vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* NSX Data Center SP Base
* NSX Data Center SP Professional
* NSX Data Center SP Advanced
* NSX Data Center SP Enterprise Plus



For vCenter Server® with NSX-V instances (VMware Solutions V4.7 and earlier), HCX is supported for vSphere 6.7. HCX requires you to use one of the following licenses from IBM Cloud:



* NSX Advanced
* NSX Enterprise



For more information, see [Comparison chart for VMware NSX-T, NSX-V, and vSAN](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-solution-appendix).

IBM Cloud® for VMware Solutions offers promotions for some services. Promotional pricing offers a number of months without charge for a service license, if the service has license charges. For more information, see [Promotions for VMware Solutions services](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_addingservicesvc_addingservices-service-promotions).

A VMware vCenter Server® instance with HCX is limited to three simultaneous connections from on-premises sites.



 Technical specifications for HCX 

The following components are ordered and included in the HCX service.

On-premises HCX instances include only licensing and activation.



 HCX Management Appliance VM 



* CPU - 4 CPUs
* RAM - 12 GB
* Disk - 60 GB VMDK



More HCX appliances are deployed during configuration as necessary for L2 connectivity, WAN optimization, and gateway connections.





 Networking 



* One public portable subnet with 16 IP addresses
* Two private portable subnets with 64 IP addresses
* Eight IP addresses from private portable vMotion subnet



For more information about resource requirements and capacity checking, see [Resource requirements for services](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_addingservicesvc_addingservices-resource-requirements).





 NFS storage
Hyper Protect Crypto Services

Key Protect



Table 1. Configurations for the HPCS service

 Configuration Description 

 HPCS instances The list of available HPCS instances that you can select to use for key management 
 Customer root key The list of customer root keys that are stored in your selected HPCS instance 







 Procedure 



1. Select the key management type, either Hyper Protect Crypto Services or Key Protect.
2. Select a key management service:



* If you selected Hyper Protect Crypto Services, click Retrieve to get the list of available HPCS instances and select the one to use for key management.
* If you selected Key Protect, enter your service ID API key, then click Retrieve to get the list of available key manager instances and select the one to use for key management.



3. Select the Key Manager instance from the dropdown.
4. If you selected Key Protect as the key management type, under Customer key ring, the names of the key rings belonging to the selected Key Manager instance are displayed. Select the Customer key ring from the dropdown.

If you selected HPCS, the key ring field is not displayed.
5. Under Customer root key, the names and values of the root keys are displayed. Select the root key you want.
6. (Optional) Add client SSL certificates.



1. Click Add.
2. In the Add client SSL certificate window, enter the name and contents of the certificate, and then click Add.

The certificate name cannot be reused within your selected instance. The certificate content must be valid and contain the BEGIN CERTIFICATE and END CERTIFICATE tags. When you use Key Protect, the certificate cannot be reused in the region where the instance is deployed.



7. Click Configure.







 Results of Step 2 



* The configuration of the instance starts automatically. The status of the instance is changed to Configuring.
* When the instance is ready to use, the status of the instance is changed to Installed.









 Step 3 - (Optional) Adding client SSL certificates 

If you did not add client SSL certificates in Step 2, you must add it after the instance can be used.



 Procedure 



1.
Profile tier-3iops
Size(GB) 40
IOPS 3000
Encryption provider_managed
Mount targets ID Name VPC ID VPC Name
87171615-f8b4-4ccd-a216-bab12eb1a973 my-target121 81ee2425-7c2f-4042-9d8f-d02b0ee8886c vpc1
b041fc54-f0b9-4397-b68e-2ab032cd1206 my-target122 c338ca08-1256-4420-9932-a9960a0f1cfd vpc2
Resource Group ID Name
bdd96715c2a44f2bb60df4ff14a543f5 Default
User Tags env:test,env:prod

Created 2023-01-07T15:26:21+05:30





 Add or modify file share user tags with the API 

As described in the [Beta VPC API](https://cloud.ibm.com/apidocs/vpc-beta) reference [versioning](https://cloud.ibm.com/apidocs/vpc-betaapi-versioning-beta) policy, support for older versions of the beta API is limited to 45 days. Therefore, beta API requests must specify a version query parameter date value within the last 45 days. You must also provide generation parameter and specify generation=2. For more information, see Generation in the [Virtual Private Cloud API reference](https://cloud.ibm.com/apidocs/vpcapi-generation-parameter).



 Add user tag when a file share is created 

Make a POST /shares request and specify the user_tags property. This example creates a share with three user tags, env:test1, env:test2, and env:prod.
Developing, hosting, and testing your service brokers 

The IBM Cloud® platform interacts with service brokers to create and manage service instances and service bindings. You can build your broker by using a combination of our public IBM Cloud service broker samples, Open Service Broker Reference App, and the Open Service Broker API documentation.

When you onboard your service to IBM Cloud, you must build one or more service brokers to manage the lifecycle of your service and its metering integration. For more information, see [Metering integration](https://cloud.ibm.com/docs/sell?topic=sell-service-metering-integration).



 What is a service broker? 

Service brokers manage the lifecycle of services. Platforms interact with service brokers to create, get access to, and manage the services they offer. The Open Service Broker API defines these interactions to allow software providers to offer their services to anyone regardless of the technology or infrastructure those software providers choose. The service broker acts as a middleware component that handles the automatic provisioning of service instances for a product, and it helps with the usage tracking of the service instances.

A broker is useful if you are developing and offering software as a service, platform as a service, or infrastructure as a service across multiple vendors. It can increase business value by introducing the service broker to automate the provisioning and binding for customers. Also, customer management and usage tracking can be easier with a middleware component that handles these cross-cutting concerns. However, a service broker is not suitable if you have custom software that can be deployed on any virtual machine or platform.

When a user selects your service and its pricing plan from the IBM Cloud catalog and creates an instance, the data for the service including the pricing plan and metrics, is sent to your service broker. The broker is integrated with the backend system that manages the provisioning of service instances and the metrics for a selected pricing plan. If a customer deletes an instance of the product, a request is sent to the service broker, and it manages the deprovisioning of the instance.

Zoom

![A diagram that shows third-party providers what role a service broker performs when a user selects their product from the catalog.]
The initiator ID is in the format CertificateID-<value>, where the value matches the fingerprint of the corresponding TLS certificate. Using the fingerprint, you can identify the vCenter Server that triggered the action.



Table 9. Description of actions that generate events for the KMIP for VMware service

 Action Description 

 hs-crypto.kmip-key.create A KMIP key is created. 
 hs-crypto.kmip-key.read A KMIP key is retrieved. 
 hs-crypto.kmip-key-attributes.retrieve A KMIP key's attributes are retrieved. 
 hs-crypto.kmip-key.activate A KMIP key is activated. 
 hs-crypto.kmip-key.revoke A KMIP key is revoked. 
 hs-crypto.kmip-key.destroy A KMIP key is destroyed. 







 EP11 keystore events 

The following table lists the Enterprise PKCS #11 (EP11) keystore actions that generate an event:



Table 10. EP11 keystore actions

 Action Description 

 hs-crypto.keystore.createkeystore Create an EP11 keystore. 
 hs-crypto.keystore.deletekey Delete an EP11 key. 
 hs-crypto.keystore.deletekeystore Delete an EP11 keystore. 
 hs-crypto.keystore.listkeysbyattributes View EP11 keys. 
 hs-crypto.keystore.listkeysbyids View EP11 keys. 
 hs-crypto.keystore.listkeystoresbyattributes View EP11 keystores. 
 hs-crypto.keystore.listkeystoresbyids View EP11 keystores. 
 hs-crypto.keystore.storenewkey Store an EP11 key. 
 hs-crypto.keystore.updatekey Update an EP11 key. 







 EP11 crypto events 

The following table lists the EP11 crypto actions that generate an event:



Table 11. EP11 crypto actions

 Action Description 

 hs-crypto.ep11.use Cryptographic operation 









 Viewing events
vMotion migration 

This migration method uses the VMware vMotion protocol to move a single VM between HCX enabled sites with no service interruption.





 Disaster Recovery 

The HCX Disaster Recover service replicates and protects VMs to a remote data center.







 Components of HCX 

The VMware HCX service deploys four virtual appliance types that are installed and configured on both the on-premises datacenter and the IBM Cloud target. Optionally, edge devices might be required depending upon the implementation design.



 Target side and client side 

HCX has the concept of cloud side (target - destination) and client side (source).



* Cloud / Destination side - HCX Cloud is pre-deployed in IBM Cloud vCenter Server Deployment on customer portal request and configured with the network and compute profiles ready for service mesh creation.
* Client / Source side - Any vSphere instances that meet the prerequisites for installation and operation. The client side of HCX is the primary that controls the cloud side secondary instance through its vCenter web client user interface (UI) snap-in.



The source and destination sites are paired together for HCX operations. An HCX Connector cannot be paired with another HCX Connector.

In both the source and destination environments, HCX is deployed to the management zone, next to each site's vCenter Server, which provides a single plane (HCX Manager) for administering VMware HCX. This HCX Manager provides a framework for deploying HCX service VMs across both the source and destination sites. VMware HCX administrators are authenticated, and each task authorized through the existing vSphere SSO identity sources. VMware HCX mobility, extension, protection actions can be initiated from the HCX User Interface or from within the vCenter Server Navigator screen's menus.





 HCX Cloud and HCX Connector 

In the HCX site-to-site architecture, an HCX source environment and an HCX destination environment exist. Depending on the environment, a specific HCX installer is used, either HCX Connector (previously HCX Enterprise) or HCX Cloud. HCX Connector is always deployed as the source.
Backing up your VMware vSphere environment by using Veeam 

You can back up your VMware vSphere environment by using a hybrid solution that consists of the following services:



* IBM Cloud® Object Storage Service
* NetApp AltaVault Cloud Storage Gateway
* Veeam Backup and Replication software



Veeam Backup and Replication enables a hybrid solution that includes NetApp AltaVault cloud-integrated storage appliance and IBM Cloud® Object Storage. Software creates, maintains, and restores virtual environments from backups. When used along with a NetApp AltaVault cloud-integrated storage appliance, you create backups that are stored locally (on-premises). The backup is also simultaneously replicated to IBM Cloud Object Storage. With this hybrid solution, two copies of a backup are made, but only one of them exists locally.



 AltaVault Cloud-Integrated Storage Gateway 

You can use AltaVault Cloud Storage Gateway to integrate your on-premises environment with the cloud without having to write scripts or applications by using REST APIs for IBM Cloud Object Storage. You can mount or point to the mount points and begin copying data into the cloud securely.



 Deploying AltaVault on-premises 

Follow these steps to deploy AltaVault as an on-premises backup solution to IBM Cloud Object Storage.

You can purchase AltaVault as either a physical or a virtual appliance. The deployment of the trial-version VMware vSphere ESXi-based AltaVault virtual appliance is covered in this procedure.



 Prerequisites 

Verify that the following prerequisites are met.



* A copy of AltaVault Virtual Appliance. It is a single file with an OVA file extension. Contact your NetApp representative for the appliance, or download a 90-day trial version from the [NetApp AltaVault website](http://www.netapp.com).
* An existing on-premises vSphere ESXi 5.5 environment with the minimum CPU, memory, and disk space requirements available for the AltaVault appliance. If you use the trial version, these requirements are four virtual CPUs (vCPUs), 24 GB of memory, and up to 8 TB of disk space.
Host profiles 

vCenter has a feature that is called Host Profiles. This feature creates a profile that captures a pre-configured and validated reference host configuration and helps a system administrator manage the host configurations in a cluster. Host Profiles provide an automated and centrally managed mechanism for host configuration and configuration compliance. Host Profiles enable the configuration to be treated as a managed object, which has a catalog of parameters to configure; networking, storage, security, and other host-level parameters. These Host Profiles can be applied to individual hosts, a cluster, or all the hosts and clusters associated to a host profile.

As more VMware vCenter Server® vSphere® ESXi™ hosts are deployed by the IBM Cloud® for VMware Solutions automation that deployed the original cluster, there are less configuration drift than with manual methods of adding hosts. However, system administrator actions, besides the automation can make the hosts configuration different. For example, more NFS storage is added or extra VLANs are added. The use of Host Profiles to validate the configuration of a new host by checking compliance of this host against an existing host is a valid use case of this tool within IBM Cloud.

To add more hosts to your vCenter Server cluster, see [Adding ESXi servers to vCenter Server instances](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_addingservers).



* For instances deployed at, or upgraded to, V2.1 or higher, newly deployed ESXi servers and clusters are patched with recent, but not necessarily the most recent ESXi updates from VMware®.
* You're responsible for all other updates to VMware components, including ensuring that newly deployed ESXi servers and clusters have all the most recent updates you require.



We advise that after a new host is added into the cluster, that it is placed in Maintenance Mode so that it can be reviewed for compliance drift and remediated before you host any workloads.

The following sequence is required to check compliance:



1. Create a Host Profile from an existing host.
2. Attach the new host to the Host Profile.
3. Check the compliance of the new host with the Host Profile.
4.
The initiator ID is in the format CertificateID-<value>, where the value matches the fingerprint of the corresponding TLS certificate. Using the fingerprint, you can identify the vCenter Server that triggered the action.



Table 8. Description of actions that generate events for the KMIP for VMware service

 Action Description 

 hs-crypto.kmip-key.create A KMIP key is created. 
 hs-crypto.kmip-key.read A KMIP key is retrieved. 
 hs-crypto.kmip-key-attributes.retrieve A KMIP key's attributes are retrieved. 
 hs-crypto.kmip-key.activate A KMIP key is activated. 
 hs-crypto.kmip-key.revoke A KMIP key is revoked. 
 hs-crypto.kmip-key.destroy A KMIP key is destroyed. 







 EP11 keystore events 

The following table lists the Enterprise PKCS #11 (EP11) keystore actions that generate an event:



Table 9. EP11 keystore actions

 Action Description 

 hs-crypto.keystore.createkeystore Create an EP11 keystore. 
 hs-crypto.keystore.deletekey Delete an EP11 key. 
 hs-crypto.keystore.deletekeystore Delete an EP11 keystore. 
 hs-crypto.keystore.listkeysbyattributes View EP11 keys. 
 hs-crypto.keystore.listkeysbyids View EP11 keys. 
 hs-crypto.keystore.listkeystoresbyattributes View EP11 keystores. 
 hs-crypto.keystore.listkeystoresbyids View EP11 keystores. 
 hs-crypto.keystore.storenewkey Store an EP11 key. 
 hs-crypto.keystore.updatekey Update an EP11 key. 







 EP11 crypto events 

The following table lists the EP11 crypto actions that generate an event:



Table 10. EP11 crypto actions

 Action Description 

 hs-crypto.ep11.use Cryptographic operation 









 Viewing events
hs-crypto.managed-keys.list Get a list of managed keys. 
 hs-crypto.managed-keys.read Retrieve information about a managed key. 
 hs-crypto.managed-keys.delete Delete a managed key. 







 Keystore events 

The following table lists the key actions that generate an event.



Table 2. Target keystore actions

 Action Description 

 hs-crypto.target-keystores.write Create or update a target keystore. 
 hs-crypto.target-keystores.list Get a list of target keystores. 
 hs-crypto.target-keystores.read Retrieve information about a target keystore. 
 hs-crypto.target-keystores.delete Delete a target keystore. 







 Vault events 

The following table lists the key actions that generate an event.



Table 3. Vault actions

 Action Description 

 hs-crypto.vaults.list Get a list of vaults. 
 hs-crypto.vaults.write Create or update a vault. 
 hs-crypto.vaults.read Retrieve information about a vault. 
 hs-crypto.vaults.delete Delete a vault. 







 Template events 

The following table lists the key actions that generate an event.



Table 4. Template actions

 Action Description 

 hs-crypto.key-templates.write Create or update a template. 
 hs-crypto.key-templates.read Retrieve template information. 
 hs-crypto.key-templates.delete Delete a template. 
 hs-crypto.key-templates.list List all key templates. 







 Registration events 

The following table lists the registration actions that generate an event.



Table 5. Registration actions

 Action Description 

 hs-crypto.registrations.list List registrations for any key. 
 hs-crypto.registrations.default Invalid registration request event. 







 Trusted Key Entry events 

The following table lists the Trusted Key Entry (TKE) actions that generate an event.



Table 6. Trusted Key Entry actions

 Action Description
$ ibmcloud is share-create --zone us-south-2 --vpc {vpc_id} --name my-encrypted-share --profile tier-5iops --encryption key abccorp-kp-vpc-2 fd57250e-908c-4785-a8a5-1f53176bcd2f
Creating volume demovolume in resource group Default under account VPC 01 as user rtuser1@mycompany.com...
ID 339c8781-f7f5-4a8f-8a2d-3bfc711788ee
Name my-encrypted-share
Size 100
IOPS 1000
Profile tier-5iops
Encryption Key crn:v1:bluemix:public:kms:us-south:a/8d65fb1cf5e99e86dd7229ddef9e5b7b:b1abf7c5-381d-4f34-836e-5db7193250bc:key:fd57250e-908c-4785-a8a5-1f53176bcd2f
Encryption customer_managed
Status pending
Resource Group Default(dbb12715c2a22f2bb60df4ffd4a543f2)
Created 2023-02-07 10:09:28
Zone us-south-2
Mount targets none





 Create customer-managed encryption file shares with the API 

You can create file shares with customer-managed encryption by calling the [Virtual Private Cloud (VPC) API](https://cloud.ibm.com/apidocs/vpc).

Make a POST /shares request and specify the encryption_key parameter to identify your customer root key (CRK). It is shown in the example as crn:[...key:...].

You can also specify the CRN of a root key from a different account in the POST /shares call.
ibmcloud dl gateway-create|gwc GATEWAY_NAME --billing BILLING --bgp-asn BGP_ASN --bgp-base-cidr BGP_BASE_CIDR --routing ROUTING --speed-mbps SPEED_MBPS --type TYPE [--bgp-cer-cidr BGP_CER_CIDR] [--bgp-ibm-cidr BGP_IBM_CIDR] [--carrier-name CARRIER_NAME] [--cross-connect-router CROSS_CONNECT_ROUTER] [--customer-name CUSTOMER_NAME] [--location-name LOCATION_NAME] [--port-id PORT_ID] [--resource-group-id RESOURCE_GROUP_ID] [-–help|-h] [--output format]



 Command options 

GATEWAY_NAME
: Specify a name for the new gateway.

--billing VALUE
: Billing of resources (metered | non-metered). Select metered to charge per gigabyte and non-metered for flat rate.

--bgp-asn VALUE
: Specify either the default value of 64999, or select an ASN from allowed ranges.

--bgp-base-cidr BGP_BASE_CIDR
: Specify the BGP Base CIDR.

--bgp-cer-cidr BGP_CER_CIDR
: Specify the BGP customer edge router CIDR.

--bgp-ibm-cidr BGP_IBM_CIDR
: Specify the BGP IBM CIDR.

--carrier-name value
: Specify the gateway carrier name.

--cross-connect-router XCR
: Select the IBM cross-connect router for the Direct Link connection.

--customer-name value
: Specify the gateway customer name.

--location-name LOCATION
: Specify the location name; for example, dal10.

--port-id
: Port ID for the gateway. Required when type is connect.

--resource-group-id value
: Resource group ID for this resource.
IBM Cloud Direct Link is integrated into the [IBM Cloud usage dashboard](https://cloud.ibm.com/docs/billing-usage?topic=billing-usage-viewingusage), which provides a summary of estimated charges for all services and resources that are used per month in your organizations. This includes the number of connections and the amount of traffic flowing across your direct links. IBM Cloud Direct Link usage is billed and reported as part of the [IBM Cloud invoice process](https://cloud.ibm.com/docs/billing-usage?topic=billing-usage-managing-invoices).
* How does IBM Cloud Direct Link work?

For every Direct Link customer, the IBM Cloud® team assigns a small private subnet to build a point-to-point network between the IBM Cloud cross-connect router (XCR) and your Edge router. Then, you and IBM Cloud configure the Border Gateway Protocol (BGP) to exchange routes between the environments. Finally, IBM Cloud places you into a VRF to allow for the implementation of non-unique routes to the private address space of your remote network.
* If I order a direct link with local routing, is it possible to upgrade and switch to global routing later?

Yes, you can change the routing option any time after creating the gateway. To do so, click Actions on the gateway's details page and then click Edit. This is not a disruptive change.
* How can I achieve redundancy with Direct Link?

Direct Link does not provide an inherently redundant service. Direct Link can provide diverse connections that enable you to create redundancy using BGP. You can achieve diversity with Direct Link by connecting to more than one IBM Cloud Direct Link Dedicated service provider for IBM Cloud.
* What's the difference between the default local routing and global routing for Direct Link?

The local routing option is the default routing option. If your Direct Link is connected at the local PoP, it provides access to all data centers within that same market. In some markets, local routing is applicable for stand-alone PoP locations and direct links that are terminated at the data center.

With our standard Direct Link offering, you can send traffic between the data centers in your selected region.