vania-janet/multiturn-rag-retrieval-data huggingface dataset:
IBM Cloud Transit Gateway is integrated into the [IBM Cloud usage dashboard](https://cloud.ibm.com/docs/billing-usage?topic=billing-usage-viewingusage), which provides a summary of estimated charges for all services and resources that are used per month in your organizations. This includes the number of connections and the amount of traffic flowing across your transit gateways. IBM Cloud Transit Gateway usage is billed and reported as part of the [IBM Cloud invoice process](https://cloud.ibm.com/docs/billing-usage?topic=billing-usage-managing-invoices).
* Are there notifications through email for events of unavailability of the service?

You should use the standard [IBM Cloud notification process](https://cloud.ibm.com/docs/get-support?topic=get-support-viewing-notifications) for any maintenance events.
* Can I generate a route report for a transit gateway?

Yes, you can. For detailed instructions, see [IBM Cloud Transit Gateway route reports](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-route-reports).
* Can I interconnect VPCs using a transit gateway?

You can create a single transit gateway or multiple transit gateways to interconnect more than one IBM Cloud VPCs. You can also connect your IBM Cloud classic infrastructure to a transit gateway to provide seamless communication with classic infrastructure resources. For more information, refer to [Interconnecting VPCs](https://cloud.ibm.com/docs/vpc?topic=vpc-interconnectivity&interface=cliinterconnecting-vpcs).



VLANs



* Can I move an existing device to a new VLAN?

Existing compute devices, such as a virtual server instance (VSI) or a bare metal, cannot be moved to a new VLAN. A new VSI or bare metal must be provisioned in the new VLAN and deprovisioned accordingly. Single VLAN firewalls cannot be moved to a new VLAN either.
Additionally, all the underlying [VPC quotas, VPC limits](https://cloud.ibm.com/docs/vpc?topic=vpc-quotas), [VPC service limitations](https://cloud.ibm.com/docs/vpc?topic=vpc-limitations), and [regular service limitations](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_limitationstech_limits) apply.



 Compute 

Keep in mind that the [service](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_limitationstech_limits) limitations also apply.



VPC cluster compute limitations

 Category Description 

 Encryption The secondary disks of your worker nodes are encrypted at rest by default by the [underlying VPC infrastructure provider](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-aboutvpc-storage-encryption). However, you can't [bring your own encryption to the underlying virtual server instances](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-instances-byok). 
 Location VPC clusters are available only in [select multizone metro locations](https://cloud.ibm.com/docs/openshift?topic=openshift-regions-and-zoneszones-vpc). 
 Virtual Private Cloud See [Limitations](https://cloud.ibm.com/docs/vpc?topic=vpc-limitations) and [Quotas](https://cloud.ibm.com/docs/vpc?topic=vpc-quotas). 
 Worker node flavors Only certain flavors are available for worker node [virtual machines](https://cloud.ibm.com/docs/openshift?topic=openshift-planning_worker_nodesvm). Bare metal machines are not supported. 
 Worker node host access For security, you can't SSH into the worker node compute host. 
 Worker node updates You can't update or reload VPC worker nodes.
FAQ about licensing 

Find answers to frequently asked questions about licensing.



 What happens if the license key you provided is not correct? 

All license keys that you provide are validated to ensure that the following conditions are met:



* They are correct for the corresponding VMware components.
* They meet the minimum edition and CPU requirements of the VMware components.



If the validation of any license key fails, you get a notification and you cannot proceed with the instance order.





 Can you provide a license key with more than 8 CPUs? 

Yes. For each VMware component, one license per CPU is required. Currently, all VMware vCenter Server® servers have two CPUs. Therefore, two licenses are required for each server. It is recommended that you provide a license key that can support the base instance and any expansion nodes that you want to add to the instance in the future.





 How are my service license charges being calculated? 



* For Caveonix RiskForesight™ on VMware Regulated Workloads or Security and Compliance Readiness Bundle, each server requires a service license.
* For VMware HCX™, service licenses are charged per two CPUs. Dual servers require a single license each. Quad servers require two licenses each. For servers with more than 16 cores per CPU, an increase in the license charge occurs.
* For Entrust CloudControl™ and Entrust DataControl®, service licenses are charged per two CPUs. Dual servers require a single license each. Quad servers require two licenses each.
* For VMware Aria® Operations™, license charges depend on the CPU type. Dual servers have different charges than Quad servers. For servers with more than 16 cores per CPU, an increase in the license charge occurs.
* All other services have static service license charges that do not change based on the number of servers in the instance.







 Why is there a discrepancy in the supported number of VMs for VMware Aria Operations licenses? 

You might see a discrepancy in the supported number of VMs between what is displayed on the VMware Aria Operations Manager console and the per CPU metering in IBM Cloud.
<custom-storageclass> vpc.block.csi.ibm.io 4m26s
5. Follow the steps in [Adding Block Storage for VPC to your apps](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-blockvpc-block-add) to create a PVC with your customized storage class to provision Block Storage for VPC. Then, mount this storage to a sample app.
6. Optional: [Verify your Block Storage for VPC file system type](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-blockvpc-block-fs-verify).







 Verifying your Block Storage for VPC file system 

You can create a customized storage class to provision Block Storage for VPC with a different file system, such as xfs or ext3. By default, all Block Storage for VPC instances are provisioned with an ext4 file system.



1. Follow the steps to [create a customized storage class](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-blockvpc-customize-storage-class) with the file system that you want to use.
2. Follow steps 4-9 in [Adding Block Storage for VPC to your apps](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-blockvpc-block-add) to create a PVC with your customized storage class to provision Block Storage for Classic with a different file system. Then, mount this storage to an app pod.

Your app might take a few minutes to mount the storage and get into a Running state.
3. Verify that your storage is mounted with the correct file system. List the pods in your cluster and note the Name of the pod that you used to mount your storage.

oc get pods
4. Log in to your pod.

oc exec <pod_name> -it bash
5. List the mount paths inside your pod.

mount | grep /dev/xvdg
* [Site-to-site VPN](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-overview)







 Step 4: Set up and provision VPC and virtual server instances 



 Option 1: Manual 

The RMM solution handles the OS, application, and data movement. It does not need to set up a VPC target side; you need to handle the setup. You first set up the VPC infrastructure. At a bare minimum, you must set up a VPC, subnets, and the corresponding virtual server instances that you are planning to migrate. The new target virtual server instance profile (vCPU and vMemory) does not need to match the source. However, as for the storage, it needs to be the same or greater in size.

This document does not provide the details for setting up the VPC infrastructure. It is described in each of the relevant VPC product document pages.



1. Create a VPC.
2. Create subnets.
3. Order the virtual server instance.



* SSH key (RMM SSH keys need to be added in addition to bastion SSH key)
* Operating system name (Linux or Windows and their respective version)
* Security groups
* Secondary volume









 Option 2: Auto-provision 

RMM can automatically provision a virtual server instance of VPC. Enable the wave level setting Autoprovision and then configure RMM with necessary details. Use these steps to use the auto-provision feature:



 Setting up a cloud user 



1. Log in to the RackWare web console.
2. In the RackWare web console, navigate to Configuration > Clouduser.
3. When you add a cloud user, enter a name and select IBM Cloud VPC for the Cloud Provider. Select the region where you want to auto-provision the virtual server instance, and enter your IBM Cloud API key.
4. Click Add.







 Creating a wave and replication 

A wave contains a single host or multiple hosts that will be migrated.
* Check whether VPN for VPC has IPsec policy authentication that is set to minimum "sha256"
* Check whether OS disks are encrypted with customer-managed keys
* Check whether VPN for VPC has an IPsec policy that does not have Perfect Forward Secrecy (PFS) disabled
* Check whether App ID email dispatchers are using HTTPS only
* Check whether Cloud Object Storage is accessible only through HTTPS
* Check whether App ID user data is encrypted
* Check whether Hyper Protect DBaaS for MongoDB is enabled with customer-managed encryption and Keep Your Own Key (KYOK)
* Check whether unattached disks are encrypted with customer-managed keys
* Check whether Virtual Servers for VPC boot volumes are enabled with customer-managed encryption and Keep Your Own Key (KYOK)
* Check whether VPN for VPC has a Dead Peer Detection policy that is set to "restart"
* Check whether Application Load Balancer for VPC is configured to convert HTTP client requests to HTTPS
* Check whether Virtual Servers for VPC is provisioned from an encrypted image
* Check whether Event Streams is enabled with customer-managed encryption and Keep Your Own Key (KYOK)
* Check whether App ID is enabled with customer-managed encryption and Keep Your Own Key (KYOK)
* Check that Schematics uses KYOK for Key management
* Check whether App ID webhooks are using HTTPS only
* Check whether Block Storage for VPC is enabled with customer-managed encryption and Keep Your Own Key (KYOK)
* Check whether Hyper Protect DBaaS for PostgreSQL is enabled with customer-managed encryption and Keep Your Own Key (KYOK)
* Check whether VPN for VPC has Internet Key Exchange (IKE) policy encryption that is not set to "triple_des"
* Check whether VPN for VPC has a Diffie-Hellman group set to at least group
* Check whether VPN for VPC has Internet Key Exchange (IKE) policy authentication that is set to minimum 'sha256'
* Check whether App ID redirect URIs are using HTTPS only
* Check whether Cloud Internet Services (CIS) has TLS mode set to End-to-End CA signed
[Load Balancer](https://cloud.ibm.com/docs/vpc?topic=vpc-load-balancers) is.load-balancer [Location-based events](https://cloud.ibm.com/docs/vpc?topic=vpc-at-eventsevents-load-balancers) 
 [VPN](https://cloud.ibm.com/docs/vpc?topic=vpc-using-vpn) is.vpn [Location-based events](https://cloud.ibm.com/docs/vpc?topic=vpc-at-eventsat-events) 
 [Client VPN](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-client-to-site-overview) is.vpn-server [Location-based events](https://cloud.ibm.com/docs/vpc?topic=vpc-at-eventsevents-vpn-server) 
 [Images](https://cloud.ibm.com/docs/vpc?topic=vpc-about-images) is.image [Location-based events](https://cloud.ibm.com/docs/vpc?topic=vpc-at-eventsevents-images) 







 Watson AI 

The following table lists Watson AI services that send auditing events:



Table 14. List of Watson AI services

 Service CRN service name Events 

 [IBM Watson® Assistant](https://cloud.ibm.com/docs/assistant?topic=assistant-getting-started) conversation [Location-based events](https://cloud.ibm.com/docs/assistant?topic=assistant-at-events) 
 [IBM Watson® Discovery](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-getting-started) discovery [Location-based events](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-at_events)
* UI
* CLI
* API
* Terraform







 Managing IAM access for VPC Infrastructure Services 

Access to IBM Cloud® Virtual Private Cloud service instances for users in your account is controlled by IBM Cloud® Identity and Access Management (IAM). Every user that accesses the VPC Infrastructure Services service in your account must be assigned an access policy with an IAM role. Review the following roles, actions, and more to help determine the best way to assign access to VPC Infrastructure Services.

The access policy that you assign users in your account determines what actions a user can perform within the context of the service or specific instance that you select. The allowable actions are customized and defined by the VPC Infrastructure Services as operations that you are allowed to perform on the service. Each action is mapped to an IAM platform or service role that you can assign to a user.

If a specific role and its actions don't fit the use case that you're looking to address, you can [create a custom role](https://cloud.ibm.com/docs/account?topic=account-custom-rolescustom-access-roles) and pick the actions to include.

IAM access policies enable access to grant at different levels. The following are some options that are included:



* Access across all instances of the service in your account
* Access to an individual service instance in your account
* Access to a specific resource within an instance, such as vpcId or instanceId.



The following table lists the VPC resource attributes. For more information, see [VPC resource attributes](https://cloud.ibm.com/docs/vpc?topic=vpc-resource-attributes&interface=cli).



Table 1. VPC resource attributes

 Resource Resource Attribute 

 Auto Scale for VPC instanceGroupId:<instance-group-id> 
 Backup service backupPolicyId: <backup-policy-id> 
 Block Storage for VPC volumeId: <volume-id> 
 Baremetal server bareMetalServerId: <bare-metal-server-id> 
 Dedicated Host for VPC dedicatedHostId:<dedicated-host-id>
For more information about the file shares VPC API, see the [VPC API reference](https://cloud.ibm.com/apidocs/vpc).



 Before you begin 

Define variables for the IAM token, API endpoint, and API version. For instructions, see [Setting up your API and CLI environment](https://cloud.ibm.com/docs/vpc?topic=vpc-set-up-environment).

To use your own encryption key to protect your new volume, provision a key management service (KMS). For a one-time setup procedure, see [Prerequisites for setting up customer-managed encryption](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-planningbyok-encryption-prereqs). For more information about locating the CRN of an existing key, see [Key Protect - Retrieving your instance ID and cloud resource name (CRN)](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-instance-ID) and [Hyper Protect Crypto Services Viewing details about a key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-key-details).

A good way to learn more about the API is to click Get sample API call on the provisioning pages in IBM Cloud console. You can view the correct sequence of API requests and better understand actions and their dependencies.





 Creating a data volume as part of instance provisioning with the API 

Make a POST /instances request to create an instance, and define the volume by using the volume_attachments parameter. Specify a volume name, capacity, and profile. Also, specify generation=2 in the request.

Valid volume names can include a combination of lowercase alpha-numeric characters (a-z, 0-9) and the hyphen (-), up to 63 characters. Volume names must begin with a lowercase letter. Volume names must be unique across the entire VPC infrastructure.
Securely access remote instances with a bastion host 

This tutorial may incur costs. Use the [Cost Estimator](https://cloud.ibm.com/estimator/review) to generate a cost estimate based on your projected usage.

This tutorial walks you through the deployment of a bastion host to securely access remote instances within a Virtual Private Cloud (VPC). A bastion host is an instance that is provisioned with a public IP address and can be accessed via SSH. Once set up, the bastion host acts as a jump server, allowing secure connection to instances provisioned without a public IP address.

To reduce exposure of servers within the VPC, you will create and use a bastion host. Administrative tasks on the individual servers are going to be performed using SSH, proxied through the bastion. Access to the servers and regular internet access from the servers, e.g., for software installation, will only be allowed with a special maintenance security group attached to those servers.



 Objectives 



* Learn how to set up a bastion host and security groups with rules
* Securely manage servers via the bastion host



Zoom

![Architecture](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/solution47-vpc-secure-management-bastion-server/ArchitectureDiagram.png)

Figure 1. Architecture diagram of the tutorial



1. After setting up the required infrastructure (subnets, security groups with rules, virtual server instances) on the cloud, the admin (DevOps) connects (SSH) to the bastion host using the private SSH key.
2. The admin assigns a maintenance security group with proper outbound rules.
3. The admin connects (SSH) securely to the instance's private IP address via the bastion host to install or update any required software eg., a web server
4. The internet user makes an HTTP/HTTPS request to the web server.







 Before you begin 



* Check for user permissions.
You are billed based on the current volume size at the metering time. The following table shows an example of how you are billed based on your volume creation:



Table 7. Calculation of data volume

 Volume size you create You are billed 

 10 GB 10 GB 
 10+5 GB 15 GB 



* Image backing volumes:These volumes are part of a boot image in your cloud-instance boot image catalog. You are billed based on the total volume size(s) contained in the image.

When the image has a single backing volume, you are billed based on the GB size of the single volume. When the image has multiple backing volumes, you are billed based on tallying up the size(s) of all the image backing volumes. The following table shows an example of how you are billed based on your boot volume:



Table 8. Calculation of image backing volume

 Image volume size Single or multiple backing You are billed 

 20 GB Single backing volume 20 GB 
 volume 1 (20 GB), volume 2 (10 GB) Multiple backing volume 30 GB 



* Deployed VM volumes: These volumes are created when you deploy a VM with an image. The deployed VMs will get a copy of all the volumes in the image. Any additional data volumes attached to the deployed VM are already accounted for under Data Volumes. The following table shows an example of how you are billed based on the VMs that you deploy:



Table 9. Calculation of deployed VMs volume

 Image backing volume You are billed 

 20 GB 20 GB 
 20 GB + 30 GB 50 GB 







 Use case of account billable storage 

The following table shows the use case on how you are billed based on the storage that you use (assuming tier 1):

Data volumes of 235 GB

Boot volumes of 200 GB

Deployed VMs of 160 GB



Table 10. Account billable for storage use case

 Name Size State/Description 

 data-volume-1 20 GB Available 
 data-volume-2 25 GB In-use (attached to vm-1) 
 data-volume-3 100 GB In-use (attached to vm-1) 
 data-volume-4 30 GB Available
All Very High Memory profiles are provisioned with temporary SSD-backed [instance storage](https://cloud.ibm.com/docs/vpc?topic=vpc-instance-storage) at no additional charge. The following Very High Memory profiles are available on Intel® x86 processors.

Intel x86-64



Table 6. Very High Memory profiles options for x86-64 instances
Very High Memory profiles options for Intel x86-64 virtual server instances.

 Instance profile vCPU Cores GiB RAM Bandwidth Cap (Gbps) Instance storage (GB) 

 vx2d-2x28 2 1 28 4 1x60 
 vx2d-4x56 4 2 56 8 1x120 
 vx2d-8x112 8 4 112 16 1x240 
 vx2d-16x224 16 8 224 32 1x480 
 vx2d-44x616 44 22 616 80 1x1320 
 vx2d-88x1232 88 44 1232 80 2x1320 
 vx2d-144x2016 144 72 2016 80 2x2160 
 vx2d-176x2464 176 88 2464 80 2x2640 







 Ultra High Memory 

Ultra High Memory profiles are hosted exclusively on the latest generation Intel® Xeon® Platinum Cascade Lake server hosts. This profile family offers our highest vCPU to memory ratio with 28 GiB of memory for every 1 vCPU of compute and up to 5.7 TiB of available RAM and is optimized for running memory intensive applications and in-memory database such as SAP HANA, Memcached, or Redis. All Very High Memory profiles are provisioned with temporary SSD-backed [instance storage](https://cloud.ibm.com/docs/vpc?topic=vpc-instance-storage) at no additional charge.

Ultra High Memory profiles are available in the US South (Dallas) and EU Germany (Frankfurt) regions. Additional regions will be added.

The following Ultra High Memory profiles are available for x86-64 processors:

Intel x86-64



Table 7. Ultra High Memory profiles options for x86-64 instances
Figure 1. Architecture diagram of the tutorial



1. The admin (DevOps) provisions VSIs in subnets under two different zones in a VPC in region 1 and repeats the same in a VPC created in region 2.
2. The admin creates a load balancer with a backend pool of servers in different zones of region 1 and a frontend listener. Repeats the same in region 2.
3. The admin provisions a IBM Cloud Internet Services instance with an associated custom domain and creates a global load balancer pointing to the load balancers created in two different VPCs.
4. The admin enables HTTPS encryption by adding the domain SSL certificate to the Secrets Manager service.
5. The user makes an HTTP/HTTPS request and the global load balancer handles the request.
6. The request is routed to the load balancers both on the global and local level. The request is then fulfilled by the available server instance.







 Before you begin 



* Check for user permissions. Be sure that your user account has sufficient permissions to create and manage VPC resources. See the list of [required permissions](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-user-permissions-for-vpc-resources) for VPC.
* You need an SSH key to connect to the virtual servers. If you don't have an SSH key, see [the instructions](https://cloud.ibm.com/docs/vpc?topic=vpc-ssh-keys) for creating a key for VPC.







 Step 1: Create virtual private clouds, subnets and virtual server instances 

In this section, you will create your own VPC in region 1 with subnets created in two different zones of region 1 followed by the provisioning of VSIs.



 Create a virtual private cloud 



1. Navigate to [Virtual private clouds](https://cloud.ibm.com/vpc-ext/network/vpcs) page and click on Create.
2.