JNCIE-Cloud cheat sheet

NIST service models: IaaS delivers compute/storage/network; PaaS adds runtime and middleware; SaaS delivers the application; control shifts to the provider as you move IaaS→SaaS.

NIST deployment models: private (single organization), public (provider-owned, multi-tenant), community (shared by organizations with common concerns), hybrid (two or more bound by standardized technology enabling data/app portability).

Essential characteristics (NIST): on-demand self-service, broad network access, resource pooling, rapid elasticity, measured service - all five must hold for a cloud.

Five pillars of cloud-native networking: automation, elasticity, multi-tenancy isolation, service abstraction, and observability; Juniper frames intent-driven networking around these.

CAP theorem: under a network partition a distributed system chooses consistency or availability; most cloud control planes (OpenStack, Kubernetes) favor availability with eventual consistency.

Shared responsibility split: provider secures physical hosts, hypervisor, and facility; tenant secures guest OS, workloads, identities, and overlay network policy - the boundary sits at the hypervisor or container runtime.

SLA math: 99.9% allows ~43.2 min downtime/month, 99.95% ~21.6 min, 99.99% ~4.32 min; availability of serial components multiplies (0.999 × 0.999 ≈ 99.8%).

Elasticity vs scalability: scalability is capacity to grow; elasticity is automatic, rapid scale out/in matching demand, including returning resources - billing and licensing follow the elastic model.

ETSI NFV MANO: NFVO (orchestrates network services across VIMs), VNFM (lifecycle of VNF instances), VIM (virtualized compute/storage/network resources); Os-Ma and Ve-Vnfm reference points connect them.

ETSI NFV architecture elements: VNF, EMS, NFVI (hardware plus virtualization layer), and MANO; the NFVI-PoP is where VNFs actually run.

SDN planes: data plane forwards, control plane computes paths, management plane configures; SDN centralizes control and exposes it via a southbound API such as OpenFlow or NETCONF.

Overlay vs underlay: VXLAN, GRE, and MPLS overlays tunnel tenant traffic over an IP underlay; EVPN is the common control plane for VXLAN data planes, replacing flood-and-learn.

VXLAN facts: 24-bit VNI (~16M segments), 8-byte header, 50-byte outer overhead with IPv4/UDP; default destination UDP port 4789.

DPDK and SR-IOV bypass the kernel data path: DPDK polls in user space; SR-IOV presents virtual functions directly to the VM, trading live migration flexibility for line-rate performance.

Service chaining steers traffic through an ordered VNF set (firewall → NAT → DPI) using policy-based routing, NSH service function paths, or OpenFlow rules on a virtual switch.

Contrail/Tungsten Fabric and VMware NSX are controller-based SDN overlays that program vRouters or vSwitches via XMPP, BGP, or proprietary APIs and integrate with OpenStack Neutron as the ML2 backend.

Tenant isolation primitives: VLAN (12-bit ID, 4094 usable), VXLAN VNI (24-bit), and GENEVE (24-bit, extensible TLV options); VLANs are limited to ~4K per L2 domain.

EVPN route types: Type 2 MAC/IP advertisement, Type 3 inclusive multicast (BUM handling), Type 5 IP prefix; Type 1 is Ethernet auto-discovery/aliasing.

Routing in the overlay: centralized (all inter-subnet traffic hairpins to a gateway) vs distributed (each hypervisor routes locally, gateway MAC/IP anycast across VTEPs).

Virtual routing instances: VRF provides per-tenant routing tables; VXLAN VNI maps to a bridge domain, and the VRF holds the IRB interfaces for inter-VNI routing.

MTU planning: VXLAN adds 50 bytes (IPv4) or 70 bytes (IPv6); underlay MTU must be ≥ 1550 for standard 1500-byte tenant frames, or fragmentation/PMTUD failure results.

BUM traffic replication modes: head-end replication (ingress VTEP unicasts copies) vs multicast underlay groups; EVPN Type 3 replaces both with ingress replication lists.

Distributed firewall and microsegmentation apply policy at the vNIC using security groups, NSX distributed firewall, or Kubernetes NetworkPolicy - enforcement point moves from appliance to hypervisor.

MAC learning scale: hardware VTEPs learn remote MACs from EVPN control plane, not data-plane flooding; this removes unknown-unicast flooding and speeds convergence.

Hypervisor types: Type 1 (bare metal: ESXi, KVM, Xen) runs on hardware; Type 2 (hosted: VirtualBox) runs atop an OS; cloud providers use Type 1.

KVM is a Linux kernel module exposing /dev/kvm; QEMU emulates devices and libvirt is the management API - the trio is the standard open-source compute stack.

virtio paravirtualized drivers (net, blk, scsi) outperform emulated e1000/IDE devices; vhost-net moves the data plane into the kernel for lower latency.

CPU overcommit ratios: typical 1:4 to 1:8 vCPU:pCPU for general workloads; memory overcommit relies on ballooning, KSM page dedup, and swap - never for latency-sensitive VNFs.

Live migration pre-copy copies RAM while the VM runs, then stops-and-copies; shared storage (NFS, Ceph, iSCSI) avoids disk copy; post-copy trades performance for bounded downtime.

NUMA and CPU pinning: host-passthrough CPU mode plus vCPU pinning and hugepages are required to meet NFV performance; emulated CPU models disable features the guest needs.

Snapshot semantics: snapshots capture disk state (and optionally memory); they are not backups and degrade performance as chains grow - flatten or delete after use.

Storage backends: Ceph RBD provides replicated block storage over the network; local ephemeral disks are fastest but lost on instance deletion; image vs flavor determines root disk size.

Core services: Nova (compute), Neutron (networking), Cinder (block storage), Glance (images), Keystone (identity), Swift (object storage), Heat (orchestration), Placement (resource inventory).

Neutron abstractions: network → subnet → port; routers connect subnets; security groups are stateful per-port firewalls; ML2 drivers (OVS, Linux bridge, Contrail) implement the data plane.

Provider vs tenant networks: provider networks map to a physical VLAN/segment and are admin-created; tenant networks are self-service overlays (VXLAN/GRE) unless the operator restricts them.

Keystone v3: domains → projects → users → roles; a scoped token carries a project and role; service catalog endpoints are per-region and per-interface (public/internal/admin).

Nova scheduling: filters (availability zone, host aggregate, affinity/anti-affinity, PCI passthrough) plus weighers; Placement tracks resource providers, inventories, and allocations.

Heat templates (HOT) declare resources, parameters, and outputs; stacks support update with rollback; OS::Neutron::Port and OS::Nova::Server are the common building blocks.

CLI workflow: source openrc → openstack token issue → openstack server create --image --flavor --nic net-id=... → openstack floating ip create/associate for external reachability.

Troubleshooting order: nova service-list and nova-compute logs → neutron agent-list and OVS flows → rabbitmq queue depth → cinder/glance API logs; most failures are messaging or quota.

Control plane: kube-apiserver (only component talking to etcd), etcd (cluster state), kube-scheduler (binds pods to nodes), kube-controller-manager (reconciliation loops); nodes run kubelet and kube-proxy.

Pod networking model: every pod gets a unique routable IP, containers in a pod share the network namespace and localhost; CNI plugins (Calico, Cilium, Flannel) implement it.

Services: ClusterIP (virtual IP via iptables/IPVS rules), NodePort (30000-32767 on every node), LoadBalancer (cloud LB integration), ExternalName (DNS CNAME); kube-proxy programs the rules.

Workload objects: Deployment (stateless, rolling updates), StatefulSet (stable identity and PVC per replica), DaemonSet (one pod per node), Job/CronJob (run to completion).

NetworkPolicy is namespaced and additive: default-allow unless a policy selects the pod; requires a CNI that enforces it (Calico, Cilium); egress rules need explicit egress policyTypes.

RBAC: Role/RoleBinding are namespaced, ClusterRole/ClusterRoleBinding are cluster-wide; verbs (get, list, watch, create, delete) on resources; service accounts get tokens mounted into pods.

Scheduling controls: nodeSelector (exact label match), affinity/anti-affinity (required vs preferred), taints (NoSchedule, PreferNoSchedule, NoExecute) and tolerations; resource requests drive the scheduler.

Debugging sequence: kubectl get pods -o wide → describe pod (events) → logs --previous → exec/nsenter → coredns and kube-proxy checks; CrashLoopBackOff usually means app exit or failed probe.

OpenShift is Kubernetes plus: integrated registry, router (HAProxy Ingress), build system (BuildConfig/S2I), templates, OAuth, and Security Context Constraints.

SCCs restrict pod capabilities, host networking, hostPath, and privileged mode; the default restricted SCC runs containers as arbitrary non-root UIDs from the namespace range.

Routes vs Ingress: a Route is an OpenShift object exposing a service via the router with edge, passthrough, or re-encrypt TLS; Ingress objects are translated into Routes.

oc CLI mirrors kubectl and adds oc new-app, oc new-project, oc adm, oc debug (runs a pod with the node's tooling), oc rsync, and oc rollout.

Projects are Kubernetes namespaces with annotations, RBAC, and quota; oc new-project creates the namespace and switches context; oc projects lists membership.

Operators extend the API with CRDs and controllers; OLM (Operator Lifecycle Manager) installs and upgrades them; ClusterVersionOperator manages cluster upgrades.

Networking: OVN-Kubernetes or OpenShift SDN provides pod network and NetworkPolicy; the ingress controller runs in openshift-ingress; the internal registry lives in openshift-image-registry.

Build strategies: Source-to-Image (S2I), Dockerfile, and Jenkins pipeline; ImageStreams and ImageStreamTags track image changes and trigger deployments when tags update.

NIST service models: IaaS delivers compute/storage/network; PaaS adds runtime and middleware; SaaS delivers the application; control shifts to the provider as you move IaaS→SaaS.

NIST deployment models: private (single organization), public (provider-owned, multi-tenant), community (shared by organizations with common concerns), hybrid (two or more bound by standardized technology enabling data/app portability).

Essential characteristics (NIST): on-demand self-service, broad network access, resource pooling, rapid elasticity, measured service - all five must hold for a cloud.

Five pillars of cloud-native networking: automation, elasticity, multi-tenancy isolation, service abstraction, and observability; Juniper frames intent-driven networking around these.

CAP theorem: under a network partition a distributed system chooses consistency or availability; most cloud control planes (OpenStack, Kubernetes) favor availability with eventual consistency.

Shared responsibility split: provider secures physical hosts, hypervisor, and facility; tenant secures guest OS, workloads, identities, and overlay network policy - the boundary sits at the hypervisor or container runtime.

SLA math: 99.9% allows ~43.2 min downtime/month, 99.95% ~21.6 min, 99.99% ~4.32 min; availability of serial components multiplies (0.999 × 0.999 ≈ 99.8%).

Elasticity vs scalability: scalability is capacity to grow; elasticity is automatic, rapid scale out/in matching demand, including returning resources - billing and licensing follow the elastic model.

ETSI NFV MANO: NFVO (orchestrates network services across VIMs), VNFM (lifecycle of VNF instances), VIM (virtualized compute/storage/network resources); Os-Ma and Ve-Vnfm reference points connect them.

ETSI NFV architecture elements: VNF, EMS, NFVI (hardware plus virtualization layer), and MANO; the NFVI-PoP is where VNFs actually run.

SDN planes: data plane forwards, control plane computes paths, management plane configures; SDN centralizes control and exposes it via a southbound API such as OpenFlow or NETCONF.

Overlay vs underlay: VXLAN, GRE, and MPLS overlays tunnel tenant traffic over an IP underlay; EVPN is the common control plane for VXLAN data planes, replacing flood-and-learn.

VXLAN facts: 24-bit VNI (~16M segments), 8-byte header, 50-byte outer overhead with IPv4/UDP; default destination UDP port 4789.

DPDK and SR-IOV bypass the kernel data path: DPDK polls in user space; SR-IOV presents virtual functions directly to the VM, trading live migration flexibility for line-rate performance.

Service chaining steers traffic through an ordered VNF set (firewall → NAT → DPI) using policy-based routing, NSH service function paths, or OpenFlow rules on a virtual switch.

Contrail/Tungsten Fabric and VMware NSX are controller-based SDN overlays that program vRouters or vSwitches via XMPP, BGP, or proprietary APIs and integrate with OpenStack Neutron as the ML2 backend.

Tenant isolation primitives: VLAN (12-bit ID, 4094 usable), VXLAN VNI (24-bit), and GENEVE (24-bit, extensible TLV options); VLANs are limited to ~4K per L2 domain.

EVPN route types: Type 2 MAC/IP advertisement, Type 3 inclusive multicast (BUM handling), Type 5 IP prefix; Type 1 is Ethernet auto-discovery/aliasing.

Routing in the overlay: centralized (all inter-subnet traffic hairpins to a gateway) vs distributed (each hypervisor routes locally, gateway MAC/IP anycast across VTEPs).

Virtual routing instances: VRF provides per-tenant routing tables; VXLAN VNI maps to a bridge domain, and the VRF holds the IRB interfaces for inter-VNI routing.

MTU planning: VXLAN adds 50 bytes (IPv4) or 70 bytes (IPv6); underlay MTU must be ≥ 1550 for standard 1500-byte tenant frames, or fragmentation/PMTUD failure results.

BUM traffic replication modes: head-end replication (ingress VTEP unicasts copies) vs multicast underlay groups; EVPN Type 3 replaces both with ingress replication lists.

Distributed firewall and microsegmentation apply policy at the vNIC using security groups, NSX distributed firewall, or Kubernetes NetworkPolicy - enforcement point moves from appliance to hypervisor.

MAC learning scale: hardware VTEPs learn remote MACs from EVPN control plane, not data-plane flooding; this removes unknown-unicast flooding and speeds convergence.

Hypervisor types: Type 1 (bare metal: ESXi, KVM, Xen) runs on hardware; Type 2 (hosted: VirtualBox) runs atop an OS; cloud providers use Type 1.

KVM is a Linux kernel module exposing /dev/kvm; QEMU emulates devices and libvirt is the management API - the trio is the standard open-source compute stack.

virtio paravirtualized drivers (net, blk, scsi) outperform emulated e1000/IDE devices; vhost-net moves the data plane into the kernel for lower latency.

CPU overcommit ratios: typical 1:4 to 1:8 vCPU:pCPU for general workloads; memory overcommit relies on ballooning, KSM page dedup, and swap - never for latency-sensitive VNFs.

Live migration pre-copy copies RAM while the VM runs, then stops-and-copies; shared storage (NFS, Ceph, iSCSI) avoids disk copy; post-copy trades performance for bounded downtime.

NUMA and CPU pinning: host-passthrough CPU mode plus vCPU pinning and hugepages are required to meet NFV performance; emulated CPU models disable features the guest needs.

Snapshot semantics: snapshots capture disk state (and optionally memory); they are not backups and degrade performance as chains grow - flatten or delete after use.

Storage backends: Ceph RBD provides replicated block storage over the network; local ephemeral disks are fastest but lost on instance deletion; image vs flavor determines root disk size.

Core services: Nova (compute), Neutron (networking), Cinder (block storage), Glance (images), Keystone (identity), Swift (object storage), Heat (orchestration), Placement (resource inventory).

Neutron abstractions: network → subnet → port; routers connect subnets; security groups are stateful per-port firewalls; ML2 drivers (OVS, Linux bridge, Contrail) implement the data plane.

Provider vs tenant networks: provider networks map to a physical VLAN/segment and are admin-created; tenant networks are self-service overlays (VXLAN/GRE) unless the operator restricts them.

Keystone v3: domains → projects → users → roles; a scoped token carries a project and role; service catalog endpoints are per-region and per-interface (public/internal/admin).

Nova scheduling: filters (availability zone, host aggregate, affinity/anti-affinity, PCI passthrough) plus weighers; Placement tracks resource providers, inventories, and allocations.

Heat templates (HOT) declare resources, parameters, and outputs; stacks support update with rollback; OS::Neutron::Port and OS::Nova::Server are the common building blocks.

CLI workflow: source openrc → openstack token issue → openstack server create --image --flavor --nic net-id=... → openstack floating ip create/associate for external reachability.

Troubleshooting order: nova service-list and nova-compute logs → neutron agent-list and OVS flows → rabbitmq queue depth → cinder/glance API logs; most failures are messaging or quota.

Control plane: kube-apiserver (only component talking to etcd), etcd (cluster state), kube-scheduler (binds pods to nodes), kube-controller-manager (reconciliation loops); nodes run kubelet and kube-proxy.

Pod networking model: every pod gets a unique routable IP, containers in a pod share the network namespace and localhost; CNI plugins (Calico, Cilium, Flannel) implement it.

Services: ClusterIP (virtual IP via iptables/IPVS rules), NodePort (30000-32767 on every node), LoadBalancer (cloud LB integration), ExternalName (DNS CNAME); kube-proxy programs the rules.

Workload objects: Deployment (stateless, rolling updates), StatefulSet (stable identity and PVC per replica), DaemonSet (one pod per node), Job/CronJob (run to completion).

NetworkPolicy is namespaced and additive: default-allow unless a policy selects the pod; requires a CNI that enforces it (Calico, Cilium); egress rules need explicit egress policyTypes.

RBAC: Role/RoleBinding are namespaced, ClusterRole/ClusterRoleBinding are cluster-wide; verbs (get, list, watch, create, delete) on resources; service accounts get tokens mounted into pods.

Scheduling controls: nodeSelector (exact label match), affinity/anti-affinity (required vs preferred), taints (NoSchedule, PreferNoSchedule, NoExecute) and tolerations; resource requests drive the scheduler.

Debugging sequence: kubectl get pods -o wide → describe pod (events) → logs --previous → exec/nsenter → coredns and kube-proxy checks; CrashLoopBackOff usually means app exit or failed probe.

OpenShift is Kubernetes plus: integrated registry, router (HAProxy Ingress), build system (BuildConfig/S2I), templates, OAuth, and Security Context Constraints.

SCCs restrict pod capabilities, host networking, hostPath, and privileged mode; the default restricted SCC runs containers as arbitrary non-root UIDs from the namespace range.

Routes vs Ingress: a Route is an OpenShift object exposing a service via the router with edge, passthrough, or re-encrypt TLS; Ingress objects are translated into Routes.

oc CLI mirrors kubectl and adds oc new-app, oc new-project, oc adm, oc debug (runs a pod with the node's tooling), oc rsync, and oc rollout.

Projects are Kubernetes namespaces with annotations, RBAC, and quota; oc new-project creates the namespace and switches context; oc projects lists membership.

Operators extend the API with CRDs and controllers; OLM (Operator Lifecycle Manager) installs and upgrades them; ClusterVersionOperator manages cluster upgrades.

Networking: OVN-Kubernetes or OpenShift SDN provides pod network and NetworkPolicy; the ingress controller runs in openshift-ingress; the internal registry lives in openshift-image-registry.

Build strategies: Source-to-Image (S2I), Dockerfile, and Jenkins pipeline; ImageStreams and ImageStreamTags track image changes and trigger deployments when tags update.

NIST service models: IaaS delivers compute/storage/network; PaaS adds runtime and middleware; SaaS delivers the application; control shifts to the provider as you move IaaS→SaaS.

NIST deployment models: private (single organization), public (provider-owned, multi-tenant), community (shared by organizations with common concerns), hybrid (two or more bound by standardized technology enabling data/app portability).

Essential characteristics (NIST): on-demand self-service, broad network access, resource pooling, rapid elasticity, measured service - all five must hold for a cloud.

Five pillars of cloud-native networking: automation, elasticity, multi-tenancy isolation, service abstraction, and observability; Juniper frames intent-driven networking around these.

CAP theorem: under a network partition a distributed system chooses consistency or availability; most cloud control planes (OpenStack, Kubernetes) favor availability with eventual consistency.

Shared responsibility split: provider secures physical hosts, hypervisor, and facility; tenant secures guest OS, workloads, identities, and overlay network policy - the boundary sits at the hypervisor or container runtime.

SLA math: 99.9% allows ~43.2 min downtime/month, 99.95% ~21.6 min, 99.99% ~4.32 min; availability of serial components multiplies (0.999 × 0.999 ≈ 99.8%).

Elasticity vs scalability: scalability is capacity to grow; elasticity is automatic, rapid scale out/in matching demand, including returning resources - billing and licensing follow the elastic model.

ETSI NFV MANO: NFVO (orchestrates network services across VIMs), VNFM (lifecycle of VNF instances), VIM (virtualized compute/storage/network resources); Os-Ma and Ve-Vnfm reference points connect them.

ETSI NFV architecture elements: VNF, EMS, NFVI (hardware plus virtualization layer), and MANO; the NFVI-PoP is where VNFs actually run.

SDN planes: data plane forwards, control plane computes paths, management plane configures; SDN centralizes control and exposes it via a southbound API such as OpenFlow or NETCONF.

Overlay vs underlay: VXLAN, GRE, and MPLS overlays tunnel tenant traffic over an IP underlay; EVPN is the common control plane for VXLAN data planes, replacing flood-and-learn.

VXLAN facts: 24-bit VNI (~16M segments), 8-byte header, 50-byte outer overhead with IPv4/UDP; default destination UDP port 4789.

DPDK and SR-IOV bypass the kernel data path: DPDK polls in user space; SR-IOV presents virtual functions directly to the VM, trading live migration flexibility for line-rate performance.

Service chaining steers traffic through an ordered VNF set (firewall → NAT → DPI) using policy-based routing, NSH service function paths, or OpenFlow rules on a virtual switch.

Contrail/Tungsten Fabric and VMware NSX are controller-based SDN overlays that program vRouters or vSwitches via XMPP, BGP, or proprietary APIs and integrate with OpenStack Neutron as the ML2 backend.

Tenant isolation primitives: VLAN (12-bit ID, 4094 usable), VXLAN VNI (24-bit), and GENEVE (24-bit, extensible TLV options); VLANs are limited to ~4K per L2 domain.

EVPN route types: Type 2 MAC/IP advertisement, Type 3 inclusive multicast (BUM handling), Type 5 IP prefix; Type 1 is Ethernet auto-discovery/aliasing.

Routing in the overlay: centralized (all inter-subnet traffic hairpins to a gateway) vs distributed (each hypervisor routes locally, gateway MAC/IP anycast across VTEPs).

Virtual routing instances: VRF provides per-tenant routing tables; VXLAN VNI maps to a bridge domain, and the VRF holds the IRB interfaces for inter-VNI routing.

MTU planning: VXLAN adds 50 bytes (IPv4) or 70 bytes (IPv6); underlay MTU must be ≥ 1550 for standard 1500-byte tenant frames, or fragmentation/PMTUD failure results.

BUM traffic replication modes: head-end replication (ingress VTEP unicasts copies) vs multicast underlay groups; EVPN Type 3 replaces both with ingress replication lists.

Distributed firewall and microsegmentation apply policy at the vNIC using security groups, NSX distributed firewall, or Kubernetes NetworkPolicy - enforcement point moves from appliance to hypervisor.

MAC learning scale: hardware VTEPs learn remote MACs from EVPN control plane, not data-plane flooding; this removes unknown-unicast flooding and speeds convergence.

Hypervisor types: Type 1 (bare metal: ESXi, KVM, Xen) runs on hardware; Type 2 (hosted: VirtualBox) runs atop an OS; cloud providers use Type 1.

KVM is a Linux kernel module exposing /dev/kvm; QEMU emulates devices and libvirt is the management API - the trio is the standard open-source compute stack.

virtio paravirtualized drivers (net, blk, scsi) outperform emulated e1000/IDE devices; vhost-net moves the data plane into the kernel for lower latency.

CPU overcommit ratios: typical 1:4 to 1:8 vCPU:pCPU for general workloads; memory overcommit relies on ballooning, KSM page dedup, and swap - never for latency-sensitive VNFs.

Live migration pre-copy copies RAM while the VM runs, then stops-and-copies; shared storage (NFS, Ceph, iSCSI) avoids disk copy; post-copy trades performance for bounded downtime.

NUMA and CPU pinning: host-passthrough CPU mode plus vCPU pinning and hugepages are required to meet NFV performance; emulated CPU models disable features the guest needs.

Snapshot semantics: snapshots capture disk state (and optionally memory); they are not backups and degrade performance as chains grow - flatten or delete after use.

Storage backends: Ceph RBD provides replicated block storage over the network; local ephemeral disks are fastest but lost on instance deletion; image vs flavor determines root disk size.

Core services: Nova (compute), Neutron (networking), Cinder (block storage), Glance (images), Keystone (identity), Swift (object storage), Heat (orchestration), Placement (resource inventory).

Neutron abstractions: network → subnet → port; routers connect subnets; security groups are stateful per-port firewalls; ML2 drivers (OVS, Linux bridge, Contrail) implement the data plane.

Provider vs tenant networks: provider networks map to a physical VLAN/segment and are admin-created; tenant networks are self-service overlays (VXLAN/GRE) unless the operator restricts them.

Keystone v3: domains → projects → users → roles; a scoped token carries a project and role; service catalog endpoints are per-region and per-interface (public/internal/admin).

Nova scheduling: filters (availability zone, host aggregate, affinity/anti-affinity, PCI passthrough) plus weighers; Placement tracks resource providers, inventories, and allocations.

Heat templates (HOT) declare resources, parameters, and outputs; stacks support update with rollback; OS::Neutron::Port and OS::Nova::Server are the common building blocks.

CLI workflow: source openrc → openstack token issue → openstack server create --image --flavor --nic net-id=... → openstack floating ip create/associate for external reachability.

Troubleshooting order: nova service-list and nova-compute logs → neutron agent-list and OVS flows → rabbitmq queue depth → cinder/glance API logs; most failures are messaging or quota.

Control plane: kube-apiserver (only component talking to etcd), etcd (cluster state), kube-scheduler (binds pods to nodes), kube-controller-manager (reconciliation loops); nodes run kubelet and kube-proxy.

Pod networking model: every pod gets a unique routable IP, containers in a pod share the network namespace and localhost; CNI plugins (Calico, Cilium, Flannel) implement it.

Services: ClusterIP (virtual IP via iptables/IPVS rules), NodePort (30000-32767 on every node), LoadBalancer (cloud LB integration), ExternalName (DNS CNAME); kube-proxy programs the rules.

Workload objects: Deployment (stateless, rolling updates), StatefulSet (stable identity and PVC per replica), DaemonSet (one pod per node), Job/CronJob (run to completion).

NetworkPolicy is namespaced and additive: default-allow unless a policy selects the pod; requires a CNI that enforces it (Calico, Cilium); egress rules need explicit egress policyTypes.

RBAC: Role/RoleBinding are namespaced, ClusterRole/ClusterRoleBinding are cluster-wide; verbs (get, list, watch, create, delete) on resources; service accounts get tokens mounted into pods.

Scheduling controls: nodeSelector (exact label match), affinity/anti-affinity (required vs preferred), taints (NoSchedule, PreferNoSchedule, NoExecute) and tolerations; resource requests drive the scheduler.

Debugging sequence: kubectl get pods -o wide → describe pod (events) → logs --previous → exec/nsenter → coredns and kube-proxy checks; CrashLoopBackOff usually means app exit or failed probe.

OpenShift is Kubernetes plus: integrated registry, router (HAProxy Ingress), build system (BuildConfig/S2I), templates, OAuth, and Security Context Constraints.

SCCs restrict pod capabilities, host networking, hostPath, and privileged mode; the default restricted SCC runs containers as arbitrary non-root UIDs from the namespace range.

Routes vs Ingress: a Route is an OpenShift object exposing a service via the router with edge, passthrough, or re-encrypt TLS; Ingress objects are translated into Routes.

oc CLI mirrors kubectl and adds oc new-app, oc new-project, oc adm, oc debug (runs a pod with the node's tooling), oc rsync, and oc rollout.

Projects are Kubernetes namespaces with annotations, RBAC, and quota; oc new-project creates the namespace and switches context; oc projects lists membership.

Operators extend the API with CRDs and controllers; OLM (Operator Lifecycle Manager) installs and upgrades them; ClusterVersionOperator manages cluster upgrades.

Networking: OVN-Kubernetes or OpenShift SDN provides pod network and NetworkPolicy; the ingress controller runs in openshift-ingress; the internal registry lives in openshift-image-registry.

Build strategies: Source-to-Image (S2I), Dockerfile, and Jenkins pipeline; ImageStreams and ImageStreamTags track image changes and trigger deployments when tags update.