vania-janet/multiturn-rag-retrieval-data huggingface dataset:
How do I connect my on-premises environment to VMware Shared? 

Each virtual data center has an Edge Services Gateway (ESG) which provides network connectivity to the virtual data center. On-premises connectivity to the customer virtual data center can be accomplished in the following ways:



* IPsec tunnel over the internet to the ESG
* SSL VPN tunnel over the internet to the ESG
* Direct internet access through the ESG to the VMs by using NAT or load balancing



Along with the internet access methods, you can use IBM Cloud service endpoints to access your virtual data centers from other IBM Cloud accounts. This way, you can use DirectLink or other on-premises environments to access your IBM Cloud account network options. Then, from your cloud account, you can connect into your virtual data centers by using the Cloud Service Endpoint method.





 How are my VMware virtual platform consumptions billed? 

All costs for the physical and virtual infrastructure and the licenses that result from the instance are charged to your IBM Cloud account. When you order an instance, you must have an IBM Cloud account and provide the SoftLayer API key that is associated with the account.





 How do I choose the data centers for my instances? 

The instance deployments have strict physical infrastructure requirements, which vary among IBM Cloud data centers. When you place your instance order, the available data centers are listed within regions and you can select the one that you want from the list.

For more information, see [IBM Cloud data center availability](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-shared_planningshared_planning-dc-availability).





 How long does it take for my instance to be deployed? 

You can check the status of the instance deployment by viewing the deployment history on the instance details page from the IBM Cloud for VMware Solutions console.





 How can I view a list of all notifications? 

To view the complete notification history, click Notifications from the left navigation pane.





 What if I have issues with VMware Shared?
For more information, see [Deploying a custom image within a Power Systems Virtual Server](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-deploy-custom-image).





 What versions of stock images are available? 

For each major version (example: Technology Level) of the operating system (OS) that is enabled through the offering, Power Systems Virtual Server provides a single stock image. PowerVS typically provides stock images for the last three major versions of the supported OS. Any update to the OS stock image is planned only when the image level is certified for PowerVM™ environment.





 When are stock images removed from the catalog? 

Any unsupported and older stock images are periodically removed from the offering. You will be notified three weeks before the images are removed.





 What happens to VMs deployed using stock images that are being removed? 

VMs deployed by using stock images that are being removed can continue to operate without any issues. You are recommended to follow operating system vendor’s guidelines to update the OS as needed.





 What formats should I use when uploading a custom image? 

Currently, you can import a custom image in the following formats: .ova, .ova.gz, .tar, .tar.gz and .tgz.





 What are the available storage types in the storage area network (SAN)? 

All regions use Tier 1 or Tier 3 storage types. The Tier 1 storage type is best for customers who require higher throughput. Customers who do not require exceptionally high throughput and are looking to minimize costs want to select Tier 3. A VM cannot have disks from both storage types while provisioning. But, you can add a volume of the other storage types after the VM has been provisioned. For more information, see [Storage tiers](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-about-virtual-serverstorage-tiers).

If you previously deployed a VM on an old storage type (SSD or standard), no action is required. Your VM continues to run by using the old storage type. You can also add new disks from those legacy tiers.
Why aren't my hosts attaching to my location? 

  What’s happening 

When you run your host attach script, some hosts are not attaching to your location, but you do not receive an error message. Your host machines are virtual machine clones.

  Why it’s happening 

Network identities of virtual machines that are attached to the same location must be unique. If you are using cloned virtual machines, these clones might not have a unique network identity and Satellite cannot attach them all to the location. To verify that the network identities are not unique, SSH into the host and run the following commands.

cat /etc/machine-id
cat /var/lib/dbus/machine-id

If the IDs match, then you must take steps to resolve this issue.

  How to fix it 

To resolve this issue, follow these steps.



1.  Remove all hosts from the location.
2.  Reload your operating systems on each host.
3.  SSH into each host and run the following commands.

rm -f /etc/machine-id
dbus-uuidgen --ensure=/etc/machine-id
rm -f /var/lib/dbus/machine-id
dbus-uuidgen --ensure
4.  Reattach your hosts.
Creating a VMware ESX Virtual Machine 

To create a new virtual machine, follow these steps.



1.  Right-Click your host node IP address in the Inventory pane of the vSphere Client.
2.  Select Custom in the configuration window.
3.  Give the virtual machine an appropriate name and click Next.
4.  Select the Storage location for virtual machine files and click Next.
5.  From the Virtual Machine Version, select Virtual Machine Version 8.
6.  Select the Operating System.
7.  Select the number of virtual processors (CPU page) and the amount of Memory that you would like to create the virtual machine. Note: You can change the number of processors and memory about later if the resources are available. In the network section, you need to connect two NICs, with NIC 1 being the Private Network and NIC 2 is the Public Network. The Adapter type is “Flexible”. Make sure that Connect at Power On is selected.
8.  Keep the SCSI Controller screen to the default “LSI Logic Parallel”. On the Select a Disk screen, select Create a new virtual disk. The Advanced Options screen and leave the Ready to Complete as the default. The creation of a new virtual machine is now complete.



To begin loading your installation media, click the server name in the inventory list. Then, click Edit Virtual machine Settings under Basic Tasks.



9.  With CD/DVD Drive 1 selected, check the Connect at power check box under Device Status. To specify an ISO file that is located in your Datastore, click Browse.
10. The ISO files that are uploaded to the default Storage1 Datastore are selectable here. You also see folders that contain the configuration/log files for all the server virtual machines.



After you select your ISO image, you are ready to begin the installation process of your respective OS.

For more information about setting up a virtual machine network, see [Setting up a Virtual Machine Network](https://cloud.ibm.com/docs/virtualization?topic=virtualization-setting-up-a-virtual-machine-network).
* In the Browse objects of Type menu, select Org Vdc Networks. Select the Organization virtual data center network that you created as the Source cell. Click the right arrow to move the Organization virtual data center network into the Filter column.
* Keep all remaining default selections.
* For Action, select Accept.
* To define a source IP address or range, click the IP in the Source cell and set the IP address, or range to allow everything on that subnet. For example, 192.168.100.2 or 192.168.100.0/24. Destination and services are set to Any when you choose the defaults.







 Source NAT definitions to the external network 

A source NAT rule is necessary to allow traffic from the Organization virtual data center network outbound to the internet. From the virtual data center for that edge gateway, create NAT44 Rules. For more information, see [Add a SNAT or a DNAT rule](https://docs.vmware.com/en/VMware-Cloud-Director/10.1/VMware-Cloud-Director-Tenant-Portal-Guide/GUID-1DE460AE-DCCC-4BC8-96AC-52D06A4AFDE3.html).

Review the following notes for source NAT definitions.

Under the NAT44 Rules, click SNAT Rule and create the configuration by using the following selections.



* For Applied On, select the Organization virtual data center external network.
* For Original Source IP/Range, enter your Organization virtual data center Gateway CIDR.
* For Translated Source IP/Range, click SELECT. Then, for Select IP Address Network, select the external network and choose one of the external network addresses that were assigned to your virtual data center.
* Optionally, enter a destination port.
* Optionally, enter a description. A description can be useful to identify the SNAT rule later.
* Set to Enabled.
* Optionally, enable logging. Logs are not preserved. If you want to have historical data, you must set up a syslog server.







 Create the Organization virtual data center network firewall rule to allow access to the IBM Cloud Services Network
Any subnet that you create in the VPC is attached to this ACL by default. The ACL includes an inbound rule and an outbound rule that allow all traffic between your worker nodes on a subnet and any system on the subnets in the same VPC. If you want to specify which private network traffic is permitted to the worker nodes on your VPC subnets, you can create a custom ACL for each subnet in the VPC. For example, you can [create a set of ACL rules](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-acls) to block most inbound and outbound private network traffic of a cluster, while allowing communication that is necessary for the cluster to function.





 What else can I do to reduce the surface for external attacks for VPC clusters? 

The more apps or worker nodes that you expose publicly, the more steps you must take to prevent external malicious attacks. Review the following table to find options for how to keep apps and worker nodes private.



VPC network security options

 Security feature Description 

 Limit the number of exposed apps By default, your apps and services that run within the cluster are not reachable over the public internet. You can choose if you want to expose your apps to the public, or if you want your apps and services be reachable on the private network only. When you keep your apps and services private, you can leverage the built-in security features to assure secured communication between worker nodes and pods. To expose services and apps to the public internet, you can leverage the [VPC load balancer and Ingress ALB support](https://cloud.ibm.com/docs/containers?topic=containers-cs_network_planningpattern_public_vpc) to securely make your services publicly available. Ensure that only necessary services are exposed, and revisit the list of exposed apps regularly to ensure that they are still valid. 
 Limit public network egress to one subnet with a public gateway If pods on your worker nodes need to connect to a public external endpoint, you can attach a public gateway to the subnet that those worker nodes are on.
Because the EP11 library is a subset of the PKCS #11 API library, and GREP11 functions are variants from the corresponding EP11 functions, the corresponding functions of EP11 and PKCS #11 are also listed in the GREP11 function tables for your reference.

GREP11 supports any programming language with a gRPC library. At the current stage, only code snippets or examples for Golang and JavaScript are included in the API reference. The content is enriched in later phases. The code snippets are based on the following external GitHub repositories that provide complete examples for using the GREP11 API. Some of the code snippets reference helper functions within the examples repositories.



* [The Golang examples repository](https://github.com/IBM-Cloud/hpcs-grep11-go)
* [The JavaScript examples repository](https://github.com/IBM-Cloud/hpcs-grep11-js)







 Retrieving supported crypto algorithms 

You can use the following functions to retrieve cryptographic algorithms or mechanisms that are supported by GREP11. With this information, you can understand the specific mechanisms that can be set when you call a function. For the full list of supported mechanisms, you can also see the [mechanisms categorized by function groups](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-security-compliancefaq-EP11-mechanisms).



 GetMechanismList 

The GetMechanismList function obtains a list of mechanism types that are supported by a token.

Enterprise PKCS #11 over gRPC

Enterprise PKCS #11

PKCS #11





 Description Binds to EP11 m_GetMechanismList, which is an implementation of PKCS #11 C_GetMechanismList. 
 Parameters message GetMechanismListRequest { } message GetMechanismListResponse { repeated uint64 Mechs = 2; } 
 Return values Wraps EP11 error into message Grep11Error. 



Code snippets



* Golang code snippet
Subnets provide network connectivity to your cluster components by assigning IP addresses to them.

The following subnets are automatically provisioned on the default public and private VLANs.



 Public VLAN subnets 



* The primary public subnet determines the public IP addresses that are assigned to worker nodes during cluster creation. Multiple clusters on the same VLAN can share one primary public subnet.
* The portable public subnet is bound to one cluster only and provides the cluster with 8 public IP addresses. 3 IPs are reserved for IBM Cloud infrastructure functions. 1 IP is used by the default public Ingress ALB and 4 IPs can be used to create public network load balancer (NLB) services or more public ALBs. Portable public IPs are permanent, fixed IP addresses that can be used to access NLBs or ALBs over the internet. If you need more than 4 IPs for NLBs or ALBs, see [Adding portable IP addresses](https://cloud.ibm.com/docs/openshift?topic=openshift-subnetsadding_ips). Note that these IP addresses are intended for use in Red Hat OpenShift on IBM Cloud. Do not use these IP addresses for other purposes outside of Red Hat OpenShift on IBM Cloud.







 Private VLAN subnets 



* The primary private subnet determines the private IP addresses that are assigned to worker nodes during cluster creation. Multiple clusters on the same VLAN can share one primary private subnet.
* The portable private subnet is bound to one cluster only and provides the cluster with 8 private IP addresses. 3 IPs are reserved for IBM Cloud infrastructure functions. 1 IP is used by the default private Ingress ALB and 4 IPs can be used to create private network load balancer (NLB) services or more private ALBs. Portable private IPs are permanent, fixed IP addresses that can be used to access NLBs or ALBs over a private network. If you need more than 4 IPs for private NLBs or ALBs, see [Adding portable IP addresses](https://cloud.ibm.com/docs/openshift?topic=openshift-subnetsadding_ips).
Open the Customer Portal for more information.
* How can I track the status of the OS reload?

Under Hardware, you see a Notes section for each of your servers. The Notes includes links to information about the current step of the reload and the estimated time to finish that portion of the reload.
* Can an OS reload erase secondary disks?

An OS reload formats only the primary disk on the system. All other disks are left alone. Formatting works the same way when you reload from an image template. If the template contains more than one disk, only the primary disk is formatted. No changes are made to the other disks.
* Why did my cpsrvd email fail?

In most cases, when you get an email that states cpsrvd failed, it is sent immediately after a restart. This error occurs when chkservd attempts to validate the cpsrvd process. The validation fails because the process did not start.

If you receive an email from the chkservd service, stating that cpsrvd failed, you can ignore the message in most cases. However, if you receive 5 or more of these messages in a row or if you receive more than 4 in a day that follows restarts, open a support ticket
* Can I purchase extra Terminal Service Licenses?

Extra licenses are available in 5-packs. If you want to purchase extra licenses, open a support ticket.

You have a maximum of two RDP connections to your server. If you add the 5-pack of terminal services, the two original connections are removed giving you a total of five licenses.



Code Engine



* What is IBM Cloud Code Engine?

Code Engine is developed by IBM and it is built with many open source components. The goal is to extend the capabilities of Kubernetes to help you create modern, source-centric containerized, and serverless apps that run on your Kubernetes cluster. The platform is designed to address the needs of developers who today must decide what type of app they want to run in the cloud: 12-factor apps, containers, or functions.
It saves all the logs that are generated when your applications interact with the Hyper Protect Crypto Services cloud HSM to execute PKCS #11 functions. 



To encrypt and authenticate the keystore that is used by PKCS #11, enable the sessionauth parameter and configure the password for the keystore. For each service instance, a maximum of five authenticated keystores are supported. The password can be 6-8 characters. The keystore passwords are not stored in the service instance. You, as the keystore administrator, are responsible for maintaining a local copy of the passwords. If a password is lost, you need to contact IBM Support to reset the keystore, which means all data in the keystore is cleared.
2. Move the configuration file into the same directory as the application (for example, pkcs11-tool) that uses the PKCS #11 library. Optionally, the PKCS #11 configuration file can be placed in the /etc/ep11client directory. Create the /etc/ep11client directory if it does not exist.







 Step 4: Use the PKCS 11 library to make PKCS 11 API calls 

After you set up the library and the configuration file, the keystores must be initialized. To initialize the keystores, the security officer (SO) user needs to perform a C_InitToken operation.

After the keystores are initialized, use the PKCS #11 library to call the standard PKCS #11 functions to generate, store, and list keys. For the detailed list of supported PKCS #11 functions, see

[PKCS #11 API reference](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-pkcs11-api-ref).
The parameters that are needed to connect the Hyper Protect Crypto Services cloud HSM can be set up along with the application code. 
 Keystore Provided by Hyper Protect Crypto Services. The keys that are generated with the PKCS #11 API are protected by the master key and are stored in cloud databases. Not provided by Hyper Protect Crypto Services. You need to store keys that are generated by the GREP11 API on the local workstation or other devices. 
 Supported cryptographic operations The PKCS #11 API supports most of the standard PKCS #11 functions:<br><br><br><br> * General purpose.<br> * Slot and token management.<br> * Session management<br> * Object management.<br> * Generate keys.<br> * Wrap and unwrap keys.<br> * Derive keys.<br> * Encrypt and decrypt data.<br> * Sign and verify message.<br> * Create message digests.<br> * Retrieve mechanism information.<br> * Retrieve and set key attributes.<br><br><br> The GREP11 API does not support general purpose functions and session management functions. It supports most of the EP11 cryptographic functions:<br><br><br><br> * Generate keys.<br> * Wrap, unwrap, and rewrap keys.<br> * Derive keys.<br> * Encrypt and decrypt data.<br> * Sign and verify message.<br> * Create message digests.<br> * Retrieve mechanism information.<br> * Retrieve and set key attributes.<br><br><br>
[VLAN connections](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/vrw-nics-vlans.svg)

Figure 3. VLAN connections

The private network consists of two VLANs within this design. Three subnets are allocated to the first of these VLANs (here designated Private VLAN A):



* The first subnet is a primary private IP subnet range that IBM Cloud assigns to the physical hosts.
* The second subnet is used for management virtual machines (VMs) such as vCenter Server Appliance and Platform Services Controller.
* The third subnet is used for the encapsulated overlay network Tunnel Endpoints (VTEPs) assigned to each host through the NSX Manager.



In addition to Private VLAN A, a second private VLAN (here designated Private VLAN B) exists to support VMware features such as vSAN and vMotion. As such, the VLAN is divided into two or more portable subnets:



* The first subnet is assigned to a kernel port group for vMotion traffic.
* The remaining subnet or subnets are used for storage traffic:



* When using vSAN, a subnet is assigned to kernel port groups that are used for vSAN traffic.





The public network consists of one VLAN within this design. The following subnets are allocated to the VLAN:



* The first subnet is a Primary Public IP subnet range that IBM Cloud assigns to the physical hosts.
* The hosts are assigned a public IP address but this IP address is not configured on the hosts, so they are not directly accessible on the public network.
* The second subnet is used for public access of components like a virtual gateway appliance.
* The public VLAN is intended to provide public internet access.



All subnets that are configured as part of an IBM Cloud for VMware Regulated Workloads automated deployment use IBM Cloud-managed ranges to ensure that any IP address can be routed to any data center within IBM Cloud.

Review the following table for a summary.
The IBM Cloud® SAP-certified infrastructure uses the Bring Your Own License (BYOL) model. This model follows the industry standard of IaaS for SAP workloads and is the same approach that is used for many decades with SAP software.

No IBM Cloud® for SAP portfolio offering contains any SAP licensing.

This arrangement applies to:



* SAP Business Application licenses (for example, SAP S/4HANA, SAP ECC)
* SAP Technical Application licenses (for example, SAP HANA, SAP NetWeaver)
* Any OEM license from SAP (for example, SAP AnyDB OEM such as MS SQL)







 How does Operating System (OS) licensing work with the IBM Cloud® for SAP Infrastructure-as-a-Service? 

The cost of the OS license (and applicable subscription additions for SAP-specific OS Packages and Support), is included when you select your OS on the order form for your SAP-certified server.





 How are the SAP-certified IBM Cloud servers priced? 

Prices are provided through the IBM Cloud catalog when you begin the ordering process. Any discounts available from Reserved Instances pricing agreements or usage of Subscription Accounts are also calculated.

For SAP-certified bare metal servers that are certified as HANA appliances, pricing includes the high-performance local storage.

As an industry practice across Cloud Service Providers, virtual servers from IBM Cloud® for SAP use redundant network block or file storage. These storage costs might not be included in the initial price estimation. In addition, there are no network bandwidth charges for local network traffic to or from the virtual server host and the storage host on IBM Cloud.







 SAP-certified IBM Power Virtual Servers 



 Which version of Db2 can I use to run SAP NetWeaver on IBM Power Virtual Servers? 

For information check [SAP Note 2855850](https://launchpad.support.sap.com//notes/2855850) regularly. You can also reference [SAP Product Availability Matrix](https://support.sap.com/en/release-upgrade-maintenance.htmlsection_1969201630).





 What are the operating system requirements for Db2, AIX and SAP NetWeaver? 

For operating system requirements, see: