Narsing Shah

OCI Developer Associate — Cloud Native Study Notes

4/14/2020

Scope: These notes are based on the OCI Developer Associate Certificate Examination.

Image

Table of Contents

  1. Service Communication Types
  2. Messaging Concepts and Protocols
  3. Serialization Formats
  4. Monitoring, Alarms, and Notifications
  5. OCI Functions (Serverless)
  6. API Gateway
  7. Resource Manager and Terraform
  8. Oracle Kubernetes Engine (OKE)
  9. OCI Service Broker
  10. API, SDK, and CLI
  11. OCI Key Management (Vault)
  12. OCI Container Registry (OCIR)
  13. Testing Concepts
  14. Key Facts and Exam Questions

1. Service Communication Types

Synchronous vs. Asynchronous Communication

Type Behavior Examples
Synchronous The caller waits for a response before continuing. HTTP, HTTPS
Asynchronous The caller does not wait for a response. AMQP

Design Goal: Try to minimize dependency on synchronous communication wherever possible, as it introduces tight coupling and latency.

Communication Protocols

Protocol Description
HTTP Standard web protocol. Relatively slow due to text-based overhead.
HTTP/2 Binary format of HTTP. More efficient than HTTP/1.1.
WebSockets Part of the HTML5 specification. Enables full-duplex, persistent connections between client and server.
gRPC Remote Procedure Call framework. High-performance, binary protocol.

2. Messaging Concepts and Protocols

Core Messaging Terminology

Term Definition
Message A package of information consisting of Headers (key-value pairs and metadata) and a Body (the actual payload).
Producer The entity that sends a message.
Consumer The entity that receives a message.
Queue A communication channel that holds messages for later retrieval by one or more consumers.
Exchange A queue aggregator that routes messages to queues using predefined logic.
Message Broker The intermediary responsible for the entire messaging architecture — acts as the postman.
Publisher / Subscriber A messaging pattern where producers publish messages to a topic and consumers subscribe to receive them.

Messaging Protocols

MQTT — Message Queue Telemetry Transport

  • Binary protocol
  • Designed for slow or unreliable networks
  • Supports publish/subscribe (pub/sub) messaging

AMQP — Advanced Message Queuing Protocol

  • Binary protocol with rich features
  • More reliable and battle-tested
  • Supports publish/subscribe, routing, and security

Idempotency

Idempotent operations can be repeated multiple times without changing the result beyond the first execution.

HTTP Method Idempotent? Notes
PUT Yes Repeated calls produce the same state.
UPDATE Yes Same outcome on every call.
DELETE Yes (state) The server state does not change after the first deletion. However, subsequent calls return 404 because the resource no longer exists. The response differs, but the server state does not.

3. Serialization Formats

Serialization is a storage and transmission concept — the process of converting data into a format suitable for storage or transfer.

JSON

  • Produces larger payloads but is human-readable.
  • Compatible with a wide range of programming languages.
  • Serialization and deserialization are comparatively expensive.

Protocol Buffers (Protobuf)

  • Binary format — compact and fast.
  • Schema is defined using .proto files.
Format Type Readability Performance
JSON Text Human-readable Slower (expensive serialization)
Protobuf Binary Not human-readable Faster (compact binary)

4. Monitoring, Alarms, and Notifications

Key Monitoring Concepts

Term Definition
Metric Stream An individual set of aggregated data points for a specific metric.
Metric Namespace A category used to filter or view monitoring data. Each OCI service publishes metrics under its own namespace.
Metric Query Language (MQL) The query language used to define conditions in alarm definitions.

Alarm States

State Description
Firing The alarm condition has been met — the alarm is triggered and active.
Reset The alarm is no longer detecting the firing condition; the metric is not being emitted.
Suppressed Notifications are intentionally paused for a specified time range.

Alarm Definitions

Alarms are configured with custom parameters in the Alarm Definitions section of the OCI Console. You define the metric, threshold, and notification behavior.

Notifications

Component Description
Topic A channel for sending messages to one or more subscriptions.
Subscription An endpoint associated with a topic that receives messages.
Protocols Email or HTTPS (e.g., PagerDuty).

5. OCI Functions (Serverless)

Navigation: Burger Menu → Developer Services → Functions

Application

  • An Application is a logical grouping of functions.
  • It provides a common context for storing configuration variables that are available to all functions within the application.

Function Metrics

Metric Description
FunctionExecutionDuration Time taken to execute a function invocation.
FunctionInvocationCount Total number of times a function has been invoked.
FunctionResponseCount Total number of responses returned by a function.

Use Cases

  • Glue code between cloud services
  • Web, mobile, and IoT backends
  • Real-time streaming pipelines
  • DevOps batch processing

Example Scenarios

  • A change in a Cloud SaaS application triggers an update in a Cloud PaaS service.
  • Event-driven architectures — functions react to events such as object creation or DB changes.
  • Automate corporate security actions — for example, applying patches or running scripts when new instances are launched.
  • Network security analysis — sending logs to Splunk or other log analyzer tools.
  • Automate database environment setup.

Demo Workflow

  1. Launch a compute instance.
  2. A Function is invoked to create an Object Storage bucket.
  3. Destroy the instance.
  4. A Function is invoked to destroy the Object Storage bucket.

Microservices Context

Concept Description
Stateful The service retains session or transaction state between requests.
Stateless The service does not retain state — each request is independent.
Microservices Architectures built from smaller, independently deployable codebases.
Defense in Depth A layered security approach applied at: source code → container image → container registry → pods → cluster.

6. API Gateway

Where API Gateway Is Useful

  • Expose RESTful APIs for OCI Functions
  • Build APIs for custom application development
  • Protect and proxy SaaS services

Key Features

Feature Description
Fully Oracle Managed No infrastructure to manage.
Authentication Built-in authentication support.
Metrics Visibility into API usage and performance.
Routing Route traffic to different backends based on rules.
Rate Limiting Control the number of requests per client or endpoint.
CORS Cross-Origin Resource Sharing support.
Terraform Support Can be provisioned and managed via Terraform.

Setup Notes

  • Create a regional public subnet with an ingress rule for HTTPS traffic on port 443.
  • Create a dynamic group to allow the API Gateway to invoke Functions.
  • Refer to IAM policies for the required permission statements.

7. Resource Manager and Terraform

Resource Manager is the OCI-native service for managing infrastructure using Terraform. It is a free service.

Two Core Components

Component Description
Stack A set of resources you want to create in a compartment, defined by Terraform .tf files.
Job An operation executed against a Stack. Options: Plan, Apply, Destroy.

8. Oracle Kubernetes Engine (OKE)

Navigation: Burger Menu → Developer Services → Kubernetes Clusters (OKE)

Pricing

Component Cost
OKE (management plane) Free
OCIR (container registry) Free
OCI Resources (VMs, storage, load balancers) Pay only for the OCI resources used to run your cluster

Required IAM Policy

allow service OKE to manage all-resources in tenancy

Supported Versions

  • 13.5
  • 12.7

Cluster Creation Steps

  1. Provide a cluster name.
  2. Choose the Kubernetes version.
  3. Select Quick Create or Custom Create.
  4. Choose the VCN and subnet.
  5. Choose the compute shape for worker nodes.
  6. Specify the number of nodes.
  7. Add an SSH public key.
  8. Optionally add labels to nodes.

Optional Add-Ons:

  • Kubernetes Dashboard
  • Tiller (Helm enabled)

Clicking Create provisions 3 worker nodes across 3 Availability Domains.

Post-Creation Setup (Quick Start Guide)

  1. Ensure the OCI CLI is installed on your local system.
  2. Save the kubeconfig file to ~/.kube/config on your local machine.
  3. Ensure kubectl is installed.
  4. Create a ClusterRoleBinding to grant dashboard admin access (the oke-admin service account will be bound to the cluster role).
  5. Copy the authentication token shown in the console.
  6. Open the dashboard URL in a browser and paste the token to log in.
  7. You can now manage your OKE cluster using the Kubernetes Dashboard.

9. OCI Service Broker

The OCI Service Broker is software that implements the Open Service Broker API.

Key Characteristics

  • Enables Lifecycle Management (LCM) of OCI services through DevOps tooling.
  • Is cloud-specific — available for OCI environments.
  • Can be downloaded from open source and deployed into a Kubernetes cluster.
  • Once installed, use kubectl to provision and bind OCI services (such as Autonomous Database) to your applications.

Important Limitations

  • You can update existing OCI services (e.g., ATP configurations) using the Service Broker.
  • You cannot delete, add, or significantly reconfigure existing OCI services through the Service Broker alone.
  • To perform those operations, you must configure the Service Broker from the beginning.

10. API, SDK, and CLI

Methods to Connect to OCI

Method Notes
Console Web-based UI.
CLI Command-line interface.
APIs Use HTTPS.
SDK Available for Java, Ruby, Python, Go.
Toolkit for Eclipse IDE plugin.
HDFS Connector for Object Storage Connects Hadoop-based workloads to OCI Object Storage.
Terraform Infrastructure as Code.
Ansible Configuration management and automation.
Resource Manager OCI-native Terraform service.

CLI Configuration

During setup, you will be prompted to provide:

  1. Config file location
  2. User OCID
  3. Tenancy OCID
  4. Region

To verify OCI CLI connectivity:

oci os ns get

SDK Authentication Methods

Method Description
Instance Principal Authenticates using the identity of the compute instance itself.
Security Token Token-based authentication.
Resource Principal Authenticates using the identity of an OCI resource (e.g., a Function).
OCI CLI Config File Uses the local ~/.oci/config file credentials.

Note: There is no Service Principal in OCI SDK authentication.

11. OCI Key Management (Vault)

Navigation: Burger Menu → Security → Vaults

Overview

OCI Key Management provides centralized key management capabilities backed by Hardware Security Modules (HSM).

Attribute Detail
HSM Standard FIPS 140-2 Level 3
Isolation Each customer gets isolated partitions within the HSM
Audit Key Lifecycle Management (LCM) events can be monitored using the OCI Audit service

Creating a Vault and Keys

Step 1 — Create a Vault:

  • Navigate to Burger Menu → Security → Vaults
  • Create a new Vault and then open the Vault details page

Step 2 — Create a Key:

Setting Options
Name and Compartment Provide a name and select the target compartment
Key Shape Algorithm Choose the encryption algorithm
Key Shape Length 128, 192, or 256 bits

Key Rotation

The Rotate Key button generates a new version of the key for the same resource. This is similar to rotating passwords periodically (e.g., every quarter).

Vaults

  • Vaults are logical entities where keys are created and stored on HSM with isolated partitions per customer.
  • The compartment used for key management should be separate from other resource compartments.

IAM Policies Required

After creating keys, write the following policies:

  • One policy for Vault Administrators
  • One or more policies for Key Administrators
  • Policies for OCI services that need to use the keys

Important Notes

  • Keys can be disabled but cannot be deleted.
  • Vaults can be deleted.
  • You can define who can access, manage, and delete keys using IAM policies.
  • Pricing: Charged hourly per Virtual Private Vault; billed at the end of the month.
  • There is no limit on the number of keys you can create within a vault.

12. OCI Container Registry (OCIR)

Navigation: Burger Menu → Developer Services → Container Registry

OCIR is a highly available Docker v2 container registry service managed by Oracle.

Creating a Repository

  1. Navigate to Container Registry and create a new repository.
  2. Choose Private visibility (can be changed to Public later via Actions menu).
  3. Available actions: Change to Public or Delete.

Pulling Images into OKE

Step 1: Create a Docker auth token from the OCI Console.

Step 2: Create a Docker registry secret in Kubernetes using kubectl:

kubectl create secret docker-registry <secret-name> ...

Step 3: Reference the secret in your YAML manifest to pull images from the repository:

kubectl create -f nginx.yaml

Image Retention Policies

Navigation: Burger Menu → Developer Services → Container Registry → Settings

  • The Image Retention Policies window allows you to control which images are kept and for how long.
  • You can edit the global retention policy or create custom policies per repository.

13. Testing Concepts

Test Doubles

Type Description
Mock An object that validates the calls it receives — used to verify behavior.
Fake A working implementation that takes shortcuts not suitable for production (e.g., an in-memory database).
Stub An object that returns pre-populated, hardcoded data in response to calls.

Test Automation Pyramid

The pyramid represents the recommended distribution of test types — more tests at the bottom, fewer at the top:

         ┌───────────┐
         │    UI     │  ← Fewer tests, slower, more expensive
         ├───────────┤
         │ Component │
         ├───────────┤
         │   Unit    │  ← More tests, faster, cheaper
         └───────────┘

Building Blocks of Testing

Level Description
Unit Tests Test individual functions or methods in isolation.
Service / Component Tests Test interactions between components or services.
UI Tests Test the full application through the user interface.

Canary Testing

Canary Testing is the practice of releasing a code change to a small subset of users and observing how the new code performs relative to the existing version still used by the majority.

  • Users are unaware that they are receiving the new code.
  • Implemented by routing a portion of traffic to dedicated Canary servers or containers running the updated release.

14. Key Facts and Exam Questions

# Question / Topic Answer
1 Maximum Function execution timeout 120 seconds
2 Maximum memory per Function 1 GB
3 OCI Functions process user Functions run using the fn user with no added privileges
4 API Gateway path routing Create a deployment and add path parameters and wildcards to route paths
5 Injecting config before pod creation Use a Pod Preset to define config outside of the pod spec
6 Bulkhead design pattern Ensures that excessive load or failure in one service does not impact all other services
7 Maintaining desired replica state during rolling updates Apply maxSurge and maxUnavailable parameters in the deployment spec
8 OCI SDK authentication methods Instance Principal, Security Token, Resource Principal, OCI CLI Config File
9 OCIR access requirement You must have an OCI username and auth token
10 Resource Principal vs Service Principal Resource Principal exists; there is no Service Principal in OCI

End of OCI Developer Associate — Cloud Native Study Notes