vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Architecture patterns for vCenter Server deployment with private connectivity options 

When you deploy a [VMware vCenter Server instance](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_vcenterserveroverview) in your IBM Cloud® classic infrastructure, the deployment consists of a number of network constructs and VMware® management components.

These architecture patterns give an overview for a few private connectivity options for VMware vCenter Server® deployments.



 Private connectivity deployed by automation 

When you deploy a vCenter Server instance in your IBM Cloud classic infrastructure, you obtain the default private network topology as presented in the following diagram.

Zoom

![Access to IBM Cloud Private network](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/arch-pattern-nsx-t-private-access.svg)

Figure 1. Access to IBM Cloud private network

The following list summarizes the private connectivity pattern.



1. The automation deploys an NSX-T Tier 0 (T0) Gateway in the NSX-T workload edge cluster. The T0 gateway provides connectivity to IBM Cloud private network.
2. The deployed T0 gateway has a route to IBM Cloud private network 10.0.0.0/8 and IBM Cloud Services networks 166.8.0.0/14 and 161.26.0.0/16 with BCR as a next-hop.
3. The automation deploys an example NSX-T overlay topology with a Tier 1 (T1) Gateway and a few example segments attached both to the T1 and T0 Gateways. You might customize the topology based on your needs.
4. IBM Cloud Services can be reached through IBM Cloud private network by using Cloud Services Endpoints when it uses IBM Cloud private network addresses.
5. When you use BYOIP on NSX-T overlay networks, you must use SNAT at T0 or T1.
For more information, see [Getting started with SSH keys](https://cloud.ibm.com/docs/vpc?topic=vpc-ssh-keys).<br><br><br> 
 Virtual private cloud Specify the VPC where you want to create your server. You can use the default VPC, another existing VPC, or you can create a new VPC. 
 Network interfaces By default the bare metal server is created with a single primary network interface. You can click the pencil icon to edit the details of the network interface. For example, the subnet or security group that's associated with the interface. To include extra secondary network interfaces, click New interface.<br><br><br><br> * For x86 architecture, you can create and assign up to eight PCI network interfaces and up to 20 PCI + VLAN network interfaces for each server. For more information about advanced networking configurations, see [Managing network interfaces for a bare metal server](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-nic-for-bare-metal-servers).<br> * For s390x architecture, you can attach up to two network interfaces based on the profile that you choose. For more information, see [Managing network interfaces for a bare metal server](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-nic-for-bare-metal-servers).<br><br><br> 





Table 2. Bare metal server advanced options

 Advanced option Value 

 User data Paste your user data to the User data (optional) field or click Import user data to upload from your user data. For example, you can enable SSH by adding the following script to the User data (optional) field. For more information about user data, see [User data](https://cloud.ibm.com/docs/vpc?topic=vpc-user-data). 
 Trusted Platform Module (TPM) Click the toggle to enable Trusted Platform Module capabilities. Then, select the mode that you want to use.
* CLI
* API







 Getting Connection Strings 

The IBM Cloud® Databases for Redis service is provisioned with authentication enabled. You need a username, password, and connection strings to connect and issue commands. In Redis 5.x and prior, there is only the admin user. Redis did not introduce support for multiple users until Redis 6.

Connection Strings for your deployment are displayed on the Dashboard Overview, in the Endpoints section. All users on your deployment can use the connection strings, including connection strings for either public or private endpoints.

Your connection string will default to database 0. However, modifying your connection to connect to a database other than 0 is supported.

Your Redis deployment is provisioned with an admin user. You must set the admin password before you can use it to connect to the database. For more information, see the [Setting the Admin Password](https://cloud.ibm.com/docs/databases-for-redis?topic=databases-for-redis-admin-password) page.



 Getting Connection Strings from the CLI 

You can grab connection strings from the [CLI](https://cloud.ibm.com/docs/databases-cli-plugin?topic=databases-cli-plugin-cdb-referencedeployment-connections).

ibmcloud cdb deployment-connections example-deployment -u <newusername> [--endpoint-type <endpoint type>]

Full connection information is returned by the ibmcloud cdb deployment-connections command with the --all flag. To retrieve all the connection information for a deployment named "example-deployment", use the following command.

ibmcloud cdb deployment-connections example-deployment -u <newusername> --all [--endpoint-type <endpoint type>]

If you don't specify a user, the deployment-connections commands return information for the admin user by default. If you don't specify an endpoint type, the connection string returns the public endpoint by default. If your deployment has only a private endpoint, you must specify --endpoint-type private or the commands return an error.
For more information, see [Getting the access key through the IBM Cloud UI](https://cloud.ibm.com/docs/monitoring?topic=monitoring-access_keyaccess_key_ibm_cloud_ui).
2. Obtain the public or private ingestion URL. For more information, see [collector endpoints](https://cloud.ibm.com/docs/monitoring?topic=monitoring-endpointsendpoints_ingestion).
3. Deploy the monitoring agent. Run the following command:

docker run -d --name sysdig-agent --restart always --privileged --net host --pid host -e ACCESS_KEY=MONITORING_ACCESS_KEY -e COLLECTOR=COLLECTOR_ENDPOINT -e COLLECTOR_PORT=6443 -e ADDITIONAL_CONF="sysdig_capture_enabled: false" -e TAGS=TAG_DATA -e ADDITIONAL_CONF=“log: { file_priority: error, console_priority: none }” -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro --shm-size=350m sysdig/agent

Where



* MONITORING_ACCESS_KEY is the ingestion key for the instance.
* COLLECTOR_ENDPOINT is the public or private ingestion URL for the region where the monitoring instance is available. To get an endpoint, see [Collector endpoints](https://cloud.ibm.com/docs/monitoring?topic=monitoring-endpointsendpoints_ingestion).
* TAG_DATA are comma-separated tags that are formatted as TAG_NAME:TAG_VALUE. You can associate one or more tags to your monitoring agent. For example, role:serviceX,location:us-south.
* Set sysdig_capture_enabled to false to disable the capture feature.
The registry secret is used to authenticate with a private registry when you download the container image. This value is optional.

--request-timeout, --rt, --timeout, -t
: The amount of time in seconds that can pass before requests made to the application must succeed or fail. This value is optional. The default value is 300.

--rn, --revision-name
: The name of the revision. Use a name that is unique within the application.



* The name can contain lowercase letters, numbers, and hyphens (-).
* The name must end with a lowercase alphanumeric character.
* The fully qualified revision name must be in the format, Name_of_application-Name of revision.
* The fully qualified revision name must be 63 characters or fewer.



This value is optional.

--service-account, --sa
: The name of the service account. A service account provides an identity for processes that run in an instance. For built-in service accounts, you can use the shortened names manager, none, reader, and writer. You can also use the full names that are prefixed with the Kubernetes Config Context, which can be determined with the project current command. This value is optional.

--user, -u
: The user ID (UID) that is used to run the application. This value overrides any user ID that is set in the application Dockerfile. The ID must conform to the operating system requirements of the container. This value is optional. The default value is 0.

--visibility, -v
: The visibility for the application. Valid values are public, private and project. Setting a visibility of public means that your app can receive requests from the public internet or from components within the Code Engine project. Setting a visibility of private means that your app is not accessible from the public internet and network access is only possible from other IBM Cloud using Virtual Private Endpoints (VPE) or Code Engine components that are running in the same project. Visibility can only be private if the project supports application private visibility.
[Providing the private SSH key for authentication](https://cloud.ibm.com/docs-content/v1/content/29e0ddc9fd7149f916889ba6a4d131cc3528c9bc/hp-virtual-servers/image/hpvs_ssh_auth.jpg)

Figure 2. Providing the private SSH key for authentication

For SSH key pairs generated other than using PuTTY, you can use Conversions -> Import key of the PuTTY Key Generator to convert the private key into the PuTTY format of the same length.
3. Define the root default username under Connection -> Data.

Zoom

![Defining the auto-login user name](https://cloud.ibm.com/docs-content/v1/content/29e0ddc9fd7149f916889ba6a4d131cc3528c9bc/hp-virtual-servers/image/hpvs_root.jpg)

Figure 3. Defining the auto-login username
4. Go back to the session configuration shown in Figure 1 and click Save again. Otherwise, you lose your changes.



From now on, you can open and log in to this server as root user without the need to specify your private SSH key.
* The leading prefix of ibm- is used for IBM-provided images. Custom images cannot be named with this prefix.
* The family component provides the operating system family, such as redhat, debian or in this example hyper-protect.
* The version component provides the operating system version, such as 18-04 for Ubuntu 18.04, or 1.0 for hyper-protect.
* The type component provides the minimization level of the operating system image, such as minimal or full.
* The architecture component provides the vCPU architecture that is supported by the operating system image, such as amd64 or s390x.
* The build component is a small, non-negative integer that is incremented each time a new build of the operating system is created. For image names that are otherwise identical, the image with the highest build value is the most recent image for that operating system.



You can obtain the current list of images, including stock images, by running the following command in the command-line interface: [ibmcloud is images](https://cloud.ibm.com/docs/vpc?topic=vpc-infrastructure-cli-plugin-vpc-referenceimages).

The image naming convention is subject to change. The list of image names is not intended to be programmatically parsed or interpreted. You can use the [GET /images](https://cloud.ibm.com/apidocs/vpcget-image) API to obtain metadata in a structured format.







 Custom images 

You can import an image from IBM Cloud Object Storage to use for creating a new virtual server instance.

To create secure execution based custom images by using the Cloud Object Storage option, see [Preparing the workload](https://www.ibm.com/docs/en/linux-on-systems?topic=tasks-prepare-workload). For information about creating secure execution based images, see [IBM Secure Execution for Linux](https://www.ibm.com/docs/en/linux-on-systems?topic=overview-introducing-secure-execution-linux).
If there is no name associated with the keystore, it means the keystore is created using the PKCS #11 API. 
 Type The type of the keystore. Possible values are Public and Private. The database-backed EP11 keystores are composed of two types of keystores: public keystores for storing less sensitive EP11 keys that can be accessed by any user types (security officers, normal users, and anonymous users) and private keystores for storing sensitive EP11 keys that can be accessed by normal users only. For more information about keystores, see [Introducing keystore](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-pkcs11-intropkcs11-keystore-intro). 







 Creating EP11 keystores 

For default service access roles that support creating EP11 keystores, see [service access roles](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-accessservice-access-roles). If you are to create custom roles, make sure to assign the following actions to the custom role:



* hs-crypto.keystore.listkeystoresbyids
* hs-crypto.keystore.createkeystore



For instructions on creating custom roles, see [Creating custom roles](https://cloud.ibm.com/docs/account?topic=account-custom-roles).

Complete the following steps to create an EP11 keystore:



1. Select the EP11 keystores tab in the side menu. You can see a list of existing EP11 keystores with each having a unique ID.
2. Click Create keystore. In the Create EP11 keystore panel that is displayed, enter the Keystore name and select the Keystore type to be Private or Public.

The database-backed EP11 keystores are composed of two types of keystores: public keystores for storing less sensitive EP11 keys that can be accessed by any user types (security officers, normal users, and anonymous users) and private keystores for storing sensitive EP11 keys that can be accessed by normal users only.
global-app-project Ready global-app Sao Paulo (br-sao) default 3 min 



For more information, see [Managing projects](https://cloud.ibm.com/docs/codeengine?topic=codeengine-manage-project).





 Step 2: Deploy your apps in multiple regions 

Now that your projects are created in multiple regions, deploy your application in each project.

For example, deploy the codeengine/helloworld app.



1. From the [Code Engine projects](https://cloud.ibm.com/codeengine/projects) page, click the name of one of the projects that you created.
2. Click Create application.
3. Configure your app with the following settings.



1. Name your application global-app.
2. Select Container image to reference a container image for your app.
3. Enter icr.io/codeengine/helloworld for your image reference.
4. Under Runtime settings, set your minimum number of instances to 1. By setting your minimum number of instances to 1, you can enable health checks from your CIS instance to monitor the availability of pools so that traffic can be routed to the healthy ones.
5. Leave the rest of the options at the default settings and click Create.



4. Repeat these steps to create the application in each project.



For more information about deploying your application, see [Deploying applications](https://cloud.ibm.com/docs/codeengine?topic=codeengine-application-workloads).





 Step 3: Generate a certificate for your custom domain 

In an enterprise environment, work with your corporate domain administrator to obtain the necessary certificates. However, if the custom domain is within your control and you want quickly create a certificate that is not self-certified, then you can optionally use the [Let's Encrypt](https://letsencrypt.org/) service and [Certbot](https://certbot.eff.org/) to obtain a certificate.



1.
You can edit the boot volume an add user tags to identify it in the resource list. 
 Data volumes You can create one or more secondary data volumes to be attached when you provision the instance. For z/OS Wazi aaS custom image only: If you want to use Hyper Protect encryption services for the boot volume, you can click Create and select Hyper Protect Crypto Services for the Encryption option. 
 To create a data volume, click Create in the Data volumes section. Define the volume in the side panel. For more information about provisioning the volume, see [Create and attach a block storage volume when you create a new instance](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-block-storagecreate-from-vsi). 
 Specify any user tags that you want to associate with the data volume you're creating and attaching to the instance. 
 Virtual private cloud Specify the IBM Cloud VPC where you want to create your instance. You can use the default VPC, another existing VPC, or you can create a new VPC. To create a new VPC, click New VPC. 
 Network interfaces By default the virtual server instance is created with a single primary network interface. You can click the pencil icon to edit the details of the network interface, for example, the subnet or security group that's associated with the interface. To include extra secondary network interfaces, click New interface. You can create and assign up to 15 network interfaces for your virtual server instance, depending on the vCPU count that is included in the instance profile. For more information, see [About network interfaces](https://cloud.ibm.com/docs/vpc?topic=vpc-using-instance-vnicsabout-network-interfaces). 



5. For Advanced options, you can choose to complete more instance configurations.



Table 4. Instance provisioning advanced options selections

 Field Value 

 User data You can add user data that automatically performs common configuration tasks or runs scripts. For more information, see [User data](https://cloud.ibm.com/docs/vpc?topic=vpc-user-data).
The automation deploys an NSX-T Tier 0 (T0) Gateway in the NSX-T workload edge cluster. The T0 gateway is attached to both IBM Cloud private and public networks or IBM Cloud private network only based on the selection.
3. The automation deploys an example NSX-T overlay topology with a Tier 1 (T1) Gateway and a few example overlay segments attached both to the T1 and T0 Gateways. You might customize the topology based on your needs.
4. There are default firewall rules (deny any) and example SNAT/DNAT rules in the T1 and T0 Gateway Firewalls for private or public connectivity. You must customize them to fit your needs.
5. The deployed T0 gateway has a default route 0.0.0.0/0 to the internet with FCR as a next-hop.
6. The deployed T0 gateway has routes to IBM Cloud private network 10.0.0.0/8 and IBM Cloud Services networks 166.8.0.0/14 and 161.26.0.0/16 with BCR as a next-hop.
7. IBM Cloud Services can be reached through IBM Cloud private network by using Cloud Services Endpoints when it uses IBM Cloud private network addresses. You need SNAT to access these endpoints.







 Private connectivity 

When you deploy a vCenter Server instance in your IBM Cloud classic infrastructure, you obtain the default private network topology as presented in the following diagram.

Zoom

![Access to IBM Cloud Private network](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/arch-pattern-nsx-t-private-access.svg)

Figure 4. Access to IBM Cloud Private network

Private connectivity pattern is summarized as follows:



1. The automation deploys an NSX-T Tier 0 (T0) Gateway in the NSX-T workload edge cluster. The T0 gateway provides connectivity to IBM Cloud private network.
2.
: In version 4.3 clusters, you can now create [private Ingress controllers](https://cloud.ibm.com/docs/openshift?topic=openshift-ingress-private-expose&interface=ui) and [private routes](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_routesprivate-routes-setup-43) to expose your apps on the private network only.

Version change logs
: Worker node patch updates are available.
: Red Hat OpenShift [3.11.200_1546_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_changelog_311311200_1546_worker).





 6 April 2020 

CLI change log
: Updated the Red Hat OpenShift on IBM Cloud CLI plug-in change log page for the [release of version 1.0.28](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_cli_changelog10).







 March 2020 



 30 March 2020 

Version change logs
: Worker node patch updates are available.
: Red Hat OpenShift [3.11.188_1545_openshift](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_changelog_311311188_1545_worker).

File storage classes
: Added gid file storage classes to specify a supplemental group ID that you can assign to a non-root user ID so that the non-root user can read and write to the file storage instance. For more information, see the storage class [reference](https://cloud.ibm.com/docs/openshift?topic=openshift-file_storagefile_storageclass_reference).





 27 March 2020 

Tech overview
: Added an [Overview of personal and sensitive data storage and removal options](https://cloud.ibm.com/docs/containers?topic=containers-service-archibm-data).





 25 March 2020
1. Use the HTTP header Authorization.
2. Prefix the IAM access token with the literal Bearer eyJhbGciOiJSUzI1Ng....
3. Add the prefixed IAM access token to the HTTP header: Authorization: Bearer eyJhbGciOiJSUzI1Ng....





* Curl
* Java
* Python
* Go
* Node



curl -H "Authorization: Bearer eyJhbGciOiJSUzI1Ng..."

import com.ibm.cloud.sdk.core.security.BearerTokenAuthenticator;
import <sdk_base_package>.ExampleService.v1.ExampleService;
...
String bearerToken = // ... obtain bearer token value ...

// Create the authenticator.
BearerTokenAuthenticator authenticator = new BearerTokenAuthenticator(bearerToken);

// Create the service instance.
ExampleService service = new ExampleService(authenticator);

// 'service' can now be used to invoke operations.
...
// Later, if your bearer token value expires, you can set a new one like this:
newToken = // ... obtain new bearer token value
authenticator.setBearerToken(newToken);

from ibm_cloud_sdk_core.authenticators import BearerTokenAuthenticator

authenticator = BearerTokenAuthenticator(<your_bearer_token>)
service = ExampleService(authenticator=authenticator)

 after getting a new access token...
service.get_authenticator().set_bearer_token('54321');

import {
"github.com/IBM/go-sdk-core/v5/core"
"<appropriate-git-repo-url>/exampleservicev1"
}
...
// Create the authenticator.
Now you can use the REST API (start from step 1 again) to obtain your activation and thus the result of your action. To do so, run this command:

ibmcloud fn activation get 31809ddca6f64cfc9de2937ebd44fbb9

In summary, you can see how a simple ibmcloud fn action invoke myAction command passes through different stages of the Cloud Functions system. The system itself mainly consists of only two custom components: the Controller and the Invoker. Everything else is already there, developed by many people in the open source community.