Narsing Shah

OCI Operations Associate — Study Notes

5/4/2020

Scope: These notes are based on the OCI Operations Associate Certificate Examination.

Image

OCI Operations Associate — Study Notes

Scope: These notes are based on the OCI Operations Associate Certificate Examination.

Table of Contents

  1. Infrastructure as Code (IaC) & Configuration Management
  2. OCI CLI & Environment Setup
  3. Terraform & OCI Resource Manager
  4. Ansible in OCI
  5. Data Backup Operations
  6. Storage Encryption
  7. Monitoring & Troubleshooting
  8. Network Connectivity & Third-Party Integration
  9. Key Quick-Reference Facts

1. Infrastructure as Code (IaC) & Configuration Management

Core Concepts

  • Infrastructure as Code (IaC): The process of managing and provisioning cloud resources and services through machine-readable definition files rather than physical hardware configuration or interactive user interface tools. Explanation: Instead of manually clicking buttons in a web console, you write code files to define your infrastructure, making it repeatable, versionable, and less error-prone.
  • Idempotency: A property where a change or action is not applied more than once, meaning repeated operations yield the same result without unintended side effects. Explanation: If you run an idempotent script ten times, it will only make changes the first time (if changes are needed) and do nothing on the next nine runs, avoiding resource duplication.
  • Immutable Infrastructure: An infrastructure paradigm where resources or services are never modified in place after deployment. Explanation: Instead of logging into an active server to upgrade software, you build a new server from an updated image and terminate the old one, preventing configuration drift.
  • Mutable Infrastructure: An infrastructure paradigm where resources are modified in place after deployment. Explanation: Servers are updated directly using configuration management tools or manual commands, which can sometimes lead to differences between servers over time.

Tool Comparison Matrix

Property OCI CLI Chef Ansible Terraform
Type CLI Tool Configuration Management Configuration Management Orchestration Tool
Task Command Execution Config Management Config Management + Orchestration Provisioning / Infrastructure
Infrastructure Mutable Mutable Mutable Immutable
Idempotency No Yes Yes (sometimes) Yes
Code Type Bash / PowerShell Ruby YAML HCL / JSON
Method Procedural Procedural Procedural Declarative
Architecture Client-Only Client-Server Client-Only (Agentless) Client-Only

2. OCI CLI & Environment Setup

OCI CLI Configuration (oci_cli_rc)

  • Definition: The oci_cli_rc file is used to write shortcuts, aliases, and default parameters for your OCI command-line interface. Explanation: It acts similarly to a shell .bashrc or .zshrc file, allowing you to define command aliases and avoid typing long parameters every time.

Setup Steps using Oracle Developer Image

  1. Generate SSH Keys: Create a public/private SSH key pair on your local machine (e.g., using Git Bash).
  2. Launch Developer Instance: Create a compute instance using the Oracle Developer Image.
  3. Upload Public Key: During instance creation, upload your public SSH key to the OCI console so that the instance trusts your system.
  4. Access the Instance: Log into the newly created virtual machine using your private key: 
    ssh -i /path/to/private.key opc@<instance-public-ip>
  5. Verify Pre-installed CLI: The OCI CLI is pre-installed on the developer image. Check its version: 
    oci -v
  6. Configure OCI CLI: Initialize the CLI configuration using: 
    oci setup config
    • Accept the default file location.
    • User OCID: Copy the User OCID from the OCI Console (IAM -> Users) and paste it.
    • Tenancy OCID: Copy the Tenancy OCID from the user profile icon.
    • Region: Enter your target region.
    • Generate API Keys: Select yes to generate a new API RSA key pair.
    • Specify the key generation location and key name (leave passphrase empty by hitting enter).
    • Add Public Key to Profile: Copy the newly generated public API key, go to your OCI profile page, click Add Public Key under the API Keys tab, and paste it.

OCI CLI Usage Examples

# Set compartment ID environment variable for ease of use
export cid="<compartment_ocid>"

# List VCNs inside a specific compartment
oci network vcn list --compartment-id $cid

# Create a VCN with a CIDR block and DNS label
oci network vcn create --cidr-block 192.168.0.0/16 -c $cid --display-name CLI-Demo-VCN --dns-label clidemovcn

# Create a subnet within a VCN
oci network subnet create --cidr-block 192.168.10.0/24 -c $cid --vcn-id <vcn_ocid> --security-list-ids '["<security_list_ocid>"]'

# Create an Internet Gateway and enable it
oci network internet-gateway create -c $cid --is-enabled true --vcn-id <vcn_ocid> --display-name DEMOIGW

# Update a route table to direct internet traffic (0.0.0.0/0) through the Internet Gateway
oci network route-table update --rt-id <route_table_ocid> --route-rules '[{"cidrBlock":"0.0.0.0/0","networkEntityId":"<igw_ocid>"}]'

# Query and list Oracle-provided compute images in the compartment
oci compute image list --compartment-id $cid --query 'data[?contains("display-name", `Oracle`)]|[0:1].["display-name", id]'

# Launch a compute instance in a specific availability domain with a public IP assigned
oci compute instance launch --availability-domain us-phx-ad1 --display-name demo-instance --image-id <image_ocid> --subnet-id <subnet_ocid> --shape VM.Standard2.1 --compartment-id $cid --assign-public-ip true --metadata '{"ssh_authorized_keys": "<public_key_string>"}'

# Check the lifecycle state of a compute instance (e.g., returns "RUNNING")
oci compute instance get --instance-id <instance_ocid> --query 'data."lifecycle-state"'

3. Terraform & OCI Resource Manager

Key Terraform Features

  • Target Option (-target): Used on both plan and apply commands to run actions against a specific resource instead of the entire configuration. Explanation: If you only want to update one user or virtual machine out of hundreds in your configuration, targeting limits Terraform’s actions to that resource.
    • Example: terraform plan -target=oci_identity_user.narsing
    • You can specify multiple targets in a single command.
    • If the target resource already exists and is unmodified, the output is null.
  • Taint (terraform taint): Used to mark a resource as degraded or damaged, forcing it to be destroyed and recreated on the next apply. Explanation: It instructs Terraform to replace a specific resource without altering the rest of your infrastructure.
  • Remote Backend: Configuration setting that stores the Terraform state file in a remote directory (e.g., OCI Object Storage) rather than locally. Explanation: Storing state remotely prevents conflicts when multiple team members manage the same infrastructure.
  • ignore_changes Parameter: A lifecycle block parameter in configuration files that instructs Terraform to ignore updates to specific resource attributes during execution. Explanation: It prevents Terraform from overwriting changes made directly in OCI (like manual size adjustments) on subsequent runs.

OCI Resource Manager (RM)

Resource Manager is an OCI-native service that automates the deployment of Terraform stacks. It is a free service.

  • No Credentials Needed: Permissions are controlled directly by OCI IAM policies; there is no need to hardcode OCI credentials in your code.
  • Formats Accepted: Accepts configurations as a JSON file or a compressed Terraform zip file.
  • Execution Constraints: You can run only one job at a time per stack.

Core Components

Component Description
Stack A logical set of OCI resources defined by Terraform .tf files that you want to create and manage in a compartment.
Job An operation executed against a Stack. The supported job types are: Plan, Apply, and Destroy.

Variable Management in stacks

  • You can input input variables in the Resource Manager stack UI.
  • These variables persist until you manually change them in the console or upload a new Terraform configuration that changes them.

Terraform Best Practices in OCI

  1. Use OCI Object Storage buckets for remote state management.
  2. Use lower_snake_case naming conventions for resources.
  3. Do not check state files into version control systems (add them to your .gitignore file).

4. Ansible in OCI

Ansible is a procedural configuration management and orchestration tool used to configure systems and deploy applications.

Key Behaviors & Configuration

  • Procedural Method: Ansible executes tasks sequentially in the order they are written.
  • Agentless/Client-Only Architecture: Executes shell commands on remote hosts over SSH without requiring agent software on target servers.
  • Credential Handling: Requires a valid OCI IAM user with an API signing key. By default, it looks for the OCI CLI config file located at ~/.oci/config.
  • Host Key Checking: Enabled by default. You can disable it permanently inside the ansible.cfg file by setting: 
    host_key_checking = false
    To disable it temporarily for a session, export the environment variable: 
    export ANSIBLE_HOST_KEY_CHECKING=false
  • Temporary SSH Keys: Ansible generates a temporary, host-specific SSH key pair during resource creation to communicate with OCI resources.

Ansible Capabilities

  • Create, modify, and destroy OCI resources such as compute instances, subnets, and Load Balancers.
  • Execute shell commands across a group of remote hosts.
  • Perform administration tasks, such as restarting Apache HTTP server on all web hosts defined in an inventory file.

5. Data Backup Operations

Object Storage Lifecycle Management

  • Purpose: Automates data archiving and deletion to optimize storage costs. Explanation: Rules automatically move old data to cheaper tiers or clean up logs after a defined period.
  • Scope: Applied at either the bucket level or matching specific object name prefixes. If no prefix is specified, the lifecycle rule applies to all objects in the bucket.
  • Priority: A rule that deletes an object always takes priority over a rule that archives the same object.
  • Status: Rules can be set to active or inactive by enabling or disabling them.

Autonomous Database (ADW & ATP) Backups

  1. Automatic Backups: OCI automatically performs backups to Oracle-owned object storage. The backup retention period is 60 days.
  2. Manual Backups: Customer-initiated backups to customer-owned Object Storage buckets.

DB Systems Backup and Restore

Restore Targets

  • Restore to the latest: Restores the database to the most recent backup point.
  • Restore to timestamp: Restores the database to a specific date and time.
  • Restore to System Change Number (SCN): Restores to a precise logical point in database transaction history.

Auto-Backup Characteristics

  • Written to Oracle-owned object storage by default (backups are not visible in the customer’s Object Storage console).
  • The auto-backup policy and backup windows are defined by Oracle and cannot be modified at this time.
  • Backup window runs daily between midnight and 6:00 AM in the database system’s regional time zone.
  • Backup jobs are designed with automatic retry logic.
  • Oracle is automatically notified if a backup job gets stuck.
  • All cloud database backups are fully encrypted.

OCI Storage Gateway (SGW)

  • Purpose: Connects on-premises systems with OCI Object Storage using files, bridging local file systems with cloud storage. Explanation: It acts as a local network share that writes data directly to OCI buckets in the background.
  • Use Cases: Hybrid cloud scenarios, one-time data migrations, and backup consolidation.
  • Cloud Sync Feature: Syncs data from local on-premises Network Attached Storage (NAS) to the Storage Gateway.

6. Storage Encryption

Block Storage & Remote Boot Volumes

  • Encryption at Rest: Volumes and backups are encrypted at rest using AES 256-bit keys managed by Oracle.
  • Data in Transit: Data moving between compute instances and block volumes is transferred over a secure internal network. Optional in-transit encryption can be enabled when using paravirtualized volume attachments.

Object Storage

  • Encryption: Supports client-side encryption using customer-managed keys. By default, data is encrypted using per-object keys managed by Oracle.
  • Transport Security: All traffic to and from the Object Storage service is encrypted using Transport Layer Security (TLS).
  • Integrity: Employs object integrity verification checks.

File System Storage (FSS)

  • Encryption: Data is encrypted at rest, and encryption is active between backend NFS servers and storage servers.

Data Transfer Service (DTS)

  • Encryption: Uses standard Linux utilities dm-crypt and LUKS to encrypt physical block devices before shipment.

Key Management Security Standard

  • OCI Vault keys are FIPS 140-2 Security Level 3 certified, verifying hardware-level cryptographic isolation.

7. Monitoring & Troubleshooting

Troubleshooting Sequence

When resolving service issues, engineers should investigate layers in the following order:

  1. Identity & Access Management (IAM): Check policies and permissions.
  2. Monitoring Query Language (MQL): Query metrics to analyze behavior.

Metric Data Components

A metric in OCI consists of the following components:

  • Namespace: The source service or application that emits the metric (e.g., oci_computeagent, oci_blockstore).
  • Dimension: A key-value pair qualifier used for filtering (e.g., resourceId).
  • Metadata: Additional attributes about the metric, such as its measurement units (e.g., bytes, count).

Alarm Attributes

Alarms use the following configurations to trigger alerts:

  • Namespace
  • Compartment ID
  • Severity level

Log Retention

  • OCI logging services support log retention periods of up to 365 days.

8. Network Connectivity & Third-Party Integration

Hybrid Network Connectivity Options

Option Protocol / Routing Details
VPN Connect BGP Dynamic Routing Uses multiple redundant IPSec tunnels with Border Gateway Protocol (BGP).
VPN Connect Static Routing Uses multiple redundant IPSec tunnels with static routes.
FastConnect BGP Dynamic Routing Dedicated physical connection using BGP routing.
FastConnect + VPN Hybrid Routing FastConnect using BGP dynamic routing combined with a backup VPN Connect using static routing.

Note: You cannot use FastConnect with static routing. It requires BGP dynamic routing.

Chef Integration

  • The knife-oci plugin allows users to interact with OCI services through Chef’s command-line tool knife.

9. Key Quick-Reference Facts

  • Docker CLI Access: Access requires generating an Auth Token in the OCI IAM console.
  • Resource Manager Limits: You can only execute one job at a time per stack.
  • Resource Manager Scripts: Resource Manager allows you to execute scripts or commands on a computer instance.
  • Ansible Credentials: Ansible looks for credentials in the OCI CLI config file located at ~/.oci/config.
  • Compartment Policies: Compartment-level security policies govern access to Resource Manager reading jobs.
  • Monitoring Access Policy: To allow a group to view and retrieve metrics only for all monitoring-enabled compute instances, write the following policy: 
    allow group cloudops to read metrics in tenancy where target.metrics.namespace='oci_computeagent'

End of OCI Operations Associate Study Notes