vania-janet/multiturn-rag-retrieval-data huggingface dataset:
ibmcloud tg connection-create|cc GATEWAY_ID --name NAME --network-type NETWORK-TYPE --network-id NETWORK_ID [-h, --help]

Where:

GATEWAY_ID
: ID of the gateway that the new connection will be on.

--name
: Name of the new connection.

--network-type
: Network type of the connection. Values are classic, vpc, or directlink.

To create an unbound GRE tunnel connection, see the [ibmcloud tg connection-create-gre](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-transit-gateway-cli&interface=cliconnection-create-gre) command.

--network-id
: ID of the network connection. For classic connections, do not set a value. Use the CRN for all other network types.

--output json
: Optional. Specify if you want the output to display in JSON format.

--help | -h
: Optional. Get help on this command.



 Examples 

This example illustrates creating a VPC connection named vpc-connection using vpcCRN="crn:v1:bluemix:public:is:us-south:a/3aa0a9999a1a46258064d84f7f447920::vpc:r134-f87014d5-87d2-46d1-9999-24683082f6bc":

ibmcloud tg cc $gateway --name vpc-connection --network-id $vpcCRN --network-type vpc

To create a classic connection named classic-conn.

ibmcloud tg cc $gateway --name classic-conn --network-account-id 67123579566843320188712647902101 --network-type classic

To approve a connection from another account as the network owner, run the following command:
For public_key property, enter in the public key information. For the type property, specify either rsa or ed25519 for the SSH key type.

curl -X POST "$vpc_api_endpoint/v1/keys?version=2023-03-30&generation=2" -H "Authorization: Bearer $iam_token" -d '{
"name":"my-key-1",
"public_key":"AAAAB3NzaC1yc2EAAAADAQABAAABAQDDGe50Bxa5T5NDddrrtbx2Y4/VGbiCgXqnBsYToIUKoFSHTQl5IX3PasGnneKanhcLwWz5M5MoCRvhxTp66NKzIfAz7r+FX9rxgR+ZgcM253YAqOVeIpOU408simDZKriTlN8kYsXL7P34tsWuAJf4MgZtJAQxous/2byetpdCv8ddnT4X3ltOg9w+LqSCPYfNivqH00Eh7S1Ldz7I8aw5WOp5a+sQFP/RbwfpwHp+ny7DfeIOokcuI42tJkoBn7UsLTVpCSmXr2EDRlSWe/1M/iHNRBzaT3CK0+SwZWd2AEjePxSnWKNGIEUJDlUYp7hKhiQcgT5ZAnWU121oc5En",
"type":"rsa"
}'





 Next steps 

After you locate or generate an SSH key, it's time to plan for and create a server.

Virtual servers



* [Planning for virtual servers](https://cloud.ibm.com/docs/vpc?topic=vpc-vsi_best_practices)
* [Creating a virtual server by using the UI](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-virtual-servers)
For example, to create a target in the US-South region, you can run the following cURL command:

curl -X POST https://private.us-south.atracker.cloud.ibm.com/api/v1/targets -H "Authorization: $ACCESS_TOKEN" -H "content-type: application/json" -d '{
"name": "My target",
"target_type": "logdna",
"logdna_endpoint": {
"target_crn": "crn:v1:bluemix:public:logdnaat:global:a/<AccountID>:<COSinstanceID>::",
"ingestion_key": "xxxxxxxxxxxxx"
}
}'

To get the target definition in a region, see [Viewing a target](https://cloud.ibm.com/docs/atracker?topic=atracker-targettarget-view).





 Step 5: Next 

Define 1 or more routes in the account. For more information, see [Configuring a route](https://cloud.ibm.com/docs/atracker?topic=atracker-route_v2&interface=cliroute-create-cli).

When you configure a route, you associate a target with the route and define which type of auditing events are collected. The route defines the rules that determine where auditing events are collected in your account. For example, you can define a route that collects auditing events from 2 different regions, and also collects global events.

You can collect [global events](https://cloud.ibm.com/docs/atracker?topic=atracker-event_typesevent_types_global) and [location-based events](https://cloud.ibm.com/docs/atracker?topic=atracker-event_typesevent_types_location).



* Global events report on activity in your account that relate to data and resources that are generally synchronized across all regions.
When creating virtual machines, use the map variable virtual_machines to define these.

 Note. Create virtual machines inside your virtual data center.
 You can define each one individually and attach multiple networks
 and disks. Individual disks are created for each additional disk.

 Note. Check the storage profile names and apply to your VMs / disks.
 If left empty, default profile is used.

virtual_machines = {
app-server-1 = {
image = {
catalog_name = "Public Catalog"
template_name = "RedHat-8-Template-Official"
}
memory = 8192
cpus = 2
cpu_hot_add_enabled = true
memory_hot_add_enabled = true
storage_profile = "2 IOPS/GB"
networks = {
0 = {
name = "application-network-1"
ip_allocation_mode = "POOL"
is_primary = true
ip = ""
},
}
disks = {
0 = {
name = "logDisk"
size_in_mb = "100"
bus_type = "SCSI"
bus_sub_type = "VirtualSCSI"
bus_number = 1
storage_profile = ""
},
}
},
db-server-1 = {
image = {
catalog_name = "Public Catalog"
template_name = "RedHat-8-Template-Official"
}
memory = 8192
cpus = 2
cpu_hot_add_enabled = true
memory_hot_add_enabled = true
storage_profile = ""
networks = {
0 = {
name = "db-network-1"
ip_allocation_mode = "POOL"
is_primary = true
ip = ""
},
1 = {
name = "isolated-network-1"
ip_allocation_mode = "POOL"
is_primary = false
ip = ""
},
}
disks = {
Get the IDs of the zones you created in the previous step.

ibmcloud cbr zones

Example output

OK
id name address_count
c14c0839c13d8aa0afa8383e2be2e124 public-mgmt-zone 2
f9676ca6ef37685315fa254b89d73159 public-cluster-zone 1
c14c0839c13d8aa0afa8383e2be2e843 private-cluster-zone 1
b53353de929de39ac2381f9b4cde8507 private-mgmt-zone 2
3. Create a rule that protects access to the public and private cluster and management APIs by using the zones you created earlier.

ibmcloud cbr rule-create --api-types crn:v1:bluemix:public:containers-kubernetes::::api-type:management --context-attributes "endpointType=public,networkZoneId=PUBLIC-MGMT-ZONE-ID" --context-attributes "endpointType=private,networkZoneId=PRIVATE-MGMT-ZONE-ID" --description "Separate private and public IPs for the management APIs" --service-name containers-kubernetes

ibmcloud cbr rule-create --api-types crn:v1:bluemix:public:containers-kubernetes::::api-type:cluster --context-attributes "endpointType=public,networkZoneId=PUBLIC-CLUSTER-ZONE-ID" --context-attributes "endpointType=private,networkZoneId=PRIVATE-CLUSTER-ZONE-ID" --description "Separate private and public IPs for cluster APIs" --service-name containers-kubernetes
rules.verbs Specify the types of [actions](https://kubectl.docs.kubernetes.io/) that you want users to be able to do, such as "get", "list", "describe", "create", or "delete". 



2. Create the role or cluster role in your cluster.

oc apply -f my_role.yaml
3. Verify that the role or cluster role is created.



* Role:

oc get roles -n <namespace>
* Cluster role:

oc get clusterroles





2. Bind users to the role or cluster role.



1. Create a .yaml file to bind users to your role or cluster role. Note the unique URL to use for each subject's name.

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: my_role_binding
namespace: default
subjects:
- kind: User
name: IAMuser1@example.com
apiGroup: rbac.authorization.k8s.io
- kind: Group
name: team1
apiGroup: rbac.authorization.k8s.io
- kind: ServiceAccount
name: <service_account_name>
namespace: <kubernetes_namespace>
roleRef:
kind: Role
name: my_role
apiGroup: rbac.authorization.k8s.io
Show more



Table 3. Understanding the YAML parameters

 Parameter Description 

 kind <br><br> * Specify RoleBinding for a namespace-specific Role or ClusterRole.<br> * Specify ClusterRoleBinding for a cluster-wide ClusterRole.<br><br><br>
The State changes to normal and the Status is Ready.

ID Public IP Private IP Machine Type State Status Zone Version
prod-dal10-pa8dfcc5223804439c87489886dbbc9c07-w1 169.xx.xxx.xxx 10.xxx.xx.xxx free normal Ready dal10 1.26
5. Add the subnet to your cluster by specifying the subnet ID. When you make a subnet available to a cluster, a Kubernetes ConfigMap is created for you that includes all available portable public IP addresses that you can use. If no Ingress ALBs exist in the zone where the subnet's VLAN is located, one portable public and one portable private IP address is automatically used to create the public and private ALBs for that zone. You can use all other portable public and private IP addresses from the subnet to create NLB services for your apps.

ibmcloud ks cluster subnet add --cluster <cluster_name_or_id> --subnet-id <subnet_ID>
6. Verify that the subnet is added to your cluster.

ibmcloud ks cluster get --cluster <cluster_name> --show-resources
7. Important: To enable communication between workers that are on different subnets on the same VLAN, you must [enable routing between subnets on the same VLAN](https://cloud.ibm.com/docs/containers?topic=containers-subnetssubnet-routing).







 Managing existing portable IP addresses 

By default, 4 portable public and 4 portable private IP addresses can be used to expose single apps to the public or private network by [creating a network load balancer (NLB) service](https://cloud.ibm.com/docs/containers?topic=containers-loadbalancer) or by [creating additional Ingress application load balancers (ALBs)](https://cloud.ibm.com/docs/containers?topic=containers-ingress-alb-managescale_albs). To create an NLB or ALB service, you must have at least 1 portable IP address of the correct type available.
Create Network Zones using the CBR UI 

With the prerequisites and requirements in place, you can follow the steps to [create zones in the UI](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-createnetwork-zones-create).

Instead of creating a zone by using UI inputs, you can use the JSON code form to directly enter JSON to create a zone by clicking Enter as JSON code.

After creating zones, you can also [update](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-update) and [delete](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-remove) them.







 About Network Rules 

After you have created your zones, you can attach the zones to your networked resources by creating rules.

You can choose from the available [types of endpoints](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-whatiscontext-restrictions-endpint-type) specific to your network topology when you add resources to a rule.



 Create Network Rules using the CBR API 

The API supports defining [network rules](https://cloud.ibm.com/apidocs/context-based-restrictionsrules), and you will need the information from creating the network zone for the next steps.

Using the path: "/v1/rules" with the same endpoint as above, the GET method lists current rules. Sending a POST to the same path with the following example format guiding your own payload, you can create new rules:

{
  "description": "this is an example of a rule",
  "resources": [
    {
      "attributes":
        {
          "name": "accountId",
          "value": "12ab34cd56ef78ab90cd12ef34ab56cd"
        },
        {
          "name": "serviceName",
          "value": "kms"
        }
      ]
    }
  ],
  "contexts": [
    {
CreateZoneOptions createZoneOptions = new CreateZoneOptions.Builder()
.name("an example of zone")
.accountId(accountID)
.description("this is an example of zone")
.addresses(java.util.Arrays.asList(ipAddressModel, ipRangeAddressModel, subnetAddressModel, vpcAddressModel, serviceRefAddressModel))
.excluded(java.util.Arrays.asList(excludedIPAddressModel))
.build();

Response<Zone> response = contextBasedRestrictionsService.createZone(createZoneOptions).execute();
Zone zone = response.getResult();

System.out.println(zone);

ip_address_model = {
'type': 'ipAddress',
'value': '169.23.56.234',
}
ip_range_address_model = {
'type': 'ipRange',
'value': '169.23.22.0-169.23.22.255',
}
subnet_address_model = {
'type': 'subnet',
'value': '192.0.2.0/24',
}
vpc_address_model = {
'type': 'vpc',
'value': vpc_crn,
}
service_ref_address_model = {
'type': 'serviceRef',
'ref': {
'account_id': account_id,
'service_name': 'cloud-object-storage',
}
}
excluded_ip_address_model = {
'type': 'ipAddress',
'value': '169.23.22.127',
}

zone = context_based_restrictions_service.create_zone(
name='an example of zone',
account_id=account_id,
42c4f51adc3147b4b4049ad9826c30a1 Default

Created 2021-03-22T11:34:57.34-05:00
4. Create a pool:

ibmcloud is load-balancer-pool-create nlb-pool r134-99b5ab45-6357-42db-8b32-5d2c8aa62776 weighted_round_robin tcp 10

Sample output:

Creating pool nlb-pool of load balancer r134-99b5ab45-6357-42db-8b32-5d2c8aa62776 under account IBM Cloud Network Services as user test@ibm.com...

ID r134-3b66d605-6aa5-4166-9f66-b16054da3cb0
Name nlb-pool
Protocol tcp
Algorithm weighted_round_robin
Instance group ID Name
- -

Health monitor Type Port Health monitor URL Delay Retries Timeout
http 8080 / 10 2 5

Session persistence type source_ip
Members
Provision status active
Created 2020-08-27T14:45:42.038-05:00
5. Create a member:

ibmcloud is load-balancer-pool-member-create r134-99b5ab45-6357-42db-8b32-5d2c8aa62776 r134-3b66d605-6aa5-4166-9f66-b16054da3cb0 9090 0716_6acdd058-4607-4463-af08-d4999d983945 --weight 70

Sample output:

Creating member of pool r134-3b66d605-6aa5-4166-9f66-b16054da3cb0 under account IBM Cloud Network Services as user test@ibm.com...

ID r134-61f8b000-a90d-4abe-909e-c507dffec565
Port 9090
* A single subresource type within an instance, for example, a bucket in an Object Storage instance



If a specific predefined platform or service role doesn't fit what you're looking for when assigning the level of access, you can create a [custom role](https://cloud.ibm.com/docs/account?topic=account-custom-roles) for a specific service and then choose from the available actions to create a role that fits your organization's needs.



 Policy example 

This policy example gives access to all service resources that belong to a resource group named default with an ID of abcd2e6fg1h74i44j5kl467m701n5289 with the Viewer platform role assigned. This policy can be assigned to a user, service ID, or access group. In this case, it is assigned to a user with an iam_id of IBMid-3IAMISBEST1.

Access groups are not identities like a user or service ID; however, they are a grouping mechanism for identities. An access group can be defined as a subject of an access policy, and the assigned access on the group applies to all members added to it.

{
"type": "access",
"subjects": [
{
"attributes":
{
"name": "iam_id",
"value": "IBMid-3IAMISBEST1"
}
]
}
],
"roles": [
{
"role_id": "crn:v1:bluemix:public:iam::::role:Viewer"
}
],
"resources": [
{
"attributes":
{
"name": "accountId",
"value": "7e522a19eb77477e88e96a600c44fb22"
},
{
"name": "resourceGroupId",
"value": "abcd2e6fg1h74i44j5kl467m701n5289"
* You must not share a bucket to collect [location-based auditing events](https://cloud.ibm.com/docs/atracker?topic=atracker-event_typesevent_types_location) from multiple regions.
* If you have regulatory and compliance requirements, check the locations where you can create a bucket. Then, if performance is critical, consider creating the COS bucket in the same region where the auditing events are generated.



For more information, see [Managing IBM Cloud Object Storage (COS) buckets](https://cloud.ibm.com/docs/atracker?topic=atracker-cos).

Use dedicated buckets for each region.

Choose one of the following options to create a bucket:



Table 1. Create bucket requests

 Action More info 

 Create a bucket through the IBM Cloud UI [Learn more](https://cloud.ibm.com/docs/atracker?topic=atracker-coscos_create_bucket_ui) 
 Create a bucket through the IBM Cloud CLI [Learn more](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-cli-plugin-ic-cos-cliic-create-bucket) 
 Create a bucket by using cURL [Learn more](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-curlcurl-add-bucket) 
 Create a bucket by using the REST API [Learn more](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-compatibility-api-bucket-operationscompatibility-api-new-bucket) 
 Create a bucket with a different storage class by using the REST API [Learn more](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-compatibility-api-bucket-operationscompatibility-api-storage-class)
To specify multiple IP addresses, use multiple --ip options.

--secret-namespace NAMESPACE
: The Red Hat OpenShift project where you want to create the Kubernetes secret that holds the SSL certificate information for the NLB. If you don't specify a project, the secret is automatically created in the default project.

--dns-type public
: The DNS provider type for subdomain registration. Currently, only public is supported.

--type public
: The subdomain type. Currently, only public is supported.

--output json
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.



 Example nlb-dns create classic command 

ibmcloud oc nlb-dns create classic --cluster mycluster --ip 1.1.1.1







 ibmcloud oc nlb-dns create vpc-gen2 

Virtual Private Cloud

Create a DNS record for a Network Load Balancer for VPC or Application Load Balancer for VPC.

When you create a Network Load Balancer for VPC, the load balancer is assigned external IP addresses for each zone in your cluster. When you create an Application Load Balancer for VPC, the load balancer is assigned a hostname. If you want an app subdomain with TLS termination, you can use the ibmcloud oc nlb-dns create vpc-gen2 command to create a DNS record for the IP addresses or hostname. IBM Cloud takes care of generating and maintaining the wildcard SSL certificate for the subdomain for you. You can create subdomains for both public and private VPC load balancers.

ibmcloud oc nlb-dns create vpc-gen2 --cluster CLUSTER (--lb-host VPC_ALB_HOSTNAME | --ip VPC_NLB_IP) [--dns-type public] [--secret-namespace NAMESPACE] [--type (public|private)] [--output json] [-q]

Minimum required permissions
List available storage classes and choose the storage class that you want to use.

oc get sc | grep ebs

To see details for a storage class, use the oc describe sc <sc-name> command or review the [storage class reference](https://cloud.ibm.com/docs/satellite?topic=satellite-config-storage-ebssat-ebs-sc-reference).
2. Create a PVC that provisions an AWS EBS storage instance with the characteristics that are described in the storage class that you selected. The following example uses the sat-aws-block-bronze storage class to create an st1 HDD AWS EBS storage instance with a size of 125 GB. For more information about this volume type, see [Hard disk drives (HDD)](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-volume-types.htmlhard-disk-drives).

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: sat-aws-block-bronze
spec:
accessModes:
- ReadWriteOnce
storageClassName: sat-aws-block-bronze
resources:
requests:
storage: 125Gi
3. Create the PVC in your cluster.

oc apply -f pvc.yaml
4. Verify that your PVC is created. Because all IBM-provided storage classes are configured as WaitForFirstConsumer, the status of your PVC remains Pending until you provision an app that mounts your PVC.

oc get pvc

Example output

NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS AGE
sat-aws-block-bronze Pending sat-aws-block-bronze 17s
5. Create a YAML configuration file for your pod that mounts the PVC that you created. When you create this pod, the AWS EBS driver starts to fulfill your storage request by dynamically creating an AWS EBS instance in your AWS account.
When you create a multizone cluster, a default public ALB is created in each zone where you have worker nodes. If you later remove one of these original three zones and add workers in a different zone, a default public ALB is not created in that new zone. You can manually create an ALB to process connections in that new zone.



1. In each zone where you have worker nodes, create an ALB.

The following command applies to classic clusters. For more information and command options, see the [CLI reference](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_alb_create).

ibmcloud ks ingress alb create --cluster <cluster_name_or_ID> --type <public_or_private> --zone <zone> --vlan <VLAN_ID> [--ip <IP_address>] [--version image_version]

The following command applies to VPC clusters. For more information and command options, see the [CLI reference](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clicli_alb-create-vpc-gen2).

ibmcloud ks ingress alb create vpc-gen2 --cluster <cluster_name_or_ID> --type <public_or_private> --zone <vpc_zone> [--version image_version]
2. Verify that the ALBs that you created in each zone have a Status of enabled. For classic clusters, check that an ALB IP is assigned. For VPC clusters, check that Load Balancer Hostname is assigned.

ibmcloud ks ingress alb ls --cluster <cluster_name_or_ID>

Example output for a classic cluster.

ALB ID Enabled Status Type ALB IP Zone Build ALB VLAN ID NLB Version
For more information, see [Controlling access to resources by using tags](https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial).
* Region - Shows the region where the VPC is located and where the VPN gateway will be provisioned.
* Virtual Private Cloud - Select the VPC for the VPN gateway.
* Subnet - Select the subnet in which to create the VPN gateway. See [Planning considerations](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-create-gatewayplanning-considerations-vpn) for important subnet information.
* Mode - Select to create a policy-based or a route-based VPN. For more information about VPN types, see [VPN features](https://cloud.ibm.com/docs/vpc?topic=vpc-using-vpnvpn-features).



6. In the New VPN connection for VPC section, you can define a connection between this gateway and a network outside your VPC by specifying the following information. You can create the VPN connection now, or after your VPN gateway is provisioned.



* VPN connection name - Enter a name for the connection, such as my-connection.
* Peer gateway address - Specify the IP address of the VPN gateway for the network outside your VPC.
* Preshared key - Specify the authentication key of the VPN gateway for the network outside your VPC. The preshared key is a string of hexadecimal digits, or a passphrase of printable ASCII characters. To be compatible with most peer gateway types, this string must follow these rules:



* Can be a combination of digits, lower or upper case characters, or the following special characters: - + & ! @ $ % ^ * ( ) . , :
* The length of the string must be 6 - 128 characters.
* Cannot start with 0x or 0s.



* Local subnets (Policy-based VPN only) - Specify one or more subnets in the VPC that you want to connect through the VPN tunnel.
> "name": "my-policy-plan-c"
> }]'

The result shows that two plans were created.

Creating backup policy backup-policy-v1 under account Test Account as user test.user@ibm.com...

ID r138-0521986d-963c-4c18-992d-d6a7a99d115f
Name backup-policy-v1
CRN crn:v1:bluemix:public:is:eu-de:a/a10d63fa66daffc9b9b5286ce1533080::backup-policy:r138-0521986d-963c-4c18-992d-d6a7a99d115f
Status pending
Plans ID Name Resource type
r138-2129a79a-5629-4069-bf79-7bb0af3b0bd3 my-policy-plan-a backup_policy_plan
r138-6f4f08ba-e0bb-470f-bbfb-f3a22aebbfa9 my-policy-plan-c backup_policy_plan

Backup tags dev:test
Backup resource type volume
Resource group defaults
Created at 2023-02-21T22:42:10+00:00

For more information about available command options, see [ibmcloud is backup-policy-create](https://cloud.ibm.com/docs/cli?topic=cli-vpc-referencebackup-policy-create).





 Creating a backup plan from the CLI 

Run the backup-policy-plan-create command to create a backup plan and attach it to an existing policy. Identify the policy by ID or name.

Syntax: