vania-janet/multiturn-rag-retrieval-data huggingface dataset:
For more information, see [Exporting a custom image to IBM Cloud Object Storage](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-custom-images&interface=apicustom-image-export-to-cos-api), or start using the new [export jobs](https://cloud.ibm.com/apidocs/vpc-betalist-image-export-jobs) methods.

This feature is now generally available. See the [VPC API change log](https://cloud.ibm.com/docs/vpc?topic=vpc-api-change-log2-may-2023).







 20 December 2022 



 For all version dates 

Backup for VPC. Backup policy jobs are now generally available. See the [VPC API change log](https://cloud.ibm.com/docs/vpc?topic=vpc-api-change-log20-december-2022).

The following updates have been made for [listing backup policy jobs](https://cloud.ibm.com/apidocs/vpc/latestlist-backup-policy-jobs) and [retrieving a backup policy job](https://cloud.ibm.com/apidocs/vpc/latestget-backup-policy-job) since the beta release:



* The source_volume property has been replaced by the source property.
* The target_snapshot property has been replaced by the target_snapshots array property.



Instance provision by volume. Accounts that have been granted special approval to preview this feature can now reuse an existing boot volume to provision a virtual server instance by specifying the existing volume's id or crn sub-property of the boot_volume_attachment property. The specified volume must be unattached and must have an operating system with the same architecture as the instance profile. Volumes now include an attachment_state property and an expanded operating_system property you can use to view a volume's eligibility.
To prepare for this change, verify that your client checks that the volume property exists for a volume attachment before attempting to access its crn, id, href, or name sub-properties.

Asynchronous DELETE response code change. In an upcoming release, the response code output for asynchronous DELETE operations will change from 204 to 202. A response code of 204 implies the action is completed, which could be misleading for operations that are still processing. A response code of 202 is more appropriate. This behavior change will occur only for an API version date after its release. A response code of 204 will continue to be returned for API versions up to this version date.

The new response code will be rolled out gradually. Each phase of the rollout will be tied to a dated API version. These changes will be announced in future change log updates.

Security group targets. In an upcoming release, new resource types will be permitted as security group targets. If you add resources of these new types to a security group, existing client applications will be exposed to the new types when iterating over the security group's targets. To avoid disruption, check that client applications are written to gracefully handle unexpected resource types in a security group's targets.

VPN site-to-site gateway cipher upgrade. In an upcoming release, connections with auto IKE or IPsec policies that are out of conformance will be automatically upgraded to the [enhanced auto-negotiation policy](https://cloud.ibm.com/docs/vpc?topic=vpc-using-vpnpolicy-negotiation). Connections with customized IKE or IPsec policies that contain weak ciphers will be disabled. For more information, see [Upgrading a VPN from a custom IKE or IPsec policy](https://cloud.ibm.com/docs/vpc?topic=vpc-upgrading-weak-ciphers&interface=apiupgrade-vpn-with-custom-policy).





 11 July 2023 



 For all version dates 

Image lifecycle management.
You can use the CRL to verify that your certificates are valid (not revoked). For more information, see [Certificate revocation list](https://cloud.ibm.com/docs/vpc?topic=vpc-cert_validatecertificate-revocation-list).







 15 December 2022 

Bare metal servers now support custom images
: You can now create custom images to use on your bare metal servers. For more information, see [Custom image considerations](https://cloud.ibm.com/docs/vpc?topic=vpc-bare-metal-image&interface=uibare-metal-custom-images-requirements) and [Bare metal server considerations](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-custom-images&interface=uibare-metal-server-custom-images-considerations).





 13 December 2022 

Volume creation from a block storage snapshot
: You can now use the UI and CLI, in addition to the VPC API, to create a stand-alone block storage volume from a snapshot. Stand-alone data volumes can be attached to a virtual server instance at any time. You can select a snapshot of a boot volume and use it to boot a new virtual server instance. For more information, see [Restore a stand-alone data volume from a snapshot](https://cloud.ibm.com/docs/vpc?topic=vpc-snapshots-vpc-restore).

Block storage volume health states
: You can now view the health state of a block storage volume from the UI, CLI, and API. Health indicated whether a volume is performing as expected or degraded. You can view health status and reasons from the list of volumes and volume details, and when you create and update volumes. For more information, see [Block storage volume health states](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-block-storageblock-storage-vpc-health-states).







 November 2022 



 14 November 2022
You can update security groups for an endpoint gateway by [adding an endpoint gateway](https://cloud.ibm.com/apidocs/vpccreate-security-group-target-binding) to or [removing an endpoint gateway](https://cloud.ibm.com/apidocs/vpcdelete-security-group-target-binding) from a security group's targets.

You will not be able to remove the only remaining security group from an endpoint gateway. As a result, if you add a security group to an endpoint gateway which had no security groups, you will not be able to revert the endpoint gateway to have no security groups.

Finally, the security group targets property can now refer to an endpoint gateway, as can the responses for the [get security group target](https://cloud.ibm.com/apidocs/vpcget-security-group-target) and [list security group target](https://cloud.ibm.com/apidocs/vpclist-security-group-targets) methods.

Snapshots for VPC. A captured_at property has been added to each [snapshot](https://cloud.ibm.com/apidocs/vpclist-snapshots), indicating the date and time when the snapshot was captured from the volume. The captured_at timestamp value is a close approximation to the actual snapshot time, typically within a few seconds. The actual snapshot capture is between the created_at and captured_at timestamps. (The created_at property indicates when the [snapshot creation](https://cloud.ibm.com/apidocs/vpccreate-snapshot) process was initiated.)

If captured_at is absent from the response, the snapshot's data has not yet been captured. Additionally, the property may be absent for snapshots created before 1 January 2022.







 23 November 2021 



 For all version dates 

Snapshots for VPC. Restrictions have been removed for deleting snapshots.
Health indicated whether a volume is performing as expected or degraded. You can view health status and reasons from the list of volumes and volume details, and when you create and update volumes. For more information, see [Block storage volume health states](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-block-storageblock-storage-vpc-health-states).







 November 2022 



 14 November 2022 

IBM Hyper Protect Container Runtime image ibm-hyper-protect-container-runtime-1-0-s390x-6 updates
: For the IBM Hyper Protect Container Runtime image version ibm-hyper-protect-container-runtime-1-0-s390x-6, new certificates are available.



* [Attestation certificate](https://cloud.ibm.com/media/docs/downloads/hyper-protect-container-runtime/ibm-hyper-protect-container-runtime-1-0-s390x-6-attestation.crt)
* [Encryption certificate](https://cloud.ibm.com/media/docs/downloads/hyper-protect-container-runtime/ibm-hyper-protect-container-runtime-1-0-s390x-6-encrypt.crt)
* [Intermediate certificate](https://cloud.ibm.com/media/docs/downloads/hyper-protect-container-runtime/ibm-hyper-protect-container-runtime-1-0-s390x-6-intermediate.crt)



Logging for Hyper Protect Virtual Servers for VPC



* Apart from IBM Log Analysis, you can now configure logging with a generic syslog backend. For more information, see [Logging for Hyper Protect Virtual Servers for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-logging-for-hyper-protect-virtual-servers-for-vpcsyslog).



Security claims on disks encryption



* Both the root disk and data disks in the Hyper Protect Virtual Servers for VPC instance are configured with Linux Unified Key Setup (LUKS) Encryption.
* [Granting users access to tag resources and service IDs](https://cloud.ibm.com/docs/account?topic=account-access&interface=ui)







 8 November 2022 

Backup policy jobs
: You can now list all jobs for a backup policy and retrieve backup policy job details from the UI, CLI, or API. Backup policy job information includes the backup plan that is used to create the backup snapshot, the backup job type, job status, source volume, target snapshot, and additional information. For more information, see [Viewing backup jobs](https://cloud.ibm.com/docs/vpc?topic=vpc-backup-view-policy-jobs).







 October 2022 



 31 October 2022 

Terraform is now available for sharing images across an enterprise account
: You can now share or publish custom images by using Terraform to other accounts within your enterprise by using a private catalog. If you select a catalog image that belongs to a different account, review [Using cross-account image references in a private catalog in Terraform](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-custom-images&interface=terraformprivate-catalog-image-reference-vpc-terraform) for extra considerations and limitations. To create a private catalog, see the tutorial [Onboarding a virtual server image with Terraform](https://cloud.ibm.com/docs/account?topic=account-catalog-vsi-tutorial&interface=ui). To create an instance from a catalog image by using Terraform, see [Creating virtual server instances by using Terraform](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-virtual-servers&interface=terraformcreate-instance-terraform).





 21 October 2022 

Context-based restrictions (limited availability)
: For accounts authorized to preview this functionality, account owners and administrators can now define and enforce network access policies for IBM Cloud VPC resources.
Application Load Balancer (ALB) support for cookie-based session persistence
: ALBs now supports HTTP-cookie persistence and application-cookie persistence. For more information, see [Advanced traffic management](https://cloud.ibm.com/docs/vpc?topic=vpc-advanced-traffic-managementsession-persistence).





 03 June 2021 

UI enhancement
: When you delete a virtual server, you must now confirm that you want to delete an instance by typing delete.







 May 2021 



 25 May 2021 

Snapshots for VPC
: Snapshots for VPC is a regional offering that lets you create a point-in-time copy of your block storage boot or data volume. Select a snapshot during instance provisioning and restore a new, fully-provisioned boot volume to start the instance. You can also create and attach a data volume from a snapshot within a running virtual server instance. Learn more [about creating and using snapshots](https://cloud.ibm.com/docs/vpc?topic=vpc-snapshots-vpc-about) and explore the new [snapshots API methods](https://cloud.ibm.com/apidocs/vpcdelete-snapshots).







 21 May 2021 

Image from volume
: You can create a custom image from a boot volume on a virtual server instance. The image is a full copy of the source volume, including the operating system and any user data. You can create new virtual server instances from the image created from the volume. For more information, see [About creating an image from a volume](https://cloud.ibm.com/docs/vpc?topic=vpc-image-from-volume-vpc).



 13 May 2021 

Scheduled Scaling for VPC (GA)
: Scheduled Scaling for VPC lets you set scheduled actions to automatically scale instance group capacity up or down based on daily, intermittent, or seasonal demand. You can set multiple, recurring scheduled action frequencies that can scale monthly, weekly, daily, hourly, or even every set number of minutes.
Customers can manage and use the cross-regional copy in the target region independently from the parent volume or the original backup. For more information, see [Cross Regional backup copies](https://cloud.ibm.com/docs/vpc?topic=vpc-backup-service-about&interface=uibackup-service-crc).





 22 June 2023 

New Ed25519 SSH key type is available (GA)
: The Ed25519 SSH key type is a new, supported SSH key type and can be used as an alternative to the RSA SSH key type. The Ed25519 SSH key can be used with Linux operating systems, but is not supported for Windows or VMware images. For more information, see [Getting started with SSH keys](https://cloud.ibm.com/docs/vpc?topic=vpc-ssh-keys) and [Managing SSH Keys](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-ssh-keys).

Madrid multi zone region (MZR)
: A new MZR is available for VPC and Classic infrastructures. Classic Virtual Servers will not be available in the Madrid MZR. The Madrid region supports only dedicated host profiles with instance storage. For more information, see [Region and data center locations for resource deployment](https://cloud.ibm.com/docs/overview?topic=overview-locations), [Setting up access to classic infrastructure](https://cloud.ibm.com/docs/vpc?topic=vpc-setting-up-access-to-classic-infrastructure&interface=ui), and [Dedicated host profiles](https://cloud.ibm.com/docs/vpc?topic=vpc-dh-profiles&interface=ui).





 20 June 2023 

IBM Hyper Protect Container Runtime image ibm-hyper-protect-container-runtime-1-0-s390x-11 updates
: For the IBM Hyper Protect Container Runtime image version ibm-hyper-protect-container-runtime-1-0-s390x-11, new certificates are available.
Any instance that is still provisioned as of 22 August 2020 will be deleted. For more information, see the [End of Service Announcement for Virtual Servers for VPC on POWER](https://www.ibm.com/cloud/blog/announcements/end-of-service-announcement-for-virtual-servers-for-vpc-on-power).







 May 2020 



 21 May 2020 

Auto scale for VPC (Beta)
: In this limited beta, use auto scale to improve performance and costs by dynamically creating virtual server instances to meet the demands of your environment. For more information, see [Creating an instance group for auto scaling (Beta)](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-auto-scale-instance-group).





 15 May 2020 

Load balancer for VPC update
: Back-end encryption (HTTPS for back-end pool) is now supported. See [Using load balancers for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-load-balancers) for details.





 1 May 2020 

Customer-managed encryption (Beta)
: Customer-managed encryption (BYOK) is available in beta. Bring your own encryption keys and store the keys in Key Protect or Hyper Protect Crypto Services within VPC. Use BYOK to encrypt your VPC-enabled block storage at the volume level by using your own keys. For more information, see [Creating virtual server instances with customer-managed encryption (Beta)](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-instances-byok).

Flow logs (Beta)
: Flow logs are now available in beta. Use flow logs to collect, store, and present the Internet Protocol (IP) traffic flowing to and from networks within your VPC. For more information, see [About flow logs (Beta)](https://cloud.ibm.com/docs/vpc?topic=vpc-flow-logs).

UI enhancement
: Create a new subnet directly from the page where you create a new instance.







 April 2020 



 22 April 2020
This process requires onboarding to the [IBM Cloud Partner Center](https://cloud.ibm.com/partner-center/sell).

Deprecated VPN for VPC ciphers
: The following VPN for VPC IKE and IPsec ciphers are now deprecated:



* Authentication algorithms md5 and sha1
* Encryption algorithm triple_des
* Diffie–Hellman groups 2 and 5



You have until 13 December 2022 to upgrade to more secure ciphers. After this date, VPN connections that use deprecated ciphers show a status of down (and no longer transfer data) until you upgrade from the weak cipher. For more information, see [Upgrading weak cipher suites on a VPN gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-upgrading-weak-ciphers).

More VPN for VPC ciphers
: VPN gateways now provide new algorithms to help meet your security and compliance requirements.



* IKE policy now supports the sha384 value for authentication, aes192 for encryption, and 15, 16, 17, 18, 20, 21, 22, 23, 24, and 31 values for Diffie–Hellman groups.
* IPsec policy now supports sha384 and disabled values for authentication, aes192, aes128gcm16, aes192gcm16, and aes256gcm16 values for encryption, and group_15, group_16, group_17, group_18, group_20, group_21, group_22, group_23 , group_24, and group_31 Diffie–Hellman groups.



Specifying IKE and IPsec policies when you configure a VPN connection is optional. If a policy is not selected, one is chosen through auto-negotiation. For more information, see [About policy negotiation](https://cloud.ibm.com/docs/vpc?topic=vpc-using-vpnpolicy-negotiation).





 20 September 2022 

Updating subnets for existing application load balancers
: You can now add or remove subnets for existing ALBs by using the UI, API, or CLI.
<br><br> * Plan name<br><br><br> Unique name for the plan. Expand to see plan details, such as frequency, tags that are associated with this plan, and whether fast restore and remote copies are enabled. 
 <br><br> * Retention<br><br><br> Period that you set for the plan to be in effect, for example, 30 days. 
 <br><br> * Status<br><br><br> Plan status. Shows enabled for an active plan. 
 <br><br> * Actions menu<br><br><br> Edit or remove a plan. You can change the name and other plan details such as retention, tags, fast restore, and remote copies. For more information, see [Edit or delete a backup plan in the UI](https://cloud.ibm.com/docs/vpc?topic=vpc-backup-service-manage&interface=ui). 







 Viewing a list of volumes that have a backup policy 

View a list of Block Storage for VPC volumes that are backed up by the policy. For a volume to be backed up by a policy, the volume must be tagged with at least one of the policy’s tags for the target resources.

Look at which Block Storage for VPC volumes have policies and verify that the policies are correctly applied.



1. In the [IBM Cloud console](https://cloud.ibm.com/login), go to the menu ![menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) > VPC Infrastructure > Backup policies.
2. Click a policy name.
3. Click the Applied resources tab.



A list of Block Storage for VPC volumes that are backed up by this policy is shown. Information about the volumes includes the volume name, status, volume size, and encryption type (see Table 3).



Table 3. List of Block Storage for VPC volumes for the backup policy

 Field Description 

 Name Name of the volume. Click the pencil icon to edit.
ibmcloud sl file snapshot-list 155617812

Which shows the available snapshots:

id user_name created size_bytes notes
167189176 IBM02SEV2046428_106 2020-09-03T03:00:00-05:00 143089

Pick the snapshot you'd like to restore from the list, keeping in mind that the CouchDB backup must be older than the peer pod backup, and restore it. For information on how to restore the snapshot, see [Restoring storage volume to a specific point-in-time by using a snapshot](https://cloud.ibm.com/docs/FileStorage?topic=FileStorage-managingSnapshotsrestorefromsnapshotUI).

Restore by using the snapshot:

ibmcloud sl file snapshot-restore <volumeid> <snapshotid>

There is only one snapshot available here, so select it:

ibmcloud sl file snapshot-restore 155617812 167189176

A successful snapshot restoration looks similar to:

OK
File volume 155617812 is being restored using snapshot 167189176.

Restoring a volume results in deleting all snapshots that were taken after the snapshot that was used for the restore.

Repeat the process for the other volume used by the peer container, which can be found by using the same commands. Choose the 3:05 a.m. snapshot corresponding to the 3:00 a.m. snapshot you restored for CouchDB volume.

Once both snapshots are restored, scale the deployment back up to one to redeploy the pod with the new data. First, check the status of the pods:

kubectl get deployments

You'll receive a response similar to:

NA.M.E READY UP-TO-DATE AVAILABLE AGE
ibp-operator 1/1 1 1 48d
orderer1node1 1/1 1 1 20h
orderer2node1 1/1 1 1 22h
orderer3node1 1/1 1 1 22h
[Generate](https://cloud.ibm.com/docs/key-protect?topic=key-protect-create-root-keys) or [import](https://cloud.ibm.com/docs/key-protect?topic=key-protect-import-root-keys) a root key that will be used to protect the DEK from step 1.
3. Use the root key to encrypt, or [wrap](https://cloud.ibm.com/docs/key-protect?topic=key-protect-wrap-keys) the DEK. To provide maximum encryption security, you can specify additional authenticated data (AAD) during your wrap request. Note that the same authentication data will be required when unwrapping the DEK.
4. The encrypted data is then stored as metadata in the Key Protect service. Store and maintain the base64 encoded output from the wrapped DEK in a secure location, such as an app or service.



You can generate a new DEK by omitting the plaintext property in your wrap request. The newly created DEK will automatically be wrapped as part of the request.





 Unwrapping keys 

Unwrapping a data encryption key (DEK) decrypts and authenticates the data protected within the key.

If your business application needs to access the contents of your wrapped DEKs, you can use the Key Protect API to send an [unwrap request](https://cloud.ibm.com/apidocs/key-protectinvoke-an-action-on-a-key) to the service.

Complete the following steps to encrypt data via envelope encryption:



1. Retrieve the base64 encoded ciphertext of the wrapped DEK.
2. [Retrieve the key ID](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-keys) of the root key that is associated with the DEK.
3. Make an [unwrap request](https://cloud.ibm.com/apidocs/key-protectinvoke-an-action-on-a-key) to Key Protect.
System and Communications Protection (SC) [SC-12 Cryptographic Key Establishment and Management](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-12) <br>[SC-12 (2) Cryptographic Key Establishment and Management | Symmetric Keys](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-12.2) <br>[SC-12 (3) Cryptographic Key Establishment and Management | Asymmetric Keys](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-12.3) <br>[SC-13 Cryptographic Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-13) <br>[SC-28 Protection of Information At Rest](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-28) <br>[SC-28 (1) Protection of Information at Rest | Cryptographic Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-28.1) 



In addition, you must follow the guidance found in Appendix A: Cryptographic Requirements within the "Control Implementation Overview Template for Application Providers Using IBM Cloud® Virtual Private Cloud".





 Next steps 



* [Data encryption in transit](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-encryption-in-transit)