IBM Cloud: provision a VPC and a virtual server

This article details the process of provisioning a Virtual Private Cloud (VPC) and a virtual server instance within IBM Cloud, using both the IBM Cloud UI…

This article details the process of provisioning a Virtual Private Cloud (VPC) and a virtual server instance within IBM Cloud, using both the IBM Cloud UI and the IBM Cloud Command Line Interface (CLI). We will cover network setup, instance creation, and essential connectivity configurations. This guide assumes you have an active IBM Cloud account and the ibmcloud CLI installed and configured.

Understanding IBM Cloud VPC Components

Before diving into provisioning, it's crucial to understand the fundamental components of an IBM Cloud VPC:

VPC (Virtual Private Cloud): An isolated, private network space in IBM Cloud where you can deploy resources. Each VPC has its own IP address ranges, routing tables, and security groups.
Subnet: A range of IP addresses within your VPC, associated with a specific availability zone. Virtual server instances are attached to subnets.
Availability Zone: A physically isolated location within a region, designed to be independent of other zones. Deploying resources across multiple zones enhances fault tolerance.
Virtual Server Instance: The virtual machine (VM) itself, comprising compute (vCPUs), memory, and storage.
Security Group: A virtual firewall that controls inbound and outbound traffic for virtual server instances. Rules are stateless for VPC.
Floating IP: A public IP address that can be associated with a virtual server instance's network interface, allowing external access.
Public Gateway: A resource attached to a subnet that allows all instances in that subnet to access the internet. Required for outbound internet connectivity for instances without Floating IPs.

Provisioning a VPC and Subnet via IBM Cloud UI

The IBM Cloud console provides a graphical interface for resource creation. Follow these steps:

Navigate to VPC Infrastructure: From the IBM Cloud console, search for "VPC Infrastructure" or go to Navigation Menu > VPC Infrastructure > VPCs.
Create a New VPC: Click "New VPC".
- Name: my-vpc-ui
- Resource group: Choose an appropriate resource group (e.g., Default).
- Region: Select a region, e.g., Dallas (us-south).
- Access management tags: (Optional) Add tags for organization.
- Default security group: Leave as default.
- Default network ACL: Leave as default.
- Classic Access: Leave disabled unless you have specific needs for Classic Infrastructure integration.
Click "Create VPC".
Create a Subnet: After VPC creation, you'll be redirected to the VPC details page. Scroll down to "Subnets" and click "New subnet".
- Name: my-subnet-ui-zone1
- VPC: my-vpc-ui (pre-selected)
- Location: Select an availability zone within your chosen region, e.g., Dallas 1.
- IP range: The UI will suggest a default CIDR block, e.g., 10.240.0.0/24. You can customize this if needed, ensuring it doesn't overlap with other subnets in your VPC. A /24 provides 256 addresses, with 5 reserved.
- Public Gateway: To allow instances in this subnet to access the internet, click "Attach a public gateway". If you don't have one, click "New Public Gateway", give it a name (e.g., my-pgw-zone1), and create it.
Click "Create subnet".

Provisioning a Virtual Server Instance via IBM Cloud UI

Navigate to Virtual Server Instances: From your VPC details page or Navigation Menu > VPC Infrastructure > Virtual server instances.
Create New Instance: Click "New instance".
- Name: my-vm-ui
- VPC: my-vpc-ui (select the VPC you just created)
- Resource group: Default or specific.
- Location: Select the same availability zone as your subnet, e.g., Dallas 1.
- Operating System: Choose an image, e.g., Ubuntu Linux 22.04 LTS.
- Profile: Select an appropriate profile. For a basic test, bx2-2x8 (2 vCPUs, 8 GiB RAM) is a good start.
- SSH keys: You must add an SSH key to connect to your instance. If you don't have one, click "New key", provide a name, and paste your public SSH key. For example, the content of your local ~/.ssh/id_rsa.pub file.
- Data volumes: (Optional) Add additional block storage. Default boot volume size is usually 100GB.
- Network interfaces: Ensure your my-subnet-ui-zone1 is selected.
Click "Create virtual server instance".
Assign a Floating IP: Once the instance is provisioned and running, navigate to its details page. Under "Network interfaces", locate the primary interface and click "Reserve Floating IP". This assigns a public IP address allowing direct SSH access.

Provisioning VPC Resources via IBM Cloud CLI

The IBM Cloud CLI offers a powerful way to automate infrastructure provisioning. Ensure you're logged in with ibmcloud login and targeting the correct region (e.g., ibmcloud target -r us-south).

1. Create VPC

ibmcloud is vpc-create my-vpc-cli --resource-group Default

This command creates a VPC named my-vpc-cli in the specified resource group. Note down the VPC ID from the output.

2. Create Subnet

First, get the VPC ID and a valid availability zone name for your chosen region. For us-south, zones are typically us-south-1, us-south-2, us-south-3.

# Get VPC ID (replace with your VPC name if different)
VPC_ID=$(ibmcloud is vpcs --output json | jq -r '.[] | select(.name=="my-vpc-cli") | .id')

# Create a subnet
ibmcloud is subnet-create my-subnet-cli-zone1 ${VPC_ID} us-south-1 --ipv4-cidr-block 10.240.1.0/24 --resource-group Default

This creates a subnet in us-south-1 with a CIDR block of 10.240.1.0/24. Choose a CIDR that doesn't conflict with other subnets in your VPC.

3. Create a Public Gateway (Optional, but recommended for internet access)

If your VM needs outbound internet access and won't have a Floating IP, or if you want to use NAT for a subnet, attach a Public Gateway.

# Get subnet ID
SUBNET_ID=$(ibmcloud is subnets --output json | jq -r '.[] | select(.name=="my-subnet-cli-zone1") | .id')

# Create Public Gateway
ibmcloud is public-gateway-create my-pgw-cli-zone1 ${VPC_ID} us-south-1 --resource-group Default

# Get Public Gateway ID
PGW_ID=$(ibmcloud is public-gateways --output json | jq -r '.[] | select(.name=="my-pgw-cli-zone1") | .id')

# Attach Public Gateway to subnet
ibmcloud is subnet-update ${SUBNET_ID} --public-gateway-id ${PGW_ID}

4. Create a Virtual Server Instance

You'll need the IDs of your VPC, subnet, an image, a profile, and an SSH key. First, list available resources:

# List available images (e.g., Ubuntu 22.04)
ibmcloud is images | grep "ubuntu-22-04"

# List available instance profiles (e.g., bx2-2x8)
ibmcloud is instance-profiles | grep "bx2-2x8"

# List your SSH keys (ensure you have one uploaded or create one)
ibmcloud is keys

Assuming you have an SSH key named my-ssh-key, a VPC named my-vpc-cli, and a subnet named my-subnet-cli-zone1:

# Get IDs
VPC_ID=$(ibmcloud is vpcs --output json | jq -r '.[] | select(.name=="my-vpc-cli") | .id')
SUBNET_ID=$(ibmcloud is subnets --output json | jq -r '.[] | select(.name=="my-subnet-cli-zone1") | .id')
IMAGE_ID=$(ibmcloud is images --output json | jq -r '.[] | select(.name=="ibm-ubuntu-22-04-amd64-v2") | .id') # Adjust image name as needed
KEY_ID=$(ibmcloud is keys --output json | jq -r '.[] | select(.name=="my-ssh-key") | .id')

# Create the instance
ibmcloud is instance-create my-vm-cli ${VPC_ID} us-south-1 bx2-2x8 ${SUBNET_ID} ${IMAGE_ID} --keys ${KEY_ID} --resource-group Default

The ibm-ubuntu-22-04-amd64-v2 image is a common choice. Always verify the exact image name with ibmcloud is images as names can change with versions.

5. Assign a Floating IP

To enable direct SSH access to your VM from the internet, assign a Floating IP:

# Get instance ID
INSTANCE_ID=$(ibmcloud is instances --output json | jq -r '.[] | select(.name=="my-vm-cli") | .id')

# Get primary network interface ID (index 0)
PRIMARY_NETWORK_INTERFACE_ID=$(ibmcloud is instance-network-interfaces ${INSTANCE_ID} --output json | jq -r '.[0].id')

# Create and assign Floating IP
ibmcloud is floating-ip-reserve my-vm-cli-fip --nic-id ${PRIMARY_NETWORK_INTERFACE_ID} --resource-group Default

After a few moments, retrieve the Floating IP address:

ibmcloud is instance ${INSTANCE_ID} --output json | jq -r '.primary_network_interface.floating_ip.address'

Connecting to Your Virtual Server Instance

Once your VM is running and has a Floating IP, you can connect via SSH. The default username for Ubuntu images is ibmuser, and for Red Hat Enterprise Linux (RHEL) it's root or cloud-user depending on the image version.

ssh ibmuser@<YOUR_FLOATING_IP_ADDRESS>

Ensure your SSH key associated with the instance is correctly loaded in your SSH agent or specified with the -i flag: ssh -i ~/.ssh/id_rsa ibmuser@<YOUR_FLOATING_IP_ADDRESS>.

Security Group Configuration

By default, the security group assigned to your instance might only allow inbound SSH (port 22). If you need other ports open (e.g., HTTP/80, HTTPS/443), you must add rules to the security group.

Via UI: Navigate to VPC Infrastructure > Security groups, select your VPC's default security group (or a custom one), and add inbound rules.

Via CLI:

# Get the default security group ID for your VPC
VPC_ID=$(ibmcloud is vpcs --output json | jq -r '.[] | select(.name=="my-vpc-cli") | .id')
DEFAULT_SG_ID=$(ibmcloud is security-groups --output json | jq -r '.[] | select(.vpc.id=="'${VPC_ID}'" and .name | contains("Default Security Group")) | .id')

# Add an inbound rule for HTTP (port 80) from any source
ibmcloud is security-group-rule-add ${DEFAULT_SG_ID} inbound tcp --port-min 80 --port-max 80 --remote-cidr 0.0.0.0/0

# Add an inbound rule for HTTPS (port 443) from any source
ibmcloud is security-group-rule-add ${DEFAULT_SG_ID} inbound tcp --port-min 443 --port-max 443 --remote-cidr 0.0.0.0/0

Remember that security group rules are stateless, meaning you need both inbound and outbound rules for specific traffic types if you're not using the default allow-all outbound rule.

Common Pitfalls

SSH Key Mismatch: The public SSH key used during instance creation must correspond to the private key you use to connect. If they don't match, you won't be able to log in.
Missing Floating IP: Without a Floating IP, instances cannot be directly accessed from the public internet. Ensure one is assigned for external SSH.
Security Group Rules: If you can SSH but other services (e.g., web server) aren't reachable, check your security group's inbound rules for the necessary ports.
Public Gateway for Outbound Access: Instances without a Floating IP in a subnet require a Public Gateway attached to that subnet to access the internet (e.g., for apt update).
Availability Zone Mismatch: Ensure your virtual server instance is provisioned in the same availability zone as its subnet.
Resource Naming: Be consistent and descriptive with resource names (VPC, subnet, VM) for easier management, especially in large deployments.
CIDR Block Overlaps: When manually specifying CIDR blocks for subnets, ensure they do not overlap within the same VPC.
Image/Profile IDs: When using the CLI, always verify the exact image and profile IDs/names using ibmcloud is images and ibmcloud is instance-profiles, as they can vary or be updated.