* Troubleshooting why specific traffic isn't reaching an instance, which helps to diagnose restrictive security group rules
* Recording the metadata network traffic that is reaching your instance
* Determining source and destination traffic from the network interfaces
* Adhering to compliance regulations
* Assisting with root cause analysis





 Overview of features 



* Availability in all IBM Cloud Multi-Zone Regions (MZRs) worldwide, providing global solutions
* Network-centric lifecycle and operations management
* Suspend (stop) and resume (start) collector activity
* Conveniently stores collector output in IBM Cloud® Object Storage
* No impact to network performance
* Built-in fault tolerance
* Pricing is metered per GB of metadata that is collected per flow log target







 Configuring flow log collectors 

You can configure flow log collectors with different collection scopes. For example, a collector that targets a VPC and aggregates in-transit data from all network interfaces within that VPC. Or, a collector that targets a virtual server instance and aggregates in-transit data from only that virtual server instance's network interfaces. After data is collected, flow logs are stored in an IBM Cloud® Object Storage bucket, which you configure when you create the flow log collector.

You can set the granularity of a flow log collector for the following target scopes. Keep in mind that if you create a flow log for a subnet or VPC, each network interface in that subnet or VPC is monitored.



Table 1. Flow log target scopes

 Target What data gets collected 

 VPC Collects data for all network interfaces on a specific VPC. 
 Subnet Collects data for all network interfaces on a specific subnet. 
 Instance Collects data for all network interfaces on a specific virtual server. 
 Interface Collects data for a specific network interface on a specific virtual server.
* International Organization for Standardization (ISO 27001, ISO 27017, ISO 27018)
* Payment Card Industry Data Security Standard (PCI DSS)



VPC infrastructure: IBM Cloud Kubernetes Service implements controls commensurate with the following security standards:



* EU-US Privacy Shield and Swiss-US Privacy Shield Framework
* Health Insurance Portability and Accountability Act (HIPAA)
* International Standard on Assurance Engagements 3402 (ISAE 3402), Assurance Reports on Controls at a Service Organization







 Can I use IBM Cloud and other services with my cluster? 

You can add IBM Cloud platform and infrastructure services as well as services from third-party vendors to your IBM Cloud Kubernetes Service cluster to enable automation, improve security, or enhance your monitoring and logging capabilities in the cluster.

For a list of supported services, see [Integrating services](https://cloud.ibm.com/docs/containers?topic=containers-supported_integrationssupported_integrations).





 Does IBM support third-party and open source tools that I use with my cluster? 

See the [IBM Open Source and Third Party policy](https://www.ibm.com/support/pages/node/737271).





 What am I charged for? Can I estimate and control costs in my cluster? 

See [Managing costs for your clusters](https://cloud.ibm.com/docs/containers?topic=containers-costs).





 Can I downgrade my cluster to a previous version? 

No, you cannot downgrade your cluster to a previous version.