NHN Cloud Associate cheat sheet

Instance flavors pair vCPU count with memory; the flavor name prefix indicates the family (general purpose, compute-optimized, memory-optimized), so sizing starts from the workload's CPU-to-memory ratio.

An instance is created from an image plus a flavor plus a key pair; the key pair is injected at first boot, so a lost private key means rebuilding the instance rather than recovering the key.

Block storage attaches to an instance as an additional volume and is bound to the same availability zone; a volume cannot be attached across zones.

A floating IP is a separately allocated public address that can be associated and dissociated from an instance without recreating it; the private IP stays fixed for the instance lifetime.

Security groups are stateful allow-lists applied per instance; there is no explicit deny rule, so traffic not matched by any allow rule is dropped.

Scaling policies act on a group of instances behind a load balancer; the policy defines a metric, a threshold, and a min/max size, and the group maintains the desired count.

Instance lifecycle states include ACTIVE, SHUTOFF, and ERROR; a SHUTOFF instance keeps its volumes and IP association but does not bill compute time the same way as a running instance.

User scripts and post-creation configuration run once at first boot; changing the script afterwards does not re-run it on existing instances.

Snapshots capture a volume at a point in time and can be used to create a new volume in the same or another zone, which is the standard path for cross-zone volume migration.

A container cluster consists of a control plane and worker nodes; workloads are scheduled onto worker nodes, and node count drives available CPU and memory for pods.

A node pool groups worker nodes of the same flavor and scaling settings; separate node pools are used when workloads need different instance sizes or labels.

A pod is the smallest scheduling unit and may hold multiple containers that share the pod's network namespace and storage volumes.

A deployment manages stateless pods with a desired replica count and rolling update strategy; a stateful workload that needs stable identity uses a StatefulSet instead.

A service provides a stable virtual IP and DNS name in front of a changing set of pods; pod IPs are ephemeral and must not be addressed directly by clients.

A config map holds non-sensitive configuration and a secret holds sensitive values; both are injected as environment variables or mounted as files.

Resource requests determine scheduling placement, while limits cap runtime usage; a pod whose requests exceed any node's free capacity stays Pending.

A persistent volume claim binds to a persistent volume and survives pod restarts; deleting the pod does not delete the claim unless it is explicitly removed.

Ingress or a load balancer service exposes cluster workloads externally; a ClusterIP service is reachable only inside the cluster.

A VPC is the top-level network boundary; subnets inside it are tied to a single availability zone, so multi-zone designs need at least one subnet per zone.

A subnet has a CIDR block taken from the VPC range; the range cannot be resized after creation, so plan for growth before provisioning.

Instances in different subnets of the same VPC route to each other by default through the VPC routing table; instances in different VPCs need peering or a gateway.

VPC peering connects two VPCs with non-overlapping CIDR blocks; overlapping ranges make peering impossible, so address planning precedes peering.

A routing table entry sends a destination CIDR to a next hop such as a peering connection, internet gateway, or NAT instance; the most specific matching route wins.

A security group filters traffic per instance and is stateful; an ACL filters traffic per subnet and is stateless, so return traffic must be allowed explicitly.

A load balancer distributes traffic across backend instances and performs health checks; an unhealthy backend is removed from rotation until the check passes.

DNS records map a name to a floating IP or load balancer address; changing the target means updating the record rather than reissuing addresses to clients.

A NAT gateway lets instances without floating IPs initiate outbound internet traffic while blocking inbound connections to those instances.

Block storage is a volume attached to one instance at a time and behaves like a local disk; it is the right choice for an operating system disk or a database data directory.

Object storage stores immutable objects in buckets addressed by key; it is accessed over HTTP API and is not mounted as a filesystem.

Object storage buckets have access policies; a public-read bucket serves objects to anyone, while a private bucket requires a signed URL or authenticated request.

Volume performance scales with volume size for the standard type; a volume that is too small can bottleneck I/O even when the instance has spare capacity.

Snapshots are incremental after the first full snapshot, so a chain of snapshots shares unchanged blocks and costs less than repeated full copies.

Object storage is eventually consistent for overwrite and delete in some configurations; do not assume a read immediately after a write returns the new version.

Lifecycle rules on a bucket transition objects to colder storage or delete them after a defined age, which controls cost for logs and backups.

A volume can be detached and reattached to another instance in the same zone; it cannot be attached to two instances simultaneously.

Static content such as images and downloads belongs in object storage behind a CDN, not on the instance's system volume.

A relational database instance is provisioned with a flavor, storage size, and engine version; storage can be expanded but the engine version upgrade path depends on the engine.

Read replicas serve read traffic from a copy of the primary; replication is asynchronous, so a replica can lag and must not be used for read-after-write consistency.

Automated backups retain a recovery window; point-in-time recovery restores to a moment inside that window, not to an arbitrary past date.

A database instance in a private subnet is reachable only from inside the VPC; exposing it publicly requires a floating IP and an open security group rule.

Connection limits are set by the instance flavor; exhausting connections returns errors to the application even when CPU and memory look idle.

A database security group admits traffic by source address and port; the application's security group is the correct source rather than a wide CIDR.

Failover promotes a standby or replica when the primary fails; the application must reconnect to the new endpoint, so connection retry logic is required.

Schema changes on a large table lock or copy data; run them during low traffic and test on a replica-sized dataset before applying to production.

Caching reduces database load for repeated reads; a cache miss falls through to the database, so the cache does not remove the need to size the database.

API credentials are issued per project or per user; a request is authorized against the role granted on the target resource, so a missing role returns an authorization error rather than a not-found error.

Roles are granted at a scope (project or organization); a role granted at the organization applies to every project under it.

Monitoring metrics are collected per instance and per service; an alarm fires when a metric crosses a threshold for a defined duration, and the alarm action can notify or trigger scaling.

Billing is driven by running instance time, allocated volume size, snapshot storage, and outbound traffic; a stopped instance still bills for its attached volumes.

A resource in an ERROR state is not serving traffic; check the service-specific log before retrying the same create request.

Tags or resource names group resources for cost attribution; untagged resources are billed to the project but cannot be split by owner.

Quotas cap resources per project; a create request that fails at the quota boundary succeeds after the quota is raised or unused resources are deleted.