vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Create a VPC gateway on a subnet in each VPC and create a VPN connection between the two VPC gateways. For example, you can connect subnets in a VPC in one region through a VPN connection to subnets in a VPC in another region. To get started, follow the steps in [Connecting two VPCs using VPN](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-example). Note that if you use [access control lists (ACLs)](https://cloud.ibm.com/docs/containers?topic=containers-vpc-network-policy) for your VPC subnets, you must create inbound or outbound rules to allow your worker nodes to communicate with the subnets in other VPCs.





 IBM Cloud Transit Gateway 

Use IBM Cloud Transit Gateway to manage access between your VPCs. Transit Gateway instances can be configured to route between VPCs that are in the same region (local routing) or VPCs that are in different regions (global routing). To get started, see the [Transit Gateway documentation](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-getting-started).







 Communication with IBM Cloud classic resources 

If you need to connect your cluster to resources in your IBM Cloud classic infrastructure, you can set up a VPC with classic access or use IBM Cloud Transit Gateway.



 Create a classic-access VPC 

If you plan to connect only one VPC to classic infrastructure, you can set up a VPC for classic access. Every virtual server instance or bare metal server without a public interface on your classic infrastructure in your account can send and receive packets to and from instances in the VPC.

Before you connect a VPC to a classic infrastructure account, note the following limitations and requirements:



* You must enable the VPC for classic access when you create the VPC. You can't convert an existing VPC to use classic access.
* You can set up classic infrastructure access for only one VPC per region. You can't set up more than one VPC with classic infrastructure access in a region.
Create a VPC gateway on a subnet in each VPC and create a VPN connection between the two VPC gateways. For example, you can connect subnets in a VPC in one region through a VPN connection to subnets in a VPC in another region. To get started, follow the steps in [Connecting two VPCs using VPN](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-example). Note that if you use [access control lists (ACLs)](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-network-policy) for your VPC subnets, you must create inbound or outbound rules to allow your worker nodes to communicate with the subnets in other VPCs.





 IBM Cloud Transit Gateway 

Use IBM Cloud Transit Gateway to manage access between your VPCs. Transit Gateway instances can be configured to route between VPCs that are in the same region (local routing) or VPCs that are in different regions (global routing). To get started, see the [Transit Gateway documentation](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-getting-started).







 Communication with IBM Cloud classic resources 

If you need to connect your cluster to resources in your IBM Cloud classic infrastructure, you can set up a VPC with classic access or use IBM Cloud Transit Gateway.



 Create a classic-access VPC 

If you plan to connect only one VPC to classic infrastructure, you can set up a VPC for classic access. Every virtual server instance or bare metal server without a public interface on your classic infrastructure in your account can send and receive packets to and from instances in the VPC.

Before you connect a VPC to a classic infrastructure account, note the following limitations and requirements:



* You must enable the VPC for classic access when you create the VPC. You can't convert an existing VPC to use classic access.
* You can set up classic infrastructure access for only one VPC per region. You can't set up more than one VPC with classic infrastructure access in a region.
* [Creating a VPC subnet in the console](https://cloud.ibm.com/docs/containers?topic=containers-vpc-subnetscreate_vpc_subnet_ui)
* [Creating a VPC subnet in the CLI](https://cloud.ibm.com/docs/containers?topic=containers-vpc-subnetscreate_vpc_subnet_cli)



* [Creating VPC subnets for classic access](https://cloud.ibm.com/docs/containers?topic=containers-vpc-subnetsclassic_access_subnets)



* [Creating VPC subnets for classic access in the console](https://cloud.ibm.com/docs/containers?topic=containers-vpc-subnetsca_subnet_ui)
* [Creating VPC subnets for classic access from the CLI](https://cloud.ibm.com/docs/containers?topic=containers-vpc-subnetsca_subnet_cli)



* [Restricting public network traffic to a subnet with a public gateway](https://cloud.ibm.com/docs/containers?topic=containers-vpc-subnetsvpc-restrict-gateway)



[Setting up VPC VPN connectivity](https://cloud.ibm.com/docs/containers?topic=containers-vpc-vpnaasvpc-vpnaas)



* [Communication with resources in on-premises data centers](https://cloud.ibm.com/docs/containers?topic=containers-vpc-vpnaasonprem)



* [IBM Cloud VPC VPN](https://cloud.ibm.com/docs/containers?topic=containers-vpc-vpnaasvpc-vpn-def)
* [Direct Link](https://cloud.ibm.com/docs/containers?topic=containers-vpc-vpnaasvpc-directlink-def)
* ROUTING_TABLE: ID or name of the VPC routing table.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is vpc-routing-table-create 

Create a VPC routing table.

ibmcloud is vpc-routing-table-create VPC [--name NAME] [--direct-link-ingress false | true] [--internet-ingress, --internet false | true] [--transit-gateway-ingress false | true] [--vpc-zone-ingress false | true] [--accept-routes-from-resource-type-filters, --ar-rtf vpn_server | vpn_gateway] [--output JSON] [-q, --quiet]



 Command examples 



* ibmcloud is vpc-routing-table-create 72b27b5c-f4b0-48bb-b954-5becc7c1dcb3 --name my-vpc-routing-table --output JSON
* ibmcloud is vpc-routing-table-create my-vpc --name my-vpc-routing-table --output JSON
* ibmcloud is vpc-routing-table-create vpc-doloremque-6364-us-east --name test-vpc-cli-routing-tb2 --direct-link-ingress true --internet-ingress false --transit-gateway-ingress false --vpc-zone-ingress false
* ibmcloud is vpc-routing-table-create 979b4bc6-f018-40a2-92f5-0b1cf777b55d --name test-vpc-cli-routing-tb1 --direct-link-ingress false --internet-ingress false --transit-gateway-ingress false --vpc-zone-ingress true
"crn": "crn:v1:public:resource-controller::a/e2f80b84-bc75-4f53-8737-8193ef1d1a7b::resource-group:e96d1fa9-76f2-4c87-a737-dbab3a947b24",
"href": "https://resource-controller.cloud.ibm.com/v2/resource_groups/e96d1fa9-76f2-4c87-a737-dbab3a947b24",
"id": "e96d1fa9-76f2-4c87-a737-dbab3a947b24",
"name": "Default"
},
"resource_type": "share",
"size": 4800,
"mount_targets": [],
"zone": {
"href": "https://us-south.iaas.cloud.ibm.com/v1/regions/us-south/zones/us-south-1",
"name": "us-south-1"
}
}





 Create a file share and mount target together with the API 

The following example request creates a file share that has VPC-wide access mode and a mount target that can be used by every virtual server instance in the specified VPC. It also adds [user tags](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-managing&interface=apifs-add-user-tags) to the share.

Access to the mount target is VPC wide; all instances in the VPC have access to this file share. You can also restrict access to a specific virtual server instance in the VPC by specifying a virtual network interface in the mount target definition.
For [management VPC connectivity](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-management), your operators can connect to the environment from your on-premises network (with Direct Link or VPN for VPC) or through a full-tunnel client-to-site VPN. In practice, all three zones in the edge VPC would be the same, but for illustrative purposes, each zone in the edge VPC box depicts one of the three scenarios for operator connectivity:



* Zone 1 - Connectivity with Direct Link, so neither a full-tunnel client-to-site VPN nor VPN for VPC is needed.
* Zone 2 - Connectivity from the application provider is with VPN for VPC, so a full-tunnel client-to-site VPN is not needed.
* Zone 3 - Connectivity from the application provider is through a full-tunnel client-to-site VPN, so VPN for VPC is not needed.



Finally, the bastion can be put either in the edge VPC or the management VPC. If you place it in the edge VPC, then the management VPC becomes optional if you are not deploying any other management tools.





 Application load balancer in workload VPC 

Use IBM Cloud® Application Load Balancer for VPC (ALB) to distribute traffic among multiple server instances within the same region of your VPC. For more information, see the following resources:



* [About IBM Cloud® Application Load Balancer for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-load-balancers&interface=ui)
* [Creating an Application Load Balancer for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-load-balancer)











 Related controls in IBM Cloud Framework for Financial Services 

The following [IBM Cloud Framework for Financial Services controls](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-aboutframework-control-requirements) are most related to this guidance.
For more information, see [Creating virtual server instances](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-virtual-servers&interface=ui), and [Managing virtual server instances](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-virtual-server-instances&interface=ui).

Designating VPC route priority
: When multiple VPC routes exist for a destination, you can now control the priority of these routes (from 0 to 4). New and existing routes that are created without a priority value, are automatically set to the default priority (2). Smaller values have higher priority. For more information, see [Determining route preference](https://cloud.ibm.com/docs/vpc?topic=vpc-about-custom-routescr-determining-route-preference).

The route priority is considered on identical destinations only.

Modifying the next hop for VPC routes
: You can now [update](https://cloud.ibm.com/apidocs/vpc/latestupdate-vpc-routing-table-route) the next-hop of a VPC route. For more information, see [Creating a route](https://cloud.ibm.com/docs/vpc?topic=vpc-create-vpc-route).





 20 March 2023 

IBM Hyper Protect Container Runtime image ibm-hyper-protect-container-runtime-1-0-s390x-9 updates
: For the IBM Hyper Protect Container Runtime image version ibm-hyper-protect-container-runtime-1-0-s390x-9, new certificates are available.



* [Attestation certificate](https://cloud.ibm.com/media/docs/downloads/hyper-protect-container-runtime/ibm-hyper-protect-container-runtime-1-0-s390x-9-attestation.crt)
ibmcloud is vpc-address-prefix-create PREFIX_NAME VPC ZONE_NAME CIDR [--default false | true] [--output JSON] [-q, --quiet]



 Command examples 



* ibmcloud is vpc-address-prefix-create my-prefix 72251a2e-d6c5-42b4-97b0-b5f8e8d1f479 us-south-2 10.0.0.0/24 --default true --output JSON
* ibmcloud is vpc-address-prefix-create my-prefix my-vpc us-south-2 10.0.0.0/24 --default true --output JSON







 Command options 



* PREFIX_NAME: Name of the VPC address prefix.
* VPC: ID or name of the VPC.
* ZONE_NAME: Name of the zone.
* CIDR: The IPv4 range of the address prefix, expressed in CIDR format. It must not overlap with any existing address prefixes in the VPC, and must fall within the [RFC 1918](https://tools.ietf.org/html/rfc1918) address ranges. The prefix length of the address prefix's CIDR must be between /9 (8,388,608 addresses) and /29 (eight addresses).
* --default: This flag indicates whether this is the default prefix for this zone in this VPC. One of: false, true. (default: false).
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is vpc-address-prefix-delete 

Delete one or more address prefixes.

ibmcloud is vpc-address-prefix-delete VPC (PREFIX1 PREFIX2 ...) [--output JSON] [-f, --force] [-q, --quiet]



 Command options
Message: Default address prefix not found.

You might see this error message if the default address prefix is not found.





 duplicate_error 

Message: The input provided already exists.

The resource specified already exists. Try using a different name for the resource you want to create. For example, when creating a new VPC, you can list existing VPCs by running ibmcloud is vpcs, and choose a name that is not shown.





 field_no_longer_supported 

Message: The field is no longer supported and should not be supplied.

The field provided was once supported but is no longer supported in the version specified. Look at the target values to determine which field is no longer supported.

For details, refer to the [API documentation](https://cloud.ibm.com/apidocs/vpc-on-classic).





 gateway_too_many 

Message: Can only have one public gateway per zone in a VPC.

Only one public gateway per zone is allowed in a VPC but the one public gateway can be attached to multiple subnets in the zone. To find the public gateway for a zone, run the GET public_gateways API and look at the "vpc" and "zone" values. If using the CLI, you can run the ibmcloud is public-gateways command and see the "VPC" and "Zone" value.

Use the public gateway's ID to attach it to a subnet, see an example in our [API examples](https://cloud.ibm.com/docs/vpc-on-classic?topic=vpc-on-classic-creating-a-vpc-using-the-rest-apisattach-public-gateway-to-the-subnet). If using the CLI, you can use the subnet update command to attach it to a public gateway, for example, ibmcloud is subnet-update SUBNET_ID --public-gateway-id PUBLIC_GATEWAY_ID.





 health_monitor_invalid_delay 

Message: The specified health monitor delay <health_monitor_delay> is invalid

Provide a value between 2 and 60 for the parameter health monitor delay.





 health_monitor_invalid_max_retries
For more information, see [Migrating VMDK or VHD images to VPC](https://cloud.ibm.com/docs/cloud-infrastructure?topic=cloud-infrastructure-migrating-images-vpc).





 Dedicated hosts 

When migrating a classic virtual server instance from a dedicated host to IBM Cloud VPC, you have the option to continue to migrate it as a single-tenant model (dedicated host) or change to a shared-tenant model (public). The default is a single-tenant model, and the VPC+ tool will try to match to the closest classic profile that VPC offers for both the dedicated host and virtual server instance. You have the option to change the profile for either the dedicated host or virtual server instance.

When you decide on classic virtual server placement, you can choose either manual (dedicated host) or auto-assign. Whereas in IBM Cloud VPC, the implementation is slightly different and placement is either to a dedicated host or dedicated host group. If the placement for the classic virtual server instance is manual, then the VPC+ tools honors the placement and provisions the virtual server in IBM Cloud VPC as such. For auto-assign, due to the different implementation, the server gets auto-assigned within a dedicated host group. For more information, see [Creating dedicated hosts and groups](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-dedicated-hosts-instances). Similarly, as with profiles, you have the option to change the virtual server placement and dedicated host group.





 Supported virtual server profiles 

Not all compute profiles are supported in VPC. For example, quadratic profiles such as C1.2x2, C1.4x4, C1.8x8 are not supported. See [VPC profiles](https://cloud.ibm.com/docs/vpc?topic=vpc-profilescompute) for a full list of supported profiles.

If the VPC+ tool encounters a profile during discovery that doesn't match a supported profile, the closest matching profile is selected. You can change the selection when editing the discovered resources.

VPC+ Cloud Migration does not currently support GPU profiles.





 Instance groups for auto scaling
These workloads are more CPU-intensive than memory-intensive. So, you want to select a Compute profile that has a vCPU ratio to memory of 1:2. Within the Compute profile, select the appropriate type based on your vCPU and memory requirements. 
 Application tier This tier tends to be more memory-intensive and involves more caching. For this workload, select a Memory profile where the ratio of vCPU-to-memory is more weighted to the memory, 1:8. 
 Data tier If you are using a virtual instance as the database, select a Balance profile that offers more balance between vCPU and memory, such as 1:4. 







 Load balancers 

You can order two types of load balancers from IBM Cloud®. While both load balancers can distribute both HTTP/HTTPS and TCP traffic, each provides different capabilities that might be more suited for different deployment types.



1. You can deploy IBM Cloud® Load Balancer either in public or private scenarios. For a public scenario, the load balancer has a public interface to take incoming traffic from the internet and distribute the traffic through its private interface connecting to the virtual servers as shown in [Scenario 1 - deploying in single zone](https://cloud.ibm.com/docs/ha-infrastructure?topic=ha-infrastructure-ha-3-tiersingle-zone). For a private scenario, the incoming and distributed outgoing traffic goes through private subnets, such as the traffic between the application tier and the data tier.

IBM Cloud Load Balancer also provides horizontal scaling to better handle increased traffic load.

You can configure the Load Balancer back-end listener across multiple zones. When you use this configuration, a secondary load balancer is automatically provisioned and deployed in an active-active fashion for better availability. See [Scenario 2 - deploying in multiple zones with IBM Cloud Internet Services](https://cloud.ibm.com/docs/ha-infrastructure?topic=ha-infrastructure-ha-3-tiermulti-zone-cis).
2. IBM Cloud® Internet Services is a global load balancer that acts as a public load balancer only. Typically, it is deployed for global applications across multiple regions.
Server: Cleversafe/3.9.0.115
X-Clv-S3-Version: 2.5
x-amz-request-id: dca204eb-72b5-4e2a-a142-808d2a5c2a87
Content-Length: 0

--------------------





 Create a bucket with a different storage class 

To create a bucket with a different storage class, send an XML block specifying a bucket configuration with a LocationConstraint of {provisioning code} in the body of a PUT request to a bucket endpoint. For more information about endpoints, see [Endpoints and storage locations](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-endpointsendpoints). Note that standard bucket [naming rules](https://cloud.ibm.com/docs/cloud-object-storage/api-reference?topic=cloud-object-storage-compatibility-api-bucket-operationscompatibility-api-new-bucket) apply. This operation does not make use of operation specific query parameters.

Not all operations are supported in Satellite environments. For details, see [supported Satellite APIs](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-apis-cos-satellite)



 Header Type Description 

 ibm-service-instance-id String This header references the service instance where the bucket will be created and to which data usage will be billed. 



Syntax

PUT https://{endpoint}/{bucket-name} path style
PUT https://{bucket-name}.{endpoint} virtual host style

The body of the request must contain an XML block with the following schema:



 Element Type Children Ancestor Constraint 

 CreateBucketConfiguration Container LocationConstraint <br><br> * <br><br><br> <br><br> * <br><br><br>
Server: Cleversafe/3.9.0.115
X-Clv-S3-Version: 2.5
x-amz-request-id: dca204eb-72b5-4e2a-a142-808d2a5c2a87
Content-Length: 0

--------------------





 Create a bucket with a different storage class 

To create a bucket with a different storage class, send an XML block specifying a bucket configuration with a LocationConstraint of {provisioning code} in the body of a PUT request to a bucket endpoint. For more information about endpoints, see [Endpoints and storage locations](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-endpointsendpoints). Note that standard bucket [naming rules](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-compatibility-api-bucket-operationscompatibility-api-new-bucket) apply. This operation does not make use of operation specific query parameters.

Not all operations are supported in Satellite environments. For details, see [supported Satellite APIs](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-apis-cos-satellite)



 Header Type Description 

 ibm-service-instance-id String This header references the service instance where the bucket will be created and to which data usage will be billed. 



Syntax

PUT https://{endpoint}/{bucket-name} path style
PUT https://{bucket-name}.{endpoint} virtual host style

The body of the request must contain an XML block with the following schema:



 Element Type Children Ancestor Constraint 

 CreateBucketConfiguration Container LocationConstraint <br><br> * <br><br><br> <br><br> * <br><br><br>
IBM Cloud CLI 

View the [Notices file](https://cloud.ibm.com/media/docs/downloads/oss-licensing-info/IBMCloud-CLI-OSS-Licenses.txt) for the IBM Cloud CLI.

This section consists of the following:



* CC-BY-2.5
* CC-BY-3.0
* CC-BY-4.0
* CC-BY-SA-1.0
* CC-BY-SA-2.0
* CC-BY-SA-2.5
* CC-BY-SA-3.0
* CC-BY-SA-4.0
* GPL V2
* GNU FREE DOCUMENTATION LICENSE
* REDHAT UNIVERSAL BASE IMAGE
* SIL OPEN FONT LICENSE 1.1
* UNIQUE (SLC REQD)





 Creative Commons Attribution 2.5 Generic 

The Program includes some or all of the following works licensed under the Creative Commons. The URL to the license is [https://creativecommons.org/licenses/by/2.5/legalcode](https://creativecommons.org/licenses/by/2.5/legalcode).



* GUARDEDBY.JAVA [JSR305](https://search.maven.org/remotecontent?filepath=com/google/code/findbugs/jsr305/3.0.1/jsr305-3.0.1-sources.jar)
* JCIP-ANNOTATIONS [HttpCore](https://repo1.maven.org/maven2/org/apache/httpcomponents/httpcore/)
* IMMUTABLE.JAVA [JSR305](https://search.maven.org/remotecontent?filepath=com/google/code/findbugs/jsr305/3.0.1/jsr305-3.0.1-sources.jar)
For this example, you see a response similar to the following output.

Name Endpoint Status
us-south /v1/regions/us-south available
3. List the zones associated with the region.

ibmcloud is zones us-south

For this example, you see a response similar to the following output.

Name Region Status
us-south-1 us-south available
us-south-3 us-south available
4. List the available profiles for creating your instance template.

ibmcloud is instance-profiles

For this example, you see a response similar to the following output.

Name vCPU Manufacturer Architecture Family vCPUs Memory(GiB) Bandwidth(Mbps) Volume bandwidth(Mbps) GPUs Storage(GB)
bx2-2x8 intel amd64 balanced 2 8 4000 1000 - -
bx2d-2x8 intel amd64 balanced 2 8 4000 1000 - 1x75
bx2-4x16 intel amd64 balanced 4 16 8000 2000 - -
bx2d-4x16 intel amd64 balanced 4 16 8000 2000 - 1x150
bx2-8x32 intel amd64 balanced 8 32 16000 4000 - -
bx2d-8x32 intel amd64 balanced 8 32 16000 4000 - 1x300
bx2-16x64 intel amd64 balanced 16 64 32000 8000 - -
bx2d-16x64 intel amd64 balanced 16 64 32000 8000 - 1x600
5. List the subnets that are associated with the IBM Cloud VPC.

ibmcloud is subnets

For this example, you see a response similar to the following output.

ID Name Status Subnet CIDR Addresses ACL Public Gateway VPC Zone Resource group
0717-cd4f74f1-bfae-423a-886b-9163256ec4a9 subnet-south-1 available 10.240.0.0/24 124/256 acl-test-1 - cdl us-south-1 Default