vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Classic bare metal to bare metal or virtual server on VPC using a private network 

This is the process of migrating from a classic physical bare metal server to a bare metal or virtual server instance on VPC environment. The RackWare Management Module (RMM) solution simplifies the overall migration process of moving the operating system, applications, and data from the classic bare metal to bare metal or virtual server instance on an IBM Cloud® VPC.

The migration can occur either over the public or private interface of the compute resource. The only requirement is all three components are reachable from one and another. This guide focuses on the private path, as this is a bit more involved, which requires setting up a transit gateway for a communication channel between classic and VPC over the private interface.



 Objectives 



* Prepare your source and target machines for migration.
* Learn how to use the RMM solution.
* Successfully complete a classic bare metal to VPC bare metal migration for private networks.







 Architecture diagram 

Zoom

![Physical to virtual migration private IP diagram.](https://cloud.ibm.com/docs-content/v1/content/8aa0853d34cf2349f1d2db8e5c61e6422a580169/cloud-infrastructure/images/Classic-bare-metal-to-VPC-bare-metal-using-private-network.svg)

Figure 1. Migrating classic bare metal to bare metal on VPC over private interface

Zoom

![Physical to virtual migration private IP diagram.](https://cloud.ibm.com/docs-content/v1/content/8aa0853d34cf2349f1d2db8e5c61e6422a580169/cloud-infrastructure/images/P2V-Private-1.svg)

Figure 2. Migrating classic bare metal to virtual server instance on VPC over private interface

This architecture diagram is also applicable for classic bare metal to VPC bare metal.





 Before you begin 



* Check for correct IBM Cloud VPC user permissions. Be sure that your user account has sufficient permissions to create and manage VPC resources.
The higher the frequency of your backups, the better your RPO.

RTO, the Recovery Time Objective, refers to the time required to bring the system back online after a failure or disaster occurs. The time taken to restore the files and roll forward (or backward) with transaction logs is your RTO.

You might need to design your HA strategy based on your RPO and RTO objectives. A more stringent RPO and RTO might also be cost prohibitive.





 Architecture diagram 

This diagram shows the 3-tier architecture that you create with the tutorial

[1].

Zoom

![Two different types of bare metal deployment.](https://cloud.ibm.com/docs-content/v1/content/df269b100c3499f1efcbb7d030dce8dec25c539b/ha-infrastructure/images/3_tier_tut.png)

Architectural Diagram





 Components 



 Infrastructure Components 

VPC, Zones, and Regions

A VPC provides an enterprise with the ability to define and control a virtual network that is logically isolated from all other public cloud tenants. This isolation creates a private, secure place on the public cloud. All the components in this architecture are in a single VPC and Region. You might have up to three Zones in a region. In the interests of simplicity, two zones are considered in this tutorial. For more information on VPC, see [Virtual Private Cloud](https://www.ibm.com/cloud/learn/vpc).

Subnets

Three distinct subnets are created in each zone as shown in the architecture diagram. There are six private subnets in two zones; one subnet for each of the web, app, and database tiers in each zone. For more information on subnets, see [About networking](https://cloud.ibm.com/docs/vpc?topic=vpc-about-networking-for-vpc).

Bastion Host

The bastion host provides access to private networked hosts. It’s a single point of entry to all virtual servers in the farm.
[Deployment target Blue-Green strategy](https://cloud.ibm.com/docs-content/v1/content/562806c0b18119f4d21cb66f5ae6d051634b4a16/ContinuousDelivery/images/ds-vpc-setup-dep-target-bg.png)

Figure 7. Deployment target Blue-Green strategy



 Configure VPC details 

Configure the toolchain by specifying information about the VPC and Virtual Server Instances (VSI).

You provisioned the VPC and VSI by using IBM Cloud® Schematics and Terraform when you selected the deployment strategy to use.



* Virtual Private Cloud Region: Select the region in which you provisioned the VPC.
* Virtual Private Cloud Name: Select the VPC that you provisioned by using the Terraform template. Options include all of the available VPCs in the selected region.
* Username for VPC Instances: Specify the username that you configured when you provisioned the VPC instance. All of the VSIs in your VPC require a username and an SSH key to log in and deploy that instance.
* Base64 Encoded SSH Key for VPC Instances: Specify the private SSH key in base64-encoded form for the public SSH key that you configured when you provisioned the VPC instances.







 Configure Bastion host details 

The Terraform template also creates a VSI for use as a Bastion host. A Bastion host provides a secure way to connect to the VSIs within your VPC to complete deployment and maintenance tasks. The Bastion host connects to the VSIs over SSH by using the credentials (username and SSH key) that you configured in the VPC details.

The toolchain requires that you to log in to the VSIs within the VPC to deploy the app binary, start and stop the app, and download the third-party dependency to run the app. All of these tasks are achieved by using SSH-Tunneling with the Bastion host. The toolchain uses the same credentials to log in to the Bastion host that are used by the Bastion host to connect to the VSIs.
When the app returns a response packet, it uses the IP address of the worker node where the Ingress controller service that forwarded the request exists. The VPC load balancer then sends the response packet to the client.







 VPC cluster with a private cloud service endpoint only 

When you create a multizone VPC cluster with the private cloud service endpoint only, a private Ingress controller is created by default. Only clients that are connected to your private VPC network can access apps that are exposed by a private Ingress controller. The following diagram shows how Ingress directs communication from private networks to an app in a VPC multizone cluster.

Zoom

![Privately expose an app in a multizone VPC cluster by using Ingress](https://cloud.ibm.com/docs-content/v1/content/bce0f0917a9eea684d1b4b704ac6343a1f65f446/openshift/images/roks_router_ingress_vpc_private.png)

Figure 1. Privately expose an app in a multizone VPC cluster by using Ingress



1. A client that is connected to your private VPC network sends a request to your app by using your app's URL. This URL is the Ingress subdomain for your cluster for your exposed app appended with the Ingress resource path, such as mycluster-<hash>-i000.us-south.containers.appdomain.cloud/myapp. For example, you might use the Virtual Private Cloud VPN, IBM Cloud Transit Gateway, or IBM Cloud Direct Link to allow requests from an on-premises network, another VPC, or IBM Cloud classic infrastructure to apps that run in your cluster.
2. A DNS service resolves the route subdomain to the VPC load balancer hostname that is assigned to the services for the Ingress controller. In VPC clusters, your Ingress controller services' private IP addresses are floating, and are kept behind a VPC-assigned hostname.
IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



Rules for SC-7 in IBM Cloud for Financial Services v1.2.0 profile

 Requirement ID Rules 

 SC-7 (a) <br><br> * Check whether Security Groups for VPC contains no outbound rules in security groups that specify source IP 8.8.8.8/32 to DNS port<br> * Check whether Event Streams network access is restricted to a specific IP range<br> * Check whether Virtual Servers for VPC instance doesn't have a floating IP<br> * Check whether Application Load Balancer for VPC has public access disabled<br> * Check whether Flow Logs for VPC are enabled<br> * Check whether OpenShift clusters are accessible only by using private endpoints<br> * Check whether authorized IP ranges are configured for the account<br> * Check whether Virtual Private Cloud (VPC) security groups have inbound ports that are open only to permitted IP addresses<br> * Check whether Hyper Protect DBaaS for MongoDB is accessible only using private endpoints<br> * Check whether Event Streams is accessible only by using private endpoints<br> * Check whether Hyper Protect DBaaS for PostgreSQL is accessible only using private endpoints<br> * Check whether Virtual Private Cloud (VPC) has no public gateways attached<br> * Check whether Virtual Private Cloud (VPC) network access control lists don't allow ingress from 0.0.0.0/0 to any port<br> * Check whether all virtual server instances have at least one Virtual Private Cloud (VPC) security group attached<br> * Check whether Virtual Private Cloud (VPC) has no public gateways attached at the time of provisioning<br> * Check whether App ID redirect URIs are not using wildcards (*)<br> * Check whether Virtual Servers for VPC instance has all interfaces with IP-spoofing disabled<br> * Check whether Cloud Object Storage network access is restricted to a specific IP range<br> * Check whether account has
In certain scenarios, when you change, add, or remove repo integrations from your toolchain, references to these integrations that are stored in the pipeline triggers or definitions might become invalid.

 How to fix it 

If a matching repo integration is located in the toolchain, the pipeline attempts to automatically update these references to fix the invalid integration references. A notification is displayed in the UI with one of the following messages:



* Repository reference fixed in the following triggers: [list of triggers]
* Repository reference fixed in the following definitions: [list of definitions]



If you see one of these notifications, but no warnings or errors are displayed in the configuration, no further action is required. If warnings or errors still appear, you might need to update or create the trigger or definition again.





 Why does my pipeline time out when it tries to connect to IBM Cloud Object Storage private endpoints? 

 What’s happening 

When you run a pipeline, requests to the IBM Cloud Object Storage that use a private endpoint time out with no response. This time out can cause the pipeline to fail.

 Why it’s happening 

IBM Cloud Object Storage private endpoints are not accessible from all IBM Cloud cluster types. Private IBM Cloud Object Storage endpoints are not accessible from private workers that run on clusters within an IBM Cloud® Virtual Private Cloud (VPC).

 How to fix it 

Replace any s3.private.* IBM Cloud Object Storage endpoints with s3.direct. endpoints. s3.direct. endpoints are direct endpoints that communicate with IBM Cloud Object Storage from any IBM Cloud cluster type.





 Why does my pipeline fail with an error that is related to secure properties? 

 What’s happening 

PipelineRuns fails with an error when any of the secure properties in the pipeline don't resolve at the start of the pipeline run.

 Why it’s happening 

Pipelines that cannot retrieve a secret value from a secrets store or from either Secrets Manager, Key Protect, or HashiCorp Vault, fail with an error message that indicates which properties cannot be resolved. Resolution failures can occur even if the properties are not used directly in the triggered run.
Why does no Ingress subdomain exist after cluster creation? 

Virtual Private Cloud

Classic infrastructure

 What’s happening 

You create a cluster and run ibmcloud ks cluster get --cluster <cluster> to check its status. The cluster State is normal, but the Ingress Subdomain and Ingress Secret are not available.

 Why it’s happening 

Even if the cluster is in a normal state, the Ingress subdomain and secret might still be in progress. The Ingress subdomain and secret creation might take more than 15 minutes to complete.



 Classic clusters 



1. When worker nodes are fully deployed and ready on the VLANs, a portable public and a portable private subnet for the VLANs are ordered.
2. After the portable subnet orders are successfully fulfilled, the ibm-cloud-provider-vlan-ip-config config map is updated with the portable public and portable private IP addresses.
3. When the ibm-cloud-provider-vlan-ip-config config map is updated, one public ALB per zone is triggered for creation.
4. A load balancer service that exposes the ALB is created and assigned an IP address.
5. The load balancer IP address is used to register the Ingress subdomain in Akamai. Akamai might have latency during the registration process.





 VPC clusters 



1. When you create a VPC cluster, one public and one private VPC load balancer are automatically created outside of your cluster in your VPC.
2. One public ALB per zone is triggered for creation.
3. A load balancer service that exposes the ALB is created and assigned a hostname.
4. The load balancer hostname is used to register the Ingress subdomain in Akamai. Akamai might have latency during the registration process.



Creating a cluster after deleting a cluster the same or similar name? See [Why does no Ingress subdomain exist after I create clusters of the same or similar name?]
* Allow inbound SSH traffic (TCP port 22)



During configuration you can specify an existing VPC to use, instead of creating a new VPC.

For the detailed steps about using Terraform to create only a VPC for SAP, see [Creating single-tier Virtual Private Cloud for SAP by using Terraform](https://cloud.ibm.com/docs/sap?topic=sap-create-terraform-single-tier-vpc-sap).





 Script files 

The configuration and script files are provided on the GitHub repository [https://github.com/IBM-Cloud/sap-hana-single-vsi](https://github.com/IBM-Cloud/sap-hana-single-vsi).

For SAP HANA stand-alone virtual server instance on IBM Cloud VPC, you modify the:



* terraform.tfvars file to add your IBM Cloud API-key
* input.auto.tfvars file to customize the resources for your solution. You specify zones, resource names, SSH keys, and SAP variables.



All of the other configuration files are provided and do not need to be modified.

The IBM Cloud Provider plug-in for Terraform on IBM Cloud uses these configuration files to provision a VPC in your IBM Cloud account.





 Support 

There are no warranties of any kind, and there is no service or technical support available for these materials from IBM®. As a recommended practice, review carefully any materials that you download from this site before using them on a live system.

Though the materials provided herein are not supported by the IBM Service organization, your comments are welcomed by the developers, who reserve the right to revise, re-adapt or remove the materials at any time. To report a problem, or provide suggestions or comments, open a GitHub issue.





 Virtual server instance configuration 

The virtual server instance is configured with:



* Red Hat Enterprise Linux 7.6 for SAP HANA (amd64)
* Two SSH keys configured to access as root user on SSH
* Three storage volumes as described in the input.auto.tfvars file.







 Before you begin
* ABAP System– You can run ABAP programs and some SAP Java apps
* Java System– You can run only Java Platform, Enterprise Edition apps. No ABAP programs can be run on a Java system
* Dual Stack – You can run both ABAP and Java Platform, Enterprise Edition in separate instances









 Architecture diagram 

This diagram shows the SAP NetWeaver 7.X on Sybase DB integrated with IBM Cloud on the SAP NetWeaver 7.x architecture:

Zoom

![Figure 1. Sample reference architecture](https://cloud.ibm.com/docs-content/v1/content/f89cc64b006ca59b35404693959c83d5747fee3e/sap/images/refarch-sap-syb-std-all.svg)

Figure 1. SAP NetWeaver 7.x with SYB standard installation with AAS on VSI to VPC IBM Cloud





 Access from an external network 

Clients on the customer facing network (CFN) use a floating IP to access virtual server instances within the IBM Cloud. Virtual server instances are hosted in availability zones (data centers) within geographic regions.

Within the Public Subnet, the [SAP router](https://support.sap.com/en/tools/connectivity-tools/saprouter.html) and the jumphost provide secure connections to the virtual server instances. The SAP router is a software application that provides a remote connection between the customer's network and SAP. The SAP Router and jumphost are within a single security group with rules for inbound and outbound traffic between the private subnets in the zone. SAP routers are used with traditional SAP products and analytics solutions and offerings that are acquired from Sybase. For a comprehensive list of which SAP Business Analytics products benefits from SAP router connections, see [SAP Note 1478974](https://launchpad.support.sap.com//notes/1478974).

A jumphost is used to access, manage, and administer SAP virtual server instances from the same customer ZONE directly from their premises. These SAP virtual server instances can be in a separate security zone but should be on same IBM Cloud region.
[Customizing the VMs by using the cloud-init script (RHEL and SLES)](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-set-full-Linuxvirtual-server)





 Step 1: Configuring a Cloud connection 

Ensure that the following requirements are met when you create a Cloud connection: Create a Cloud connection with the following parameters:



* Ensure that you set up a Cloud connection between the Power Systems Virtual Server instance and the IBM Cloud Classic infrastructure by using a private network.
* The Power Systems Virtual Servers in each region and zone must have its own cloud connection.
* You have the details of this private network for further configuration.



For more information about creating a Cloud connection, see [Managing Cloud connections](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-cloud-connections).





 Step 2: Creating a proxy 

Create a proxy setup by completing the following steps. This proxy is set up in a virtual private cloud (VPC) environment.



1. Deploy a proxy instance based on your requirement. For more information, see [Enabling proxy protocol](https://cloud.ibm.com/docs/vpc?topic=vpc-advanced-traffic-managementproxy-protocol-enablement).
2. Open the Security groups for the VPC by navigation to IBM Cloud dashboard > VPC Infrastructure > Networks > Security groups. For more information about security groups, see [security groups](https://cloud.ibm.com/docs/vpc?topic=vpc-using-security-groups).
3. Select the security group that is attached to your proxy and add these port numbers: 443, 8443, 80, and 3128. Ensure that the IP address that you are asked to specify is the subnet CIDR of your private network for the Power Systems Virtual Server instance. To view the subnet CIDR in the IBM Cloud dashboard, go to the zone, click Subnets, identify the subnet that you will be using, and copy the CIDR.
4.
Getting started with custom images 

Custom images are used to create new virtual servers with your own settings and configurations. You can create a Linux® custom image, a Windows® custom image, a z/OS Wazi aaS custom image, or a VMware custom image. You can import your custom image directly into IBM Cloud® Virtual Private Cloud from IBM Cloud® Object Storage or create one from an existing virtual server boot volume. You can also create an image template to migrate a virtual server from the Classic infrastructure. After a custom image is created and imported into IBM Cloud VPC, you can import it into a private catalog, with some limitations. For more information about these limitations, see [VPC considerations when using custom images in a private catalog](https://cloud.ibm.com/docs/vpc?topic=vpc-custom-image-cloud-private-catalog&interface=ui).

On the console, you can find custom images by clicking Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/icons/icon_hamburger.svg) > VPC Infrastructure > Compute > Images > Custom images. Image from a volume are part of the custom images tab. For more information on image from a volume, see [About creating an image from a volume](https://cloud.ibm.com/docs/vpc?topic=vpc-image-from-volume-vpc).



 Using a custom image to create a server 

To create a virtual server using a custom image, see one of the following:



* [Creating a virtual server instance with the UI](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-virtual-servers&interface=uicreating-virtual-servers-ui)
* [Creating a virtual server instance with the CLI - provision with a stock or custom image](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-virtual-servers&interface=cliinstance-create-from-image-cli)
[Deploying critical applications with IBM Cloud MZR](https://cloud.ibm.com/docs/ha-infrastructure?topic=ha-infrastructure-multi-zone-resiliency)Deploying critical applications with IBM Cloud MZR

This tutorial walks you through setting up a resilient environment for an n-tier application in an IBM Cloud® MZR. In this tutorial, you create your own VPC in region 1, then create subnets in two different zones of region 1, then you provision the virtual server instances. You create two availability zones and virtual server instances in each availability zone for UI, application, and db.

Virtual Servers for Classic Virtual Private Cloud (VPC)

+2

IBM Cloud Load Balancer,High availability and resiliency for infrastructure



* 45 minutes
* 2021-09-03



[Bring Your Own IP Address](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-byoip)Bring Your Own IP Address

This tutorial presents a brief overview of BYOIP implementation patterns that can be used with IBM Cloud and a decision tree for identifying the appropriate pattern when realizing the secure enclosure as described in the Isolate workloads with a secure private network tutorial. Setup may require additional input from your onsite network team, IBM Cloud technical support or IBM Services.

Virtual Servers for Classic



* 1 hour
* 2023-05-05



[Linking secure private networks over the IBM network](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-linking-secure-network-enclosures)Linking secure private networks over the IBM network

This tutorial presents setup of a privately routed IP connection over the IBM Cloud private network between two secure private networks hosted in different data centers. All resources are owned by one IBM Cloud account. It uses the Isolate workloads with a secure private network tutorial to deploy two private networks that are securely linked over the IBM Cloud private network using the VLAN Spanning service.

Virtual Router Appliance Virtual Servers for Classic

+1

VLANs



* 2023-05-05