vania-janet/multiturn-rag-retrieval-data huggingface dataset:
"eventTime": "2022-02-22T17:59:07.57+0000",
"action": "is.snapshot.create",
"outcome": "success",
"message": "Block Storage Snapshots for VPC: create my-snapshot-1",
"initiator": {
"id": "ABCid-45B7R6TVH4",
"typeURI": "service/security/account/user",
"name": "myname@mycompany.com",
"host": {
"address": "192.0.2.0"
},
"credential": {
"type": "token"
}
},
"target": {
"id": "crn:v1::public:is::a/cf27ad23-60e6-47d8-a4c1-b63ac14488f1::snapshot:09ca2bab-c5c4-4c06-b034-dda9bbeb859c",
"typeURI": "is.snapshot/snapshot",
"name": "my-snapshot-1"
},
"observer": {
"name": "ActivityTracker"
},
"reason": {
"reasonCode": 201,
"reasonType": "Created"
},
"severity": "normal",
"requestData": {
"generation": "2"
},
"responseData": {
"responseURI": "/v1/snapshots/09ca2bab-c5c4-4c06-b034-dda9bbeb859c"
},
"dataEvent": false,
* In the workload section of the contract, you can define the workload via Pod descriptors. Each pod can contain one or more container definitions. Previously, only one container described by docker compose was supported. For more information about using Pod descriptors, see the [play subsection](https://cloud.ibm.com/docs/vpc?topic=vpc-about-contract_sehpcr_contract_play). Container images described by Pod descriptors can be [validated by RedHat Simple Signing](https://cloud.ibm.com/docs/vpc?topic=vpc-about-contract_secontainer-image-by-pod-descriptors).



Changes to the attestation document



* In the attestation document se-checksums.txt, user-data.decrypted is removed, and Machine Type/Plant/Serial (the information required to identify the host machine) is added. For more information, see [Attestation](https://cloud.ibm.com/docs/vpc?topic=vpc-about-attestation).



Virtual network interface (beta)
: Virtual network interfaces are now available in a beta release for use with file share mount targets. For more information see [About virtual network interfaces](https://cloud.ibm.com/docs/vpc?topic=vpc-vni-about).

Instance group integration with network load balancers
: IBM Cloud Network Load Balancer (NLB) for VPC now integrates with instance groups to improve pool member scaling. When you create or update an instance group for auto scaling, you can specify an NLB pool for the instance group to manage. Attaching an instance group to a load balancer allows your pool back-end members to automatically scale up or down depending upon your usage and requirements. For more information see [Integrating an IBM Cloud Network Load Balancer for VPC with instance groups](https://cloud.ibm.com/docs/vpc?topic=vpc-nlb-integration-with-instance-groups).

Access control modes and granular authorization for File Storage for VPC file shares (beta)
One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------









 Virtual private clouds 



 ibmcloud is vpc 

View details of a VPC.

ibmcloud is vpc VPC [--show-attached] [--output JSON] [-q, --quiet]



 Command options 



* VPC: ID or name of the VPC.
* --show-attached: View details of resources (subnets, VPC routes and address prefix) attached to this VPC.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is vpc-address-prefix 

View details of a VPC address prefix.

ibmcloud is vpc-address-prefix VPC PREFIX [--output JSON] [-q, --quiet]



 Command options 



* VPC: ID or name of the VPC.
* PREFIX: ID or name of the VPC address prefix.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is vpc-address-prefix-create 

Create an address prefix.

ibmcloud is vpc-address-prefix-create PREFIX_NAME VPC ZONE_NAME CIDR [--default false | true] [--output JSON] [-q, --quiet]



 Command examples 



* ibmcloud is vpc-address-prefix-create my-prefix 72251a2e-d6c5-42b4-97b0-b5f8e8d1f479 us-south-2 10.0.0.0/24 --default true --output JSON
VPC CLI reference 

Use the following information as a reference of the command-line interface (CLI) commands that are available for IBM Cloud® Virtual Private Cloud (VPC).

This CLI reference is organized into the following sections:



* [Network commands](https://cloud.ibm.com/docs/vpc?topic=vpc-infrastructure-cli-plugin-vpc-referencenetwork)
* [Compute commands](https://cloud.ibm.com/docs/vpc?topic=vpc-infrastructure-cli-plugin-vpc-referencecompute-clis)
* [Regions and zones commands](https://cloud.ibm.com/docs/vpc?topic=vpc-infrastructure-cli-plugin-vpc-referencegeography)
* [Storage commands](https://cloud.ibm.com/docs/vpc?topic=vpc-infrastructure-cli-plugin-vpc-referencestorage)





 Prerequisites 



1. Install the [IBM Cloud CLI ![External link icon](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/includes/icons/launch-glyph.svg)](https://cloud.ibm.com/docs/cli).
2. Install or update the VPC infrastructure service plug-in.

ibmcloud plugin install vpc-infrastructure

To update, use the following command:

ibmcloud plugin update

To view installed plug-ins and versions, use the following command:

ibmcloud plugin list



--------------------





 NETWORK COMMANDS 

The following section provides information about CLI commands for network services.





 Flow logs 



 ibmcloud is flow-log-create 

Create a flow log.
Table 97. Platform roles - Security Group for VPC
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the platform role name and the column headers identify the specific information available about each role.

 Role Description 

 Administrator As an administrator, you can perform all platform actions based on the resource this role is being assigned, including assigning access policies to other users. 
 Editor As an editor, you can perform all platform actions except for managing the account and assigning access policies. 
 Operator As an operator, you can perform platform actions required to configure and operate service instances, such as viewing a service's dashboard. 
 Viewer As a viewer, you can view service instances, but you can't modify them. 







 Block Storage Snapshots for VPC 

Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use is.snapshot for the service name.

Platform roles

Actions



Table 98. Platform roles - Block Storage Snapshots for VPC
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the platform role name and the column headers identify the specific information available about each role.

 Role Description 

 Administrator As an administrator, you can create, view, list, modify, delete and restore block storage snapshots, including assigning access policies to other users. 
 Editor As an editor, you can create, view, list, modify, delete and restore block storage snapshots, except for assigning access policies to other users. 
 Operator As an operator, you can view, list and restore block storage snapshots, but you can't modify them. 
 Viewer As a viewer, you can view and list block storage snapshots, but you can't modify them. 







 Subnet 

Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use is.subnet for the service name.

Platform roles

Actions



Table 99. Platform roles - Subnet
VPC CLI reference 

Use the following information as a reference of the command-line interface (CLI) commands that are available for IBM Cloud® Virtual Private Cloud (VPC).

This CLI reference is organized into the following sections:



* [Network commands](https://cloud.ibm.com/docs/vpc?topic=vpc-infrastructure-cli-plugin-vpc-reference&interface=uinetwork)
* [Compute commands](https://cloud.ibm.com/docs/vpc?topic=vpc-infrastructure-cli-plugin-vpc-reference&interface=uicompute-clis)
* [Regions and zones commands](https://cloud.ibm.com/docs/vpc?topic=vpc-infrastructure-cli-plugin-vpc-reference&interface=uigeography)
* [Storage commands](https://cloud.ibm.com/docs/vpc?topic=vpc-infrastructure-cli-plugin-vpc-reference&interface=uistorage)





 Prerequisites 



1. Install the [IBM Cloud CLI ![External link icon](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/includes/icons/launch-glyph.svg)](https://cloud.ibm.com/docs/cli).
2. Install or update the VPC infrastructure service plug-in.

ibmcloud plugin install vpc-infrastructure

To update, use the following command:

ibmcloud plugin update

To view installed plug-ins and versions, use the following command:

ibmcloud plugin list



--------------------





 NETWORK COMMANDS 

The following section provides information about CLI commands for network services.





 Flow logs 



 ibmcloud is flow-log-create 

Create a flow log.
},
"vpc":{
"id":"6054c339-8a17-4c75-958c-4a23358a37ed"
},
"image":{
"id":"524d52aa-b267-4801-a7d2-6d4fe75baf65"
},
"zone":{
"href":"https://us-south.iaas.cloud.ibm.com/v1/regions/us-south/zones/us-south-3"
},
"primary_network_interface":{
"name":"ifv-nic",
"subnet":{
"id":"7382-4b33d349-1752-4bf9-ab73-751ec065e193"
}
}
}'





 Step 2 - Stopping the running instance 

Stop the running instance by specifying the stop action in a POST /instances call:

curl -X POST "$vpc_api_endpoint/v1/instances/{instance-id}/gen/actions?version=2021-05-20"
$iam_token" -d
'{
"type":"stop"
}'





 Step 3 - Creating an image and provide the ID of the boot volume image 

The source boot volume originates from an image. This boot volume is used to populate the new image's operating system information.

Create an image with a POST /images request and pass the boot volume ID of the instance that you created in [Step 1](https://cloud.ibm.com/docs/vpc?topic=vpc-create-ifvifv-create-instance) as source volume. See the following example:

curl -X POST "$vpc_api_endpoint/v1/images?version=2021-05-20"
$iam_token" -d
{
"name": "test-ifv-boot-volume",
"source_volume": {
No. The VPC provides access to new availability zones in multi-zone regions. Compute, network, and storage resources are designed to function in the VPC.





 What is image from volume and how does it relate to Block Storage for VPC volumes? 

With the image from volume feature, you can create a custom image directly from a Block Storage for VPC boot volume. Then, you can use the custom image to provision other virtual server instances. For more information, see [About creating an image from a volume](https://cloud.ibm.com/docs/vpc?topic=vpc-image-from-volume-vpc).







 Volume management questions 



 How is the boot disk created for an instance and how does it relate to the virtual machine image? 

The boot disk, also called a boot volume, is created when you provision a virtual server instance. The boot disk of an instance is a cloned image of the virtual machine image. For stock images, the boot volume capacity is 100 GB. If you are importing a custom image, the boot volume capacity can be 10 GB to 250 GB, depending on what the image requires. Images smaller than 10 GB are rounded up to 10 GB. The boot volume is deleted when you delete the instance to which it is attached.





 When can I delete a Block Storage for VPC data volume? 

You can delete a Block Storage for VPC data volume only when it isn't attached to a virtual server instance. [Detach the volume](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-block-storagedetach) before you delete it. Boot volumes are detached and deleted when the instance is deleted.





 What happens to my data when I delete a Block Storage for VPC data volume? 

When you delete a Block Storage for VPC volume, your data immediately becomes inaccessible. All pointers to the data on that volume are removed. The inaccessible data is eventually overwritten as new data is written to the data block. IBM guarantees that data deleted cannot be accessed and that deleted data is eventually overwritten.
A VPC can span multiple zones within its assigned region.





 Zones 

A zone is an abstraction that refers to the physical data center that hosts the compute, network, and storage resources, plus the related cooling and power, which provides services and applications. Zones are isolated from each other to create no shared single point of failure, improved fault tolerance, and reduced latency. Each zone is assigned a default address prefix, which specifies the address range in which subnets can be created. If the default address scheme does not suit your requirements, such as if you want to bring your own public IPv4 address range, you can customize the address prefixes.







 Characteristics of subnets in the VPC 

Each subnet consists of a specified IP address range (CIDR block). Subnets are bound to a single zone, and they cannot span multiple zones or regions. Subnets in the same VPC are connected to each other.



 Addresses reserved by the system 

Certain IP addresses are reserved for use by IBM for operating the VPC. The following addresses are the reserved addresses (these IP addresses assume that the subnet's CIDR range is 10.10.10.0/24):



* First address in the CIDR range (10.10.10.0): Network address
* Second address in the CIDR range (10.10.10.1): Gateway address
* Third address in the CIDR range (10.10.10.2): reserved by IBM
* Fourth address in the CIDR range (10.10.10.3): reserved by IBM for future use
* Last address in the CIDR range (10.10.10.255): Network broadcast address









 External connectivity 

External connectivity can be achieved by using a public gateway that is attached to a subnet, or a floating IP address that is attached to a virtual server instance. Use a public gateway for source network address translation (SNAT) and a floating IP for destination network address translation (DNAT).

Table 1 summarizes the differences between the options:



Table 1. External connectivity options

 Public gateway Floating IP 

 Instances can initiate connections to the internet, but they can't receive connections from the internet. Instances can initiate or receive connections to or from the internet
Example for all IBM Cloud Kubernetes Service resources.

provider "ibm" {
}

Example for all other resources.

provider "ibm" {
region = "<region_name>"
}







 Adding IBM Cloud resources to the resource block 

Use resource blocks to define the IBM Cloud resources that you want to manage with IBM Cloud Schematics.

To support a multi-cloud approach, Terraform works with multiple cloud providers. A cloud provider is responsible for understanding the resources that you can provision, their API, and the methods to expose these resources in the cloud. To make this knowledge available to users, every supported cloud provider must provide a command-line plug-in for Terraform that users can use to work with the resources. To find an overview of the resources that you can provision in IBM Cloud, see the [IBM Cloud Provider Plug-in for Terraform reference](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-resources-datasource-list).

Example infrastructure code for provisioning a VPC.

resource ibm_is_vpc "vpc" {
name = "myvpc"
}



 Referencing resources in other resource blocks 

Review the options that you have to reference existing resources in other resource blocks of your Terraform configuration file.

The IBM Cloud Provider plug-in reference includes two types of objects, data sources and resources. You can use both objects to reference resources in other resource blocks.



* Resources: To create a resource, you use the resource definition in the IBM Cloud Provider plug-in reference. A resource definition includes the syntax for configuring your IBM Cloud resources and an Attributes reference that shows the properties that you can reference as input parameters in other resource blocks. For example, when you create a VPC, the ID of the VPC is made available after the creation. You can use the ID as an input parameter when you create a subnet for your VPC. Use this option if you combine multiple resources in one Terraform configuration file.

Example of an infrastructure code.

resource ibm_is_vpc "vpc" {
name = "myvpc"
ibmcloud is vpc-routing-table-route-delete VPC ROUTING_TABLE (ROUTE1 ROUTE2 ...) [--output JSON] [-f, --force] [-q, --quiet]



 Command options 



* VPC: ID or name of the VPC.
* ROUTING_TABLE: ID or name of the VPC routing table.
* ROUTE1: ID or name of the VPC route.
* ROUTE2: ID or name of the VPC route.
* --output: Specify output format, only JSON is supported. One of: JSON.
* --force, -f: Force the operation without confirmation.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is subnet-routing-table 

View details of routing table that is attached to the subnet.

ibmcloud is subnet-routing-table SUBNET [--vpc VPC] [--output JSON] [-q, --quiet]



 Command options 



* SUBNET: ID or name of the subnet.
* --vpc: ID or name of the VPC. It is only required to specify the unique resource by name inside this VPC.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------









 Security groups 



 ibmcloud is security-group 

View details of a security group.

ibmcloud is security-group GROUP [--vpc VPC] [--output JSON] [-q, --quiet]



 Command options 



* GROUP: ID or name of the security group.
* --vpc: ID or name of the VPC. It is only required to specify the unique resource by name inside this VPC.
* --output: Specify output format, only JSON is supported. One of: JSON.
* POOL2: ID or name of the pool.
* --vpc: ID or name of the VPC. It is only required to specify the unique resource by name inside this VPC.
* --output: Specify output format, only JSON is supported. One of: JSON.
* --force, -f: Force the operation without confirmation.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is load-balancer-pool-member 

View details of load balancer pool member.

ibmcloud is load-balancer-pool-member LOAD_BALANCER POOL MEMBER_ID [--vpc VPC] [--output JSON] [-q, --quiet]



 Command options 



* LOAD_BALANCER: ID or name of the load balancer.
* POOL: ID or name of the pool.
* MEMBER_ID: ID of the member.
* --vpc: ID or name of the VPC. It is only required to specify the unique resource by name inside this VPC.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is load-balancer-pool-member-create 

Create a load balancer pool member.

ibmcloud is load-balancer-pool-member-create LOAD_BALANCER POOL PORT TARGET [--vpc VPC] [--weight WEIGHT] [--output JSON] [-q, --quiet]



 Command examples 



* ibmcloud is load-balancer-pool-member-create 72251a2e-d6c5-42b4-97b0-b5f8e8d1f479 72b27b5c-f4b0-48bb-b954-5becc7c1dcb3 3000 192.168.100.5
VPC VPC provides you the security of a private cloud environment with the dynamic scalability of a public cloud. 
 zones You must have one VPC subnet for each zone in your cluster. The available zones depend on the metro location that you created in the VPC. 
 subnet VPC subnets is used to provide private IP addresses for your worker nodes and load balancer services in your cluster. You cannot change the number of IP addresses that a VPC subnet has. 
 master node Controls and manages a set of worker nodes (workloads runtime) and resembles a cluster in Kubernetes. 
 cluster A cluster contains a control plane and one or more compute machines, or nodes. Nodes run the applications and workloads. 
 worker node Add the zone to your worker pool. When you add a zone to a worker pool, the worker nodes that are defined in your worker pool are provisioned in the zone and considered for future workload scheduling. 



You can add worker nodes and pool to your VPC cluster by using a ibm_container_vpc_worker_pool provider resource.

The costs are incurred based on your resource usage. For more information about the VPC pricing, see [VPC pricing](https://www.ibm.com/cloud/virtual-servers/pricing).





 Objectives 

In this tutorial, you will do the following:



* Learn how to use an IBM-provided Terraform template to create a Virtual Private Cloud (VPC) and provision an IBM Cloud Kubernetes Service cluster that runs on Virtual Servers for VPC.
* Create an IBM Cloud Object Storage service instance and bind the service to your IBM Cloud Kubernetes Service cluster.
* Explore how to create an IBM Cloud Schematics Workspace.
* Create a Terraform execution plan and apply your Terraform template in IBM Cloud.
* Review the IBM Cloud® resources that you create.







 Time required 

1 hour





 Audience 

This tutorial is intended for developers and system administrators who want to learn how to use Terraform templates to create and manage cloud infrastructure services by using IBM Cloud Schematics.





 Prerequisites 

Before you begin, complete the following prerequisites.
Requests for provisioning resources do not contain a resource ID.

If you do not find a context-based restriction event in Activity Tracker, it's possible access was denied due to IAM access policies. For more information, see [VPC IAM getting started guide](https://cloud.ibm.com/docs/vpc?topic=vpc-iam-getting-started).





 Client-to-site VPN data plane impact with context-based restrictions 

If a user enables a User ID and passcode when configuring [client authentication](https://cloud.ibm.com/docs/vpc?topic=vpc-client-to-site-vpn-planningclient-authentication) for a client-to-site VPN, and creates context-based rules on VPC resources, the client connection to the VPN is impacted by context-based restrictions. If the VPN client remote IP is not in the Network Zone, the connection to the VPN server returns an Auth Failed error.

After the VPN client connects to the VPN server, the requests to the VPE endpoint or Cloud Service Endpoint (CSE) are controlled with context-based restrictions. Also, the requests' source IP is the VPC [Cloud service endpoint source addresses](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-behind-the-curtaincse-source-addresses). Make sure that the VPC CSE source addresses are in the CBR Network Zone; otherwise, the request is denied.







 Limitations 



* Context-based restrictions protect only the actions associated with the [VPC Infrastructure Services APIs](https://cloud.ibm.com/apidocs/vpc) or the is plugin, through the IBM CLI. The SDK and Terraform options are also supported. Actions associated with the following platform APIs are not protected by context-based restrictions:



* [Resource Instance List APIs](https://cloud.ibm.com/apidocs/resource-controller/resource-controllerlist-resource-instances)