vania-janet/multiturn-rag-retrieval-data huggingface dataset:
With IBM Cloud VPC, you can use the UI, CLI, and API to manually provision virtual server instances for VPC with high network performance. VPC infrastructure contains a number of Infrastructure-as-a-Service (IaaS) offerings, including Virtual Servers for VPC. Use the following information to understand a simple use case for planning, creating, and configuring resources for your VPC, and learn about more VPC overviews and VPC tutorials. For more information about VPC, see [Getting started with Virtual Private Cloud (VPC)](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started).





 SAP on IBM Cloud 

SAP NetWeaver is the core foundation of the SAP technology stacks and is the platform that is used for ABAP and Java applications. The SAP system can be installed and configured in IBM Cloud for various system and database types.

For more information about SAP system architectures on IBM Cloud VPC, see the infrastructure reference architectures for SAP for each supported database type. For example, [SAP NetWeaver 7.x on UNIX with HANA on IBM Cloud VPC](https://cloud.ibm.com/docs/sap?topic=sap-sap-refarch-nw-hana&interface=terraform) is the dedicated reference architecture for this SAP solution.





 HANA db backup to IBM Cloud Object Storage (COS) 

IBM Cloud Object Storage stores encrypted and dispersed data across multiple geographic locations. This getting started tutorial walks through the steps that are needed to use IBM Cloud Object Storage to create buckets, upload objects, and set up access policies to allow other users to work with your data.

Manually deploying a VPC and configure a backup/restore on iCOS with a backint hana agent on a cloud platform can be time-consuming. The Terraform automation assures not only a much quicker implementation, but also a standardized and less prone to error deployment. Terraform and Ansible are used for automating the deployment processes.





 Ansible for SAP installation 

Ansible is an automation tool for the deployment of several IT tasks. Ansible is used for automating the installation of an Hana db backup to iCOS automation module.
When you create an instance, a 100 GB block storage volume is automatically attached as a primary boot volume. To add secondary data volumes to your instance, create block storage volumes.





 External connectivity 

Several options are available for enabling your instances to communicate with the public internet:



* To enable all instances in a subnet to send outgoing traffic, attach a public gateway to the subnet.
* To enable communication to and from a particular instance, independent of whether the subnet is attached to a public gateway, associate the instance with a floating IP.
* To enable secure connectivity, use the Virtual Private Network (VPN) service.







 Security 

For instance-level protection, use security groups that act as virtual firewalls to restrict traffic for one or more instances. For subnet-level protection, use access control lists (ACLs) to limit a subnet's inbound and outbound traffic.





 High availability 

A region is the geographical location where you deploy the VPC's services, resources, and applications. Each region contains zones, which are logically isolated data centers with independent infrastructures. You can deploy resources in multiple zones to achieve fault tolerance and high availability.

Use load balancers to distribute your network traffic across a set of virtual server instances to improve performance and availability. You can set up a load balancer to distribute incoming application traffic across instances in a single zone or across multiple zones within a region.





 Classic access 

You can set up access from a VPC to your IBM Cloud classic infrastructure, including Direct Link connectivity. One VPC per region can communicate with classic resources. For more information, see [Setting up access to classic infrastructure](https://cloud.ibm.com/docs/vpc?topic=vpc-setting-up-access-to-classic-infrastructure).





 Next steps 

To get started using the API and CLI, [set up your environment](https://cloud.ibm.com/docs/vpc?topic=vpc-set-up-environment). To learn how to create VPC resources, see these tutorials:
Virtual Private Endpoints 

This document covers all the IBM Cloud Databases: Databases for DataStax, Databases for Elasticsearch, Databases for EnterpriseDB, Databases for etcd, Databases for MongoDB, Databases for PostgreSQL, Databases for Redis, IBM Cloud® Databases for MySQL, and Messages for RabbitMQ.

IBM Cloud® Virtual Private Endpoint (VPE) for IBM Cloud® Virtual Private Cloud provides connection points to IBM services on the IBM private network from your VPC network.



 Using Virtual Private Endpoints 

Virtual Private Endpoints (VPEs) are generally available in all regions.



 Before you begin 



* You need to have an [IBM Cloud account](https://cloud.ibm.com/registration)
* And a Cloud Databases deployment. You can [provision](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-provisioning) one from the [IBM Cloud catalog](https://cloud.ibm.com/catalog/services/). Give your deployment a memorable name that appears in your account's Resource List.







 Setting up your VPE 



1. Create an IBM Cloud® Virtual Private Cloud. Follow the Getting started[instructions here](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started).
2. Make sure that your VPC has at least one VSI (virtual server instance), and can connect to the VSI. You can use the UI, CLI, and API to quickly provision IBM Cloud® Virtual Private Cloud from the Virtual server instances page in IBM Cloud console:



1. Use this information when you're creating [generation 1 virtual server instances](https://cloud.ibm.com/docs/vpc-on-classic-vsi?topic=vpc-on-classic-vsi-creating-virtual-servers).
2. Use this information when you're creating [generation 2 virtual server instances](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-virtual-servers).



3.
For more information, see [About encrypted custom images](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-aboutbyok-about-encrypted-images).



Excellent performance:



* BYOK uses hypervisor encryption on the VPC infrastructure, which delivers excellent encrypted Block Storage for VPC I/O performance for your virtual server instances.
* With the VPC infrastructure, you can create and start 1,000 instances with customer-managed encrypted boot volumes within minutes.
* Because the hypervisor manages the encryption and decryption, the guest OS does not have to modify the data. The guest OS has no knowledge that encryption is occurring.



Choice of key management service:



* You choose the [key management service (KMS)](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-aboutkms-for-byok) that you want to use. You can select Key Protect, a public multi-tenant KMS that is FIPS 140-2 L3 compliant, or the more secure Hyper Protect Crypto Services, which is FIPS 140-2 L4 compliant.
* The KMS instance that contains your root key can reside outside of the region where the encrypted volume exists. However, for best performance and security, use keys in the [same region as the Block Storage for VPC volumes](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-aboutbyok-cross-region-keys).



Key rotation and audit tracking:



* You can manually rotate your root keys with the API or from the CLI, or set up a rotation policy to automatically rotate your keys. Rotating keys replaces the root key's original cryptographic material and generates new material. For more information, see [Key rotation for VPC resources](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-key-rotation).
* Customer-managed encryption provides better audit records for root key usage.
You can use Auto scale for your virtual servers that are on IBM Cloud VPC. For more information, see [Creating an instance group for auto scaling](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-auto-scale-instance-group).







 June 2021 



 08 June 2021 

KVM console now available
: You can now access the KVM console of your virtual servers directly from IBM Cloud console. For more information, see [Accessing the KVM console for virtual servers](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-access-kvm-console).







 July 2020 



 22 July 2020 

IBM Cloud Monitoring
: IBM Cloud® Monitoring collects classic infrastructure and VPC virtual server instance metrics such as CPU usage, disk usage, network traffic, and memory. These metrics are stored in IBM Cloud Monitoring. For more information, see [IBM Cloud Monitoring](https://cloud.ibm.com/docs/virtual-servers?topic=cloud-infrastructure-monitoring-iaas).







 February 2020 



 11 February 2020 

Veeam Backup for Microsoft Office 365 is now available
: Veeam Backup for Microsoft Office 365 is now available for virtual servers monthly. For more information about Veeam Backup for Microsoft Office 365, see [Veeam backup for Office 365](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-veeam-backup-o365).







 September 2019 



 12 September 2019 

Improve network performance by configuring jumbo frames
: You can improve network performance on your virtual server instance by configuring jumbo frames in your virtual server settings. You can configure jumbo frames for the following operating systems.



* Linux: Debian, Ubuntu, CentOS, Red Hat Enterprise Linux
* Windows









 May 2019 



 07 May 2019 

Autoscale now available for virtual servers
: Auto scale for IBM Cloud® Virtual Servers provides you with the ability to automate the manual scaling process that's associated with adding or removing instances to support your business applications.
About placement groups 



 Overview 

Placement groups for IBM Cloud® Virtual Private Cloud are used to create placement strategies for managing high availability workloads. A placement group contains virtual server instances that share a common placement strategy. Placement strategies influence the physical placement of select VPC resources to meet certain workload demands.

Placement groups and their assigned resources can be managed by using the UI, CLI, API, and Terraform. A placement group can have 1 of two placement strategies: [host spread](https://cloud.ibm.com/docs/vpc?topic=vpc-about-placement-groups-for-vpchost-spread-placement-groups-for-vpc) or [power spread](https://cloud.ibm.com/docs/vpc?topic=vpc-about-placement-groups-for-vpcpower-spread-placement-groups-for-vpc). With a VPC resource called placement-groups, you can create a policy for placing groups of instances together. The placement-groups resource is then added to the service is.placement-groups. For more information about actions that are related to placement group resources, see the placement group events section in [Activity Tracker events](https://cloud.ibm.com/docs/vpc?topic=vpc-at-eventsevents-placement-group).

After the placement group is created, a selected virtual server instance or a group of virtual server instances are assigned to the placement group. When you provision these virtual server instances, the virtual server instances are then placed on a compute host in the appropriate zone for the instance based on the placement group strategy. The same placement group can be used for instances that are provisioned on shared public servers in different VPCs.



 Benefits 

Placement groups give you a measure of control over the host on which a new public virtual server is placed in relation to other virtual servers in the same placement group.

They support high availability workloads by making sure that virtual server instances in the group do not share a physical host or power supply. This technology is an added layer of assuredness for the resiliency of your virtual server instances if an unexpected power disruption or host failure occurs.
Ensure through a [signed contract](https://cloud.ibm.com/docs/vpc?topic=vpc-about-contract_sehpcr_contract_sign), that only a given combination of your workload and environment is deployed.
* Built on the Virtual Private Cloud (VPC) infrastructure for extra network security

Choose from various profile sizes and grow as needed to protect containerized applications and pay-as-you-go on an hourly basis.

Leverage your existing or common [network security groups](https://cloud.ibm.com/docs/vpc?topic=vpc-security-in-your-vpc) and [logging infrastructure](https://cloud.ibm.com/docs/vpc?topic=vpc-logging-for-hyper-protect-virtual-servers-for-vpc).



Complete the following steps to get started with Hyper Protect Virtual Servers for VPC. Most importantly, a valid [contract](https://cloud.ibm.com/docs/vpc?topic=vpc-about-contract_se) is required for creating an instance.





 Before you begin 

It's important to read the following information and complete the required preparations before you create a Hyper Protect Virtual Servers for VPC instance.



* [Planning](https://cloud.ibm.com/docs/vpc?topic=vpc-vsi_best_practices)

Consider aspects including profiles and operating system images. To create a Hyper Protect Virtual Servers for VPC instance with a stock image, choose the [IBM Hyper Protect Container Runtime image](https://cloud.ibm.com/docs/vpc?topic=vpc-vsabout-imageshyper-protect-runtime).
* Choose to build your own image with Hyper Protect Virtual Servers

Apart from using the stock image, you can choose to securely build your own image with Hyper Protect Virtual Servers and use that image to provision a Hyper Protect Virtual Servers for VPC instance. For more information, see [Hyper Protect Secure Build](https://cloud.ibm.com/docs/vpc?topic=vpc-about-hpsb).
To create a private catalog, see the tutorial [Onboarding a virtual server image for VPC](https://cloud.ibm.com/docs/account?topic=account-catalog-vsivpc-tutorial&interface=ui).<br><br><br> 
 Profile Select from popular profiles or all available vCPU and RAM combinations. The profile families are Balanced, Compute, Memory, and GPU. For more information, see [Profiles](https://cloud.ibm.com/docs/vpc?topic=vpc-profiles). 
 SSH Key You must select an existing public SSH key or click Create an SSH key to create a new one. You can create only RSA SSH keys. For Ed25519 SSH keys, you must upload the key information. For more information on creating a SSH key, see [Creating your SSH key using the UI](https://cloud.ibm.com/docs/vpc?topic=vpc-ssh-keys&interface=uigenerate-ssh-keys-ui). SSH keys are used to securely connect to the instance after it's running.<br><br>Note: Alpha-numeric combinations are limited to 100 characters. SSH keys can either be RSA or Ed25519. Ed25519 can only be used if the operating system supports this key type. Ed25519 can't be used with Windows or VMware images.<br><br>For more information, see [Getting started with SSH keys](https://cloud.ibm.com/docs/vpc?topic=vpc-ssh-keys). 
 Boot volume The default boot volume size for all profiles is 100 GB. You can specify a larger boot volume capacity, up to 250 GB, depending on what the image allows. You can also specify user tags. 
 Data volumes You can add one or more secondary data volumes to be included when you provision the instance. To add volumes, click Create. You can specify customer-managed encryption and user tags for the volume. 
 Virtual private cloud Specify the IBM Cloud VPC where you want to create your instance.
For other VMware licenses, for example, vCenter Server and NSX-T, see [FAQ about licensing and BYOL](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-faq_byol).

Billing applies for all IBM rented licenses.





 Network design and connectivity 

To manage access to your IBM Cloud network and VMware management components, and to plan your IBM Cloud network topology, you must complete the following steps:



* Devise a strategy for public versus private network connectivity to and from your VMware workloads.
* You can provide access to your VPC that hosts the VMware ESXi hosts and workloads by using the various VPC connectivity options, for example:



* Access to your VMware workloads attached directly to VPC subnets by using VPC network functions, such as floating IP addresses, security groups, and subnet ACLs.
* Access to your VMware workloads hosted on NSX-T software-defined networking (SDN) by using NSX-T Edge Nodes and Clusters and NSX-T Tier-0 Logical Routers.
* Private access by using VPC VPNaaS, Transit Gateway, or Direct Link.



* Access your VPC by using the various VPC connectivity options.







 Security planning and hardening 

You are responsible for securing, encrypting, and monitoring your VMware hosts, vCenter Server, NSX-T, and the workloads that are running in the hosts or cluster. In that way, you can meet your corporate, industry, and regulatory standards. The following steps provide generic guidelines to ensure proper security:



* The default host root UID passwords are stored and encrypted in the IBM Cloud. You can have them with the SSH key that you must provide by provisioning the bare metal server. It is recommended to change all host root IDs passwords after you finish the provisioning activities and configurations.
* Review password policies, such as complexity and expiration period, across all components.
* Review encryption settings across all components.
Cluster users must either be in your VPC network or connect through a [VPC VPN connection](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-vpnaas).





 Worker communication to other services or networks 

To connect your cluster with your on-premises data center, you can set up the VPC VPN service. The IBM Cloud VPC VPN connects your entire VPC to an on-premises data center. If your app workload requires other IBM Cloud services that support private cloud service endpoints, your worker nodes can automatically, securely communicate with these services over the private VPC network.





 External communication to apps that run on worker nodes 

After you test your app, you can expose it to the private network by creating a private Kubernetes LoadBalancer service or using the default private Ingress application load balancers (ALBs). The VPC load balancer that is automatically created in your VPC outside of your cluster when you use one of these services routes traffic to your app. Note that the VPC load balancer exposes your app to the private network only so that any on-premises system with a connection to the VPC subnet can access the app. You can improve the security of your cluster and control public traffic apps by modifying the default VPC security group for your cluster. Security groups consist of rules that define which inbound traffic is permitted for your worker nodes.

Ready to get started with a cluster for this scenario? After you plan your [high availability](https://cloud.ibm.com/docs/openshift?topic=openshift-ha_clusters) and [worker node](https://cloud.ibm.com/docs/openshift?topic=openshift-planning_worker_nodes) setups, see [Creating VPC clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-clusters).
* UI
* CLI
* Terraform







 Creating VPC clusters 

Virtual Private Cloud

Use the IBM Cloud CLI or the IBM Cloud console to create a standard VPC cluster, and customize your cluster to meet the high availability and security requirements of your apps.

Do not delete the subnets that you attach to your cluster during cluster creation or when you add worker nodes in a zone. If you delete a VPC subnet that your cluster used, any load balancers that use IP addresses from the subnet might experience issues, and you might be unable to create new load balancers.



 Prerequisites and notes 



* If worker nodes must access public endpoints, or if you plan to enable both the public and private cloud service endpoints, you must attach a public gateway to each subnet in your VPC to access default Red Hat OpenShift components such as the web console or OperatorHub.
* If you plan to enable both the public and private cloud service endpoints, you must attach a public gateway to each subnet to access default Red Hat OpenShift components such as the web console or OperatorHub. Additionally, a public network gateway is required when you want your cluster to access public endpoints, such as a public URL of another app or an IBM Cloud service that supports public cloud service endpoints only. Make sure to review the [VPC networking basics](https://cloud.ibm.com/docs/openshift?topic=openshift-plan_vpc_basics) to understand when a public network gateway is required and how you can set up your cluster to limit public access to one or more subnets only.
* Before you can use KMS encryption, you must create a KMS instance and set up the required service authorization in IAM. For more information, see [Managing encryption for the worker nodes in your cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionworker-encryption).
* By default, your cluster is provisioned with a VPC security group and a cluster-level security group.
For more information about this service, see [About File Storage for VPC (beta)](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-about).

UI enhancement
: When provisioning a new VPN gateway in a default VPC, the UI now populates the subnet table with the default subnet information.





 06 April 2021 

New Toronto region
: The Toronto region endpoint is now in service at https://ca-tor.iaas.cloud.ibm.com. For more information, see [Creating a VPC in a different region](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-in-a-different-region).





 01 April 2021 

Instance storage
: You can now provision a virtual server instance with instance storage, a set of one or more solid state drives directly attached to your instance. An instance storage disk provides fast, affordable, temporary storage to improve the performance of cloud-native workloads with scratch space, caching buffers, or a place for replicated data. To provision a virtual server instance with instance storage, you must select an instance storage [profile](https://cloud.ibm.com/docs/vpc?topic=vpc-profiles). For more information, see [About instance storage](https://cloud.ibm.com/docs/vpc?topic=vpc-instance-storage).

Dedicated hosts support instance storage
: You can now provision a dedicated host with an instance storage profile, providing the capability to host virtual server instances that include instance storage. For more information, see [Dedicated host profiles](https://cloud.ibm.com/docs/vpc?topic=vpc-dh-profiles).

Instance resize (GA)
: The ability to resize a virtual server instance by selecting a different profile to assign to the instance is now generally available. Profiles are a combination of instance attributes, such as the number of vCPUs, amount of RAM, network bandwidth, and more that define the size and capabilities of the virtual server instance.