vania-janet/multiturn-rag-retrieval-data huggingface dataset:
To authenticate with client certificates, be aware of the following:



* Use unique client certificates. The VPN server configuration of client certificate authentication requires a client certificate as input. However, unique client certificates signed by the same Certificate Authority (CA) can be created separately and used for different users.
* Use a Certificate Revocation List (CRL) to revoke client certificates. Client-to-site VPN servers support CRL to revoke client certificates. For more information, see [Creating a VPN server](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-create-server).
* Do not use a client certificate signed with a public CA, such as LetsEncrypt certificates created through Secrets Manager. Using public-CA-signed client certificates means that anyone can provision a client certificate and authenticate successfully. Also, certificates that are created with a public CA cannot be easily tracked and revoked with a CRL.









 Additional VPN server configurations 

Client-to-site VPN servers support a number of additional options that you can configure for improved security and to meet compliance requirements. For more information, see [Creating a VPN server](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-create-server) and [Planning considerations for VPN servers](https://cloud.ibm.com/docs/vpc?topic=vpc-client-to-site-vpn-planning).

You should be aware of the following issues with VPN server configurations:



* VPN servers support client idle timeout. By default, a VPN client connection disconnects after 10 minutes without active traffic. You can edit the timeout to add your required value.
* Enable full-tunnel mode on VPN servers. Full-tunnel mode is more secure and preferred, especially if connecting from an untrusted network. In full-tunnel mode, all traffic from a VPN client is routed to the VPN server.
* Configure the transport protocol and VPN ports. In some cases, you might not want to leave well-known ports, such as TCP/443, open.
[Continuous Delivery clusters](https://cloud.ibm.com/docs-content/v1/content/562806c0b18119f4d21cb66f5ae6d051634b4a16/ContinuousDelivery/images/CD_cluster_arch.svg)

Figure 1. Continuous Delivery clusters

For more information about availability, see [High availability and disaster recovery](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-ha-dr).

All Continuous Delivery service plans share management, isolation, and deployment characteristics. For more information about the Continuous Delivery plans, see [Plan limitations and usage](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-limitations_usage).

You can configure Delivery Pipeline Private Workers to communicate between customer clusters and Delivery Pipeline services by using [private endpoints](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-install-private-workersinstall_pw_agent_pse).



 Continuous Delivery workload isolation 

The IBM-managed components of the Continuous Delivery service are organized to provide compute isolation between the multi-tenant toolchain platform workloads and the single tenant Delivery Pipeline worker workloads of the service.

The following diagram shows the management and isolation characteristics of the Continuous Delivery service components.



* The Multi-tenant toolchain platform section represents the IBM-managed components of the service that provide multi-tenant, or shared, workloads.
* The Container level compute workload isolation section represents the IBM-managed Delivery Pipeline shared workers component of the service. This component supports single tenant workloads.
* The multi-tenant and single tenant workloads each run in different sets of clusters, and are compute-isolated from each other.
* Each Delivery Pipeline job or step runs in its own container that is compute-isolated from the other containers within a cluster. This isolation applies to both IBM-managed shared workers and customer-managed shared workers.



Zoom

!
Canceling a Premium VLAN 

You can cancel your Premium VLANs when you no longer need them and when they are empty of native devices, or have devices which are all canceled. Trunked devices do not prevent cancelation.

Follow these steps to cancel a Premium VLAN.



1.  From your browser, open the [IBM Cloud console](https://cloud.ibm.com/) and log in to your account.
2.  From the console, click the Menu icon ![menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) and select Classic Infrastructure.
3.  Select Network > IP Management > VLANs.
4.  Select Cancel VLAN from the overflow menu ![overflow icon](https://cloud.ibm.com/docs-content/v1/content/3fa5994ae9adccdcd1e1af1de40af9e12f188fef/vlans//images/overflow.png) of the Premium VLAN that you want to cancel.
5.  Select the appropriate Cancel method based on when you want to cancel the VLAN.

Specific information on cancellation options is displayed next to each item.
6.  Select Confirm to confirm the cancellation, or select Close to cancel the action and keep the VLAN active.



You can alternatively click Actions > Cancel VLAN on the VLAN Details page.



  What happens next 

Premium VLANs are canceled either immediately or on the billing anniversary date. If you choose to cancel the VLAN immediately, the VLAN is reclaimed as soon as possible. If you select cancellation on the billing anniversary date, the VLAN remains on your account and active until the billing anniversary date.

Any secondary subnets present on the VLAN will be unrouted as part of VLAN reclaim, and any trunks present on the VLAN will be automatically removed.
However, you might find it helpful to create new access groups that include a combination of access policies for the [account management services](https://cloud.ibm.com/docs/account?topic=account-account-servicesaccount-management-access). The following table outlines the details of an IAM access policy that includes the permission from the migrated permission access group so that you can re-create and even combine these permissions with others in a new access group.



Table 1. Migrated infrastructure permissions that are mapped to IAM roles

 Migrated permission access group name Description Account management service IAM role 

 View account summary View the account summary page, invoices, and payments Billing Viewer 
 Get compliance reports Request compliance reports Billing Viewer 
 Edit company profile Edit the company profile information Billing Editor 
 Update payment details Update the recurring monthly payment information Billing Editor 
 Limit EU case restriction Enable or disable the EU Supported option to restrict support case data to the European Union Billing Not applicable 
 Add cases and view orders Create support cases and view all orders Support Center Editor 
 View cases View all support cases Support Center and User Management Viewer 
 Search cases Search all support cases if permission to view cases is assigned Support Center Viewer 



For the view cases access, create two separate policies with the viewer role for the Support Center and User Management services. The policy on the User Management service ensures that the user views all cases in the account regardless of who opened them. Without the policy on the User Management service, if the account owner has restricted users' ability to view other users in the account, the user's view of cases might be limited to only the ones they opened themselves.



 Assigning new IAM access policies for migrated permissions 

To re-create the migrated permissions that are available in each access group, you can assign policies to individual users or create new access groups in your account. The benefit of creating a new access group is that you can choose to combine a set of permissions for one access group rather than manage a set of access groups with a granular scope of access set for each. For this example, the steps explain how to create a new access group and assign an equivalent access policy for viewing the account summary and viewing all support cases.
* Internet Communication Manager (ICM) - The ICM is an element of the Java instance that handles requests coming from clients and dispatches them to the available server processes. Data is transferred from the ICM to the server processes and vice versa by using the Fast Channel Architecture (FCA), which allows fast and reliable communication between them
* One or several server processes - The server processes of AS Java run the Java application. They are responsible for processing incoming requests that are assigned to them by the ICM. Each server process is multi-threaded, and can therefore process many requests simultaneously.



2. System Central Services instance (SCS instance) - Central services form the basis of communication and synchronization for the AS Java cluster. They are responsible for lock administration, message exchange, and load balancing within the cluster. Central services that are run on one physical machine and constitute a separate instance. This [SAP Central Services Instance (SCS)](https://help.sap.com/viewer/5bdacafd0bbd41648f4b80093a1bf9d6/7.4.19/en-US/480728f74c6a3837e10000000a42189b.html) comprises:



* Message Server - The message server keeps a list of all server processes in the AS Java cluster and provides information about their availability to Internet Communication Manager (ICM). It also represents the infrastructure for data exchange between the participating server processes.
* Enqueue Server - The enqueue server manages logical locks. The enqueue server runs on the Central Services instance of the Java cluster. It manages the lock table in the main memory and receives requests for setting or releasing locks. It maps the logical locks to the database.





Db2 for standard system



* Database instance (DB) - Db2 in this case. For more information, see [AnyDB - IBM Db2](https://cloud.ibm.com/docs/sap?topic=sap-anydb-ibm-db2) and [Infrastructure certified for SAP](https://cloud.ibm.com/docs/sap?topic=sap-iaas-offerings).
For more information, see [ASCS Instance with Integrated Gateway](https://help.sap.com/viewer/ce9e270ad34949969c16d09d1b099a26/CURRENT_VERSION/en-US/bf1d359ac8384441a781ae3b0b5bd1b5.html).



Architecture of SAP NetWeaver AS for JAVA



1. Java central instance (J< nn > instance) – A Java instance is a unit in the AS Java cluster that is identified by its instance number. The elements that form an instance that is run on one physical machine. Also, it is possible to run several instances on one physical machine, but it is recommended that you split the different instances among different physical machines. A [Java Central Instance](https://help.sap.com/viewer/5bdacafd0bbd41648f4b80093a1bf9d6/7.5.4/en-US/4b1bb795eb2770d3e10000000a42189b.html) consists of:



* Internet Communication Manager (ICM) - The ICM is an element of the Java instance that handles requests coming from clients and dispatches them to the available server processes. Data is transferred from the ICM to the server processes and vice versa by using the Fast Channel Architecture (FCA), which allows fast and reliable communication between them
* One or several server processes - The server processes of AS Java run the Java application. They are responsible for processing incoming requests that are assigned to them by the ICM. Each server process is multi-threaded, and can therefore process many requests simultaneously.



2. System Central Services instance (SCS instance) - Central services form the basis of communication and synchronization for the AS Java cluster. They are responsible for lock administration, message exchange, and load balancing within the cluster. Central services that are run on one physical machine and constitute a separate instance.
You can learn more about assigning access between services in the [Using authorizations to grant access between services](https://cloud.ibm.com/docs/account?topic=account-serviceauth) documentation.





 Roles 

IBM Cloud access roles are a group of actions. Access roles allow users and service IDs to complete specific tasks within the context of the target resources that are defined in the policy. There are two types of predefined access roles: platform management and service access. The third type of access role is a custom role that you can create for a service to combine any set of available actions to meet your organizational needs.

Platform management roles define allowable actions, such as assigning user access and creation of service instances, for managing resources at the platform level. Platform roles also apply to actions that can be taken within the context of account management services, such as inviting and removing users, managing access groups, managing service IDs, and private catalog products.

Service access roles define allowable actions, such as calling service APIs or accessing a service's dashboard. These roles are customized based on the service that is selected within the policy.

When you assign access within the console, next to the role you can see the number of actions that are mapped to each role and drill down into that list to see exactly what each role allows.

For more information, see [IAM roles](https://cloud.ibm.com/docs/account?topic=account-userrolesiamusermanrol).





 Actions 

Actions are mapped to IBM Cloud IAM roles so that users can perform only specific tasks when they are assigned the different roles. Sometimes actions are also referred to as permissions or operations. Allowable actions for each role change based on the service that is being accessed because each service defines how that role maps to the use of the service. For more information, see [IAM roles and actions](https://cloud.ibm.com/docs/account?topic=account-iam-service-roles-actions).





 Access management system 

The IBM Cloud IAM control system allows or denies actions by users or service IDs within the context of a service based on their assigned access policies. By default, every user and service ID has no access.
* [SAP Solution Manager](https://support.sap.com/en/alm/solution-manager.html). Access to the SAP Solution Manager has different connectivity requirements between an SAP Solution Manager and its managed systems. The differences depend on your usage scenario. These scenarios require an understanding of the required network connectivity.
* If you are deploying public gateways or floating IPs, you need to look into the details of Network Address Translation (NAT) and the behavior of SAP applications. Refer to the [SAP document on NAT](https://wiki.scn.sap.com/wiki/display/ABAPConn/NAT+and+RFC) to consider potential issues on the application layer, especially in the SAP Remote Function Calls (RFCs).









 Networking consumption considerations 

Traditional SAP workload network communication is relatively small with under 100 MiB network traffic per day possible, such as:



* User transactions from SAPGUI; for Windows, for Java (used with macOS or Linux)
* User transactions from SAP WebGUI
* User transactions with SAP web Dynpro apps from SAP NetWeaver Business Client (NWBC)
* SAP Remote Function Call (SAP RFC) between SAP and non-SAP systems
* SAP iDOC Inbound/Outbound between SAP and non-SAP systems with third-parties (for example, banks, suppliers)



However, there are much larger SAP workload network communications too consuming significantly more network traffic, such as:



* SAPUI5 preinstall libraries and themes for SAP Fiori Launchpad and Apps



* 10 MiB - 25 MiB (estimate) per new session that is loaded from SAP web Assistant (also known as. XRay), these preinstall libraries are then cached by the browser. Once cached the libraries are available for use in any new browser tab, even after browser restart or SAP Fiori logout; until browser cache cleared
* 20 KiB - 500 KiB (estimate) per each new Fiori app that is loaded within the session



* SAP HANA System Replication (HSR) Sync or Async, streaming Gigabyte's of data per month from primary to secondary (or tertiary) nodes
The blocknonlogged parameter must always be set to YES. Changing it to NO will prevent any non-logged operations on the primary database from being replicated onto the standy databases breaking HADR



 High availability (HA) 

Db2 on Cloud high availability plans have excellent availability characteristics with a 99.99% SLA.

High availability disaster recovery (HADR) on Db2 on Cloud Enterprise and Standard plans is provided by leveraging the support of native Db2 HADR.



* Each HADR system consists of 3 nodes located in different independent availability zones.



Zoom

![Schematic view of the 3 nodes in different availability zones](https://cloud.ibm.com/docs-content/v1/content/2a59ee244ed61eb35ab50e45757b42d22f720132/Db2onCloud/images/ha_AZ_small.png)

Figure 1. Schematic view of the 3 nodes in different availability zones



* The primary node processes read and write transactions and the standby nodes can provide read-only query capability. One of the standby nodes is replicated synchronously, which means each transaction is committed on at least 2 nodes before it is successful. This standby node is ready to take over write processing as well should any failure or maintenance event occur. The other standby node is asynchronously replicated and assumes the role of the synchronous node during a failure or maintenance event. Even in the case of an entire data center failure or maintenance event, you still have an HA system that is replicated between the surviving data centers.



Zoom

![Schematic view of primary node failover](https://cloud.ibm.com/docs-content/v1/content/2a59ee244ed61eb35ab50e45757b42d22f720132/Db2onCloud/images/ha_failure.png)

Figure 2. Schematic view of primary node failover



* During failover events, you can expect between 10-20 seconds during which transactions are restricted.
Instead, use unique names such as ml and chem-lab. Alternatively, use prefix or suffix values to avoid such unintended substring matches.
* Using naming conventions, along with prefix or suffix values can help you easily allow access to several projects.
* Quantum experiments (jobs) belong to service instances, and users that have access to an instance can see its jobs.
* Service instances can be based on different plans, allowing access to different backends like real devices or simulators. See [Choose a system or simulator](https://cloud.ibm.com/docs/quantum-computing?topic=quantum-computing-choose-backend) for details.



* Which users need to access which projects?
* Should users be able to delete jobs? Keeping jobs in service instances gives more traceability for billing costs. This information combines well with the audit trail of [Activity Tracker](https://cloud.ibm.com/docs/quantum-computing?topic=quantum-computing-considerations-org), which tracks which user submitted the job.
* Will you use access groups that directly reference Qiskit Runtime service instances or organize services into resource groups?



* Access groups are a convenient and common way of controlling user access for IBM Cloud resources. They are a simple but powerful means to consistently assign user access. We create an access group for each project and map users to access groups. Each access group uses a custom role that allows users to access specific Qiskit Runtime service instances or resource groups.
* Resource groups are used only when you need to maintain a clear separation of service instances. If more service instances are created in a resource group, all users that have access to the resource group see them automatically without updating access groups. If you choose to use resource groups, you will create access groups and then assign them to resource groups.



A service instance can belong to only one resource group, and after instances are assigned into resource groups, they cannot be changed. This also means that the resource group assignment can happen only at service instance creation. Therefore, resource groups might not provide enough flexibility if assignments of service instances to resource groups might need to change.







 Next steps
Public gateway uses source network address translation (SNAT) and a floating IP uses destination network address translation (DNAT). These functionalities are identical to VPC virtual servers.

The following diagram depicts how VMware workloads that are attached to VPC subnets can use these two options, and shows the key differences between them. Each VM has a VLAN interface, and the external connectivity depends how the VLAN interface is provisioned.

Zoom

![Public Gateways and floating IPs](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/vpc-ryo-diagrams-non-nsx-based-vms-pgw.svg)

Figure 3. Public Gateways and floating IPs

VLAN interfaces that are attached to a VPC subnet with a Public Gateway can initiate connections to the internet, but they cannot receive connections from the internet. Public Gateway provides connectivity for an entire subnet, and public traffic that originates from the VMs on this subnet considers the Public Gateway IP address as the source. If the subnet is not attached to a Public Gateway, the traffic is fully private. In this design, vSAN, vMotion, or TEP subnets can be examples.

A VLAN interface with a floating IP can initiate or receive connections to or from the internet. Floating IP provides connectivity for a single instance. This action overrides the Public Gateway of that specific VLAN interface in VPC subnet, if that is provisioned to a subnet with attached Public Gateway.





 Related links 



* [IBM Cloud VPC getting started](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started)
* [IBM Cloud VPC Bare Metal Servers](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-for-bare-metal-servers)
: Added [IAM actions and Activity Tracker events](https://cloud.ibm.com/docs/openshift?topic=openshift-api-at-iamks-ingress) for the Ingress secret, Ingress ALB, and NLB DNS APIs.





 9 November 2020 

New! Reduced and hourly billing is available for OCP licenses
: Now when you create worker nodes with the latest flavors, OCP license costs are billed at reduced rates as part of the worker node cost. You can check the new rates in the pricing estimate when you create a cluster or worker pool. This billing change means that virtual worker nodes are only billed hourly for OCP license instead of monthly. Existing worker nodes in clusters continue to be billed at the previous rates for monthly OCP licenses. For more information and to migrate existing worker nodes, see [On-demand OCP licenses from Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-costslicenses-on-demand) or review the [IBM Cloud blog announcement](https://www.ibm.com/cloud/blog/announcements/run-workloads-by-the-hour-with-red-hat-openshift-on-ibm-cloud).

Worker node versions
: Worker node fix pack update change log documentation is available.