vania-janet/multiturn-rag-retrieval-data huggingface dataset:
[Encrypting the Kubernetes master's local disk and secrets by using a KMS provider](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkeyprotect) 
 [Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift) Red Hat OpenShift on IBM Cloud is a managed offering to create your own Red Hat OpenShift on IBM Cloud cluster of compute hosts to deploy and manage containerized apps on IBM Cloud. In addition to using Hyper Protect Crypto Services to protect the Kubernetes secrets, you can also deploy the Hyper Protect Crypto Services Router, which uses the GREP11 OpenSSL Engine to access private keys that are stored in your Hyper Protect Crypto Services instance to encrypt routes. <br><br> * [Encrypting the Red Hat OpenShift on IBM Cloud master's local disk and secrets by using a KMS provider](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionkeyprotect)<br> * OpenShift Data Foundation: [Setting up encryption by using Hyper Protect Crypto Services](https://cloud.ibm.com/docs/openshift?topic=openshift-deploy-odf-vpc&interface=uiodf-create-hscrypto-vpc)<br><br><br> 







 Ingestion service integrations 

You can integrate Hyper Protect Crypto Services with the following ingestion services.



Table 5. Supported ingestion services.

 Service Description Integration instruction 

 [IBM Cloud Monitoring](https://cloud.ibm.com/docs/monitoring) IBM Cloud Monitoring is a cloud-native, and container-intelligence management system. You can use it to gain operational visibility into the performance and health of your Hyper Protect Crypto Services instance. [Getting started tutorial](https://cloud.ibm.com/docs/monitoring?topic=monitoring-getting-started)
Accessing private clusters by using the WireGuard VPN 

You can use the WireGuard VPN to securely connect to Red Hat OpenShift clusters with only a private network connection. Your cluster might run in a private network in IBM Cloud or an IBM Cloud Satellite location in another cloud provider or your on-premises data center.

Before you begin, make sure that you have an Red Hat OpenShift cluster with a private-only network connection and that the cluster is assigned a private service endpoint.



1. Create a virtual server instance (VSI) that is connected to the same private network that your Red Hat OpenShift cluster runs in. This VSI serves as a jump box for your cluster. For example, if you have a private VPC cluster, make sure that you create the VSI in the same VPC. For more information about creating the VSI, consult your infrastructure provider's documentation. The VSI must meet the following specifications:



* The VSI must have a minimum of 2 vCPUs, 8 GB memory, and 25 GB of disk space.
* The VSI must run an operating system that is supported by WireGuard. For example, the steps in this topic were tested on an Ubuntu VSI.
* You must create an SSH key that is stored on the VSI so that you can connect to your VSI via SSH.
* You must assign a public IP address to your VSI so that your VSI is accessible over the public network.
* Your VSI must allow at least the following network traffic. You can optionally open up more network traffic on your VSI if required for the apps that run on your cluster.



* Inbound TCP traffic on port 22 for SSH connections
* Inbound UDP traffic on port 51820 for the WireGuard server
* All outbound traffic





2. Log in to your VSI by using the public IP address of the VSI.

ssh -i <filepath_to_sshkey> root@<public_IP>
3. Install the WireGuard server.

The following steps are specific to VSIs that run Ubuntu.
Onboarding your Operator 

This tutorial walks you through how to onboard a sample Node-RED Operator to your private catalog in IBM Cloud®. You can onboard an Operator or Operator bundle by using a TGZ file. By completing this tutorial, you learn how to import the Operator, configure the deployment, license, and other details, and validate that the Operator can be installed on a Red Hat OpenShift cluster.



 Before you begin 



1. [Upload your Operator and application images to IBM Cloud® Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-getting-started).
2. [Create your Red Hat OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-getting-started).
3. Upload your source code to your repository.

Use the [latest release of the sample Node-RED Operator](https://github.com/IBM-Cloud/operator-bundle-sample/releases) as an example of how to set up your directory structure.
4. Make sure you're assigned the IBM Cloud Identity and Access Management (IAM) editor role on the Catalog Management and Partner Center - Sell services. See [Assigning access to account management services](https://cloud.ibm.com/docs/account?topic=account-account-services) for more information.



For Operator bundles, you also need the following IBM Cloud Identity and Access Management (IAM) roles.



* Administrator on all account management services and all IAM services
* Editor on the software instance service
* Editor on the IBM Cloud Container Registry service
* Administrator on the Red Hat OpenShift on IBM Cloud cluster



Make sure that you use the same account to access IBM Cloud Container Registry and to create the Red Hat OpenShift on IBM Cloud cluster.





 Step 1: Import your Operator 



1. In the IBM Cloud console, click the Navigation Menu icon !
You can also leverage built-in logging and monitoring tools to detect malicious attacks and suspicious usage patterns.

For more information about the components of your cluster and how you can meet security standards for each component, see [Security for Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-securitysecurity).
* What access policies do I give my cluster users?

Red Hat OpenShift on IBM Cloud uses Cloud Identity and Access Management (IAM) to grant access to cluster resources through IAM platform access roles and Kubernetes role-based access control (RBAC) policies through IAM service access roles. For more information about types of access policies, see [Pick the correct access policy and role for your users](https://cloud.ibm.com/docs/openshift?topic=openshift-access-overviewaccess_roles).

The access policies that you assign users vary depending on what you want your users to be able to do. You can find more information about what roles authorize which types of actions on the [User access reference page](https://cloud.ibm.com/docs/openshift?topic=openshift-access_reference) or in the following table's links. For steps to assign policies, see [Granting users access to your cluster through IBM Cloud IAM](https://cloud.ibm.com/docs/openshift?topic=openshift-userschecking-perms).



Types of roles you might assign to meet different use cases.

 Use case Example roles and scope 

 App auditor [Viewer platform access role for a cluster, region, or resource group](https://cloud.ibm.com/docs/openshift?topic=openshift-iam-platform-access-roles), [Reader service access role for a cluster, region, or resource group](https://cloud.ibm.com/docs/openshift?topic=openshift-iam-service-access-roles).
: Review the following information about Caveonix RiskForesight for the 4.1 release.



* Caveonix RiskForesight is offered as a per-host license for new deployments of Caveonix on VMware Regulated Workloads and Security and Compliance Readiness Bundle instances. For vCenter Server deployments, Caveonix is still offered as license packs that are priced per virtual machine (VM).
* A Caveonix RiskForesight license is valid for five years.
* Deleting Caveonix RiskForesight deletes the initial Caveonix RiskForesight license that was associated with the service.



Veeam on bare metal server
: You can install Veeam v11 on a bare metal server. This new feature is supported only for vSphere 7.0 with NSX-T.

REST APIs
: The following API updates are available:



* The VMware Solutions API provides support for the additional edge services cluster and workload cluster on multizone instances.
* The VMware Solutions API provides support for the following services on multizone instances: Caveonix RiskForesight, HyTrust CloudControl, Veeam, and vRealize Operations and Log Insight.
* The network option for selecting a private only network or a public and private network is available through the VMware Solutions Shared API.







 29 January 2021 

VMware Regulated Workloads
: Starting with the 4.0 release, you can now order VMware Regulated Workloads directly from the VMware Solutions main page. The VMware Regulated Workloads offering includes a secure-by-default architecture that follows IBM's unique policy controls framework, provides continuous compliance monitoring, and offers the highest level of data encryption (FIPS 140-2 Level 4). For VMware Regulated Workloads, only VMware vSphere 7.0 Update 1a is supported.

VMware Solutions Dedicated - VMware vSphere 7.0 Update 1a support
: You can order vSphere 7.0 Update 1a with your VMware vCenter Server with NSX-T instances and VMware vSphere with NSX-T clusters.
[Creating a virtual data center in a VMware as a Service using the VMware Cloud Director Console](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vmware-as-a-service-vdc)Creating a virtual data center in a VMware as a Service using the VMware Cloud Director Console

This tutorial is to demonstrate the basic steps to operationalize an IBM Cloud® for VMware as a Service – single tenant instance after initial instance provisioning. This tutorial should take about 30-60 minutes to complete and assumes that IBM Cloud® for VMware as a Service – single tenant instance and a virtual data center (VDC) have already been provisioned.

VMware as a Service



* 1 hour
* 2023-05-05



[Getting started with VMware as a Service](https://cloud.ibm.com/docs/vmware-service?topic=vmware-service-getting-started)Getting started with VMware as a Service

In this IBM Cloud® for VMware as a Service tutorial, we take you through the process of ordering a VMware as a Service instance by using the IBM Cloud for VMware Solutions user interface. Other operations that you can complete are also listed.

VMware as a Service



* 20 minutes
* 2023-02-08



[Getting Started with IBM Cloud for VMware Solutions Shared](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vmware-solutions-shared-getting-started)Getting Started with IBM Cloud for VMware Solutions Shared

On IBM Cloud there are a number of deployment offerings for VMware that you can choose from, with each providing a different level of abstraction. VMware Cloud Director (VCD) is offered under the banner of IBM Cloud for VMware Solutions Shared. It is a multi-tenant service with elasticity and two subscription types:

VMware Solutions Schematics



* 2 hours
* 2023-05-05
You specify the location of the Kits in the configuration files.





 Prerequisite, where to run the scripts 

Before you deploy any of the SAP automated solutions on IBM Cloud VPC, you create a bastion server VPC in your chosen region. The bastion server is used for downloading and storing specific SAP solution media that are needed for later automation deployment. The Bastion server is used for both CLI deployment scenarios, as well for Schematics UI deployments. For more information about how to create the Bastion server and its corresponding VPC, see [Automate SAP bastion server – SAP media storage repository](https://cloud.ibm.com/docs/sap?topic=sap-sap-bastion-server).

After bastion VPC deployment is complete, you must download the SAP Kits to the temporary storage assigned to you on the Bastion Server. Ansible installs the kits for you. You specify the location of the Kits in the configuration files.

To save costs the bastion server, with its SAP media dedicated storage, can be decommissioned after the SAP solutions are successfully implemented on IBM Cloud VPC cloud. Or, you can keep the bastion server and use it as a jump host for that specific region.

This automation is offered free of charge however, the provisioned infrastructure comes at cost.
You specify the location of the Kits in the configuration files.





 Prerequisite, create a Bastion server to run the scripts 

Before you deploy any of the SAP automated solutions on IBM Cloud VPC, you create a Bastion server VPC in your chosen region. The Bastion server is used for downloading and storing specific SAP solution media that are needed for later automation deployment. The Bastion server is used for both CLI deployment scenarios, as well for Schematics UI deployments. For more information about how to create the Bastion server and its corresponding VPC, see [Automate SAP Bastion server – SAP media storage repository](https://cloud.ibm.com/docs/sap?topic=sap-sap-bastion-server).

After Bastion VPC deployment is complete, you must download the SAP Kits to the temporary storage assigned to you on the Bastion Server. Ansible installs the kits for you. You specify the location of the Kits in the configuration files.

To save costs the Bastion server, with its SAP media dedicated storage, can be decommissioned after the SAP solutions are successfully implemented on IBM Cloud VPC cloud. Or, you can keep the Bastion server and use it as a jump host for that specific region.

This automation is offered free of charge however, the provisioned infrastructure comes at cost.
* VMware Regulated Workloads offer Data Center SP Advanced or Data Center SP Enterprise Plus.



: NSX-T Data Center SP license restrictions



* License upgrade is not available for NSX-T Data Center SP license edition.
* Automated deployment of the VMware HCX service is not supported for VMware vCenter Server instances with the NSX-T Data Center SP Enterprise Plus license edition. However, you can manually deploy HCX outside of the VMware Solutions console. For more information, see [HCX Connector and HCX Cloud installations](https://docs.vmware.com/en/VMware-HCX/4.2/hcx-getting-started/GUID-B1023D31-0458-433B-9ABB-62E8BDD3FEC2.html).



IBM Cloud data center pod availability
: You can now select the data center pod for your resource deployment. By using this feature, you can deploy new resources to the same pod where you have existing resources.

Support for Dual Intel Xeon Gold 6250 Cascade Lake servers
: Dual Intel® Xeon® Gold 6250 / 16 cores, 3.9 GHz bare metal servers are available for deployment for vCenter Server instances and VMware vSphere clusters with VMware vSphere 7, and for VMware Regulated Workloads and Security and Compliance Bundle instances.

Multizone support for VMware Solutions Shared
: VMware Solutions Shared now offers multizone VMware virtual data centers. Multizone is offered for new on-demand and reserved virtual data centers and includes support for Dallas 10 and Dallas 12 IBM Cloud data centers.

Add-on services upgrades
: The following service versions are now available to install on deployed instances.



* Caveonix RiskForesight v3.1.0
* Entrust DataControl v5.4
* IBM Spectrum Protect Plus v10.1.8
* Red Hat OpenShift v4.7.34
* vRealize Operations v8.6



About pages for add-on services
: You can now access overview information about a service from the first page of the VMware Solutions console.
The account owner can increase the RAM on ESXi servers by following these steps:



1. Log in to the IBM Cloud console and go to the device list.
2. Select the ESXi server to be modified.
3. From the details page, click Modify next to RAM or memory.
4. Specify the higher limit. Then, confirm the change to place your order.
5. Repeat these steps, as needed, for each additional ESXi server.



An IBM Cloud representative confirms the billing change and contacts you to schedule a maintenance window for adding the memory.

You must manage the VMware Solutions components that are created in your IBM Cloud account only from the VMware Solutions console, not any other means outside of the console. If you change these components outside of the VMware Solutions console, the changes are not synchronized with the console.





 Does VMware vSphere use automation to install, configure, and start the VMware stack? 

No. VMware vSphere does not use the advanced automation from the vCenter Server platform. Based on what you order, the platform delivers optional VMware licenses, ESXi servers, and, optionally, an HA-pair of FortiGate® physical firewalls. If a new cluster is created, three new VLANs are also provisioned: a public VLAN and two private VLANs.

VMware ESXi is automatically installed on each IBM Cloud bare metal server, but you are responsible for installing any additional VMware components like vCenter Server or NSX. While VMware vSphere ensures that VMware-compatible hardware is ordered based on the VMware components selected, no automation exists to configure and start the VMware environment. You are responsible for designing and architecting the IBM-hosted environment.





 How can I view a list of all notifications? 

To view the complete notification history, click Notifications from the left navigation.





 What if I have issues with VMware Solutions?
Zerto on IBM Cloud overview 

Zerto on IBM Cloud integrates replication and disaster recovery capabilities into the deployment offerings to protect and recover data in your VMware® virtual environment on IBM Cloud®. Zerto on IBM Cloud is a non-IBM product that is offered under terms and conditions from Zerto, not IBM.

Zerto is supported on VMware vCenter Server® instances that meet the following requirements:



* VMware NSX-T™ 3.1 or later
* VMware vSphere® 7.0



IBM Cloud® for VMware Solutions offers promotions for some add-on services. Promotional pricing offers a number of months without charge for a service license, if the service has license charges. For more information, see [Promotions for VMware Solutions add-on services](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_addingservicesvc_addingservices-service-promotions).

The Zerto version available for deployment is 9.7u3.



 Before you begin 



* Ensure that your IBM Cloud account is a billable account, and that it is linked to the IBM Cloud infrastructure account where your instance is deployed. For more information, see [Billing for Zerto replication](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-zerto_orderingzerto_ordering-billing).
* This service is available only to instances that are deployed in V1.2 or later.







 Technical specifications for Zerto 

For more information about resource requirements and capacity checking for some services, see [Resource requirements for services](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_addingservicesvc_addingservices-resource-requirements).

The following components are ordered and included in the Zerto service.

Zerto Virtual Replication Appliance (VRA) components are deployed only into the default cluster.



 Virtual Service Instances 



* One Virtual Service Instance (VSI) - Zerto Virtual Manager
VMware Aria Operations and VMware Aria Operations for Logs on IBM Cloud overview 

The VMware Aria Operations and VMware Aria Operations for Logs service is not available to Business Partner users.

VMware Aria® Operations™ (formerly known as VMware vRealize® Operations™) and VMware Aria Operations™ for Logs (formerly known as VMware vRealize® Log Insight™) on IBM Cloud deploys the VMware Aria Operations and VMware Aria Operations for Logs Enterprise Edition tools. These tools help you operate and monitor the performance, health, and capacity of your IBM®-hosted, dedicated VMware environment. VMware Aria Operations for Logs helps you troubleshoot issues by using log files more quickly. VMware Aria Operations and VMware Aria Operations for Logs on IBM Cloud is a non-IBM product that is offered under terms and conditions from VMware, not IBM.

These tools are deployed by using the IBM advanced automation and are based on a consistent highly available design. VMware Aria Operations includes preinstalled and configured Management Packs to provide deeper visibility into the core VMware Software Defined Data Center components like VMware NSX®, vSAN™, and HCX™. The automation provides optimized dashboards out of the box so that you can monitor the full VMware stack more easily.

IBM Cloud® for VMware Solutions offers promotions for some services. Promotional pricing offers a number of months without charge for a service license, if the service has license charges. For more information, see [Promotions for VMware Solutions services](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_addingservicesvc_addingservices-service-promotions).

The service versions available for deployment are VMware Aria Operations 8.12 and VMware Aria Operations for Logs 8.12.



 Technical specifications for VMware Aria Operations and VMware Aria Operations for Logs
[BI.S4.H8.12000 Appliance](https://cloud.ibm.com/gen1/infrastructure/provision/bm?imageItemId=13467&packageId=1119&presetId=1129) 224 448 12288 GB 550,670 OLAP/OLTP (**) 



(*): RHEL 7.4 for SAP Solutions, RHEL 7.6 for SAP Solutions, RHEL 7.9 for SAP Solutions, RHEL 8.2 for SAP Solutions -- SLES 12 SP2, SLES 12 SP4, SLES 12 SP5, SLES 15, SLES 15 SP1, SLES 15 SP2, SLES 15 SP3

(**): RHEL 7.6 for SAP Solutions, RHEL 7.9 for SAP Solutions, RHEL 8.2 for SAP Solutions -- SLES 12 SP4, SLES 12 SP5, SLES 15, SLES 15 SP1, SLES 15 SP2, SLES 15 SP3

(***): SLES 12 SP4, SLES 15, SLES 15 SP1, SLES 15 SP2, SLES 15 SP3

Please regard the supported operated systems mentioned in the footnotes.

For more information see [SAP Note 2414097 - SAP Applications on IBM Cloud Classic Infrastructure environment](https://launchpad.support.sap.com//notes/2414097).

A number of these Profiles are also available as "Boot-only" which have the same configuration but only the boot drives are inserted. This configuration lets you customize the Local SSD Storage and the attachment of either Network Block or File storage options.





 Understanding Bare Metal profile names 

The Bare Metal profile names are contextual and sequential. This example uses an SAP HANA certified server to list and describe the naming conventions:



Table 2. Profile naming for SAP HANA

 Profile name Naming convention component What it means 

 BI.S4.H2.1500 BI Bluemix Infrastructure (former name of IBM Cloud)
The recommended way to run the scripts is from your deployment (bastion) server because the deployment (bastion) server has Terraform and Ansible already installed. If you want to run the scripts from your local workstation, you need to install Terraform and Ansible locally.

For both the deployment (bastion) server and local workstation, you must download the SAP kits to the temporary storage assigned to you on the deployment (bastion) server. Ansible installs the kits for you. You specify the location of the kits in the configuration files.





 Prerequisite, where to run the scripts 

Before you deploy any of the SAP automated solutions on IBM Cloud VPC, you create a bastion server VPC in your chosen region. The bastion server is used for downloading and storing specific SAP solution media that are needed for later automation deployment. The bastion server is used for both CLI deployment scenarios, as well for Schematics UI deployments. For more information about how to create the bastion server and its corresponding VPC, see [Automate SAP bastion server – SAP media storage repository](https://cloud.ibm.com/docs/sap?topic=sap-sap-bastion-server).

After bastion VPC deployment is complete, you must download the SAP kits to the temporary storage assigned to you on the bastion server. Ansible installs the kits for you. You specify the location of the kits in the configuration files.

To save costs, the bastion server, with its SAP media dedicated storage, can be decommissioned after the SAP solutions are successfully implemented on IBM Cloud VPC. Or, you can keep the bastion server and use it as a jump host for that specific region.

This automation is offered free of charge however, the provisioned infrastructure comes at cost.