vania-janet/multiturn-rag-retrieval-data huggingface dataset:
"id": "'$vpc'"
},
"primary_network_interface": {
"subnet": {
"id": "'$subnet'"
}
},
"keys":[{"id": "'$key'"}],
"profile": {
"name": "'$profile_name'"
},
"image": {
"id": "'$image_id'"
}
}'





 Provision an instance from a private catalog image by using the API 

You can provision an instance with a private catalog image by specifying the image's offering_crn or the version_crn subproperty as the value of the catalog_offering property.



* Create an instance by using a private catalog image from the latest version of a catalog product offering.

curl -X POST "$vpc_api_endpoint/v1/instances?version=$api_version&generation=2" -H "Authorization:$iam_token" -d '{
"name": "my-instance",
"zone": {
"name": "us-south-3"
},
"vpc": {
"id": "'$vpc'"
},
"primary_network_interface": {
"subnet": {
"id": "'$subnet'"
}
},
"keys":[{"id": "'$key'"}],
"profile": {
"name": "'$profile_name'"
},
"catalog_offering": {
"offering": {
"crn": "'$offering_crn'"
}
}'
* Create an instance by using a private catalog image from a specific version of a catalog product offering.

curl -X POST "$vpc_api_endpoint/v1/instances?version=$api_version&generation=2" -H "Authorization:$iam_token" -d '{
You can specify customer-managed encryption when you create Block Storage for VPC volumes during instance provisioning. You can also specify it when you create a stand-alone volume.

Figure 1 shows the procedure for creating a data volume with customer-managed encryption during instance provisioning. The volume is automatically attached to the instance.

Zoom

![Figure shows the procedure for creating an instance with a customer-managed encrypted volume.](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc//images/vpc_flowchart_instances_color.svg)

Figure 1. Creating an instance with a customer-managed encrypted volume.

Figure 2 shows the procedure for creating a stand-alone volume and attaching it to an instance later.

Zoom

![Figure shows the procedure for creating Block Storage for VPC volumes with customer-managed encryption.](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc//images/vpc_flowchart_volumes_color.svg)

Figure 2. Creating a Block Storage for VPC volume with customer-managed encryption.







 About encrypted custom images 

You can create a QCOW2 custom image that meets the requirements for IBM Cloud VPC infrastructure and [encrypt it](https://cloud.ibm.com/docs/vpc?topic=vpc-create-encrypted-custom-imagemanually-encrypt-image) by using your own LUKS passphrase and root key. After you encrypt the custom image with your own passphrase, you upload it to IBM Cloud Object Storage.

To import an encrypted custom image to IBM Cloud VPC, begin by setting up a key management service (KMS) instance, either Key Protect or Hyper Protect Crypto Services.
* ROUTE: ID or name of the VPC route.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is vpc-routing-table-route-create 

Create a VPC route.

ibmcloud is vpc-routing-table-route-create VPC ROUTING_TABLE --zone ZONE_NAME --destination DESTINATION_CIDR [--action delegate_vpc | delegate | deliver | drop] [--priority PRIORITY] [--next-hop NEXT_HOP --vpngw VPNGW]] [--name NAME] [--output JSON] [-q, --quiet]



 Command examples 



* ibmcloud is vpc-routing-table-route-create 72b27b5c-f4b0-48bb-b954-5becc7c1dcb3 72b27b5c-f4b0-48bb-b954-5becc7c1d456 --name my-vpc-route --action deliver --zone us-south-1 --destination 10.2.2.0/24 --next-hop 10.0.0.2 --output JSON
* ibmcloud is vpc-routing-table-route-create my-vpc my-routing-table --name my-vpc-route --action deliver --zone us-south-1 --destination 10.2.2.0/24 --next-hop 10.0.0.2 --output JSON
* ibmcloud is vpc-routing-table-route-create 72b27b5c-f4b0-48bb-b954-5becc7c1dcb3 72b27b5c-f4b0-48bb-b954-5becc7c1d456 --name my-vpc-route --action delegate --zone us-south-1 --destination 10.2.2.0/24 --output JSON
vpc = <vpc_id>
}

You can also create mount targets that provide granular authentication with the use of Security groups. The following example creates a mount target with security_group access control mode. You specify the name of the mount target and define the new virtual network interface by providing an IP address and a name. You must also specify the security group that you want to use to manage access to the file share that the mount target is associated to. The attribute auto_delete = true means that the virtual network interface is to be deleted if the mount target is deleted.

resource "ibm_is_share_mount_target" "target" {
name = <share_target_name>
virtual_network_interface {
name = <virtual_network_interface_name>
primary_ip {
address = “10.240.64.5”
auto_delete = true
name = <reserved_ip_name>
}
resource_group = <resource_group_id>
security_groups = [<security_group_ids>]
}
}

For more information about the arguments and attributes, see [ibm_is_share_mount_target](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/is_share_mount_target).







 Next steps 

Mount and use your file shares:



* [Viewing file shares and mount targets](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-view).
* [Encryption in transit - Securing mount connections between file share and host](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-eit).
* [Mounting file shares on Red Hat Linux](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-mount-RHEL).
* [Mounting file shares in CentOS](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-mount-centos).
Message: The Windows instance cannot be created because the request contains multiple keys.

Windows instances only support one key.





 insufficient_space_for_subnet 

Message: Insufficient space for subnet in address prefix.

The subnet cannot be created because the number of addresses requested cannot be allocated. Try again using a smaller address count or a larger CIDR.





 internal_error 

Message: An internal error occurred.

An unexpected error occurred. This problem may be temporary. Try the request again in a few minutes. If this error persists, [contact support](https://cloud.ibm.com/docs/vpc-on-classic?topic=vpc-on-classic-getting-help-and-support).





 internal_server_error 

Message: None

An unexpected error occurred. This problem may be temporary. Try the request again in a few minutes. If this error persists, [contact support](https://cloud.ibm.com/docs/vpc-on-classic?topic=vpc-on-classic-getting-help-and-support).





 internal_solution 

Message: Please contact your administrator.

An unexpected error occurred. This problem may be temporary. Try the request again in a few minutes. If this error persists, [contact support](https://cloud.ibm.com/docs/vpc-on-classic?topic=vpc-on-classic-getting-help-and-support).





 invalid_action_for_public_image 

Message: The action cannot be performed on a public image.

Public images cannot be added, modified, or deleted.





 invalid_generation_parameter 

Message: The generation query parameter is invalid.

For versions on and after 5/31/2019, the 'generation' query parameter must be set to 1 to allow VPC API requests for use with generation 1 compute resources and set to 2 to allow VPC API requests for use with generation 2 compute resources.

How to set the generation parameter

In the CLI: ibmcloud is target --gen 1

In the API:
About the contract 

When you create an IBM Cloud Hyper Protect Virtual Servers for VPC instance with the IBM Hyper Protect Container Runtime (HPCR) image, you must specify a contract as part of the User Data field.



 What is a contract? 

The contract is a definition file in the YAML format that is specific to the Hyper Protect Virtual Servers for VPC instance. This file must be created by the cloud user as a prerequisite for creating an instance. After this file is created, it must be passed as an input as part of the User Data field when an instance is created. You cannot create an instance without a valid contract. If you create an instance without a contract, the deployment starts and then fails, and the instance goes into a shutdown state. The contract is specific to creating a Hyper Protect Virtual Servers for VPC instance and is an extension of the IBM Secure Execution technology by Hyper Protect.

If the workload discloses the decrypted tokens (either through SSH or REST APIs), then the decrypted data contains both the workload and the environment secrets (however it does not contain the seeds that were used for volume encryption).





 Contract sections 

A contract file can have the following four valid high-level sections, of which the workload and env sections are mandatory.



* [workload](https://cloud.ibm.com/docs/vpc?topic=vpc-about-contract_sehpcr_contract_workload) is a mandatory section.
* [env](https://cloud.ibm.com/docs/vpc?topic=vpc-about-contract_sehpcr_contract_env) is a mandatory section.
* [attestationPublicKey](https://cloud.ibm.com/docs/vpc?topic=vpc-about-attestationattest_pubkey) is an optional section. You can provide a public RSA key as part of the contract, which is used to encrypt the attestation document and the attribute must be named as attestationPublicKey.
* envWorkloadSignature is an optional section and contains the signature of the other sections of the contract.
* [Creating block storage volumes with customer-managed encryption](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-vpc-encryption)
* [Creating virtual server instances with customer-managed encryption volumes](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-instances-byok)







 Working with customer-managed keys for VPC 

For more information about managing data encryption, see [Managing data encryption](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managing), and the section on temporarily revoking access by [removing service authorization to a root key](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managinginstance-byok-inaccessible-data).

Encryption of the link between a customer's workload that's outside of IBM Cloud, and a workload that's inside IBM Cloud, is the customer’s responsibility. See Encryption in [Security and regulation compliance](https://cloud.ibm.com/docs/vpc?topic=vpc-responsibilities-vpcsecurity-compliance).







 Deleting data in VPC 



 Deleting root keys 

For more information about deleting root keys, see [Deleting root keys](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managingbyok-delete-root-keys).





 Deleting a block storage volume 

For more information about deleting block storage volumes, see this FAQ: [What happens to my data when I delete a block storage data volume?](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-vpc-faqfaq-block-storage-16).





 Deleting a custom image 

For more information about deleting custom images from IBM Cloud VPC, see [Managing custom images](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-custom-images&interface=ui).
For the routing to succeed, the VPC must not already have a routing table with this property set to "true". One of: false, true.
* --vpc-zone-ingress, --vpc-zone: If set to "true", this routing table is used to route traffic that originates from subnets in other zones in this VPC. For the routing to succeed, the VPC must not already have a routing table with this property set to "true". One of: false, true.
* --accept-routes-from-resource-type-filters, --ar-rtf: The comma-separated resource type filters that can create routes in this routing table. All learned routes from resources that match a resource filter are removed when an existing resource filter is removed. One of: vpn_server, vpn_gateway.
* --clean-all-accept-routes-from-filters, --cl-arf: Remove all accept routes from filters and delete all learned routes from the routing table.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is vpc-routing-table-delete 

Delete one or more VPC routing tables.

ibmcloud is vpc-routing-table-delete VPC (ROUTING_TABLE1 ROUTING_TABLE2 ...) [--output JSON] [-f, --force] [-q, --quiet]



 Command options 



* VPC: ID or name of the VPC.
* ROUTING_TABLE1: ID or name of the VPC routing table.
* ROUTING_TABLE2: ID or name of the VPC routing table.
* --output: Specify output format, only JSON is supported. One of: JSON.
* --force, -f: Force the operation without confirmation.
* -q, --quiet: Suppress verbose output.
[Direct Link with VMware on VPC with NSX-T](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/vpc-ryo-diagrams-dl-nsx-t-arch.svg)

Figure 2. Direct Link with VMware on VPC with NSX-T





 Related links 



* [IBM Cloud VPC getting started](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started)
* [IBM Cloud VPC Bare Metal Servers](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-for-bare-metal-servers)
* [IBM Cloud VPC RYO VMware reference architecture](https://cloud.ibm.com/docs/vmwaresolutions?topic=vpc-ryo-overview)
* [IBM Cloud Direct Link overview](https://cloud.ibm.com/docs/dl?topic=dl-get-started-with-ibm-cloud-dl)
* [IBM Cloud Transit Gateway overview](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-getting-started)
* [IBM Cloud VPC VPN overview](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-overview)
* [VPC IaaS endpoints](https://cloud.ibm.com/docs/vpc?topic=vpc-service-endpoints-for-vpcinfrastructure-as-a-service-iaas-endpoints)
* [VMware on Bare Metal VPC tutorial](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-bm-vmware)
curl -X POST "$vpc_api_endpoint/v1/shares?version=2023-06-11&generation=2&maturity=beta" 
-H "Authorization: $iam_token" 
-d '{
"size": 20,
"name": "myshare-3",
"profile": {
"name": "dp2"
},
"zone": {
"name": "us-south-1"
},
"mount_targets": [
"virtual_network_interface": {
"subnet": {
"id": "4e95744c-7e64-48c9-b5d2-3b6481b1dfde"
},
"security_groups":
{
"id": "34c09abb-37bf-4ef6-88bb-f63a0ef28915"
}
]
},
"transit_encryption": {
"user_managed"
}
]
}'
Show more

The following response shows that access control mode is security_group, which is the default value.

{
"access_control_mode": "security_group",
"created_at": "2023-06-11T12:55:40Z",
"crn": "crn:[...]",
"encryption": "provider_managed",
"href": "$vpc_api_endpoint/v1/shares/r134-56f91d4a-2801-470a-b368-176bde64e954",
"id": "r134-56f91d4a-2801-470a-b368-176bde64e954",
"initial_owner": {
"gid": 0,
"uid": 0
},
"iops": 100,
rule-6970e312-329d-44dc-b683-5ab14acd6a42 - Check whether Virtual Servers for VPC is provisioned from an encrypted image
rule-24e259fb-608e-486f-bb9d-99b78ae0383c - Check whether Virtual Servers for VPC instances are identifable by the workload they are running based on the Auto Scale for VPC instance group definition
rule-250a7311-0cfd-4b43-8987-e5629f8d99ae - Check whether Application Load Balancer for VPC has application port of the workload that is identifiable by the Auto Scale for VPC instance group definition
rule-c2dd768e-9a49-4d6d-8ac5-8fcfb233a7b0 - Check whether Virtual Private Cloud (VPC) has no subnet with public gateway attached
rule-24508beb-c00a-4c6b-bd04-d38dd8cb7d71 - Check whether App ID user data is encrypted
rule-65196a37-ddcc-422d-8096-09955c4b4e5d - Check whether Event Streams is accessible through public endpoints
rule-3b2768e5-d783-4b0c-a47f-81479af34689 - Check whether Event Streams is accessible only by using private endpoints
rule-c471b983-9dc5-4659-8fb1-4d20c9d516cc - Check whether App ID redirect URIs are using HTTPS only
rule-f4d30138-01c1-409d-a469-fa99a23f2fbd - Check whether App ID redirect URIs are not using localhost or 127.0.0.1
rule-6e0c618d-523d-4352-a1d1-12bb9905b914 - Check whether App ID redirect URIs are not using wildcards ()
Virtual Servers for VPC is an infrastructure-as-a-service (IaaS) offering that gives you access to all of the benefits of VPC, including network isolation, security, and flexibility.

With Virtual Servers for VPC, you can quickly provision instances with high network performance. When you provision an instance, you select a profile that matches the amount of memory and compute power that you need for the application that you plan to run on the instance. Instances are available on the x86 architecture.





 Dedicated hosts for VPC (optional) 

With [Dedicated hosts for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-dedicated-hosts-instances), you can carve out a single-tenant compute node, free from users outside of your organization. Within that dedicated space, you can create virtual server instances according to your needs. Additionally, you can create dedicated host groups that contain dedicated hosts for a specific purpose. Because a dedicated host is a single-tenant space, only users within your account that have the required permissions can create instances on the host.

Dedicated hosts are highly recommended when you use virtual servers, particularly for any parts of your application that process regulated data and keep it in memory.





 IBM Cloud Auto Scale for VPC (optional) 

[Auto Scale for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-auto-scale-instance-group) is highly recommended if you are using virtual servers. With Auto Scale for VPC, you can improve performance and costs by dynamically creating virtual server instances to meet the demands of your environment. You set scaling policies that define your desired average utilization for metrics like CPU, memory, and network usage. The policies that you define determine when virtual server instances are added or removed from your instance group.







 Containers 



 Red Hat OpenShift on IBM Cloud 

In addition to Virtual Servers for VPC, you can use [Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-roks-overview) if you want to run containers. {{site.data.content.openshift-service-description}}
For more information, see [Viewing notifications](https://cloud.ibm.com/docs/get-support?topic=get-support-viewing-notifications) and [Host failure recovery policies](https://cloud.ibm.com/docs/vpc?topic=vpc-host-failure-recovery-policies&interface=ui).
* Can I connect my VPC to my other IBM Cloud workloads?

Yes, you can set up access to your IBM Cloud® classic infrastructure from one VPC in each region. For more information, see [Setting up access to classic infrastructure](https://cloud.ibm.com/docs/vpc?topic=vpc-setting-up-access-to-classic-infrastructure).
* Can a subnet's size be changed after it is created?

No, a subnet cannot be resized after it is created.
* What is the limit on the number of characters in a VPC name?

Currently, the limit is 100. If this limit is exceeded, you might receive an "internal error" message.
* Can any of my VPC resource names begin with a number?

No, although the name can contain numbers, it must begin with a letter.
* Are there restrictions on what characters that I can use in a name?

Yes, the UI blocks consecutive double dashes, underscores, and periods from being part of a virtual server instance name.
* During the public gateway creation, do I need to reserve the floating IP address, or does the system automatically reserve it? Can I see that floating IP address when I query all of the floating IP addresses?

The VPC API automatically creates a floating IP along with the public gateway if an existing floating IP is not specified. And yes, that floating IP shows up in the list.
* Who enforces that only one public gateway can exist per zone for a VPC?

The VPC API service enforces this limit.
* Does the VPC public gateway have a timeout function?

Yes, the VPC public gateway has a fixed, 4-minute timeout for TCP connections, and it is not configurable.
ibmcloud is vpc-routing-table-create VPC [--name NAME] [--direct-link-ingress false | true] [--internet-ingress, --internet false | true] [--transit-gateway-ingress false | true] [--vpc-zone-ingress false | true] [--accept-routes-from-resource-type-filters, --ar-rtf vpn_server | vpn_gateway] [--output JSON] [-q, --quiet]

Where:

VPC
: Is the ID or name of the VPC.

--name
: Is the name of the VPC routing table.

--direct-link-ingress, --direct-link
: Optional. If set to true, this routing table is used to route traffic that originates from IBM Cloud Direct Link to this VPC. For the routing to succeed, the VPC must not already have a routing table with this property set to true. One of: false, true.

--internet-ingress, --internet
: Indicates whether this routing table is used to route traffic that originates from the internet. Updating to true selects this routing table, provided no other routing table in the VPC already has this property set to true. Updating to false deselects this routing table. One of: false, true.

--transit-gateway-ingress, --transit-gateway
: If set to true, this routing table is used to route traffic that originates from Transit Gateway to this VPC. For the routing to succeed, the VPC must not already have a routing table with this property set to true. One of: false, true.

--vpc-zone-ingress, --vpc-zone
: Optional. If set to true, this routing table is used to route traffic that originates from the public internet. For the routing to succeed, the VPC must not have an existing routing table with this property set to true. One of: false, true.

--accept-routes-from-resource-type-filters, --ar-rtf
* Check whether Security Groups for VPC contains no outbound rules in security groups that specify source IP 8.8.8.8/32 to DNS port
* Check whether Virtual Private Cloud (VPC) has no public gateways attached
* Check whether all virtual server instances have at least one Virtual Private Cloud (VPC) security group attached
* Check whether Virtual Private Cloud (VPC) has no public gateways attached at the time of provisioning
* Check whether account has at least one VPN or Direct Link configured
* Check whether Virtual Private Cloud (VPC) classic access is disabled
* Check whether Virtual Private Cloud (VPC) has no rules in the default security group
* Check whether all network interfaces of a virtual server instance have at least one Virtual Private Cloud (VPC) security group attached
* Check whether Virtual Servers for VPC instance has the minimum # interfaces
* Check whether Virtual Private Cloud (VPC) has no subnet with public gateway attached
* Check whether Virtual Private Cloud (VPC) security groups have outbound ports that are open only to permitted IP addresses
* Check whether Virtual Private Cloud (VPC) is configured with public gateways that are provisionable only within permitted zones
* Check whether Virtual Private Cloud (VPC) network access control lists don't allow egress from 0.0.0.0/0 to any port







 NIST supplemental guidance 

Safeguards implemented by organizations to prevent unauthorized exfiltration of information from information systems include, for example: (i) strict adherence to protocol formats; (ii) monitoring for beaconing from information systems; (iii) monitoring for steganography; (iv) disconnecting external network interfaces except when explicitly needed; (v) disassembling and reassembling packet headers; and (vi) employing traffic profile analysis to detect deviations from the volume/types of traffic expected within organizations or call backs to command and control centers. Devices enforcing strict adherence to protocol formats include, for example, deep packet inspection firewalls and XML gateways. These devices verify adherence to protocol formats and specification at the application layer and serve to identify vulnerabilities that cannot be detected by devices operating at the network or transport layers. This control enhancement is closely associated with cross-domain solutions and system guards enforcing information flow requirements.