Oracle -OCI : Foundations
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
OCI
https://education.oracle.com/oracle-cloud-infrastructure-2021-architect-associate/pexam_1Z0-1072-21
https://mylearn.oracle.com/course/oracle-cloud-infrastructure-foundations/35644/96915
https://mylearn.oracle.com/story/35644/
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
OCI Introduction :
To make things simple lets break it down into 7 different categories .
Compute -- Storage and Networking
Compute service cover Bare Metal Servers , Containers , Managed Kubernetes Service and a Managed VMWare service.
These services are primarily for Performing Calculations , Executing Logic and running applications
Cloud Storage includes disks attached to Virtual Machines. File Storage , Network Storage , Archive storage and Data Migration services
OCI gives the complete range of storage services for you to
- Store
- Access
- Govern
- Analyze
- Highest Reliability
- Security Feature
- Performance
- OLTP
- OLAP
- JSON
- Security
- identity
- Observability
Now there are several concepts in Identity Management Service
The first thing in Identity Management is you define your Users
Users : Can be Physcal persons , Services or compute instances for example.
In OCI there is a concept called - Instance Principal
Instance Principal : lets instances and applications running on those instances to make API Call against other OCI services
Think of Principal as IAM entity that is allowed to interact with other OCI resources.
Then you group these users what is called as Groups
Think of group as collection of Users who all needs the same kind of access to a particular set of resources. So that you could create service specific groups . Storage Admins , Network Admins , or you could create groups based on your Geographical requirement
And then you write these policies which are nothing but the authorization . what decides what kind of permissions these specific kind of users have. And you write these policies either on Compartments
Compartments are logical entities to Isolate and control accesses for resources . Or you are write your policies in your entire account your Tenancy or within your accounts or compartments and wihin your compartments reside the actual resources .
Through this mechanism you are providing access to these resources for a group of users by writing these policies .
What are these Resources : Resources are cloud Objects
How do we identify this Resources ?
You identify these resource through a Unique Identifier
OCID : Oracle Cloud ID
This is an Oracle Assigned Unique Identifier .
This contains Meta-Data about resources .
Most of the times you need not know the OCID because it is a Oracle created Unique ID.
AuthN / AuthZ : Authentication and Authorization
Authentication is basiacally figuring out are you who state you are ?
Authorization deal with permissions and figuring out what permissions do you have . In OCI authorization is done through IAM policies .
Policies : Policies are like human readable statements to define granular permissions . We have couple of examples here
Remember , Policies can be attached to a Compartment , or they could be attached to a tenancy . If they are attached to a tenancy, it applies to everything within that tenancy . If it applies to a compartment . It only applies to the resources with in that compartment.
Every permission has been denied by deafult
You cannot write polcies on a user, you always write polciies on the Group level .
Location can be a Tenancy /or a compartment
And you can make these policies really complex , with adding conditions and again foundations course
How verbs look like. There are four levels of verbs
As you go down these become addictive .
Compartment are unique feature within OCI
When you open up an account in OCI you get a Tenancy which is another fancy name for an account and we also give you a ROOT compartment
Think of this Compartment as a Logical Construct where you can keep all your cloud resources and you create your isolate compartment such as below,
Root compartment is one which can hold all of the cloud resources. But the best practices is to create dedicated compartments to Isolate resources . You will see why .
Each resource you create belongs to a Compartment for example when you create a Virtual Machine it goes to Compartment A and it cannot go to Compartment B- You may have to move it to Compartment B if you were to move it to a different compartment.
Keep in mind each resource belong to a single compartment .
Why we use compartment is to control access and Isolation .
For instance you have a Block Storage in Compartment A and you don't want anyone to have access to it . You only want Compute Admin and Storage Admin to have access to that . so you create those users as admins and groups write the policies and they can access these resource in this compartment .
How do rescource interact if they are in different compartments
The Virtual Cloud in one compartment can communicate with the resources in another compartment. And it keep your . The compute instance uses the Virtual Cloud Network But these are in two different compartments . And it keeps your design much cleaner .
Keep in mind now resources can also be move to one compartment from another.
Another important concept to know if that Compartments are Global Constructs like everything in Identity . So resources from Multiple regions can be in the same Compartment
When you go to Phoenix you see this compartment it exists there and you go to ashburn and you see the same compartment existing there two.
Now you can write policies that will prevent users from accessing resources from a different region.
Compartment are gloabl and they are available in every region you have access to .
Finally you can set Quotas and Budgets on Compartments . You can define such as you cannot create a Bare Metal machine in my compartment or you cannot create an exa-data resource . And you can also create budgets on compartments - You can say that when your usage in a particular compartment goes beyond thousand dollars it gets flagged and you get notified .
Demo IAM :
Click on Identity & Security -- Compartment
You can see the compartments now
WWe created the following compartment
- Sandbox
- Development
- Production
Click on Sandbox Compartments
You can see that there is no Child Compartment here .
We can have Six levels of deep nesting . So I can create Six compartments here .
Lets go and create a Group . click on the left bar to create the group .
It is not a good practice for your tenant administrator to manage account on a day to day basis.
Therefore create your own service administrators - they can be Service Administrators or Project Administrators - These are the folks who create other users or compartments and they have admin rights whether on the Compartments or the whole tenancy .
We have an Administrators group by default when you click on Group .
When I click on the Administrator this is the email id of the tenancy who is the Administrator.
I signed up for the 300 $ free trial account. So you can see that listed therein . Lets go ahead and create another group . Lets call this OCIAdmin Group .
There is no users under this Group. So we are going to create users now .
After creating a user , go to the Group and select the user that you want to add to the it .
Lets go to policies now. There are a couple of policies listed here. There is something called a "Tenant Admin Policy" . This is the default policy created by default . You can replicate this policy and lets do something where the OCI user has access to a particular compartment but does not have access anything beyond that .
Click Create Policy , I can create this policy in the root compartment or any of these compartments
We are going to keep the policy in the root compartment. And depending where you create the policy its behavior changes.
Right here you see this Policy Builder.
This gives me some common policies or you can build your policy by clicking the policy builder.
Click in Account Management
click in Account Management
IAM Summary
5 Networking :
- VCN Introduction
- VCN Routing
- VCN Security
- Demo : VCN
- Demo : Creating an Instance
- Load Balancer
- Demo : Load Balancer
- Network Summary
- Hands On Activity : Networking
VCN Introduction : At the core it is a software defined network . It is an regional service
NAT Gateway : The traffic here is unidirectional it can go from the private subnets to the internet . But users from the Internet cannot use the NAT gateway to reach your instances running in a private subnet . Idea with a NAT Gateway is to provide outbound communication to the internet but block inbound traffic from the internet.
Then we have another Route which is called service Gateway . And the idea is it lets resource in VCN to access public OCI services such as Object Storage but without using an internet or NAT Gateway.
Dynamic Routing Gateway :
This is a virtual router that provides a path for private traffic between your VCN and destinations and The destinations can be your On-Premises environments
VCN Routing
VCN uses route tables to send traffic out of the VCN to the internet , to on premises networks, or to peered VCN .
Route tables consists of a set if route rules , each rules specifies a destination CIDR block and a route target .
Think of Route Target as the next hop for the traffic - The traffic that matches the destination CIDR block. Now one thing to keep in mind is that traffic within the VCN subnet is automatically handled by the VCN local routing
You can see a Public Subnet and a Private subnet here and there is no routing data needed in the routing table to handle the routing between the private and the public subnet .
I have a public and a private subnet and I am showing you route table only for the Public subnet .
There are two kind of data movement happening from the Private Subnet . We are leveraging the NAT gateway , may be there is a database running here so you are using the NAT gateway to connect to the internet to get some patches for the Database from the internet .
Second Path is that you are using a Dynamic Routing Gateway , that kind of a virtual router for on-premise network. and that is going to On-Premises , may be you are running an DNS server on-premises , may be your database needs to get its DNS result , if you see the route table entries - you have two entries here.
Since the /16 is bigger than /0 so that takes priority . So first your /16 takes priority so your traffic goes through the Dynamic Routing Gateway to your own premises environments, your DNS servers and the traffic which is not destined for your on-premises environments goes to the internet through the NAT Gateway to get a patch from the internet .
If the networks are from same OCI region they can talk to each other using a mechanism called local peering . We have a concept called Local Peering Gateway which is like a virtual Gateway router, which lets you manage that communication .
If the network are in two different OCI Datacenter regions you have similat concept now but it now Remote Peering .
And instead if using the local peering now it now uses Dynamic Routing Gateway which we used for on-premises routing.
How does communication happens for large size of network, lets assume you have 300 VCN in a network .
what happens here is that you no longer needs to maintain a point to point communication using a local Routing Gateway .
Instead the VCNs can communicate using DRG and this feature also let you scale 300 VCN in a single DRG . If this option is not enough you can always connect an extra DRG through a remote peering connection
VCN Security
With in VCN you have this concept called security list , think of security list as Firewall rules associated with a subnet and applies to all instances within that subnets
The security list is a specific type of rules which specify a certain type of traffic allowed in and out it the subnet , this applies to a given instance whether it is talking to another instance in the VCN or a host outside a VCN .And you can see a couple of entries here these rules can be stateful or stateless .
Stateful : If traffic is allowed in a particular port allowed in it is allowed out from that port vice-versa
The traffic coming from port 80 or any where from the web .
For Private subnet it has its own rules , for it is a private subnet it does not need any kind of web traffic , so the only rule here is for the traffic coming from the public subnet
There is also another concept called NSG - Network Security Groups
These are very similar concept that of Security List . But the key difference is - NSG ,These apply to only a set of Virtual Network Interface Card in a single VCN . And the difference is NSGs can be the source or the destination in the rules , contract this with the security list rules where you specify a CIDR as a source or destination
Also one thing to keep in mind that as you leverage the NSG as they are applied to individual VNICs . Now you can have two instance in a single subnet and they can have different security constructs
Demo VCN :
Getting Started with Virtual Cloud Network .
Spin up our Virtual Cloud Network : This is a regional service if you recall it.
Create VCN / or Start VCP Wizard
We are going to test this setup -- Go to Compute -- Instantiate
We are going to instantiate a compute instance
And we are going to create a Webserver. And we are going to open it up.
Install the httpd server . I am going to open the port 80 in the local firewall .
Demo : Creating an Instance :
OCI Compute service , I am logged in as an OCI Admin , who has complete admin privilege on Sandbox compartment . Click on "Create a VM Instance " It will pick up a name for my instance
It picks up the Compartment , or you can choose to select the apartment
Image it your operating system which picked up Oracle Linux ,
here I get the instance of Bare Metal and VM instances
Load Balancer :
You would use load balancer to achieve high availability and scalability , typically how the load balancers work they work as reverse proxies , you will have clients hitting the load balancer and you will have load balancer will proxy the traffic to various backend servers .
The first type of load balancer we have in OCI is the Layer 7 load balancer
Load balancer comes in two different shapes
- Flexible Shape - where you define the minimum and the maximum - you define a range and your load balancer can achieve any kind of traffic in that particular range going from 10mbs to 8 gbps
- Dynamic Shape - Where you predefine the shapes where you have Micro , Small , Medium Larger in this case you dont have to warm the load balancer the Load balancer automatically scales
You can always make a public or a private load balancer , Public means load balancer is available on the web .
Secod Kind of Load balancer we have is Network Load Balancer - Network load balancer operates at Layer 4 , therefore it understands UDP, TCP, also supports IDMP
It is again like HTTP load balancer , it has both public and private options
Why would you use network load balancer over a http load balancer . Primary reason you would use it because it is much faster than http load balancer . It has much lower latency
if performance is the key criteria for you go with Network load balancer , on the contrary HTTP load balancer has higher level intelligence where it can look at the package , it can inspect the package and it has that intelligence
Demo : Load Balancer :
Setting up load balancer , lets see how you can set up load balancer in Oracle cloud , as a pre-requsite I have gone ahead and created two compute instances
I have created a webserver 1 one and webserver 2 and I have installed Apache HTTP server on each of these , so that you can ping them and put them behind the load balancer
Networking - Load balancer
6. Compute
OCI compute server provide you with Virtual Machines and Bare Metal Servers to meet your compute and application requirements . The three defining scalability of these service define "Scalability" , "High-Performance"
In the cloud there is notion if T_Shirt sizing . So we have a small medium large
If you still want to use your traditional approach we have bare metal servers and dedicated hosts.
Dedicated Host : You have a dedicated host where you have your own VMs and do not have VMs from another customers .
OCI is the one of the two cloud providers to provide options on processors .
We are 50% cheaper than any other cloud out there.
Not only that you can reduce your cost from more than 50 % by using Preemptible VMs buys using them .
Preemptible :
Instance Basics
The first dependency the compute host have is on VCN . In order spin up an instance you need to have a compute cloud network
You need to create before you can spin up a compute host .
Now you can spin up a Virtual Host which is physical construct , Networking is a Virtual construct . How are they related . Within a compute host you have physical a VNIC and you virtualize that card .
VNIC is placed inside the subnet .
Now there is another dependency that the compute instances have - The boot disks and the block volumes . What do they mean , each of these compute hosts that you are spinning up has an operating system and the image that is used to launch an instance determines its operating system and other software. So you have this concept of an image that comes from a network storage called a boot disk. so that it is not living on the compute host it is living somewhere on the Network .
You also have some data something like file system etc , you are working on the compute instances . They also live on the network . So there is the data disks and the operating system disks - together there is a service called block volume service that the compute host uses to run its operating system and run its data disks and these are remote storage as you can see here
There is one more feature that is really important when you are talking about compute instances . And that is live Migration. We know computers fail all the time. How do you make sure that the compute instance that you are running is always up and running.
So we have a feature called live migrate the idea here is that if one of your compute host goes down there is a , we will migrate your VM to another host in the data center . there are multiple option for you to opt-in or opt-out , so the idea is we migrate your virtual machines . You can live migrate between your host with out rebooting. This keeps you application running during maintenance events. To achieve this in your own data center is not so trivial task but we make them seemless within OCI.
Scaling :
- Verical Scaling
- Horizontal Scaling
You can scale the core, memory or you can scale other characteristics. When you are scaling up or down there is a down time required . When you instantiate it goes to somekind of another host , so there is some kind of downtime required.
There is another kind of scaling that you have which is called -- Auto-Scaling also referred to as Horizontal scaling .
You add more VMs of the same shape or you reduce the number of VMs based on their usage metrics
You have a running instance where you want to autoscale and you need to have a so you create a template - is called a config in OCI terminology . Basically like your OS image , your meta-data
You create a stamp for your running instance and the second step is you take that stamp and you you create a running instance pool. A pool is a collection of those instances in Advance .
The idea is that you can manage all those instances as one unit. You could start all of them in the same time and terminate all of them in the same time . For high availability you can put them into different availability domains .
Then you take this instance pool and then you can write this auto scaling rules on that , you start with an desired or initial size . There is a minimum size and there is a maximum size. And you write a rule if the CPU and the Memory goes beyond some threshold and goes below some threshold.
OS Management Service :
If you are a system admin you will absolutely love this service. Patching and Package Management is a complex . Sys admins automate the management of Oracle Linux and Windows server instances .
There are two main charecterstics of this service. And they are
- Automated Patch Management
- Simplified Package Management
It supports both Oracle Linux and Windows operating system .
These vulnerabilities are stored in a CVEs database , the service looks against that database and allows you to install the packages . Vulnerabilities can easily be patched . That is another feature available with software Management service. There is no charge for customers to use OS management service. Additonally if you are using Oracle Linux servers , support is also provided for no additional cost.
In this particular demo we are going to look at OCI cloud shell .
Demo : Getting Started with Cloud Shell
When you click on the Cloud shell there us an empemeral machine spin up in the background . It is used for a host for a unix shell.
Cloud shell is a browser based terminal .
Demo : Creating and Instance :
Compute Summary :
Storage Introduction :
Various storage services available within OCI , Let us look at storage requirement because they are many and varied .
You want Persistent Storage / or Non-Persistent Storage
What kind if performance do you need ? What kind of capacity do you need ?
They you need to decide on durability , how many copies of data do you want to maintain .
There is a difference between persistent and durability .
- Persistent : Means you safely store the data .
- Durability : Making multiple copies of the data
Protocol : Because this determines what kind of applications that you can build.
OCI Storage Services
- Local NVMe -- Availability Domain you have a compute server and you have a locally attached storage . When you think if NVMe - think of locally attached storage these a locally attached SSDs .
Performance sensitive application.
Block Volume :
Then we take this locally attached storage and move it to a remote server - Network server . Here we have a compute server and the storage server which is on a network.
The storage can be persistent and durable and can extend beyond the lifetime of the instance itself .
This kind of storage is called Block - volume. In this kind of storage the data is managed as fixed size blocks.
So you create a partition and you create a filesystem and you mount the file system. Thats how your compute instances use the storage service .
File Storage :
File storage is in the same Availability Domain and is a shared file storage system . You manage the storage as File and Directories . Think Shared -- Think File Storage.
Object Storage : Which is storage for the web . This kind of a storage is mainly used for Photos, Videos, Log files, text files . Any kind of files you store on the web. Typically the way it is accessed is through the internet client. Typcially you have these internet client who accesses these particular objects .
Along with that we have few data migration services
- Data Transfer Disk
- Data Transfer Appliance
- Disk is basically you send us your disks and we migrate the data
- Appliance is a much larger to send the data to us.
- Finally you have a storage Gateway , sits in your data center and using that you can migrate data to OCI .
Object Storage :
What is OCI Object storage , well that is a
 |
What are the scenarios in which you will use OCI object storage.
Anything that you store is stored as onject . Think of object as Key Value Pairs
Objects can also have its Meta-Data and you can define your own Meta-Data there .
Namespace : There is something called namespace which is a logical entity which is a Top level container for all buckets / Objects. It has to have a Gloabally Unique name.
Lets see how this work. I have a URL which is the API end point for object storage that how you access this service , remember you have a public service lets take this example which has an object which has a Notation called "o"
here I am storing log.zip which is in a bucket called "development" and there is a namespace which is depicted by account name
Tiers in Object Storage
The first tier in the Object Storage is standard tier . It is also refered to us the hot tier . Here is the place where you keep all your critical data which you want to retrieve instancetaneously. The retrieval is instantaneous and is strongly consistent . So any time you update the copy we give you the latest copy in there .
Second Tier : Infrequent Access -- 60% cheaoper than the standard Tier . It is significantly cheaper than the standard tier.
Third Tier : Archive Tier
This is for your data that you don't need right away . Think of this as Tape storage on cloud . This much more feature rich
There is something called Auto-Tearing which monitors your pattern. Lets say you have an unkown access pattern or your data access patterns keep on changing . It can move the data from standard tier to infrequent access tier and vice-versa . It can move back to standard when the objects starts getting used. There is no retrieval fees and there and using this you can significantly reduce your cost
There are other features like Life Cycle Management
It can move the data from hot tier to lower cost tiers
You can also do Version , as you are storing data there are multiple versioning and these objects are automatically versioned - You just specify that in the bucket and we take care of that .
Data Encryption :
Pre-Authenticated Request
Demo : Object Storage - Part 1
Demo : Object Storage - Part 2
Block Volume : Provides persistent and durable storage to compute instances
So the data is stored independently beyond the life cycle of the instance .
There you have large Basic Volume Tier which is good for streaming and large data warehousing
Auto Tune Performance : it changes the volume performance to lower cost when the volume is detached , when the volume is reattached the volume performance is automatically adjusted.
Keep in Mind this replication is Asyncronous. Finally we have this feature called Volume Groups
Demo : Block Volume
File Storage :
SMB : Server Messaging Block for windows . Which are the use cases where you use the File Storage
Migration Services :
Data Migration services available in OCI .
WAN - to transfer that data to Oracle cloud .
Storage Gateway service :
It is a Linux docker appliance which is installed on one of more hosts on your on-premises data center .
Storage Gateway exposes NFS mount points that can be mounted on any host that supports an NFS client. And this mount point maps to a object storage bucket on the OCI side. And it can take the data from your own premises environment.
Storage Summary :
Hands On Activity : Object Storage :
Hands On Activity : Block Storage:
8 . Database
Managed Database services you get from OCI
For one node db system OCI provides fast provisioning option that allows you to create your DB system using something called Logical Volume Manager as your storage management layer. The alternative is called Standard Provisioning - And is provisioned with Oracle Automatic Storage management system which is also know as ASM.
Autonomous databases are cloud databases that uses Machine Learning , for automating database security , tuning
There are a few Open source databases MySQL Database service is a fully managed OCI service.
Autonomous DB
Demo: Autonomous Data Warehouse :
DB Systems : These are fully feature, fully managed databases running in the cloud . The support Enterprise / Or standard edition.
Comments
Post a Comment