JNCIE-Cloud flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

NIST essential characteristics

Five traits a service must satisfy to be cloud: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. Missing any one means it is not cloud by NIST definition.

IaaS vs PaaS vs SaaS

IaaS provides virtual compute, storage, and network; PaaS adds managed runtime and middleware; SaaS delivers the finished application. The provider manages progressively more of the stack as you move from IaaS to SaaS.

Hybrid cloud deployment

Two or more distinct cloud infrastructures (private, public, or community) bound by standardized technology that enables data and application portability between them, such as common APIs or orchestration tooling.

Shared responsibility boundary

The provider secures facilities, physical hosts, and hypervisor; the tenant secures guest OS, workloads, identities, and overlay policy. The split sits at the hypervisor or container runtime boundary.

ETSI NFV MANO functions

NFVO orchestrates network services across VIMs, VNFM manages VNF lifecycle, and the VIM manages virtualized compute, storage, and network resources. Reference points Os-Ma and Ve-Vnfm connect these functions.

VXLAN encapsulation overhead

VXLAN adds 50 bytes with an IPv4 outer header and 70 bytes with IPv6: outer IP, UDP, 8-byte VXLAN header, and inner Ethernet. Underlay MTU must be at least 1550 for 1500-byte tenant frames.

SR-IOV virtual functions

A NIC exposes multiple virtual functions passed directly to VMs, bypassing the virtual switch for near line-rate performance. Trade-off: live migration and virtual switching policy features are limited.

SDN control plane separation

SDN moves path computation from individual devices to a centralized controller that programs forwarding tables via a southbound API like OpenFlow or NETCONF, leaving devices as simple data-plane forwarders.

EVPN route type 2

MAC/IP advertisement route: a VTEP advertises tenant MAC addresses and optionally IP addresses with their VNI and next hop, letting remote VTEPs install MAC entries from the control plane instead of flooding.

Distributed versus centralized routing

Centralized routing hairpins all inter-subnet traffic to a gateway appliance. Distributed routing places the gateway on every hypervisor with anycast MAC/IP, so traffic routes locally and avoids tromboning.

BUM traffic replication

Broadcast, unknown unicast, and multicast frames must reach all VTEPs in a segment. Options are head-end replication (ingress VTEP unicasts copies) or underlay multicast groups; EVPN Type 3 replaces both.

Microsegmentation enforcement point

Security policy applied at the virtual NIC by hypervisor distributed firewalls, security groups, or Kubernetes NetworkPolicy, rather than at a physical appliance. Enforcement follows the workload wherever it moves.

Type 1 versus Type 2 hypervisor

Type 1 runs directly on hardware (ESXi, KVM, Xen) and is used in cloud data centers. Type 2 runs as an application on a host OS (VirtualBox, VMware Workstation) and suits desktops.

KVM, QEMU, and libvirt roles

KVM is the Linux kernel module providing hardware virtualization; QEMU emulates devices and runs the guest; libvirt is the management API and daemon that OpenStack Nova calls to control instances.

Live migration pre-copy

The hypervisor copies guest memory to the destination while the VM runs, then briefly pauses to copy remaining dirty pages and switches over. Shared storage avoids copying disk contents and shortens downtime.

CPU pinning for NFV

Dedicating vCPUs to physical cores with host-passthrough CPU mode and hugepages reduces jitter and cache contention. Required for latency-sensitive VNFs; overcommit and emulated CPU models defeat the purpose.

Neutron network, subnet, port

A network is an isolated Layer 2 segment, a subnet supplies CIDR and gateway, and a port is a attachment point bound to a VM interface. Security groups attach to ports.

Keystone domains and projects

Keystone v3 organizes users and projects into domains. A scoped token carries a project and its roles; the service catalog lists per-region, per-interface endpoints used by CLI and API clients.

Neutron ML2 plugin

The Modular Layer 2 plugin lets Neutron drive multiple L2 technologies through type and mechanism drivers, such as flat, VLAN, VXLAN, OVS, Linux bridge, or an SDN controller backend like Contrail.

Nova Placement service

Placement tracks resource providers, their inventories, and allocations so the scheduler knows real capacity. Nova-compute reports resources; the scheduler filters and weighs candidates before claiming an allocation.

Heat stack orchestration

Heat consumes HOT templates declaring parameters, resources, and outputs, then creates a stack. Updates can roll back on failure. Common resources include OS::Neutron::Port and OS::Nova::Server.

Floating IP purpose

A floating IP is a routable external address NAT-mapped to a fixed tenant address on a Neutron router. It provides inbound reachability to instances on tenant networks without exposing internal addressing.

Kubernetes control plane components

kube-apiserver is the only component that talks to etcd, which stores cluster state. kube-scheduler binds pods to nodes, and kube-controller-manager runs reconciliation loops toward desired state.

Kubernetes Service types

ClusterIP gives a virtual IP reachable inside the cluster; NodePort exposes a port on every node; LoadBalancer requests a cloud load balancer; ExternalName returns a DNS CNAME. kube-proxy programs the rules.

NetworkPolicy default behavior

Pods are non-isolated by default. Once any NetworkPolicy selects a pod, only explicitly allowed ingress or egress is permitted. Policies are additive and namespaced, and require a CNI that enforces them.

Taints and tolerations

Taints on nodes repel pods; tolerations on pods allow scheduling onto tainted nodes. Effects are NoSchedule, PreferNoSchedule, and NoExecute. They complement node affinity and nodeSelector scheduling rules.

StatefulSet versus Deployment

Deployments manage interchangeable stateless pods with rolling updates. StatefulSets give each replica stable ordinal identity, stable DNS name, and its own PersistentVolumeClaim, suited to databases and clustered apps.

CNI plugin role

The Container Network Interface plugin assigns pod IPs, wires veth pairs to the pod network, and often enforces NetworkPolicy. Calico, Cilium, and Flannel are common implementations with different data planes.

OpenShift Security Context Constraints

SCCs control what a pod may do: privileged mode, host networking, hostPath mounts, capabilities, and UID ranges. The default restricted SCC assigns arbitrary non-root UIDs from the namespace range.

OpenShift Route versus Ingress

A Route is a native OpenShift object exposing a service through the HAProxy router with edge, passthrough, or re-encrypt TLS. Ingress objects are accepted and translated into Routes by the ingress operator.

OpenShift Source-to-Image builds

S2I combines application source with a builder image to produce a runnable image without a Dockerfile. BuildConfigs define the strategy, and resulting ImageStreamTags can trigger deployments when updated.

OpenShift Operators and OLM

Operators package a controller plus custom resource definitions to manage an application's lifecycle. Operator Lifecycle Manager installs, upgrades, and tracks subscriptions and channels for installed operators.