diegoecab/oci-deal-accelerator
1
1
Fork 2
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

initial version

Browse Source
This commit is contained in:
Diego Cabrera
2026-03-18 18:03:44 -03:00
commit 9d269e902b
136 changed files with 28175 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1537
kb/architecture-center/catalog.yaml Normal file
View File

File diff suppressed because it is too large Load Diff

349
kb/compatibility/adb-feature-matrix.yaml Normal file
View File

@@ -0,0 +1,349 @@
# =============================================================================
# ADB FEATURE COMPATIBILITY MATRIX
# =============================================================================
#
# INTERNAL — DO NOT SHARE EXTERNALLY
#
# This matrix tracks feature availability across ADB versions and deployment
# types. It is maintained by the field team based on real testing and customer
# engagements, NOT copied from Oracle documentation.
#
# Status values:
# GA — Generally Available, tested, works as expected
# GA_CAVEAT — Available but with significant caveats (see notes)
# PREVIEW — Available as preview/beta, not production-ready
# LIMITED — Available with restrictions not obvious from docs
# NOT_AVAIL — Not available in this combination
# BROKEN — Documented as available but does not work (see field_finding ref)
# UNTESTED — Not yet verified by the team
#
# Cell format (enhanced with attribution):
# status: Required — one of the status values above
# notes: Optional — concise description of caveats
# contributor: Optional — attribution block (name, team, date, confidence)
# field_finding_ref: Optional — link to field finding ID (e.g., FF-202603-008)
#
# To edit: add/modify entries and update last_verified. Keep notes concise.
# =============================================================================
---
last_verified: "2026-03-14"
maintained_by: "Field Architecture Team"
versions:
- id: "23ai"
full_name: "Oracle Database 23ai"
release_year: 2024
notes: "First AI-branded release. Major feature additions."
- id: "26ai"
full_name: "Oracle Database 26ai"
release_year: 2026
notes: "Latest. Check feature availability — not everything from 23ai carried forward identically."
deployment_types:
- id: "adb_s"
name: "ADB-S Serverless"
- id: "adb_s_ep"
name: "ADB-S Elastic Pool"
- id: "adb_d_dep"
name: "ADB Dedicated Elastic Pool (DEP)"
- id: "adb_d"
name: "ADB on Dedicated Exadata"
- id: "exacs"
name: "Exadata Cloud Service"
- id: "dbcs_ee"
name: "Base DB Service (EE)"
# =============================================================================
# FEATURE MATRIX
# =============================================================================
features:
# --- Auto Management ---
- name: "Auto Scaling (OCPU)"
category: "auto_management"
matrix:
adb_s:
"23ai": { status: "GA_CAVEAT", notes: "Activation takes 2-3 min. Size base for P75. Billing per-second when active." }
"26ai": { status: "GA_CAVEAT", notes: "Same 2-3 min activation delay persists in 26ai." }
adb_s_ep:
"23ai": { status: "GA_CAVEAT", notes: "Scales within pool allocation. Pool itself doesn't auto-scale." }
"26ai": { status: "GA_CAVEAT", notes: "Same as 23ai." }
adb_d_dep:
"23ai": { status: "LIMITED", notes: "Scales within DEP allocation. DEP itself is fixed capacity." }
"26ai": { status: "UNTESTED" }
adb_d:
"23ai": { status: "NOT_AVAIL", notes: "Dedicated infra — manual scaling only." }
exacs:
"23ai": { status: "NOT_AVAIL", notes: "Manual OCPU enable/disable." }
- name: "Auto Indexing"
category: "auto_management"
matrix:
adb_s:
"23ai": { status: "GA_CAVEAT", notes: "Creates indexes HIDDEN by default. Instantly reversible. DML costing prevents over-indexing. Deduplication with manually created indexes." }
"26ai": { status: "GA", notes: "Improved in 26ai — better cost model, fewer false positives." }
adb_s_ep:
"23ai": { status: "GA_CAVEAT", notes: "Same as ADB-S Serverless." }
adb_d_dep:
"23ai": { status: "GA_CAVEAT", notes: "Available but less tested in DEP." }
adb_d:
"23ai": { status: "GA", notes: "Fully supported." }
exacs:
"23ai": { status: "NOT_AVAIL", notes: "Not an ADB feature. Use manual indexing." }
dbcs_ee:
"23ai": { status: "NOT_AVAIL" }
- name: "Auto Patching"
category: "auto_management"
matrix:
adb_s:
"23ai": { status: "GA", notes: "Automatic quarterly. No opt-out. Maintenance window configurable but change requires SR." }
"26ai": { status: "GA", notes: "Same policy." }
adb_d_dep:
"23ai": { status: "GA_CAVEAT", notes: "Maintenance window immutable post-DEP creation. Change via SR only. Saturday/Sunday default, other days via SR." }
exacs:
"23ai": { status: "GA_CAVEAT", notes: "Customer-managed patching schedule. Must apply within 90 days." }
# --- High Availability ---
- name: "Transparent Application Continuity (TAC)"
category: "ha_dr"
matrix:
adb_s:
"23ai": { status: "GA_CAVEAT", notes: "Zero perceived RTO for app. DB itself ~2 min unavailable during failover. Replay NOT guaranteed with UTL_HTTP, DBMS_PIPE, NOCACHE sequences. Requires JDBC thin driver with TAC config." }
"26ai": { status: "GA_CAVEAT", notes: "Same limitations persist." }
adb_s_ep:
"23ai": { status: "GA_CAVEAT", notes: "Same as Serverless." }
adb_d:
"23ai": { status: "GA_CAVEAT", notes: "Same limitations." }
exacs:
"23ai": { status: "GA_CAVEAT", notes: "Available with RAC. Same replay limitations." }
dbcs_ee:
"23ai": { status: "NOT_AVAIL", notes: "Requires RAC — only in EE-HP or EE-EP." }
- name: "Autonomous Data Guard (Local)"
category: "ha_dr"
matrix:
adb_s:
"23ai": { status: "GA", notes: "Synchronous. Same region. Auto-failover ~2 min." }
"26ai": { status: "GA" }
adb_d:
"23ai": { status: "GA" }
exacs:
"23ai": { status: "GA", notes: "Standard Data Guard, not 'Autonomous' — manual setup." }
- name: "Autonomous Data Guard (Cross-Region)"
category: "ha_dr"
matrix:
adb_s:
"23ai": { status: "GA_CAVEAT", notes: "Asynchronous only. RPO ≈ seconds. Manual switchover or auto-failover (configurable)." }
"26ai": { status: "GA_CAVEAT", notes: "Same." }
adb_d_dep:
"23ai": { status: "GA_CAVEAT", notes: "ADG must be disabled before joining DEP. Known issue." }
exacs:
"23ai": { status: "GA", notes: "Standard cross-region DG. Manual setup." }
- name: "Refreshable Clone"
category: "ha_dr"
matrix:
adb_s:
"23ai": { status: "GA_CAVEAT", notes: "Read-only. Auto-refresh frequency configurable. Failed refresh leaves clone AVAILABLE (not DISCONNECTED) — leader monitors lifecycle state, not refresh success. Detection delay = ADG RTO for unplanned." }
"26ai": { status: "GA_CAVEAT", notes: "Same detection delay issue." }
adb_d:
"23ai": { status: "GA" }
# --- Security ---
- name: "Virtual Private Database (VPD)"
category: "security"
matrix:
adb_s:
"23ai": { status: "GA", notes: "Full VPD support including OLS." }
"26ai": { status: "GA" }
exacs:
"23ai": { status: "GA" }
dbcs_ee:
"23ai": { status: "GA", notes: "Requires Advanced Security option license." }
- name: "Private Endpoints"
category: "security"
matrix:
adb_s:
"23ai": { status: "GA", notes: "Recommended for production. Required for some compliance." }
"26ai": { status: "GA" }
adb_d:
"23ai": { status: "GA", notes: "Default — all ADB-D is private." }
exacs:
"23ai": { status: "GA", notes: "Always private subnet." }
- name: "Data Safe Integration"
category: "security"
matrix:
adb_s:
"23ai": { status: "GA", notes: "Audit, masking, assessment, SQL Firewall." }
"26ai": { status: "GA", notes: "Enhanced SQL Firewall in 26ai." }
exacs:
"23ai": { status: "GA" }
dbcs_ee:
"23ai": { status: "GA_CAVEAT", notes: "Must register DB manually in Data Safe." }
# --- Developer Features ---
- name: "Select AI"
category: "developer"
matrix:
adb_s:
"23ai": { status: "GA", notes: "Natural language → SQL via LLM. Requires AI profile configuration." }
"26ai": { status: "GA", notes: "Improved accuracy in 26ai." }
adb_d:
"23ai": { status: "GA" }
exacs:
"23ai": { status: "NOT_AVAIL", notes: "ADB-only feature." }
- name: "Property Graph / SQL/PGQ"
category: "developer"
matrix:
adb_s:
"23ai": { status: "GA_CAVEAT", notes: "Node tables + edge tables. Only FK indexes essential. Additional indexes require filter evidence. See Graph DBA Advisor philosophy." }
"26ai": { status: "GA", notes: "Improved PGQ optimizer in 26ai." }
exacs:
"23ai": { status: "GA", notes: "Full graph support with PGQL and SQL/PGQ." }
- name: "APEX"
category: "developer"
matrix:
adb_s:
"23ai": { status: "GA", notes: "Built-in. No additional cost." }
"26ai": { status: "GA" }
adb_d:
"23ai": { status: "GA" }
exacs:
"23ai": { status: "GA_CAVEAT", notes: "Must install APEX manually." }
dbcs_ee:
"23ai": { status: "GA_CAVEAT", notes: "Must install and manage manually." }
- name: "JSON Relational Duality Views"
category: "developer"
matrix:
adb_s:
"23ai": { status: "GA", notes: "Major 23ai feature." }
"26ai": { status: "GA" }
exacs:
"23ai": { status: "GA" }
dbcs_ee:
"23ai": { status: "GA", notes: "Requires 23ai version." }
# --- AI / Vector Search ---
- name: "AI Vector Search (HNSW)"
category: "developer"
matrix:
adb_s:
"23ai":
status: "GA_CAVEAT"
notes: |
HNSW indexes are node-local on multi-node RAC. Works well up to
~50M vectors on single node (≤24 ECPUs). At 100M+ on multi-node
(≥64 ECPUs), requires hash-partitioned vector table with LOCAL
HNSW index for <50ms P95. See FF-202603-008.
scale_limits:
single_node_max_vectors: "~50M with <50ms P95"
multi_node_requires: "Hash partitioning + LOCAL HNSW index"
validated_at: "120M vectors, 64 ECPU, P95 = 38ms (with workaround)"
without_workaround: "P95 >200ms at 100M+ on 2-node RAC"
field_finding_ref: "FF-202603-008"
"26ai":
status: "UNTESTED"
notes: "Check if distributed HNSW is added in 26ai. Expected to remain node-local."
adb_s_ep:
"23ai":
status: "GA_CAVEAT"
notes: "Same node-local limitation as ADB-S Serverless."
field_finding_ref: "FF-202603-008"
adb_d:
"23ai":
status: "GA_CAVEAT"
notes: "Same limitation. Dedicated infra doesn't change HNSW locality."
exacs:
"23ai":
status: "GA_CAVEAT"
notes: "RAC with HNSW has same node-local constraint. Partitioning workaround applies."
dbcs_ee:
"23ai":
status: "NOT_AVAIL"
notes: "AI Vector Search requires 23ai. Available in EE but HNSW performance limited without Exadata storage."
- name: "AI Vector Search (IVF)"
category: "developer"
matrix:
adb_s:
"23ai":
status: "GA"
notes: |
IVF (Inverted File) indexes ARE distributed across RAC nodes.
Works at 100M+ scale without partitioning. However, IVF has
lower recall than HNSW at same latency budget. Trade-off:
IVF for scale without redesign, HNSW+partitioning for best recall.
"26ai":
status: "UNTESTED"
adb_s_ep:
"23ai":
status: "GA"
notes: "Same as ADB-S Serverless."
adb_d:
"23ai":
status: "GA"
exacs:
"23ai":
status: "GA"
notes: "IVF distributed across RAC nodes. Exadata storage accelerates scans."
dbcs_ee:
"23ai":
status: "NOT_AVAIL"
notes: "AI Vector Search requires 23ai. Available in EE but performance limited without Exadata."
# --- Deployment / Operations ---
- name: "Elastic Pool Membership"
category: "operations"
matrix:
adb_s_ep:
"23ai": { status: "GA_CAVEAT", notes: "Billing starts at AVAILABLE. Co-location at next maintenance window. Pool can't auto-scale." }
adb_d_dep:
"23ai":
status: "GA_CAVEAT"
notes: "Provisioning days-weeks. ADG must be disabled before joining. Maintenance window immutable. Saturday/Sunday default."
contributor:
name: "Diego Cabrera"
team: "Field Architecture"
date: "2026-03-14"
confidence: "validated"
field_finding_ref: "FF-202603-002"
- name: "Cross-Region Read Offload (ProxySQL/Refreshable Clone)"
category: "operations"
matrix:
adb_s:
"23ai":
status: "LIMITED"
notes: "Architecturally impossible without pre-provisioned Elastic Pool in Region B post-switchover. Mitigation for planned: DBMS_PROXY_SQL.DISABLE_READ_ONLY_OFFLOAD. For unplanned: OCI Events + Functions."
contributor:
name: "Diego Cabrera"
team: "Field Architecture"
date: "2026-03-14"
confidence: "validated"
field_finding_ref: "FF-202603-005"
"26ai": { status: "UNTESTED", notes: "Same architectural constraint expected to persist." }
- name: "OCI CLI Management"
category: "operations"
matrix:
adb_s:
"23ai": { status: "GA_CAVEAT", notes: "--resource-pool-summary works on CLI 3.73+. --autonomous-database-maintenance-window has JSON serialization bug on CLI 3.73.1 AND 3.75.0. Must use Console for maintenance window." }
# =============================================================================
# HOW TO ADD A NEW FEATURE
# =============================================================================
# 1. Add entry under "features:" following the template above
# 2. Fill matrix for every deployment_type + version you've tested
# 3. Mark untested combinations as UNTESTED
# 4. Add field_finding_ref if the entry comes from a specific incident
# 5. Update last_verified date
# 6. Commit with a message: "feat-matrix: added [feature_name]"

112
kb/competitive/aws-mapping.yaml Normal file
View File

@@ -0,0 +1,112 @@
# Competitive Mapping: AWS → OCI
# Honest comparison — advantages AND disadvantages
service_mapping:
compute:
aws: "EC2"
oci: "OCI Compute"
oci_advantage:
- "Consistent pricing (no per-second billing complexity)"
- "Flex shapes — pay for exact OCPUs/memory needed"
- "Dense I/O shapes with local NVMe included"
aws_advantage:
- "Broader instance family selection"
- "Spot instances (wider availability than OCI Preemptible)"
- "Graviton ecosystem maturity vs Ampere"
notes: "OCI compute is generally 30-50% cheaper for equivalent configurations"
kubernetes:
aws: "EKS"
oci: "OKE"
oci_advantage:
- "Free control plane (EKS charges $0.10/hr = ~$73/month)"
- "Virtual Nodes (serverless) option"
aws_advantage:
- "Larger ecosystem (Fargate, App Mesh, more add-ons)"
- "More community resources and tooling"
database_oracle:
aws: "RDS Oracle / Oracle on EC2"
oci: "ADB-S / DBCS / ExaCS"
oci_advantage:
- "Autonomous Database — no equivalent in AWS"
- "Exadata performance for Oracle workloads"
- "BYOL pricing ~50-75% cheaper than AWS RDS Oracle"
- "Native Oracle features (RAC, Data Guard, Advanced Compression)"
- "Direct migration path with ZDM/DMS"
aws_advantage:
- "Multi-engine flexibility (same tooling for Oracle, PostgreSQL, MySQL)"
- "Aurora for PostgreSQL/MySQL is excellent"
notes: "This is OCI's strongest competitive advantage. Lead with database."
database_mysql:
aws: "RDS MySQL / Aurora MySQL"
oci: "MySQL HeatWave"
oci_advantage:
- "HeatWave in-memory query accelerator (up to 400x faster analytics)"
- "Combined OLTP + analytics without ETL"
aws_advantage:
- "Aurora is a mature, battle-tested platform"
- "Broader integration with AWS analytics stack"
object_storage:
aws: "S3"
oci: "OCI Object Storage"
oci_advantage:
- "No data retrieval charges for Standard tier"
- "Cheaper per-GB pricing"
aws_advantage:
- "S3 ecosystem is unmatched (integrations, tooling, community)"
- "S3 Intelligent Tiering is more mature"
networking:
aws: "VPC / Direct Connect / ALB/NLB"
oci: "VCN / FastConnect / Flexible LB"
oci_advantage:
- "Free inter-AZ data transfer (AWS charges $0.01/GB)"
- "Free inter-VCN data transfer within same region via DRG"
- "Significantly cheaper outbound data transfer"
- "Service Gateway (free access to OCI services without internet)"
aws_advantage:
- "More load balancer features (ALB path-based routing)"
- "Broader Direct Connect partner ecosystem"
notes: "Networking cost savings are a major OCI differentiator. Quantify them."
security:
aws: "IAM / GuardDuty / SecurityHub / KMS"
oci: "IAM / Cloud Guard / Security Zones / Vault"
oci_advantage:
- "Cloud Guard is free (GuardDuty is per-event pricing)"
- "Security Zones enforce compliance at resource creation"
- "Data Safe included free for Autonomous Database"
aws_advantage:
- "Broader security partner ecosystem"
- "More mature SIEM integrations"
observability:
aws: "CloudWatch / X-Ray / CloudTrail"
oci: "Monitoring / APM / Audit / Logging Analytics"
oci_advantage:
- "Generous free tier for monitoring"
- "Logging Analytics is powerful for centralized analysis"
aws_advantage:
- "CloudWatch is deeply integrated with all services"
- "More third-party observability integrations"
competitive_positioning:
lead_with:
- "Oracle Database cost savings (BYOL, Exadata, Autonomous)"
- "Network cost savings (free inter-AZ, cheap egress)"
- "Overall price/performance for equivalent configurations"
honest_gaps:
- "Smaller service catalog than AWS"
- "Fewer regions (though expanding rapidly)"
- "Smaller community and ecosystem"
- "Less mature serverless/event-driven offerings"
neutralize:
- "Enterprise support: Oracle Premier Support is equivalent to AWS Enterprise"
- "Terraform support: full parity via OCI Terraform provider"
- "Multi-cloud: OCI Multicloud with Azure (Oracle Database@Azure)"
- "Multi-cloud: Oracle Database@AWS (GA in us-east-1, us-west-2, us-east-2, eu-central-1, ap-northeast-1 + expanding to 20+ regions)"
- "Database@AWS: co-located Exadata in AWS AZ, ~200-400μs same-AZ latency, single AWS bill"
- "Database@AWS limitation: ADB-D only, no ADB-S Serverless — requires Exadata dedicated infra"

54
kb/competitive/azure-mapping.yaml Normal file
View File

@@ -0,0 +1,54 @@
---
last_verified: 2026-03-14
description: OCI to Azure service mapping for competitive positioning.
---
service_mapping:
database:
- oci: "ADB-S"
azure: "Azure SQL Managed Instance / Azure Database for PostgreSQL"
oci_advantage: |
ADB-S runs actual Oracle Database. Azure SQL MI is SQL Server only.
No native Oracle database service on Azure.
Oracle on Azure VMs loses Exadata performance and autonomous operations.
azure_advantage: "Native SQL Server support if migrating from SQL Server."
- oci: "ExaCS"
azure: "Oracle Database@Azure (ExaCS in Azure datacenters)"
notes: |
Oracle Database@Azure is ExaCS running in Azure datacenters with
direct connectivity to Azure services. Available in select regions.
This is a partnership offering, not a competitive comparison.
compute:
- oci: "OCI Compute"
azure: "Azure Virtual Machines"
oci_advantage: "Flexible shapes, lower cost for Oracle workloads."
azure_advantage: "Deeper Microsoft ecosystem integration, Hybrid Benefit."
networking:
- oci: "OCI Interconnect with Azure"
azure: "Azure ExpressRoute with OCI"
notes: |
OCI and Azure have a direct interconnect in multiple regions.
Low-latency (<2ms) connectivity for hybrid deployments.
Enables Oracle DB on OCI with apps on Azure.
pricing_comparison:
notes: |
For Oracle workloads, OCI is significantly cheaper:
- No Oracle license surcharge on OCI
- Exadata performance not available on Azure
- BYOL works better on OCI
- Data egress cheaper on OCI
common_objections:
- objection: "We're an Azure shop — Microsoft is our strategic partner"
response: |
Oracle Database@Azure allows running OCI database services directly
in Azure datacenters. Your team stays in the Azure portal while
getting OCI database performance and economics.
- objection: "We prefer Azure SQL for our databases"
response: |
For SQL Server workloads, Azure SQL is excellent. For Oracle database
workloads that must remain Oracle, OCI provides superior performance
and cost. Consider multi-cloud: Azure for .NET/SQL Server, OCI for Oracle.

85
kb/competitive/common-objections.yaml Normal file
View File

@@ -0,0 +1,85 @@
---
last_verified: 2026-03-14
description: Common customer objections about OCI and evidence-based responses.
---
objections:
- id: OBJ-001
category: market
objection: "OCI is a niche cloud — AWS/Azure are the leaders"
response: |
OCI is the #4 cloud globally and growing fastest in database PaaS.
For Oracle database workloads specifically, OCI is the leader:
- Only cloud with Exadata hardware
- Only cloud with Autonomous Database
- Best Oracle license portability
The question isn't "best cloud overall" but "best cloud for this workload."
evidence: "Gartner, IDC reports on cloud database market"
- id: OBJ-002
category: risk
objection: "What if Oracle EOLs or changes OCI pricing?"
response: |
OCI pricing has only decreased since launch. Oracle's cloud investment
is $50B+ in CapEx. OCI is Oracle's strategic platform — not a side project.
Contractual pricing protection exists via Annual Flex and Universal Credits.
mitigation: "Use annual flex contracts with pricing guarantees"
- id: OBJ-003
category: skills
objection: "Our team has no OCI experience"
response: |
ADB-S reduces DBA workload by 80% (no patching, tuning, scaling).
OCI console follows familiar cloud patterns. Terraform provider is mature.
Oracle provides free training and certification. Typical ramp-up is 2-4 weeks.
mitigation: "Include training budget in migration plan"
- id: OBJ-004
category: features
objection: "OCI doesn't have as many services as AWS"
response: |
True for breadth (AWS has 200+ services). For database and enterprise
workloads, OCI feature parity is strong. Key services are GA:
- Compute, networking, storage, Kubernetes, serverless
- Monitoring, logging, IAM, security
- Queue, Streaming, API Gateway
What matters is whether OCI has what *you* need, not a raw count.
- id: OBJ-005
category: cost
objection: "We can get better pricing from AWS/Azure"
response: |
OCI list prices are already 30-50% below AWS for equivalent configs.
For Oracle specifically:
- No Oracle license surcharge on OCI
- BYOL discount is deeper on OCI
- Data egress is 10x cheaper
Request a detailed cost comparison with matched configurations.
- id: OBJ-006
category: migration
objection: "Migration is too risky and expensive"
response: |
Oracle provides free migration tools (ZDM, DMS) and migration credits.
Phased migration reduces risk. ADB-S migrations from on-prem Exadata
are well-documented with reference architectures. Typical timeline is
8-16 weeks for database migration.
mitigation: "Phased migration with rollback plan at each phase"
- id: OBJ-007
category: vendor_lock
objection: "We don't want vendor lock-in with Oracle"
response: |
You're already locked into Oracle Database (the software). OCI doesn't
add lock-in — it reduces cost and operational burden of running Oracle.
OCI also supports open source: PostgreSQL, MySQL, Kubernetes, Terraform.
If you want to reduce Oracle dependency, that's a separate conversation
about database modernization, not cloud choice.
- id: OBJ-008
category: availability
objection: "OCI has fewer regions than AWS"
response: |
OCI has 50+ public cloud regions globally, covering all major markets.
If a specific region is required, check current availability.
For Oracle Database@Azure, OCI services run inside Azure regions.

1121
kb/diagram/oci-icons.json Normal file
View File

File diff suppressed because one or more lines are too long

240
kb/diagram/oci-toolkit-styles.yaml Normal file
View File

@@ -0,0 +1,240 @@
# OCI Official Diagram Styles — Extracted from OCI Style Guide for Draw.io Toolkit v24.2
# Source: OCI Library.xml + OCI Architecture Diagram Toolkit v24.2.drawio
# This supersedes earlier palette files based on inference from reference architectures.
# ============================================================
# CONTAINER STYLES (from Physical Groupings in the toolkit)
# These are the EXACT styles Oracle uses for diagram containers.
# ============================================================
containers:
tenancy:
# Toolkit item [200]: Physical - Grouping - Tenancy
style: "whiteSpace=wrap;html=1;strokeWidth=1;dashed=1;align=left;fontFamily=Oracle Sans;verticalAlign=top;fillColor=none;fontColor=#312D2A;strokeColor=#9E9892;fontSize=12;spacingLeft=5;"
notes:
- "DASHED gray border, NO fill"
- "Text color is charcoal #312D2A"
- "Border is warm gray #9E9892"
region:
# Toolkit item [202]: Physical - Grouping - OCI Region
style: "whiteSpace=wrap;html=1;align=left;fontFamily=Oracle Sans;verticalAlign=top;fillColor=#F5F4F2;rounded=1;arcSize=5;strokeColor=#9E9892;fontColor=#312D2A;fontSize=12;fontStyle=1;spacingLeft=8;spacingTop=5;"
notes:
- "SOLID border, rounded corners"
- "FILLED with warm gray #F5F4F2"
- "This is the only container with a solid background fill"
availability_domain:
# From template styles
style: "whiteSpace=wrap;html=1;strokeWidth=1;align=center;fontFamily=Oracle Sans;verticalAlign=top;fillColor=#DFDCD8;fontColor=#312D2A;strokeColor=#9E9892;rounded=1;arcSize=1;fontStyle=1;"
notes:
- "Slightly darker gray fill #DFDCD8"
- "Bold text (fontStyle=1)"
vcn:
# Toolkit item [197]: Physical - Grouping - VCN
style: "whiteSpace=wrap;html=1;strokeWidth=2;dashed=1;align=left;fontFamily=Oracle Sans;verticalAlign=top;fillColor=none;fontColor=#AE562C;strokeColor=#AE562C;perimeterSpacing=0;fontSize=12;spacingLeft=5;"
notes:
- "DASHED BURNT ORANGE border — this is the signature OCI VCN visual"
- "strokeWidth=2 (thicker than subnet)"
- "Text AND border are both #AE562C (burnt orange)"
- "NO fill — transparent background"
subnet:
# Toolkit item [198]: Physical - Grouping - Subnet
style: "whiteSpace=wrap;html=1;strokeWidth=1;dashed=1;align=left;fontFamily=Oracle Sans;verticalAlign=top;fillColor=none;fontColor=#AE562C;perimeterSpacing=0;strokeColor=#AE562C;fontSize=12;spacingLeft=5;"
notes:
- "DASHED BURNT ORANGE border — same color as VCN but THINNER (strokeWidth=1)"
- "Inside templates, subnet interior uses fillColor=#FCFBFA (near-white)"
- "Text is #AE562C (burnt orange)"
compartment:
# Toolkit item [199]: Physical - Grouping - Compartment
style: "whiteSpace=wrap;html=1;strokeWidth=1;dashed=1;align=left;fontFamily=Oracle Sans;verticalAlign=top;fillColor=none;fontColor=#312D2A;strokeColor=#9E9892;fontSize=12;spacingLeft=5;"
notes:
- "Same as tenancy style — dashed gray"
fault_domain:
# Toolkit item [204]
style: "whiteSpace=wrap;html=1;strokeWidth=1;dashed=1;align=left;fontFamily=Oracle Sans;verticalAlign=top;fillColor=none;fontColor=#312D2A;strokeColor=#9E9892;fontSize=12;spacingLeft=5;"
tier:
# Toolkit item [201]
style: "whiteSpace=wrap;html=1;strokeWidth=1;dashed=1;align=left;fontFamily=Oracle Sans;verticalAlign=top;fillColor=none;fontColor=#312D2A;strokeColor=#9E9892;fontSize=12;spacingLeft=5;"
# ============================================================
# SERVICE ICON COLORS
# ============================================================
service_colors:
oci_teal: "#2D5967"
oracle_copper: "#AA643B"
oracle_purple: "#804998"
burnt_orange: "#AE562C" # Used ONLY for VCN/Subnet borders and text — NOT for service icons
oracle_red: "#C74634" # Accent only
# ============================================================
# BACKGROUND AND TEXT COLORS
# ============================================================
backgrounds:
region_fill: "#F5F4F2" # Warm gray — region containers
ad_fill: "#DFDCD8" # Slightly darker — AD containers
subnet_fill: "#FCFBFA" # Near-white — subnet interiors in templates
dormant: "#DFDCD8" # Dormant/inactive elements
text:
primary: "#312D2A" # Charcoal — ALL text (never pure black)
secondary: "#70665E" # Medium gray — step circles, muted text
on_dark: "#FFFFFF" # White — text on colored service blocks
borders:
container: "#9E9892" # Warm gray — tenancy, region, compartment borders
vcn_subnet: "#AE562C" # Burnt orange — VCN and subnet borders ONLY
connector: "#312D2A" # Charcoal — ALL connection arrows (matches text color)
# ============================================================
# CONNECTOR STYLES (from toolkit items [206-214])
# ALL connectors use charcoal #312D2A — same as text color.
# Differentiation is via dash pattern, not color.
# ============================================================
connectors:
standard:
# Toolkit item [206]: Physical - Connector
style: "endArrow=open;endFill=0;strokeColor=#312D2A;strokeWidth=1;edgeStyle=orthogonalEdgeStyle;endSize=6;rounded=0"
notes:
- "Open arrow tip (not filled)"
- "Orthogonal routing (right-angle turns)"
- "endSize=6 for small consistent arrowheads"
- "Color is charcoal #312D2A — NOT gray"
fastconnect:
# Toolkit items [209-210]: Physical - Special Connectors - FastConnect
style: "endArrow=open;endFill=0;startArrow=open;startFill=0;strokeColor=#312D2A;strokeWidth=1;edgeStyle=orthogonalEdgeStyle;endSize=6;rounded=0"
notes:
- "Bidirectional open arrows"
- "Same charcoal color as standard"
- "In toolkit, has lightning/zigzag icon overlay — not reproducible in simple edges"
site_to_site_vpn:
# Toolkit items [211-212]
style: "endArrow=open;endFill=0;strokeColor=#312D2A;strokeWidth=1;dashed=1;edgeStyle=orthogonalEdgeStyle;endSize=6;rounded=0"
notes: "Dashed line with lock icon overlay"
remote_peering:
# Toolkit items [213-214]
style: "endArrow=open;endFill=0;strokeColor=#312D2A;strokeWidth=1;dashed=1;edgeStyle=orthogonalEdgeStyle;endSize=6;rounded=0"
notes: "Dashed line for inter-region connectivity"
# ============================================================
# TYPOGRAPHY
# ============================================================
typography:
font_family: "Oracle Sans"
fallback_fonts: "Segoe UI, Helvetica Neue, Arial, sans-serif"
container_labels: "fontSize=12, fontColor=#312D2A"
service_labels: "fontSize=8-9, fontColor=#FFFFFF (on colored background)"
title_text: "fontSize=10, fontColor=#70665E, fontStyle=2 (italic)"
# ============================================================
# KEY VISUAL RULES (from toolkit analysis)
# ============================================================
design_rules:
# Container rules (confirmed from OCI Toolkit v24.2 + 7 Oracle Architecture Center reference diagrams)
- "VCN and Subnet borders are ALWAYS dashed burnt orange (#AE562C) — this is the signature Oracle visual"
- "VCN border is strokeWidth=2, Subnet border is strokeWidth=1"
- "Region containers are the ONLY ones with solid background fill (#F5F4F2)"
- "Tenancy and Compartment containers are dashed gray, NO fill"
- "VCN and Subnet labels are BOLD, ORANGE (#AE562C), left-aligned inside the container (top-left)"
- "Subnet labels sometimes include CIDR notation below in smaller text (10pt gray)"
# VCN/Subnet containers — NO corner badges
- "VCN and Subnet containers do NOT have badges or icons at the corners"
- "Confirmed by re-checking original Architecture Center drawio files (e-commerce, ExaCS, etc.)"
# Service icon rules (confirmed from 7 Oracle Architecture Center reference diagrams)
- "Service icons are LINE ART / OUTLINE style in teal (#2D5967) — NOT filled colored rectangles"
- "Service icons do NOT have colored background boxes when rendered as OCI library stencils"
- "Service label is BELOW the icon, centered, in dark charcoal (#312D2A)"
- "Service label font size is 10-11pt (NOT 14pt) — confirmed from Oracle ref arch diagrams"
- "Total service block height (icon + label) should be ~90px for OCI services, not 45px"
# External cloud rules (confirmed from multicloud Oracle reference diagrams)
- "Azure containers use SOLID blue border (#0078D4) with light blue fill (#EBF5FF)"
- "Azure container labels are bold, dark blue (#0050A2)"
- "GCP containers use solid green border (#34A853) with light green fill (#E8F5E9)"
- "AWS/generic containers use dashed muted gray border (no specific Oracle style defined)"
# Oracle Services Network panel (confirmed from hub-spoke, OKE, lakehouse Oracle diagrams)
- "Oracle Services Network is a right-side dashed gray panel containing managed OCI services"
- "Services in Oracle Services Network are NOT in any VCN/Subnet — they float in the panel"
- "Use compartment-style container with oracle_services_network label for this panel"
- "OSN panel has NO fill (transparent) — dashed gray border only"
# Flow differentiation — Oracle uses line patterns, NOT numbered circles
- "Oracle differentiates flow types by DASH PATTERN, not numbered circle badges"
- "Ingest: dotted fine; Transform: dash-dot; Curate: fine dotted; Analyze: dashed"
- "Flow labels are text strings on the arrow path ('Process and store', 'Deploy model')"
- "A legend box at the bottom explains the line patterns if multiple flow types exist"
# Connector and typography rules
- "Service blocks use solid fills with NO stroke (strokeColor=none)"
- "Text is NEVER pure black — always charcoal #312D2A"
- "Font is Oracle Sans (falls back to Segoe UI)"
- "Icons are composite multi-layer Visio stencils in the OCI Library.xml"
- "ALL connectors use charcoal #312D2A — same as text, NOT colored"
- "Connectors use open arrow tips (endArrow=open, endFill=0) — never filled blocks"
- "Connectors use orthogonal routing (edgeStyle=orthogonalEdgeStyle) — never diagonal"
- "Arrow size is small and consistent (endSize=6)"
- "Dashed lines differentiate replication/migration from standard flows"
- "FastConnect is bidirectional (startArrow=open + endArrow=open)"
- "Oracle DB-related services use copper #AA643B"
- "Integration/messaging services use purple #804998"
- "All other OCI services use teal #2D5967"
reference_diagrams_analyzed:
# 7 Oracle Architecture Center diagrams analyzed visually (2026-03-17)
# Used to confirm and extend the style guide from OCI Toolkit v24.2
- url: "https://docs.oracle.com/en/solutions/exadb-dr-on-db-azure/img/exadb-dr-db-azure.png"
topology: "multi-region multi-cloud (ExaDB DR on Database@Azure)"
- url: "https://docs.oracle.com/en/solutions/hub-spoke-network-drg/img/hub-and-spoke-drg.png"
topology: "hub-spoke networking with DRG"
- url: "https://docs.oracle.com/en/solutions/data-platform-lakehouse/img/lakehouse-architecture.png"
topology: "data lakehouse (multi-tier, analytics)"
- url: "https://docs.oracle.com/en/solutions/deploy-oke-with-bastion-and-github/img/oke-bastion-deployment-diagram.png"
topology: "OKE with Bastion and GitHub Actions"
- url: "https://docs.oracle.com/en/solutions/cis-oci-benchmark/img/oci-core-landingzone.png"
topology: "CIS Landing Zone (complex, multi-compartment)"
- url: "https://docs.oracle.com/en/solutions/deploy-autonomous-database-db-at-azure/img/autonomous-database-db-azure-diagram.png"
topology: "ADB-S on Database@Azure (multi-cloud)"
- url: "https://docs.oracle.com/en/solutions/data-application-integration-workloads/img/integration-architecuture-pattern-1.png"
topology: "data integration pattern"
# ============================================================
# FULL ICON CATALOG (224 icons in OCI Library.xml)
# ============================================================
# See separate file for the full icon list.
# Key icons for Deal Accelerator:
# 37: Database - Autonomous DB
# 18: Networking - Load Balancer
# 32: Networking - Internet Gateway
# 33: Networking - NAT Gateway
# 31: Networking - Service Gateway
# 30: Networking - Dynamic Routing Gateway DRG
# 102: Identity and Security - WAF
# 105: Identity and Security - Vault
# 106: Identity and Security - Bastion
# 45: Database - Data Safe
# 46: Database - NoSQL
# 74: Developer Services - Container Engine for Kubernetes
# 2: Compute - Functions
# 3: Compute - Virtual Machine VM
# 65: Analytics and AI - Streaming
# 127: Observability and Management - Queuing
# 79: Developer Services - API Gateway
# 120: Observability and Management - Monitoring
# 123: Observability and Management - Logging Analytics

55
kb/diagram/reference-layouts/database-ha-dr.yaml Normal file
View File

@@ -0,0 +1,55 @@
---
last_verified: 2026-03-14
description: Reference layout for database HA/DR architecture diagram
---
layout:
name: "Database HA/DR — Dual Region"
page_size: "A3 landscape"
structure:
# Primary region takes 60% of width
primary_region:
position: { x: 20, y: 40 }
size: { width: 680, height: 720 }
contains:
vcn:
position: { x: 20, y: 40 }
size: { width: 640, height: 660 }
subnets:
data_tier:
position: { x: 20, y: 30 }
size: { width: 300, height: 400 }
label_position: "top-left"
app_tier:
position: { x: 340, y: 30 }
size: { width: 280, height: 200 }
dmz:
position: { x: 340, y: 250 }
size: { width: 280, height: 100 }
# DR region takes 35% of width
dr_region:
position: { x: 720, y: 40 }
size: { width: 460, height: 720 }
contains:
vcn:
position: { x: 20, y: 40 }
size: { width: 420, height: 400 }
subnets:
dr_data_tier:
position: { x: 20, y: 30 }
size: { width: 380, height: 350 }
# Connection between regions (horizontal)
inter_region_connection:
from: "data_tier"
to: "dr_data_tier"
style: "adg"
label_position: "center"
notes:
- "Primary region on left, DR region on right"
- "Data Guard arrow flows left → right"
- "FastConnect shown at bottom connecting to on-premises"
- "Security services (Vault, Data Safe) placed near data tier"

70
kb/diagram/reference-layouts/single-region-ha.yaml Normal file
View File

@@ -0,0 +1,70 @@
---
last_verified: 2026-03-14
layout: Single Region with HA
description: |
Reference layout for a single-region deployment with high availability.
Suitable for most production workloads not requiring cross-region DR.
---
canvas:
width: 1200
height: 800
structure:
tenancy:
x: 0
y: 0
width: 1200
height: 800
region:
x: 20
y: 40
width: 1160
height: 740
vcn:
x: 20
y: 40
width: 1100
height: 680
subnets:
public_web:
position: top
x: 20
y: 30
width: 520
height: 180
purpose: "Load balancers, WAF"
private_app:
position: middle
x: 20
y: 230
width: 520
height: 200
purpose: "Application servers, OKE workers"
private_db:
position: bottom
x: 20
y: 450
width: 1060
height: 200
purpose: "Database instances, Data Safe, Vault"
private_mgmt:
position: right
x: 560
y: 30
width: 500
height: 400
purpose: "Bastion, monitoring, management"
notes: |
- Place load balancers in public subnet at top
- App tier in private subnet in middle
- Database tier in private subnet at bottom (widest)
- Management/security services in right column
- Services flow top-to-bottom: LB → App → DB

312
kb/field-findings/tracker.yaml Normal file
View File

@@ -0,0 +1,312 @@
# =============================================================================
# FIELD FINDINGS TRACKER
# =============================================================================
#
# INTERNAL & CONFIDENTIAL — DO NOT SHARE EXTERNALLY
#
# Log of real issues, limitations, bugs, and surprises found during customer
# engagements. Each entry is a finding that another architect should know about
# before hitting the same wall.
#
# Entry format:
# id: Unique identifier (FF-YYYYMM-NNN)
# date: When discovered (YYYY-MM-DD)
# contributor: Attribution block (replaces flat "reported_by")
# name: Who found it (required)
# team: Team or role (required)
# client: Client name or anonymized reference (optional)
# context: Brief context — PoC, migration, assessment (optional)
# confidence: validated / observed / reported / inferred (required)
# product: OCI product/service affected
# version: Product version if relevant
# severity: CRITICAL / HIGH / MEDIUM / LOW / INFO
# category: bug / limitation / undocumented / gotcha / workaround / performance
# summary: One-line description
# detail: Full description of the finding
# workaround: How to work around it (if known)
# oracle_sr: Oracle SR number (if filed)
# status: open / resolved / wontfix / acknowledged / monitoring
# resolved_date: When resolved (if applicable)
# resolution: How it was resolved
# affects_matrix: Feature matrix entry this relates to (if any)
# tags: Searchable tags
# confirmations: List of peer confirmations (optional)
#
# HOW TO ADD:
# 1. Add entry at the TOP of the findings list (newest first)
# 2. Use next sequential ID: FF-YYYYMM-NNN
# 3. Be specific — include CLI versions, API errors, exact messages
# 4. If you filed an SR, include the number
# 5. Update status when resolved
# =============================================================================
---
last_updated: "2026-03-14"
findings:
- id: "FF-202603-008"
date: "2026-03-14"
reported_by: "Diego Cabrera"
client: "Vector Search Customer"
product: "ADB-S"
version: "23ai"
severity: "HIGH"
category: "limitation"
summary: "Distributed HNSW indexes not available — 100M+ vector search requires partitioning workaround"
detail: |
ADB-S AI Vector Search supports HNSW indexes but they are node-local on
multi-node RAC (≥64 ECPUs). At 100M+ vectors, queries on a 2-node RAC
miss vectors on the other node. Results are either incomplete or require
cross-node scan that blows P95 >200ms.
Workaround from internal DB PM team: hash-partition vector table on
vector_id, create partition-local HNSW index. Queries hit single
partition on single node, maintaining <50ms at 100M scale.
Requires table redesign — cannot be applied to existing unpartitioned
vector tables without data reload.
workaround: |
Hash-partition vector table by vector_id. Create HNSW index as LOCAL
(partition-level). Ensure partition pruning in queries.
Source: internal DB PM team contact [name].
Validated on ADB-S 23ai with 120M vectors, P95 = 38ms on 64 ECPU.
oracle_sr: ""
status: "acknowledged"
resolved_date: null
resolution: null
affects_matrix: "AI Vector Search (HNSW)"
tags: ["vector-search", "hnsw", "distributed", "rac", "partitioning", "100m", "latency", "ai-vector-search"]
- id: "FF-202603-001"
date: "2026-03-10"
contributor:
name: "Diego Cabrera"
team: "Field Architecture"
client: "Strategic Migration Customer"
context: "Production migration"
confidence: "validated"
product: "OCI CLI"
version: "CLI 3.73.1 and 3.75.0"
severity: "MEDIUM"
category: "bug"
summary: "OCI CLI --autonomous-database-maintenance-window has JSON serialization bug"
detail: |
The --autonomous-database-maintenance-window parameter fails with a JSON
serialization error on both OCI CLI 3.73.1 (Cloud Shell) and 3.75.0
(VM decabrer-4S46W64). The expected JSON schema is:
{"dayOfWeek": {"name": "SATURDAY"}, "hourOfDay": 4}
But the CLI cannot serialize this properly. API returns 403 at create time.
Tested via dry-run: the 204 response is received but actual creation fails.
workaround: "Use OCI Console to set maintenance window. Or set post-creation via API directly (not CLI)."
oracle_sr: ""
status: "open"
resolved_date: null
resolution: null
affects_matrix: "OCI CLI Management"
tags: ["cli", "maintenance-window", "adb", "dep", "json", "serialization"]
- id: "FF-202603-002"
date: "2026-03-08"
contributor:
name: "Diego Cabrera"
team: "Field Architecture"
client: "Strategic Migration Customer"
context: "Production migration"
confidence: "validated"
product: "ADB-S Dedicated Elastic Pool (DEP)"
version: "23ai"
severity: "HIGH"
category: "limitation"
summary: "ADG must be disabled before joining Dedicated Elastic Pool"
detail: |
When attempting to add an ADB-S instance with active Autonomous Data Guard
to a Dedicated Elastic Pool, the operation fails. ADG must be explicitly
disabled before the instance can join the DEP. This is a known issue
acknowledged by Oracle but not prominently documented.
Impact: requires a brief HA gap during DEP onboarding. Must coordinate
with the customer's change window.
workaround: "Disable ADG → join DEP → re-enable ADG. Plan for ~15 min HA gap."
oracle_sr: ""
status: "acknowledged"
resolved_date: null
resolution: null
affects_matrix: "Elastic Pool Membership"
tags: ["dep", "adg", "elastic-pool", "ha", "limitation"]
- id: "FF-202603-003"
date: "2026-03-05"
contributor:
name: "Diego Cabrera"
team: "Field Architecture"
client: "Strategic Migration Customer"
context: "Production migration"
confidence: "validated"
product: "ADB-S Dedicated Elastic Pool (DEP)"
version: "23ai"
severity: "MEDIUM"
category: "undocumented"
summary: "DEP maintenance window immutable post-creation — change only via SR"
detail: |
The maintenance window for a Dedicated Elastic Pool cannot be changed
after creation via Console, CLI, or API. The only way to change it is
by filing a Service Request with Oracle Support.
Default window is Saturday/Sunday. Other days require specifying at
creation time (which itself has the CLI bug — see FF-202603-001) or
requesting via SR.
workaround: "Set desired window at DEP creation time (via Console, not CLI). If missed, file SR."
oracle_sr: ""
status: "acknowledged"
resolved_date: null
resolution: null
affects_matrix: "Auto Patching"
tags: ["dep", "maintenance-window", "immutable", "sr-required"]
- id: "FF-202603-004"
date: "2026-03-01"
contributor:
name: "Diego Cabrera"
team: "Field Architecture"
client: "Strategic Migration Customer"
context: "Production migration"
confidence: "validated"
product: "ADB-S"
version: "23ai"
severity: "MEDIUM"
category: "gotcha"
summary: "DEP provisioning takes days to weeks depending on capacity"
detail: |
Dedicated Elastic Pool provisioning is NOT instant like ADB-S Serverless.
It requires physical Exadata infrastructure allocation. Lead time varies
from 3 days (if capacity available in region) to 2-3 weeks (if capacity
needs to be provisioned).
Billing starts only at AVAILABLE state, not at request time.
Co-location of existing ADB-S instances happens at the next maintenance
window after joining, not immediately.
workaround: "Request DEP early in the project timeline. Don't make it a critical-path dependency in week 1."
oracle_sr: ""
status: "acknowledged"
resolved_date: null
resolution: null
affects_matrix: "Elastic Pool Membership"
tags: ["dep", "provisioning", "lead-time", "capacity", "planning"]
- id: "FF-202603-005"
date: "2026-02-20"
contributor:
name: "Diego Cabrera"
team: "Field Architecture"
client: "Strategic Migration Customer"
context: "Production migration"
confidence: "observed"
product: "ADB-S"
version: "23ai"
severity: "LOW"
category: "gotcha"
summary: "Refreshable Clone failed refresh leaves clone in AVAILABLE state — detection delay"
detail: |
When a Refreshable Clone's auto-refresh fails, the clone remains in
AVAILABLE state (not DISCONNECTED). The Elastic Pool leader monitors
lifecycle state changes, not refresh success/failure.
This means a failed refresh is NOT immediately detected by the
infrastructure. The stale data window equals the ADG RTO for
unplanned scenarios.
workaround: |
Planned switchovers: DBMS_PROXY_SQL.DISABLE_READ_ONLY_OFFLOAD proactively.
Unplanned: OCI Events + OCI Function that monitors refresh state and
disables read offload automatically. Reduces stale window to ~ADG RTO.
oracle_sr: ""
status: "monitoring"
resolved_date: null
resolution: null
affects_matrix: "Refreshable Clone"
tags: ["refreshable-clone", "stale-reads", "elastic-pool", "detection-delay", "proxysql"]
- id: "FF-202603-006"
date: "2026-02-15"
contributor:
name: "Diego Cabrera"
team: "Field Architecture"
client: "Strategic Migration Customer"
context: "Migration assessment"
confidence: "validated"
product: "OCI DMS"
version: "current"
severity: "MEDIUM"
category: "limitation"
summary: "Bidirectional GoldenGate replication not yet available in DMS"
detail: |
OCI Database Migration Service does not support bidirectional GoldenGate
replication. This is needed for zero-hard-cutover migration workflows
where the customer wants to run both source and target in parallel with
data flowing both ways during transition.
Feature request submitted to Oracle DMS PM team. In their pipeline but
no committed timeline. Offered beta participation.
workaround: "Use standalone GoldenGate deployment (not DMS-managed) for bidirectional replication."
oracle_sr: ""
status: "open"
resolved_date: null
resolution: null
affects_matrix: null
tags: ["dms", "goldengate", "bidirectional", "migration", "zero-downtime"]
- id: "FF-202603-007"
date: "2026-02-10"
contributor:
name: "Diego Cabrera"
team: "Field Architecture"
client: "Pepe SRL"
context: "Discovery engagement"
confidence: "validated"
product: "ADB-S"
version: "23ai"
severity: "INFO"
category: "gotcha"
summary: "ADB-S Serverless RAC node split threshold at 64 ECPUs"
detail: |
ADB-S Serverless runs on 1 RAC node at ≤24 ECPUs and splits to 2 nodes
at 64 ECPUs (16 cpu_count each). The gv$instance view only shows nodes
where the PDB is open.
This affects connection pooling behavior and session distribution.
Applications should use UCP or JDBC connection pool with FAN events
to handle the multi-node scenario properly.
workaround: "Ensure connection pool configuration handles multi-node. Use UCP with FAN."
oracle_sr: ""
status: "acknowledged"
resolved_date: null
resolution: null
affects_matrix: null
tags: ["adb-s", "rac", "ecpu", "node-split", "connection-pooling"]
# =========================================================================
# TEMPLATE — Copy this for new entries:
# =========================================================================
# - id: "FF-YYYYMM-NNN"
# date: "YYYY-MM-DD"
# contributor:
# name: ""
# team: ""
# client: "" # Optional — anonymize if sensitive
# context: "" # Optional — PoC, migration, assessment
# confidence: "" # validated / observed / reported / inferred
# product: ""
# version: ""
# severity: "" # CRITICAL / HIGH / MEDIUM / LOW / INFO
# category: "" # bug / limitation / undocumented / gotcha / workaround / performance
# summary: ""
# detail: |
#
# workaround: ""
# oracle_sr: ""
# status: "" # open / resolved / wontfix / acknowledged / monitoring
# resolved_date: null
# resolution: null
# affects_matrix: null # Feature matrix entry name, or null
# tags: []
# confirmations: [] # Peer confirmations

247
kb/field-knowledge/gotchas.yaml Normal file
View File

@@ -0,0 +1,247 @@
# Field Knowledge: Real-World Gotchas and Lessons Learned
# From actual OCI deployments — things the documentation doesn't emphasize
gotchas:
- id: FK-001
area: "ADB-S Auto-Scaling"
severity: HIGH
description: |
ADB-S auto-scaling takes 2-3 minutes to activate. If you size base OCPUs
for average load (P50), short spikes will hit before scale-out completes.
Size base OCPUs for P75 sustained load.
recommendation: "Base OCPU = P75 CPU usage, not P50"
- id: FK-002
area: "ADB-S Private Endpoint"
severity: HIGH
description: |
ADB-S with public endpoint allows connections from the internet to the
DB listener. Always use private endpoints for production. This requires
a VCN subnet and Service Gateway.
recommendation: "Always use private endpoints. Never public for production."
- id: FK-003
area: "FastConnect Redundancy"
severity: HIGH
description: |
A single FastConnect virtual circuit is a single point of failure.
For production, deploy 2 virtual circuits on diverse physical paths.
Also configure IPSec VPN as a backup path.
recommendation: "2x FastConnect (diverse paths) + VPN backup"
- id: FK-004
area: "Service Limits"
severity: MEDIUM
description: |
OCI has default service limits per tenancy that are often too low for
production deployments. Request limit increases BEFORE go-live, as
approval can take 1-3 business days.
recommendation: "Submit service limit increase requests during planning phase"
- id: FK-005
area: "Block Volume Performance"
severity: MEDIUM
description: |
Block Volume IOPS scale with volume size. A 50 GB Balanced volume only
provides 3,000 IOPS. If you need 25,000 IOPS, you need at least 417 GB
(even if your data is only 50 GB).
recommendation: "Size volumes for IOPS, not just capacity. Over-provision if needed."
- id: FK-006
area: "OKE LoadBalancer Annotations"
severity: LOW
description: |
OKE creates a 10 Mbps Flexible Load Balancer by default for
LoadBalancer-type Kubernetes services. For production, set the
bandwidth annotation explicitly.
recommendation: |
Set annotation: service.beta.kubernetes.io/oci-load-balancer-shape: "flexible"
And: service.beta.kubernetes.io/oci-load-balancer-shape-flex-min: "100"
- id: FK-007
area: "Terraform State"
severity: MEDIUM
description: |
Don't store Terraform state locally or in git. Use OCI Object Storage
with versioning as the remote backend. Enable state locking.
recommendation: "Use OCI Object Storage as Terraform remote backend with state locking."
- id: FK-008
area: "Cross-Region Data Transfer"
severity: MEDIUM
description: |
Cross-region data transfer is not free. Data Guard redo transport,
Object Storage replication, and cross-region backup copy all incur
egress charges. Factor this into DR cost estimates.
recommendation: "Include cross-region egress in DR cost estimates"
- id: FK-009
area: "Identity Domain Limits"
severity: LOW
description: |
Free tier Identity Domain supports up to 2,000 users. For larger
deployments, upgrade to Premium Identity Domain.
recommendation: "Check user count against Identity Domain tier limits"
- id: FK-010
area: "Compartment Depth"
severity: LOW
description: |
Compartments can be nested up to 6 levels deep. In practice, 3-4 levels
is the sweet spot. Deeper nesting makes IAM policies harder to manage.
recommendation: "Limit compartment depth to 3-4 levels"
- id: FK-011
area: "VCN CIDR Planning"
severity: HIGH
description: |
VCN CIDRs cannot be changed after creation (you can add secondary CIDRs
but not modify the primary). Plan CIDR ranges carefully, especially
when on-premises integration is required.
recommendation: "Use /16 per VCN, document all CIDRs, avoid overlap with on-prem"
- id: FK-012
area: "Data Guard Switchover vs Failover"
severity: HIGH
description: |
Switchover is planned (zero data loss, both DBs running). Failover is
unplanned (potential data loss with async). Ensure runbooks distinguish
between the two and teams practice both.
recommendation: "Document and practice both switchover (planned) and failover (unplanned)"
- id: FK-013
area: "TAC Replay Limitations"
severity: MEDIUM
description: |
Transparent Application Continuity (TAC) cannot replay operations that
have external side effects: UTL_HTTP calls, DBMS_PIPE, NOCACHE sequences,
and certain PL/SQL constructs. These cause replay to abort and the
application sees the error. Audit application code before relying on TAC.
recommendation: "Audit application for non-replayable operations before enabling TAC"
- id: FK-014
area: "ADB-S Auto Indexing"
severity: LOW
description: |
ADB-S Auto Indexing creates indexes with VISIBILITY=INVISIBLE (HIDDEN).
They exist and are used by the optimizer but don't appear in standard
DBA_INDEXES views unless you filter for invisible. This confuses DBAs
who think no indexes were created.
recommendation: "Query DBA_INDEXES with VISIBILITY='INVISIBLE' to see auto-created indexes"
- id: FK-015
area: "Database Enterprise Patching (DEP)"
severity: MEDIUM
description: |
DEP provisioning can take 30-60 minutes for DBCS/ExaCS. Plan maintenance
windows accordingly. DEP also requires Fleet Management setup which has
its own prerequisites (OS Management Hub agent, etc.).
recommendation: "Set up DEP and Fleet Management early; plan for 60-minute patching windows"
- id: FK-016
area: "ExaCS Minimum Cost"
severity: HIGH
description: |
ExaCS requires dedicated Exadata infrastructure. Minimum configuration
(quarter rack) starts at ~$6,000/month before database licensing.
Don't recommend for workloads under 16 OCPUs sustained.
recommendation: "Use ADB-S or DBCS for workloads < 16 OCPUs; ExaCS only for isolation/RAC/high IOPS"
- id: FK-017
area: "Cross-Region ADG is Async Only"
severity: HIGH
description: |
Cross-region Autonomous Data Guard uses asynchronous replication only.
RPO is always > 0 (typically seconds). For zero RPO you need same-region
standby or ADB-D with local synchronous Data Guard.
recommendation: "Set customer expectations: cross-region DR = RPO > 0 (seconds, not zero)"
- id: FK-018
area: "OKE VCN-Native Pod Networking"
severity: MEDIUM
description: |
VCN-Native Pod Networking (OCI CNI) assigns VCN IPs directly to pods.
This enables NSG attachment to pods but consumes subnet IP addresses
rapidly. A /24 subnet supports ~250 pods. Size subnets for pod count,
not node count.
recommendation: "Use /21 or larger subnets for pod networking; calculate IPs from max pod count"
- id: FK-019
area: "Object Storage Eventual Consistency"
severity: MEDIUM
description: |
OCI Object Storage provides strong read-after-write consistency for PUTs
of new objects, but LIST operations may show eventual consistency.
If your application lists then reads immediately after upload, the new
object may not appear in the list yet.
recommendation: "Don't rely on LIST immediately after PUT; use specific GET for confirmation"
- id: FK-020
area: "Database@AWS — ADB-S NOT available"
severity: HIGH
description: |
Oracle Database@AWS only supports ADB on Dedicated Exadata Infrastructure
(ADB-D), NOT ADB-S Serverless. Customers expecting serverless auto-scaling
and pay-per-query pricing will be disappointed. If ADB-S is required,
the architecture must use native OCI with FastConnect from AWS — which
adds ~1-2ms RTT vs the ~0.2-0.4ms of Database@AWS co-located infra.
recommendation: |
Clarify ADB-S vs ADB-D early in discovery. If P95 <1ms AND serverless
are both hard requirements, they are mutually exclusive with current
Database@AWS offering. Trade-off: co-located ADB-D (low latency) vs
native OCI ADB-S (serverless) via FastConnect (higher latency).
- id: FK-021
area: "Database@AWS — Same-AZ placement is critical"
severity: HIGH
description: |
Database@AWS latency drops from ~0.2-0.4ms (same AZ) to ~1ms+ (cross-AZ).
If app EC2 and ODB network are in different AZs, you lose the latency
benefit that justifies co-location. Transit Gateway attachment must also
be in the same AZ as the ODB network.
recommendation: |
Always deploy app and ODB network in the same AZ. Document AZ choice
early — VM clusters cannot be moved between ODB networks after creation.
- id: FK-022
area: "Flex Shape Memory Ratio"
severity: LOW
description: |
VM.Standard.E4.Flex allows 1-64 GB per OCPU (default 16 GB). For
memory-intensive workloads, you can increase memory without adding OCPUs.
But memory is billed separately — verify it's cheaper than adding OCPUs
with default memory.
recommendation: "Compare cost of extra memory vs extra OCPUs for memory-intensive workloads"
- id: FK-024
area: "Exadata X11M — Minimum Configuration (ADB-D and ExaCS)"
severity: HIGH
description: |
Exadata X11M applies the same minimum configuration for both ADB-D and ExaCS:
2 DB servers + 3 storage servers. It is not possible to provision a single DB
server. This applies to X8M, X9M, and X11M generations.
Elastic range: 2–32 DB servers, 3–64 storage servers.
The tenancy service limits for X11M must be set to at least DB=2, Storage=3
before provisioning.
recommendation: "Always start X11M sizing at 2 DB servers + 3 storage servers minimum. Applies to both ADB-D and ExaCS."
source: "Verified — Oracle docs (ExaDB-D X11M datasheet, ADB-D X11M datasheet, OCI docs)"
references:
- "https://www.oracle.com/a/ocom/docs/engineered-systems/exadata/exadb-d-x11m-ds.pdf"
- "https://docs.oracle.com/en/cloud/paas/autonomous-database/dedicated/adbde/"
- id: FK-023
area: "GPU Bare Metal — Preemptible Availability"
severity: HIGH
description: |
OCI Preemptible instances (~50% off) are technically supported for BM shapes,
but for high-demand GPU bare metal shapes (BM.GPU.H100, BM.GPU.H200, BM.GPU.B200,
BM.GPU.B300) preemptible capacity is practically unavailable. These shapes are
sold almost entirely via reservations or Universal Credits commitments.
Additionally, preemptible instances can be reclaimed with only 30 seconds notice,
making them operationally unviable for multi-day or multi-week training runs.
recommendation: |
Do NOT model GPU BM cost savings based on preemptible pricing.
Use Universal Credits 1yr (~35% off) or 3yr (~55% off) for realistic estimates.
If the workload is short batch jobs tolerant to interruptions, ask your PDM
about spot/preemptible availability before committing to that model.
source: "Field experience — Diego, OCI SA"

96
kb/field-knowledge/lessons-learned.yaml Normal file
View File

@@ -0,0 +1,96 @@
---
last_verified: 2026-03-14
description: |
Lessons learned from real OCI deployments. Anonymized but based on
actual customer experiences.
---
lessons:
- id: LL-001
category: migration
title: "Always test GoldenGate replication before cutover"
context: |
Customer planned zero-downtime migration using GoldenGate replication
from on-prem Exadata to ADB-S. During cutover rehearsal, discovered
that several PL/SQL packages used database links that didn't work with
ADB-S private endpoints.
lesson: |
Run full regression testing with GoldenGate replication active for
at least 2 weeks before cutover. Test all database links, PL/SQL
packages, and application connectivity against the target.
recommendation: "Add 2-week parallel-run phase to every migration plan"
- id: LL-002
category: sizing
title: "P95 is not enough for seasonal workloads"
context: |
Retail customer sized ADB-S for P95 utilization from normal months.
During Black Friday, actual peak was 4x normal (well above P95).
Auto-scaling helped but wasn't fast enough for the initial surge.
lesson: |
For seasonal workloads, get metrics from the peak period specifically.
Generic P95 from normal months underestimates seasonal peaks.
recommendation: "Ask for peak-period metrics separately, size auto-scale max for peak"
- id: LL-003
category: networking
title: "Plan IP addressing before anything else"
context: |
Customer deployed dev, staging, and production with overlapping CIDR
ranges. When they needed VCN peering for shared services, had to
re-architect networking — required rebuilding all subnets.
lesson: |
IP addressing must be planned enterprise-wide before deploying
any VCN. Include on-prem ranges, future VCNs, and DR regions.
recommendation: "Create IP addressing document as first deliverable"
- id: LL-004
category: operations
title: "IaC from day one, not after"
context: |
Customer built initial infrastructure manually via console, planning
to "Terraformify" later. After 6 months, infrastructure had drifted
so far that reverse-engineering Terraform was more work than starting over.
lesson: |
Start with Terraform from the first resource. The cost of IaC on day
one is low; the cost of retrofitting is very high.
recommendation: "Include OCI Terraform provider setup in project kickoff"
- id: LL-005
category: cost
title: "Auto-scaling costs can surprise"
context: |
Customer enabled ADB-S auto-scaling with 3x maximum. Workload was
consistently hitting auto-scale range, resulting in 2x the expected
database costs. They were effectively paying for auto-scaled OCPUs
most of the time.
lesson: |
If workload consistently auto-scales, the base OCPU is too low.
Right-size base to P75 and use auto-scaling for genuine peaks.
recommendation: "Review auto-scaling usage monthly, adjust base OCPUs accordingly"
- id: LL-006
category: dr
title: "DR drill found app-tier gap"
context: |
Customer had cross-region ADG for database DR. During DR drill,
database failed over successfully in 3 minutes. But app tier had
no DR — compute instances were only in primary region. Recovery
took 2 hours to provision app tier in DR region.
lesson: |
DR must cover all tiers, not just the database. App tier, load
balancers, DNS, and certificates all need DR strategy.
recommendation: "Include app tier DR in all architecture proposals"
- id: LL-007
category: security
title: "Cloud Guard catches what humans miss"
context: |
Customer deployed without Cloud Guard. 3 months later, security
audit found public Object Storage buckets, overly permissive
security lists, and an unused API key with admin privileges.
Cloud Guard would have flagged all of these on day one.
lesson: |
Enable Cloud Guard in every deployment. It's free and catches
common misconfigurations automatically.
recommendation: "Cloud Guard is mandatory in security baseline"

77
kb/field-knowledge/real-world-limits.yaml Normal file
View File

@@ -0,0 +1,77 @@
---
last_verified: 2026-03-14
description: |
Real-world limits that differ from official documentation or are not
well-documented. These come from actual deployment experience.
---
limits:
- service: ADB-S
limit: "Concurrent connections"
documented: "300 per OCPU"
real_world: |
300 per OCPU is the hard limit, but performance degrades noticeably
past 200 active sessions per OCPU. Size for 200 concurrent active
sessions per OCPU, not 300.
recommendation: "Plan for 200 active sessions per OCPU as practical limit"
- service: ADB-S
limit: "Auto-scaling speed"
documented: "Automatic"
real_world: |
Takes 2-3 minutes to begin scaling. Not instantaneous. Very short
bursts (< 3 minutes) may complete before scaling activates.
recommendation: "Size base OCPUs for P75 to absorb initial burst"
- service: ExaCS
limit: "Provisioning time"
documented: "Hours"
real_world: |
Can take 4-8 hours for infrastructure provisioning. VM cluster
creation adds another 1-2 hours. Total: 6-10 hours first time.
recommendation: "Plan provisioning 1-2 business days ahead"
- service: OKE
limit: "Node provisioning"
documented: "Minutes"
real_world: |
Node provisioning: 3-5 minutes for compute instance.
Node ready (kubelet + image pull): 5-10 minutes total.
Pod scheduling after node ready: 10-30 seconds.
recommendation: "Plan for 10-minute node scale-up, keep warm pool for critical workloads"
- service: FastConnect
limit: "Provisioning time"
documented: "Varies by partner"
real_world: |
Partner-based: 2-6 weeks depending on partner and location.
Co-location: 1-2 weeks if already in the same facility.
Always have IPSec VPN as backup during provisioning.
recommendation: "Start procurement 6-8 weeks early, use VPN as interim"
- service: Block Volume
limit: "IOPS per volume"
documented: "Up to 25K (Balanced), 35K (Higher Performance)"
real_world: |
Documented limits are achievable with sufficient volume size.
Small volumes (< 200 GB) won't reach max IOPS due to per-GB ratio.
Need 417 GB for 25K IOPS on Balanced (60 IOPS/GB).
recommendation: "Size volumes for IOPS requirement, not just capacity"
- service: Object Storage
limit: "API rate limits"
documented: "Request-based"
real_world: |
Burst throttling can occur at ~1000 requests/second per bucket.
Use multipart upload for large objects. Prefix partitioning helps
for high-throughput scenarios.
recommendation: "Use multipart upload, prefix partitioning for high throughput"
- service: ADB-S
limit: "Maximum databases per tenancy"
documented: "Service limits page"
real_world: |
Default limit is often 10-20 ADB instances per region. Need to
request limit increase via support ticket. Increases are usually
approved within 1-2 business days.
recommendation: "Request limit increases early in project planning"

149
kb/patterns/application-patterns.yaml Normal file
View File

@@ -0,0 +1,149 @@
# Application Patterns Library
# Proven application-level architecture patterns for common workload types
# Referenced during DESIGN/Future to select the right application architecture
patterns:
# --- Web Application Patterns ---
- id: app_web_traditional
name: "Traditional Web Application (3-Tier)"
description: "Classic presentation → application → database architecture on OCI"
applicable_when:
- "Java/J2EE, .NET, PHP, or Python web application"
- "WebLogic, Tomcat, or similar app server"
- "Stateful sessions or shared filesystem dependencies"
oci_architecture:
presentation_tier: "Load Balancer (public) → WAF"
application_tier: "Compute instances (VM.Standard.E4.Flex) in Instance Pool with auto-scaling"
database_tier: "ADB-S or DBCS depending on feature requirements"
networking: "Public subnet (LB) → Private subnet (app) → Private subnet (DB)"
technology_patterns: [compute_scaling, database_ha_adb_s, networking_basic, security_baseline]
considerations:
- "WebLogic clustering needs shared storage (FSS) or session replication"
- "Consider OKE if team has container skills and wants to modernize"
- id: app_web_cloud_native
name: "Cloud-Native Web Application"
description: "Containerized microservices on OKE with managed services"
applicable_when:
- "New application or major refactoring opportunity"
- "Team has Kubernetes experience"
- "Need rapid scaling and deployment"
oci_architecture:
presentation_tier: "Load Balancer → API Gateway"
application_tier: "OKE (managed K8s) with HPA auto-scaling"
database_tier: "ADB-S (OLTP) + autonomous JSON for microservice data"
messaging: "OCI Streaming (Kafka-compatible) for event-driven"
technology_patterns: [compute_scaling, database_ha_adb_s, networking_hub_spoke]
# --- Batch Processing Patterns ---
- id: app_batch_processing
name: "Batch / ETL Processing"
description: "Scheduled data processing, reporting, or ETL workloads"
applicable_when:
- "Nightly batch jobs, report generation, data warehousing"
- "Variable compute needs (high during batch windows)"
oci_architecture:
compute: "Preemptible instances or Functions for cost optimization"
orchestration: "Resource Scheduler or cron-based"
database: "ADB-S with auto-scaling (scale up during batch, scale down after)"
storage: "Object Storage for staging data"
technology_patterns: [database_ha_adb_s, compute_scaling]
considerations:
- "ADB-S auto-scaling takes 2-3 min to activate — pre-scale for predictable batch windows"
# --- Analytics Patterns ---
- id: app_analytics_lakehouse
name: "Analytics / Lakehouse"
description: "Data warehouse and analytics platform on OCI"
applicable_when:
- "Business intelligence, reporting, or advanced analytics"
- "Data from multiple sources needs consolidation"
- "Self-service analytics for business users"
oci_architecture:
ingestion: "GoldenGate or OCI Data Integration for CDC"
storage: "Object Storage (data lake) + ADB-DW (warehouse)"
analytics: "Oracle Analytics Cloud (OAC)"
governance: "Data Catalog for metadata management"
technology_patterns: [database_ha_adb_s]
# --- Hybrid Patterns ---
- id: app_hybrid_cloud
name: "Hybrid Cloud (On-Prem + OCI)"
description: "Application split across on-prem and OCI with connectivity"
applicable_when:
- "Cannot migrate everything at once"
- "Some workloads must stay on-prem (data gravity, regulation)"
- "Want to extend capacity to cloud"
oci_architecture:
connectivity: "FastConnect (primary) + IPSec VPN (backup)"
networking: "Hub-spoke VCN with DRG"
data_sync: "GoldenGate for bidirectional replication"
dns: "OCI DNS with split-horizon"
technology_patterns: [networking_hub_spoke, database_ha_adb_s]
considerations:
- "Latency between on-prem and OCI affects application performance"
- "FastConnect provisioning takes 2-4 weeks"
- "Consider data gravity — move compute to where data lives"
# --- Migration Patterns ---
- id: app_lift_and_shift
name: "Lift and Shift Migration"
description: "Move existing workloads to OCI with minimal changes"
applicable_when:
- "Timeline pressure (hardware EOL, contract expiry)"
- "Application is stable and not being modernized"
- "Want to get to cloud quickly, optimize later"
oci_architecture:
compute: "VM shapes matching current specs (use sizing ratios from kb/sizing/)"
database: "DBCS if feature compatibility requires, ADB-S if possible"
storage: "Block Volume (replacing SAN), FSS (replacing NFS)"
technology_patterns: [networking_basic, security_baseline]
considerations:
- "May not realize full cloud benefits initially"
- "Plan a Phase 2 optimization after stabilization"
- id: app_replatform
name: "Re-Platform (Lift, Tinker, Shift)"
description: "Migrate with targeted changes to leverage managed services"
applicable_when:
- "Want cloud benefits without full re-architecture"
- "Can accept minor application changes"
- "Database can move to managed service (ADB-S, MySQL HeatWave)"
oci_architecture:
compute: "OKE or Compute with auto-scaling"
database: "ADB-S (autonomous) vs DBCS (managed)"
storage: "Object Storage replacing file-based integrations"
technology_patterns: [database_ha_adb_s, compute_scaling]
considerations:
- "Test application compatibility with ADB-S restrictions early"
- "Connection string changes may require app config updates"
# --- Disaster Recovery Patterns ---
- id: app_dr_active_passive
name: "Active-Passive DR"
description: "Primary region active, standby region for failover"
applicable_when:
- "RTO 1-4 hours, RPO < 1 hour"
- "Cost-conscious — don't want to run full duplicate"
oci_architecture:
primary: "Full deployment in primary region"
standby: "Dormant compute (scaled down) + DB replica (Data Guard)"
failover: "DNS switchover + compute scale-up"
technology_patterns: [database_dr_cross_region, networking_hub_spoke]
- id: app_dr_active_active
name: "Active-Active Multi-Region"
description: "Both regions serve traffic, mutual failover"
applicable_when:
- "RTO < 15 min, RPO ~ 0"
- "Geo-distributed users"
- "Budget supports dual infrastructure"
oci_architecture:
both_regions: "Full deployment with load balancing"
database: "ADB-S with Autonomous Data Guard (bidirectional)"
traffic: "OCI Traffic Management for geo-steering"
technology_patterns: [database_dr_cross_region, database_ha_adb_s]
considerations:
- "Application must handle eventual consistency for cross-region writes"
- "Significantly higher cost (nearly 2x)"

107
kb/patterns/architecture-principles.yaml Normal file
View File

@@ -0,0 +1,107 @@
---
last_verified: 2026-03-16
pattern:
id: architecture-principles
name: "Architecture Principles (ECAL)"
category: governance
---
description: >
Formalized decision-making principles aligned with Oracle's ECAL framework.
The skill selects applicable principles based on the workload profile and
presents them in the proposal as the governance framework for the architecture.
principles:
design:
- id: "D-01"
name: "Operational Simplicity"
principle: "Keep architecture simple. If still complex, simplify again."
rationale: "Complex solutions tend to be inflexible, non-agile, and operationally fragile."
applies_when: "always"
- id: "D-02"
name: "Application First (SaaS > PaaS > IaaS)"
principle: "Always consider application services first, platform services second, infrastructure services as last resort."
rationale: "Higher-level services reduce operational burden and accelerate delivery."
applies_when: "always"
- id: "D-03"
name: "Use-Case Fit"
principle: "Map workloads into applicable use-cases. Architectural simplicity and operational success come from re-use."
rationale: "Custom architectures are expensive to build and maintain. Reference architectures exist for a reason."
applies_when: "always"
- id: "D-04"
name: "Hybrid-Ready"
principle: "Solution should run in hybrid mode, accounting for network bandwidth and latency."
rationale: "Most enterprise migrations have a hybrid phase. Architecture must work during transition."
applies_when: "on-prem exists or migration is phased"
- id: "D-05"
name: "HA for Business Continuity"
principle: "Architect for availability, prepare for disaster, leverage cloud's built-in resilience."
rationale: "HA is cheaper to build in from day 1 than to retrofit."
applies_when: "always"
- id: "D-06"
name: "Compliance by Design"
principle: "Consider required compliance requirements and existing policies from the initial design phase."
rationale: "Retrofitting compliance is orders of magnitude more expensive than designing for it."
applies_when: "compliance requirements identified (PCI, HIPAA, banking, GDPR)"
deployment:
- id: "P-01"
name: "Automation First"
principle: "Strive to automate production processes from the beginning — infrastructure as code, seeded features."
rationale: "Manual processes don't scale, are error-prone, and create key-person dependencies."
applies_when: "always"
- id: "P-02"
name: "Environment Separation"
principle: "Production always separated from test and dev. Clear lifecycle policy."
rationale: "Prevents accidental data exposure and configuration drift."
applies_when: "always"
- id: "P-03"
name: "API-Centric Integration"
principle: "Prefer integration via REST APIs over lower-level network protocols."
rationale: "APIs are versionable, documentable, and testable. Direct DB links are fragile."
applies_when: "integration points exist"
- id: "P-04"
name: "Data Security at Rest and In Transit"
principle: "Encrypt data at rest (TDE) and in transit (SQL*Net encryption). Key management from day 1."
rationale: "Encryption is a baseline, not an option. Key management complexity grows with scale."
applies_when: "always"
- id: "P-05"
name: "Unified Identity Management"
principle: "All users managed in central identity system. SSO. Federation where applicable."
rationale: "Distributed identity is a security liability."
applies_when: "always"
service:
- id: "S-01"
name: "Cloud Monitoring & Management"
principle: "Map management and monitoring requirements explicitly. Use cloud-native tools first."
rationale: "Observability gaps become operational crises during incidents."
applies_when: "always"
- id: "S-02"
name: "Issue & Incident Management"
principle: "Design for service. Adopt incident management with clear ownership, governance, and SLAs."
rationale: "Without defined escalation paths, incidents become crises."
applies_when: "always"
- id: "S-03"
name: "Solution Lifecycle"
principle: "Map governance for cloud solution lifecycle. Apply ITIL/ITSM frameworks. Readiness for continuous change."
rationale: "Cloud evolves constantly. The architecture must evolve with it."
applies_when: "always"
- id: "S-04"
name: "Cloud Onboarding"
principle: "Setup PoC environment first. Early Customer Success Management involvement."
rationale: "Hands-on validation before commitment reduces risk and builds confidence."
applies_when: "customer is new to OCI"

217
kb/patterns/business-drivers.yaml Normal file
View File

@@ -0,0 +1,217 @@
---
last_verified: 2026-03-18
pattern:
id: business-drivers
name: "Business Drivers Framework"
category: define
---
description: >
Categorizes customer business drivers into four pillars (Strategic,
Financial, Business Ops, IT Ops) and maps them to cloud value
propositions. Used during DEFINE phase to structure the Value Story
and during CONFIRM to frame the Solution Proposal. Source: ECAL 3.1.
# ═══════════════════════════════════════════════════════════════
# The Four Pillars
# ═══════════════════════════════════════════════════════════════
pillars:
strategic:
label: "Strategic"
headline: "Business Transformation to Cloud"
description: >
Long-term strategic positioning. Cloud as enabler for business
model evolution, M&A, market expansion, or competitive defense.
common_drivers:
- "Cloud-first / cloud-native strategy mandated by CxO"
- "Digital transformation initiative"
- "Merger or acquisition requiring platform consolidation"
- "Geographic expansion requiring global infrastructure"
- "Competitive pressure from cloud-native disruptors"
- "Board/investor mandate for technology modernization"
- "Innovation enablement (AI/ML, IoT, blockchain)"
value_propositions:
- "Cloud-based solution with enterprise features"
- "On-premise security with cloud economics (C@C, dedicated region)"
- "Customer-defined security model"
- "Data sovereignty and residency guarantees"
- "Multi-cloud and hybrid flexibility"
financial:
label: "Financial"
headline: "Cost Optimization"
description: >
Direct financial impact. CAPEX→OPEX shift, license optimization,
support cost reduction, consumption-based pricing.
common_drivers:
- "Reduce total cost of ownership (TCO)"
- "Shift from CAPEX to OPEX model"
- "Optimize Oracle licensing (ULA wind-down, BYOL)"
- "Reduce data center costs (power, cooling, space, staff)"
- "Support rebate / simplified licensing"
- "Avoid hardware refresh cycle"
- "Consumption-based pricing alignment with business cycles"
value_propositions:
- "Subscription and consumption-based commercials"
- "Simplified licensing (BYOL, universal credits)"
- "PAYG flexibility for variable workloads"
- "Support cost reduction via managed services"
- "Elimination of hardware refresh capex"
quantification_tips:
- "Compare 3-year TCO: current state vs. OCI (include staff, power, space)"
- "Factor in support rebate for moving to OCI"
- "Account for BYOL savings (if eligible)"
- "Include non-prod savings (auto-scaling, auto-stop)"
business_ops:
label: "Business Operations"
headline: "Faster Time to Market"
description: >
Business agility and speed. Faster development cycles, quicker
deployment of new capabilities, reduced time-to-value.
common_drivers:
- "Faster development and deployment of new applications"
- "Reduce release cycle from months to weeks"
- "Enable self-service provisioning for developers"
- "Data platform for analytics and decision-making"
- "Support rapid experimentation and A/B testing"
- "Enable mobile/digital channels faster"
- "Partner and ecosystem integration"
value_propositions:
- "Faster development of customer-facing and internal apps"
- "Data platform implementation (lakehouse, analytics)"
- "Self-service database provisioning"
- "CI/CD and DevOps enablement"
- "Integration with partner ecosystems"
it_ops:
label: "IT Operations"
headline: "Operational Efficiency"
description: >
IT team productivity and operational excellence. Reduce toil,
improve reliability, automate operations.
common_drivers:
- "Reduce DBA / sysadmin toil (patching, backups, monitoring)"
- "Improve availability and reduce unplanned downtime"
- "Standardize operations across environments"
- "Automate provisioning and lifecycle management"
- "Improve disaster recovery posture"
- "Address skill gaps (hard to hire Oracle DBAs)"
- "Consolidate tooling and reduce tool sprawl"
- "Performance improvement without hardware throw"
value_propositions:
- "Oracle Managed Cloud environment"
- "Autonomous operations (ADB self-tuning, self-patching)"
- "Data platform implementation and consolidation"
- "Performance improvement via Exadata architecture"
- "Unified monitoring and management (OCI native tools)"
# ═══════════════════════════════════════════════════════════════
# Mapping: Business Driver → Hypothesis Family
# ═══════════════════════════════════════════════════════════════
# Use this to quickly map a customer's stated driver to a
# hypothesis family for the Value Story
hypothesis_families:
db_consolidation:
triggers:
- "Too many databases across too many platforms"
- "Hardware refresh coming due"
- "DBA team stretched thin"
- "License compliance concerns"
use_cases:
- "Consolidation of N databases to shared platform"
- "Transform to fully managed operations"
- "Improved elasticity and cost control"
- "Standardized backup, HA, and DR"
typical_services:
- "ADB-S or ADB-D (for consolidation)"
- "ExaCS or ExaCC (for large scale)"
- "OEM for fleet management"
pillar_alignment: ["financial", "it_ops"]
cloud_migration:
triggers:
- "Data center lease expiring"
- "Cloud-first mandate"
- "Competitive pressure"
- "EOL hardware or software"
use_cases:
- "Lift-and-shift existing Oracle workloads"
- "Re-platform to managed services"
- "Hybrid cloud (keep some on-prem)"
typical_services:
- "OCI Compute (VM/BM)"
- "ExaCS (for Oracle DB workloads)"
- "ADB-S (for re-platform)"
- "FastConnect + VPN"
pillar_alignment: ["strategic", "financial"]
modernization:
triggers:
- "Legacy app can't support new business requirements"
- "Technical debt is slowing delivery"
- "Need for microservices or API-first"
- "AI/ML capabilities required"
use_cases:
- "Re-architect legacy apps to cloud-native"
- "Add AI/ML capabilities to existing workflows"
- "Microservices decomposition"
- "APEX rapid app development"
typical_services:
- "OKE (Kubernetes)"
- "ADB-S + APEX"
- "OCI AI Services"
- "API Gateway + Functions"
pillar_alignment: ["business_ops", "strategic"]
dr_and_resilience:
triggers:
- "Recent outage or near-miss"
- "Audit finding on DR gaps"
- "Insurance or compliance requirement"
- "Business continuity plan update"
use_cases:
- "Cross-region DR for critical workloads"
- "Active-active for zero RPO"
- "Pilot light DR for cost optimization"
typical_services:
- "Cross-region ADG"
- "Full Stack DR"
- "Object Storage for backups"
pillar_alignment: ["it_ops", "strategic"]
compliance_driven:
triggers:
- "New regulation (DORA, NIS2, GDPR enforcement)"
- "Audit finding requiring remediation"
- "Data sovereignty requirement"
- "Industry-specific mandate (banking, healthcare)"
use_cases:
- "Data residency with OCI regions or dedicated region"
- "Encryption and key management (customer-managed keys)"
- "Access controls and audit trail"
- "Isolated compute (C@C, dedicated region)"
typical_services:
- "OCI Vault (KMS)"
- "Data Safe"
- "Cloud Guard"
- "ExaCC or Dedicated Region"
pillar_alignment: ["strategic", "it_ops"]
# ═══════════════════════════════════════════════════════════════
# Usage in the skill
# ═══════════════════════════════════════════════════════════════
skill_usage:
define_phase:
- "Parse discovery notes to identify which pillar(s) are dominant"
- "Use pillar alignment to select the right hypothesis family"
- "Structure the Value Story around the dominant 1-2 pillars"
- "Use value_propositions as talking points for the proposal"
confirm_phase:
- "Frame the Solution Proposal business case around the identified pillars"
- "Use quantification_tips for the financial pillar"
- "Map each architecture decision back to the business driver"

128
kb/patterns/business-patterns.yaml Normal file
View File

@@ -0,0 +1,128 @@
# Business Patterns Library
# Proven business-level patterns that map customer drivers to OCI solution strategies
# Referenced during DEFINE/Ideate to formulate value hypotheses
patterns:
# --- Cost Optimization Patterns ---
- id: biz_cost_reduction_db
name: "Database Cost Reduction"
business_driver: cost_reduction
hypothesis_template: "Migrate {n} Oracle databases from {current_platform} to ADB-S, reducing total DB cost by {pct}% through autonomous operations and BYOL/ULA leverage"
applicable_when:
- "Customer runs Oracle databases on-prem or in AWS/Azure"
- "Existing ULA or BYOL licenses available"
- "DBA team spends >50% time on maintenance tasks"
typical_outcome:
cost_savings: "40-70% vs on-prem, 30-50% vs AWS RDS Oracle"
operational_savings: "50-80% reduction in DBA administrative effort"
evidence:
- "ADB-S automates patching, tuning, backups"
- "BYOL cost advantage vs AWS License Included"
technology_patterns: [database_ha_adb_s, database_dr_cross_region]
risks: ["Feature compatibility gaps", "Migration complexity for customized DBs"]
- id: biz_cost_reduction_compute
name: "Compute Cost Optimization"
business_driver: cost_reduction
hypothesis_template: "Right-size and modernize {n} compute workloads to OCI Flex shapes with auto-scaling, reducing compute spend by {pct}%"
applicable_when:
- "Over-provisioned VMs on-prem or in another cloud"
- "Variable workload patterns with steady-state over-provisioning"
typical_outcome:
cost_savings: "30-50% through right-sizing + auto-scaling"
technology_patterns: [compute_scaling]
# --- Modernization Patterns ---
- id: biz_app_modernization
name: "Application Modernization"
business_driver: modernization
hypothesis_template: "Modernize {app_name} from {current_stack} to cloud-native on OKE, improving deployment frequency from {current_freq} to {target_freq}"
applicable_when:
- "Monolithic application limiting agility"
- "Slow deployment cycles (monthly or longer)"
- "Team has or is building container/K8s skills"
typical_outcome:
deployment_frequency: "From monthly to daily/weekly"
scalability: "Horizontal auto-scaling vs vertical only"
technology_patterns: [compute_scaling]
risks: ["Requires significant app refactoring", "Team skill gap"]
- id: biz_db_modernization
name: "Database Modernization (non-Oracle)"
business_driver: modernization
hypothesis_template: "Migrate {db_engine} to OCI-managed {target_service}, eliminating operational overhead while maintaining application compatibility"
applicable_when:
- "Running self-managed MySQL, PostgreSQL, or MongoDB"
- "Want to reduce operational burden without app rewrite"
typical_outcome:
operational_savings: "Automated backups, patching, HA"
technology_patterns: [database_ha_adb_s]
# --- Compliance Patterns ---
- id: biz_compliance_driven
name: "Compliance-Driven Migration"
business_driver: compliance
hypothesis_template: "Migrate {scope} to OCI to meet {compliance_framework} requirements by {deadline}, leveraging OCI's built-in compliance controls"
applicable_when:
- "Upcoming compliance audit or certification deadline"
- "Current infrastructure doesn't meet regulatory requirements"
- "Data residency or sovereignty requirements"
typical_outcome:
compliance: "Certification-ready infrastructure"
timeline: "Typically 8-16 weeks for standard compliance scope"
technology_patterns: [security_baseline, compliance_pci]
risks: ["Compliance scope creep", "Shared responsibility model gaps"]
# --- Hardware EOL / Contract Expiry Patterns ---
- id: biz_hardware_eol
name: "Hardware End-of-Life Migration"
business_driver: hardware_eol
hypothesis_template: "Migrate {n} workloads from EOL {hardware} to OCI before {eol_date}, avoiding {cost} hardware refresh while gaining cloud elasticity"
applicable_when:
- "On-prem hardware approaching end of support"
- "Capital expenditure avoidance is a driver"
- "Timeline is fixed by hardware support dates"
typical_outcome:
capex_avoidance: "Avoid $X hardware refresh"
opex_model: "Shift to predictable OpEx"
technology_patterns: [database_ha_adb_s, compute_scaling, networking_basic]
- id: biz_contract_expiry
name: "Cloud Contract Expiry / Repatriation"
business_driver: contract_expiry
hypothesis_template: "Migrate {n} workloads from {incumbent_cloud} to OCI before contract renewal, reducing cloud spend by {pct}% with better Oracle licensing economics"
applicable_when:
- "AWS/Azure contract up for renewal"
- "Running Oracle workloads on non-Oracle cloud"
- "Significant Oracle license cost on AWS/Azure"
typical_outcome:
cost_savings: "30-60% for Oracle DB workloads (BYOL advantage)"
technology_patterns: [database_ha_adb_s, networking_hub_spoke]
# --- Performance Patterns ---
- id: biz_performance_improvement
name: "Performance Improvement"
business_driver: performance
hypothesis_template: "Migrate {workload} to OCI {target_service} to achieve {target_metric}, resolving current {pain_point}"
applicable_when:
- "Current platform cannot meet performance SLAs"
- "Latency or throughput is a business-impacting issue"
- "Exadata-class performance needed without Exadata cost"
typical_outcome:
performance: "2-5x improvement typical with ADB-S/ExaCS"
technology_patterns: [database_ha_adb_s]
# --- Consolidation Patterns ---
- id: biz_consolidation
name: "Database Consolidation"
business_driver: consolidation
hypothesis_template: "Consolidate {n} Oracle databases into {target_n} ADB-S instances, reducing management complexity and licensing footprint"
applicable_when:
- "Many small Oracle databases (sprawl)"
- "Under-utilized database instances"
- "License optimization opportunity"
typical_outcome:
license_reduction: "40-60% fewer required OCPUs"
operational_reduction: "Manage N instead of N*10 instances"
technology_patterns: [database_ha_adb_s]

94
kb/patterns/compliance-pci/pattern.yaml Normal file
View File

@@ -0,0 +1,94 @@
---
last_verified: 2026-03-14
pattern: PCI-DSS Compliance Overlay
category: compliance
---
description: |
Additional security controls required for PCI-DSS compliance on OCI.
Builds on top of the security-baseline pattern.
pci_scope_definition:
cardholder_data_environment:
- "Databases storing PAN (Primary Account Number)"
- "Application servers processing card data"
- "Network segments carrying card data"
out_of_scope:
- "Reporting databases (if no PAN)"
- "Development environments (if no real card data)"
- "Management/monitoring infrastructure"
recommendation: |
Minimize PCI scope aggressively. Use tokenization to remove PAN
from most systems. Only the tokenization service and payment
gateway should be in scope.
controls:
network_segmentation:
pci_req: "Requirement 1: Network segmentation"
implementation:
- "Dedicated VCN for CDE (Cardholder Data Environment)"
- "NSGs restricting traffic to/from CDE"
- "Network Firewall for traffic inspection between CDE and non-CDE"
- "No internet-facing services in CDE subnet"
- "Document all network flows in and out of CDE"
encryption:
pci_req: "Requirement 3 & 4: Protect stored and transmitted data"
implementation:
- "TDE with customer-managed keys (OCI Vault) for databases"
- "TLS 1.2+ for all data in transit"
- "Column-level encryption for PAN if stored"
- "Key rotation per PCI requirements (annual minimum)"
- "Data masking for non-production environments (Data Safe)"
access_control:
pci_req: "Requirement 7 & 8: Access control"
implementation:
- "Dedicated compartment for CDE resources"
- "IAM policies restricting CDE access to authorized personnel"
- "MFA required for all CDE access"
- "Privileged access management with session recording"
- "Quarterly access reviews"
monitoring:
pci_req: "Requirement 10: Logging and monitoring"
implementation:
- "Centralized logging (OCI Logging + SIEM integration)"
- "Audit trail for all CDE access (OCI Audit)"
- "Real-time alerting for security events (Cloud Guard)"
- "Log retention minimum 12 months (1 year online, archive older)"
- "Daily log review process"
vulnerability_management:
pci_req: "Requirement 5 & 6: Vulnerability management"
implementation:
- "Vulnerability Scanning service for compute instances"
- "Data Safe security assessments for databases"
- "Automated patching via OS Management"
- "Web Application Firewall (WAF) for public endpoints"
- "Quarterly vulnerability scans, annual penetration tests"
dr_for_pci:
pci_req: "Requirement 12: DR and business continuity"
implementation:
- "Cross-region DR for CDE (same PCI controls in DR region)"
- "DR region must also be PCI-compliant"
- "Annual DR drill with PCI scope validation"
oci_pci_services:
- service: "OCI Vault"
role: "Customer-managed encryption keys"
- service: "Data Safe"
role: "Database security assessment, data masking, audit"
- service: "Cloud Guard"
role: "Threat detection, security posture management"
- service: "WAF"
role: "Web application firewall for public endpoints"
- service: "Bastion"
role: "Secure access to CDE without public IPs"
- service: "Network Firewall"
role: "Traffic inspection between CDE and non-CDE"
- service: "Vulnerability Scanning"
role: "Automated vulnerability detection"
- service: "OS Management"
role: "Automated patching"

72
kb/patterns/compute-scaling/pattern.yaml Normal file
View File

@@ -0,0 +1,72 @@
---
last_verified: 2026-03-14
pattern: Compute Scaling
category: compute
---
description: |
Auto-scaling and load balancing patterns for OCI compute workloads.
patterns:
instance_pool_autoscaling:
name: "Instance Pool Auto-Scaling"
components:
- "Instance Pool with instance configuration"
- "Auto-scaling policy (metric-based or schedule-based)"
- "Load Balancer (flexible or network)"
scaling_metrics:
- "CPU utilization"
- "Memory utilization"
- "Custom metrics via Monitoring service"
scaling_speed: "New instances in 2-5 minutes"
when_to_use:
- "Stateless applications"
- "Web/API tiers"
- "Batch processing with variable load"
oke_horizontal_pod_autoscaling:
name: "OKE Horizontal Pod Autoscaler"
components:
- "OKE cluster with managed nodes"
- "HPA resource definitions"
- "Cluster Autoscaler for node scaling"
scaling_metrics:
- "CPU utilization"
- "Memory utilization"
- "Custom metrics"
scaling_speed: "Pods: seconds, Nodes: 5-10 minutes"
when_to_use:
- "Containerized microservices"
- "Applications already on Kubernetes"
oke_virtual_nodes:
name: "OKE Virtual Nodes (Serverless)"
components:
- "OKE cluster with virtual node pool"
- "No node management required"
scaling_speed: "Seconds (no node provisioning)"
when_to_use:
- "Burst workloads"
- "Event-driven container workloads"
- "Teams that don't want to manage nodes"
load_balancing:
flexible_lb:
type: "Layer 7 (HTTP/HTTPS)"
features:
- "SSL termination"
- "Path-based routing"
- "Session persistence"
- "Health checks"
- "WAF integration"
bandwidth: "10 Mbps to 8 Gbps"
use_for: "Web applications, API endpoints"
network_lb:
type: "Layer 4 (TCP/UDP)"
features:
- "Ultra-low latency"
- "Preserves source IP"
- "Health checks"
bandwidth: "Up to line rate"
use_for: "Database connections, non-HTTP protocols, high-throughput"

90
kb/patterns/database-dr-cross-region.yaml Normal file
View File

@@ -0,0 +1,90 @@
# Pattern: Cross-Region Database DR
# Composable architecture block for cross-region disaster recovery
pattern:
name: "Cross-Region Database DR"
id: database_dr_cross_region
category: database-dr
description: |
Cross-region disaster recovery using Autonomous Data Guard or Active Data Guard to
maintain an asynchronous standby database in a remote OCI region. Provides protection
against full-region outages with RPO measured in seconds and RTO in minutes. Applicable
to ADB-S, DBCS, and ExaCS deployments.
variants:
- id: adb_s_cross_region
name: "ADB-S Cross-Region Autonomous Data Guard"
topology: "ADB-S primary in Region A, Autonomous Data Guard standby in Region B"
rpo: "Seconds (asynchronous replication)"
rto: "< 15 minutes (automated switchover/failover)"
use_when:
- "ADB-S workload requires regional DR"
- "RPO of seconds is acceptable"
- "Fully managed DR with minimal operational overhead"
- id: dbcs_cross_region
name: "DBCS Cross-Region Active Data Guard"
topology: "DBCS primary in Region A, ADG standby in Region B"
rpo: "Seconds to minutes (asynchronous)"
rto: "Minutes to 1 hour depending on automation"
use_when:
- "DBCS workload requires regional DR"
- "Custom database configuration needed"
- "Manual or scripted failover acceptable"
- id: exacs_cross_region
name: "ExaCS Cross-Region Active Data Guard"
topology: "ExaCS primary in Region A, ADG standby in Region B"
rpo: "Seconds to minutes (asynchronous)"
rto: "Minutes to 1 hour depending on automation"
use_when:
- "ExaCS workload requires regional DR"
- "High-performance database with regional protection"
- "Consolidated databases on Exadata with cross-region standby"
preconditions:
- "Primary database provisioned and operational"
- "DR region selected with matching service availability"
- "Network connectivity between regions (remote VCN peering via DRG or dedicated infrastructure)"
- "Sufficient quota in DR region for standby compute and storage"
- "For DBCS/ExaCS: Active Data Guard license (EE-HP or EE-EP, or BYOL with ADG option)"
implied_services:
- service: dns_traffic_management
reason: "Automated DNS failover to redirect application traffic to DR region"
- service: oci_notifications
reason: "Alerting on replication lag, failover events, and switchover status"
- service: monitoring
reason: "Track replication lag, standby apply rate, and DR readiness"
conflicts:
- pattern: "sync_data_guard_cross_region"
reason: "Synchronous Data Guard is not supported cross-region due to latency; only asynchronous replication is available"
gotchas:
- "Cross-region Active/Autonomous Data Guard is asynchronous only — RPO is always > 0"
- "Cross-region data transfer costs apply for redo log transport between regions"
- "Switchover is planned (zero data loss, brief outage) vs. failover is unplanned (potential data loss up to RPO)"
- "After failover, old primary must be reinstated or re-created — not automatic for DBCS/ExaCS"
- "Application connection strings must be updated or use DNS-based failover"
- "ADB-S cross-region DR requires both regions to support ADB-S"
- "DR readiness should be validated with periodic switchover drills"
cost_impact:
- "Full standby compute and storage cost in DR region (same as primary)"
- "Cross-region network egress charges for redo transport"
- "For ADB-S: standby OCPU/ECPU billed at same rate as primary"
- "DNS Traffic Management: per-zone and per-query charges"
- "Consider reserved capacity in DR region for cost optimization"
sizing_rules:
- "Standby must be same shape and size as primary to ensure failover performance"
- "Network bandwidth: estimate redo generation rate (typically 10-50 Mbps per 10K TPS)"
- "Storage in DR region must match primary storage allocation"
- "For ExaCS: same Exadata infrastructure shape required in DR region"
references:
- "https://docs.oracle.com/en/cloud/paas/autonomous-database/adbsa/autonomous-data-guard.html"
- "https://docs.oracle.com/en/cloud/paas/base-database/index.html"
- "https://docs.oracle.com/en/database/oracle/oracle-database/19/sbydb/"

97
kb/patterns/database-dr/pattern.yaml Normal file
View File

@@ -0,0 +1,97 @@
---
last_verified: 2026-03-14
pattern: Database Disaster Recovery
category: database
---
description: |
DR patterns for Oracle databases on OCI. Covers active-passive,
active-active, and pilot light approaches.
tiers:
tier_1_mission_critical:
name: "Mission Critical"
rto: "<15 minutes"
rpo: "<1 minute"
pattern: "Active-passive with automatic failover"
implementation:
adb_s: "Cross-region ADG with auto-failover"
exacs: "Cross-region Data Guard with FSFO + Observer"
cost_multiplier: "2x (full standby)"
testing: "Quarterly automated DR drill"
tier_2_business_critical:
name: "Business Critical"
rto: "<1 hour"
rpo: "<15 minutes"
pattern: "Active-passive with manual failover"
implementation:
adb_s: "Cross-region ADG with manual switchover"
exacs: "Cross-region Data Guard without FSFO"
cost_multiplier: "2x (full standby) or 1.5x (scaled-down standby)"
testing: "Semi-annual DR drill"
tier_3_standard:
name: "Standard"
rto: "<4 hours"
rpo: "<1 hour"
pattern: "Pilot light or backup-restore"
implementation:
adb_s: "Cross-region backup with restore-on-demand"
exacs: "RMAN backups to Object Storage, cross-region replicated"
cost_multiplier: "1.1x (backup storage only)"
testing: "Annual DR drill"
dr_regions:
recommended_pairs:
- primary: "US East (Ashburn)"
dr: "US West (Phoenix)"
latency_ms: "~60"
- primary: "UK South (London)"
dr: "Germany Central (Frankfurt)"
latency_ms: "~15"
- primary: "Japan East (Tokyo)"
dr: "Japan Central (Osaka)"
latency_ms: "~10"
- primary: "Brazil East (Sao Paulo)"
dr: "Brazil Southeast (Vinhedo)"
latency_ms: "~5"
migration_cutover:
zero_downtime:
tools: ["ZDM with GoldenGate", "Data Guard switchover"]
prerequisites:
- "GoldenGate configured and replicating"
- "Application connection strings use TNS aliases"
- "DNS TTL reduced before cutover"
steps:
- "Verify replication lag is zero"
- "Stop writes to source"
- "Verify final sync"
- "Switch application connection strings"
- "Validate application functionality"
- "Decommission source (after bake period)"
planned_downtime:
tools: ["Data Pump", "RMAN restore", "ZDM physical"]
typical_downtime: "2-8 hours depending on database size"
steps:
- "Announce maintenance window"
- "Take final backup/export"
- "Restore/import to target"
- "Switch application connections"
- "Validate"
gotchas:
- id: DR-001
issue: "Cross-region ADG network latency affects commit performance"
impact: "Synchronous mode adds latency to every commit"
recommendation: "Use asynchronous for cross-region (default), accept seconds of RPO"
- id: DR-002
issue: "DR standby compute may not be available during regional disaster"
impact: "If DR region is also impacted, compute capacity may be limited"
recommendation: "Use capacity reservations in DR region for critical workloads"
- id: DR-003
issue: "Application tier DR often forgotten"
impact: "Database fails over but app tier is not available"
recommendation: "Include app tier in DR plan — Terraform for on-demand provisioning"

71
kb/patterns/database-ha-adb-s.yaml Normal file
View File

@@ -0,0 +1,71 @@
# Pattern: ADB-S High Availability
# Composable architecture block for Autonomous Database Serverless HA
pattern:
name: "ADB-S High Availability"
id: database_ha_adb_s
category: database-ha
description: |
Autonomous Database Serverless (ADB-S) provides built-in high availability through
Transparent Application Continuity (TAC) and automated failover. TAC replays in-flight
transactions transparently after infrastructure failures, masking outages from applications.
For additional protection, Autonomous Data Guard provides a same-region standby with
synchronous replication for zero data loss.
variants:
- id: local_ha
name: "Built-in Local HA (TAC)"
topology: "Same-region, ADB-S infrastructure-managed failover"
rpo: "0"
rto: "~0 perceived (transparent replay via TAC)"
use_when:
- "Standard HA for ADB-S workloads"
- "Application can tolerate brief transparent replay"
- "No separate standby database required"
- id: local_standby
name: "Same-Region Autonomous Data Guard Standby"
topology: "Primary + Standby in same region via Autonomous Data Guard"
rpo: "0 (synchronous replication)"
rto: "< 30 seconds (automatic switchover)"
use_when:
- "Zero RPO mandatory"
- "Protection against full AD or FD failure"
- "Read-only offload to standby needed"
preconditions:
- "ADB-S instance provisioned (Shared infrastructure)"
- "Private endpoint recommended for production workloads"
- "VCN with Service Gateway for secure OCI service access"
- "Wallet or mTLS connectivity configured for clients"
implied_services:
- service: service_gateway
reason: "Secure access to OCI services without internet traversal"
- service: oci_vault
reason: "Customer-managed encryption keys for TDE"
- service: data_safe
reason: "Database security posture management, auditing, and masking"
gotchas:
- "TAC replay does not cover all operations — UTL_HTTP calls, DBMS_PIPE, NOCACHE sequences, and external interactions are not replayed"
- "Auto-scaling takes 2-3 minutes to add OCPUs; plan base capacity for burst tolerance"
- "Autonomous Data Guard standby is read-only; cannot run DML on standby"
- "Switchover requires brief downtime; failover is automatic on primary failure"
- "TAC requires JDBC Thin driver 18c+ or ODP.NET with TAC enabled in connection string"
cost_impact:
- "Built-in local HA (TAC): no additional cost, included in ADB-S"
- "Autonomous Data Guard standby: billed at same compute (OCPU/ECPU) rate as primary"
- "Standby storage is additional and billed at standard ADB-S storage rates"
- "Auto-scaling can increase OCPU cost up to 3x base during peaks"
sizing_rules:
- "Standby must be same shape and OCPU/ECPU count as primary for seamless failover"
- "Storage on standby mirrors primary automatically"
- "Base OCPU count should handle normal workload without relying on auto-scaling for HA events"
references:
- "https://docs.oracle.com/en/cloud/paas/autonomous-database/adbsa/autonomous-data-guard.html"
- "https://docs.oracle.com/en/cloud/paas/autonomous-database/serverless/adbsb/application-continuity-autonomous.html"

76
kb/patterns/database-ha/active-data-guard.yaml Normal file
View File

@@ -0,0 +1,76 @@
# Pattern: Active Data Guard HA/DR
# Composable architecture block for Oracle Database high availability
pattern:
name: "Active Data Guard"
id: active_data_guard
category: database-ha
applies_to: [adb_s, adb_d, dbcs, exacs]
description: |
Oracle Active Data Guard provides real-time data protection with a standby database
that can be used for read-only queries, reporting, and backups while maintaining
synchronous or asynchronous replication from the primary.
variants:
- id: adg_same_region
name: "Same-Region ADG (HA)"
topology: "Primary + Standby in same region, different ADs or FDs"
rpo: "0 (synchronous)"
rto: "< 30 seconds (automatic failover with FSFO)"
use_when:
- "99.99% SLA requirement"
- "Zero RPO mandatory"
- "Read-only offload needed"
- id: adg_cross_region
name: "Cross-Region ADG (DR)"
topology: "Primary in Region A, Standby in Region B"
rpo: "> 0 (asynchronous, typically seconds to minutes)"
rto: "Minutes to 1 hour depending on automation"
use_when:
- "Regional disaster recovery required"
- "RPO of seconds acceptable"
- "Regulatory requirement for geo-separation"
- id: adg_hybrid
name: "Same-Region HA + Cross-Region DR"
topology: "Primary + Local Standby (sync) + Remote Standby (async)"
rpo: "0 local, seconds remote"
rto: "< 30s local, minutes remote"
use_when:
- "Maximum protection: HA + DR"
- "Mission-critical workloads"
preconditions:
- "Oracle Database Enterprise Edition with Active Data Guard option"
- "BYOL: customer must have ADG license or ULA"
- "License Included: ADG included with ADB-S, ExaCS EE-HP/EE-EP"
- "For ADB-S: Autonomous Data Guard (managed, no manual config)"
implied_services:
- service: data_guard
- service: dns_traffic_management
reason: "DNS failover for application connection string update"
when: "cross_region"
- service: oci_notifications
reason: "Alert on failover events"
conflicts:
- pattern: "backup_restore_only"
reason: "ADG provides real-time replication; backup-restore is a subset"
cost_impact:
- "Standby database incurs full compute + storage cost"
- "For ADB-S: standby OCPUs billed at same rate"
- "Cross-region: additional network egress for redo transport"
- "BYOL: ADG license required (included in EE-EP)"
sizing_rules:
- "Standby must be same shape/OCPU as primary for failover"
- "For read-only offload: standby can handle ~80% of primary read capacity"
- "Network bandwidth for redo: estimate 10-50 Mbps per 10K TPS (varies by workload)"
references:
- "https://docs.oracle.com/en/cloud/paas/autonomous-database/adbsa/autonomous-data-guard.html"
- "https://docs.oracle.com/en/database/oracle/oracle-database/19/sbydb/"

87
kb/patterns/database-ha/pattern.yaml Normal file
View File

@@ -0,0 +1,87 @@
---
last_verified: 2026-03-14
pattern: Database High Availability
category: database
---
description: |
Patterns for achieving high availability for Oracle databases on OCI.
Covers ADB-S, ADB-D, ExaCS, and DBCS configurations.
patterns:
adb_s_ha:
name: "ADB-S Built-in HA"
availability: "99.95% SLA"
rto: "<30 seconds"
rpo: "0 (synchronous)"
components:
- "ADB-S with Autonomous Data Guard (same-region)"
- "Automatic failover enabled"
- "No additional configuration needed"
cost_impact: "2x OCPU cost (standby billed at same rate)"
when_to_use:
- "Standard HA requirement"
- "Same-region protection sufficient"
notes:
- "Standby is provisioned automatically when ADG is enabled"
- "Failover is transparent to applications using recommended connection strings"
- "Switchover for planned maintenance is automatic"
adb_s_cross_region:
name: "ADB-S Cross-Region ADG"
availability: "99.95% SLA per region, survives region failure"
rto: "<5 minutes (automatic), <30 minutes (manual)"
rpo: "Seconds (asynchronous replication)"
components:
- "ADB-S primary in Region 1"
- "ADB-S standby in Region 2 (cross-region ADG)"
- "Optional: Refreshable clone in Region 2 for reporting"
cost_impact: "2x OCPU + inter-region data transfer"
when_to_use:
- "Compliance requires geo-redundant DR"
- "RTO < 30 minutes for region failure"
- "Business-critical workloads"
notes:
- "Cross-region ADG is asynchronous — RPO is not zero"
- "Automatic failover requires ADG Auto-Failover configuration"
- "Test failover quarterly"
exacs_rac_ha:
name: "ExaCS RAC High Availability"
availability: "99.95%+ (RAC + Data Guard)"
rto: "<60 seconds (RAC failover)"
rpo: "0 (synchronous within RAC)"
components:
- "ExaCS with multi-node RAC"
- "Data Guard to standby ExaCS (same or cross-region)"
- "Fast-Start Failover (FSFO) with Observer"
cost_impact: "2x infrastructure for Data Guard standby"
when_to_use:
- "Application requires RAC"
- "Sub-minute RTO required"
- "High-throughput OLTP workloads"
dbcs_ha:
name: "DBCS 2-Node RAC + Data Guard"
availability: "99.95%"
rto: "<60 seconds (RAC), <5 minutes (Data Guard)"
rpo: "0 (synchronous within region)"
components:
- "DBCS 2-node RAC (primary)"
- "DBCS Data Guard standby"
cost_impact: "3x compute (2 RAC + 1 DG standby)"
when_to_use:
- "Moderate workloads needing HA"
- "Budget doesn't allow Exadata"
decision_tree: |
Need HA for Oracle Database?
├── Using ADB-S?
│ ├── Same-region sufficient → Enable ADG (built-in)
│ └── Cross-region required → Cross-region ADG
├── Using ExaCS?
│ ├── RAC for local HA
│ └── Data Guard for DR (same or cross-region)
└── Using DBCS?
├── 2-node RAC for local HA
└── Data Guard for DR

678
kb/patterns/ecal-artefacts-catalog.yaml Normal file
View File

@@ -0,0 +1,678 @@
---
last_verified: 2026-03-18
pattern:
id: ecal-artefacts-catalog
name: "ECAL 3.1 Artefacts Catalog"
category: governance
---
description: >
Complete catalog of ECAL 3.1 artefacts across all 9 steps.
Each entry has: description, purpose, ECAL role, and whether
the OCI Deal Accelerator skill can generate it. Source: ECAL 3.1
Practitioners Guides (01-09).
# auto_generate: skill produces this artefact
# assist: skill provides partial content or structure
# reference: skill references this but customer/team produces it
# out_of_scope: purely delivery/commercial, skill doesn't touch
# ═══════════════════════════════════════════════════════════════
# DEFINE PHASE
# ═══════════════════════════════════════════════════════════════
define:
ideate:
- id: "DEF-01"
name: "Customer Profile"
what: "Strategic business goals, Oracle footprint, industry analysis, competitor positioning"
why: "Understand what drives the customer so the PoV resonates with their strategic goals"
how: "Account team intel, annual reports, web research, Business Model Canvas"
skill_support: "assist"
skill_notes: "Skill can research public info and structure into profile template"
customer_facing: false
- id: "DEF-02"
name: "Strategy Map"
what: "Customer goals → strategies → capabilities → enablers mapping"
why: "Links Oracle products to business strategy. Arguably most important ECAL artefact"
how: "Leverage Customer Profile, annual reports, Value Navigator"
skill_support: "assist"
skill_notes: "Skill can draft from discovery notes; needs customer validation"
customer_facing: false
- id: "DEF-03"
name: "Point of View (PoV)"
what: "Hypothesis about customer need, business benefit, SMART-evaluated"
why: "Go to customer with validated ideas that have significant business value"
how: "Review Pattern Library, Sales Central, quantify with Business Case"
skill_support: "auto_generate"
skill_notes: "Skill generates as 'value hypothesis' in value-story.yaml"
customer_facing: false
- id: "DEF-04"
name: "Ideation Workshop"
what: "Design Thinking workshop to formulate and validate PoV"
why: "Ensure no bias, everyone thinking about customer needs"
how: "Brainstorming, group discussion, NEXT/V2V methodology"
skill_support: "reference"
skill_notes: "Skill can generate agenda and talking points"
customer_facing: true
- id: "DEF-05"
name: "Business Case"
what: "Executive summary, drivers, recommended solution, benefits, timeline, risks"
why: "Communicate business value of cloud adoption"
how: "Use Value Navigator, work with customer on the model"
skill_support: "auto_generate"
skill_notes: "Skill generates via business-case.yaml template + deck"
customer_facing: true
- id: "DEF-06"
name: "Value Story"
what: "Compelling vision of the PoV and why customer should adopt it"
why: "Continue discussion with customer, tailor the PoV"
how: "External Ideation template, PowerPoint, demo, mockup"
skill_support: "auto_generate"
skill_notes: "Skill generates via value-story.yaml template"
customer_facing: true
validate:
- id: "DEF-07"
name: "Value Story Delivery"
what: "Half-day workshop presenting the Value Story to customer"
why: "Validate ideas with customer, do discovery through engagement"
how: "Presentations, whiteboards, exercises — be creative"
skill_support: "assist"
skill_notes: "Skill can generate workshop deck and discussion guide"
customer_facing: true
plan:
- id: "DEF-08"
name: "Joint Engagement Plan (JEP)"
what: "Outline plan for Design phase: activities, resources, timeline, scope"
why: "Customer must commit resources; cannot design in isolation"
how: "Use ECAL template, be clear on scope and outcomes"
skill_support: "auto_generate"
skill_notes: "Skill generates via joint-engagement-plan.yaml template"
customer_facing: true
# ═══════════════════════════════════════════════════════════════
# DESIGN PHASE — CURRENT STEP
# ═══════════════════════════════════════════════════════════════
design:
current:
identify_constraints:
- id: "DES-01"
name: "Business Constraints"
what: "Time, funding, legal, compliance, resource, technology constraints"
why: "Constraints impact Future State Architecture, Roadmap, and Proposal"
how: "Collect from customer via workshops or Constraints Questionnaire"
skill_support: "assist"
skill_notes: "Skill captures in workload-profile.yaml constraints section"
customer_facing: false
- id: "DES-02"
name: "Security Constraints"
what: "Security requirements, GDPR, regulatory needs"
why: "Security is major concern in cloud adoption"
how: "Security checklist, assess need for Oracle Security team"
skill_support: "assist"
skill_notes: "Skill flags compliance requirements from discovery notes"
customer_facing: true
capture_current_state:
- id: "DES-03"
name: "Current State Process & Capability Map"
what: "Business processes/capabilities currently in scope, single-slide view"
why: "Shows Oracle understands customer business needs"
how: "Cloud Notation Business Architecture, neutral language (no Oracle buzzwords)"
skill_support: "reference"
skill_notes: "Business architecture — needs customer input"
customer_facing: true
- id: "DES-04"
name: "Discovery Questionnaire"
what: "Structured collection of customer IT landscape"
why: "Build/understand current state, validate hypotheses"
how: "Send template to customer or fill collaboratively"
skill_support: "auto_generate"
skill_notes: "Skill generates via templates/discovery-questionnaire.yaml"
customer_facing: true
- id: "DES-05"
name: "Current State Apps & Tech Portfolio"
what: "Systems, assets, integrations, strategy per application"
why: "Understand environment, build Current State Architecture"
how: "Portfolio Assessment Workbook — Systems, Assets, Integrations tabs"
skill_support: "assist"
skill_notes: "Skill structures from discovery questionnaire responses"
customer_facing: true
- id: "DES-06"
name: "Security Baseline & Guidance"
what: "Current security posture and requirements"
why: "Baseline for designing security in future state"
how: "Security team assessment"
skill_support: "reference"
skill_notes: "References kb/well-architected/security.yaml"
customer_facing: true
- id: "DES-07"
name: "Operational RACI (Current)"
what: "How customer currently runs operations — services, SLAs, responsibilities"
why: "Understand current ops model to design future ops that fit"
how: "Request operational definitions, frameworks (ITIL), service levels"
skill_support: "assist"
skill_notes: "Skill maps to operational-raci.yaml models"
customer_facing: false
- id: "DES-08"
name: "Prioritization Matrix"
what: "Applications scored by criticality, fit, potential, risk"
why: "Focus on highest-value, lowest-risk initiatives first"
how: "Score each app on 5 criteria, weighted calculation"
skill_support: "auto_generate"
skill_notes: "Skill generates from discovery-questionnaire.yaml prioritization section"
customer_facing: true
- id: "DES-09"
name: "Current State Architecture"
what: "Architecture diagrams of current environment in scope"
why: "Baseline for Future State Architecture"
how: "Receive from customer or draw using Cloud Notation"
skill_support: "assist"
skill_notes: "Skill can generate .drawio from description"
customer_facing: true
future:
solution_design:
- id: "DES-10"
name: "Future State Process & Capability Map"
what: "Business capabilities covered by proposed solution"
why: "Shows Oracle understands and addresses customer needs"
how: "Map capabilities to Oracle products, use Cloud Notation"
skill_support: "reference"
skill_notes: "Business architecture — needs customer validation"
customer_facing: true
- id: "DES-11"
name: "Future State Apps & Tech Portfolio"
what: "Oracle/3rd party products mapped to business capabilities"
why: "Bridges capability map to architecture"
how: "List capabilities per product, show integration relationships"
skill_support: "assist"
skill_notes: "Skill can map from service selection"
customer_facing: true
- id: "DES-12"
name: "Future State Architecture"
what: "Application + Technology architecture diagrams"
why: "Communicates solution vision internally and to customer"
how: "Cloud Notation, review with ECAL team, iterate"
skill_support: "auto_generate"
skill_notes: "Skill generates .drawio via oci_diagram_gen.py"
customer_facing: true
- id: "DES-13"
name: "Solution Roadmap"
what: "Phased implementation plan by value/risk"
why: "Complex solutions can't be delivered in one step"
how: "Divide by criteria (org, region, risk), prioritize high-value/low-risk"
skill_support: "auto_generate"
skill_notes: "Skill includes roadmap slide in deck"
customer_facing: true
- id: "DES-14"
name: "Extension Catalog"
what: "Custom extensions beyond OOTB Oracle products"
why: "Highlights gaps requiring custom development"
how: "Identify missing capabilities, clarify implementation"
skill_support: "reference"
skill_notes: "Customer-specific; skill flags potential gaps"
customer_facing: true
- id: "DES-15"
name: "Integration Catalog"
what: "All non-OOTB integrations with data flows, volumes, frequency"
why: "Communicate integration effort and responsibility"
how: "Map all inter-component data flows, include volumes"
skill_support: "assist"
skill_notes: "Skill can list integrations from architecture"
customer_facing: true
- id: "DES-16"
name: "Information & BI Model"
what: "Data flows, MDM, analytics architecture"
why: "Document where data resides and how it's managed"
how: "Data Ecosystem reference architecture, Cloud Notation"
skill_support: "reference"
skill_notes: "Reference patterns in kb/patterns/"
customer_facing: true
deployment_design:
- id: "DES-17"
name: "Datacentre Design"
what: "Which services run in which region/DC for each environment"
why: "Data locality, regulatory compliance, HA strategy"
how: "Map components to OCI regions, include on-prem/multi-cloud"
skill_support: "auto_generate"
skill_notes: "Skill includes region mapping in architecture"
customer_facing: true
- id: "DES-18"
name: "Lifecycle Management Design"
what: "CI/CD, dev-to-prod automation, IaC approach"
why: "Automation is critical for cloud operational success"
how: "OCI DevOps, Terraform, Resource Manager"
skill_support: "assist"
skill_notes: "Skill recommends IaC approach in deployment design"
customer_facing: true
- id: "DES-19"
name: "Network Design"
what: "Connectivity between DCs, within DCs, to users"
why: "Well-defined networking is critical for solution success"
how: "Cloud Notation, show gateways, protocols, public/private"
skill_support: "auto_generate"
skill_notes: "Skill includes networking in .drawio diagrams"
customer_facing: true
- id: "DES-20"
name: "Identity & Access Design"
what: "How users access the system, authentication, authorization"
why: "IAM is critical non-functional requirement"
how: "End-to-end identity across proposed and existing systems"
skill_support: "assist"
skill_notes: "Skill recommends IAM approach from patterns"
customer_facing: true
- id: "DES-21"
name: "Environment Catalog"
what: "List of all environments: prod, dev, test, DR with sizing"
why: "Understand total solution size for accurate BoM"
how: "Discuss with team and customer, use environment-catalogue.yaml"
skill_support: "auto_generate"
skill_notes: "Skill generates from kb/patterns/environment-catalogue.yaml"
customer_facing: true
- id: "DES-22"
name: "Recovery Model"
what: "HA/DR architecture for different failure scenarios"
why: "Customers need to understand business continuity"
how: "Map RTO/RPO requirements to HA/DR patterns"
skill_support: "auto_generate"
skill_notes: "Skill generates from service-tiering.yaml + HA/DR patterns"
customer_facing: true
- id: "DES-23"
name: "Management Design"
what: "Monitoring tools, alerting, operations management"
why: "Operational readiness is critical for customer confidence"
how: "Map to OCI native tools or customer's existing tools"
skill_support: "assist"
skill_notes: "Skill recommends monitoring stack in operations model"
customer_facing: true
- id: "DES-24"
name: "Data Locality & Data Security"
what: "Where controlled data resides, encryption, key management"
why: "Data security is highest customer concern"
how: "Map data locations, encryption methods, key management"
skill_support: "assist"
skill_notes: "Skill flags data residency and encryption in architecture"
customer_facing: true
transition_design:
- id: "DES-25"
name: "Implementation Plan"
what: "Prioritized implementation/migration of capabilities"
why: "Most organizations can't change architecture in one phase"
how: "Implementation partner responsibility; SA validates compatibility"
skill_support: "assist"
skill_notes: "Skill generates high-level migration plan slides"
customer_facing: true
- id: "DES-26"
name: "Implementation RACI"
what: "Who does what during implementation"
why: "Clear roles prevent rework and delays"
how: "High-level tasks with R/A/C/I per role"
skill_support: "assist"
skill_notes: "Skill can draft from engagement-raci.yaml adopt section"
customer_facing: true
- id: "DES-27"
name: "Provisioning Plan / Map"
what: "How each component gets provisioned and brought into service"
why: "Basis for actual provisioning of services"
how: "Map BoM components to provisioning steps"
skill_support: "reference"
skill_notes: "Delivery partner responsibility"
customer_facing: true
- id: "DES-28"
name: "Adoption Plan"
what: "How customer adopts the cloud service post-provisioning"
why: "Ensure availability of resources and service levels"
how: "Cloud Adoption Services (CAS), business readiness"
skill_support: "reference"
skill_notes: "CAS/delivery partner responsibility"
customer_facing: true
service_design:
- id: "DES-29"
name: "Operational Services RACI"
what: "Runtime responsibilities for operating/supporting the solution"
why: "Clear ops responsibilities prevent go-live surprises"
how: "Map to operational-raci.yaml models (fully/co/self managed)"
skill_support: "auto_generate"
skill_notes: "Skill generates from kb/patterns/operational-raci.yaml"
customer_facing: true
- id: "DES-30"
name: "Operational Services Design"
what: "9 categories of operational service model for running the solution"
why: "Customer needs to know best practices for operating in cloud"
how: "Use 9 Enduring Capabilities framework"
skill_support: "assist"
skill_notes: "Skill generates operations model from template"
customer_facing: true
demo_poc:
- id: "DES-31"
name: "PoC Joint Execution Plan"
what: "Scope, approach, timeline, success criteria for PoC"
why: "Structured PoC with bilateral commitment"
how: "Define scope, test architectures, use cases, ground rules"
skill_support: "reference"
skill_notes: "Customer-specific; skill can outline structure"
customer_facing: true
- id: "DES-32"
name: "Demo / PoC Delivery"
what: "Execution of demo or proof of concept"
why: "Prove technical feasibility or address customer concerns"
how: "Demo Central, Cloud Trials, custom PoC"
skill_support: "reference"
skill_notes: "Execution activity, not a document"
customer_facing: true
bom_sizing:
- id: "DES-33"
name: "Architecture Review"
what: "Team review of all architecture artefacts before BoM"
why: "Ensure team alignment on proposed solution"
how: "Review meeting with complete account team"
skill_support: "auto_generate"
skill_notes: "Skill runs WA validation via validate-architecture.py"
customer_facing: false
- id: "DES-34"
name: "Bill of Materials & Sizing"
what: "All pricing and sizing for each solution component"
why: "Summarizes all software/hardware/service costs"
how: "Map from Future State Architecture + sizing model"
skill_support: "auto_generate"
skill_notes: "Skill generates cost estimate from kb/pricing/ + kb/sizing/"
customer_facing: true
confirm:
- id: "DES-35"
name: "Solution Proposal"
what: "High-impact customer presentation of the proposed solution"
why: "Enable customer to decide whether to proceed to Deliver"
how: "Collect all designs, simplify, merge with business drivers"
skill_support: "auto_generate"
skill_notes: "Skill generates .pptx deck via oci_deck_gen.py"
customer_facing: true
- id: "DES-36"
name: "Partner / Services Proposal"
what: "Implementation + operational services cost estimate"
why: "Complete solution = products + implementation + operations"
how: "Work with OC/ACS/partners based on Design artefacts"
skill_support: "reference"
skill_notes: "OC/ACS/partner responsibility"
customer_facing: true
- id: "DES-37"
name: "RFx Response"
what: "Formal response to customer RFI/RFQ/RFP"
why: "Formal stage in customer buying cycle"
how: "Qualify, plan, manage response, QA, submit"
skill_support: "reference"
skill_notes: "Sales/BD responsibility; skill provides technical content"
customer_facing: true
- id: "DES-38"
name: "Commercial Agreement"
what: "Commercial terms: cloud credits, BYOL, ELA, pricing"
why: "Customer needs to understand costs to proceed"
how: "Sales/CSM use BoM to produce commercial terms"
skill_support: "reference"
skill_notes: "Sales responsibility"
customer_facing: true
# ═══════════════════════════════════════════════════════════════
# DELIVER PHASE
# ═══════════════════════════════════════════════════════════════
deliver:
adopt:
establish_governance:
- id: "DEL-01"
name: "Architecture Governance"
what: "Compliance review process for projects vs. enterprise architecture"
why: "Ensure original vision is realized during implementation"
how: "Regular meetings, architecture compliance checklists"
skill_support: "reference"
skill_notes: "Implementation team responsibility"
customer_facing: true
- id: "DEL-02"
name: "Operating Model"
what: "How existing processes/tools change for the new solution"
why: "Without agreed model, risk of project failure"
how: "Assess org capabilities using Operational Service RACI/Design"
skill_support: "auto_generate"
skill_notes: "Skill generates via templates/operations-model.yaml"
customer_facing: true
- id: "DEL-03"
name: "Business Transition Plan"
what: "Managing business change and readiness for go-live"
why: "Business must change processes/org to realize value"
how: "Analysis of business strategy, process standardization"
skill_support: "reference"
skill_notes: "CAS/delivery partner responsibility"
customer_facing: true
- id: "DEL-04"
name: "Training & Communication Plan"
what: "End-user training strategy and project communication"
why: "Effective communication is difference between success and failure"
how: "Review Adoption Plan, determine training delivery method"
skill_support: "reference"
skill_notes: "Delivery partner responsibility"
customer_facing: true
manage_project:
- id: "DEL-05"
name: "Project Governance"
what: "Oversight framework: steering committee, change control, escalation"
why: "Key elements that make a project successful"
how: "Define governance structure, reporting, risk management"
skill_support: "reference"
skill_notes: "PM responsibility"
customer_facing: true
- id: "DEL-06"
name: "Project Plan"
what: "Detailed steps with timelines for deployment"
why: "Identify critical path, stick to timelines"
how: "Detailed iteration of high-level Implementation Plan"
skill_support: "reference"
skill_notes: "Implementation partner responsibility"
customer_facing: true
- id: "DEL-07"
name: "Project Delivery"
what: "Execute the project per plan and governance"
why: "Correctly mobilising prevents delays"
how: "Onboard team, enable, kick off, deliver"
skill_support: "reference"
skill_notes: "Execution activity"
customer_facing: false
- id: "DEL-08"
name: "Signoff & Close"
what: "Validate and sign off all elements of solution"
why: "Formal confirmation before moving to production"
how: "Confirm configs, integrations, data migrations complete"
skill_support: "reference"
skill_notes: "PM responsibility"
customer_facing: true
customer_adoption:
- id: "DEL-09"
name: "Contracts & Policy Review"
what: "Review all agreements associated with the project"
why: "Incomplete understanding puts project at risk"
how: "Review with customer, note risks"
skill_support: "reference"
skill_notes: "Legal/commercial responsibility"
customer_facing: true
- id: "DEL-10"
name: "Readiness Assessment"
what: "Ensure project team has right skills and assets"
why: "Lack of tools/docs/processes becomes obstacle"
how: "Review requirements, define readiness assets"
skill_support: "reference"
skill_notes: "PM responsibility"
customer_facing: false
- id: "DEL-11"
name: "Configuration & Customization"
what: "Build the solution: configs, customizations, integrations"
why: "Build per agreed architecture and deployment design"
how: "Delivery partner method (e.g., TCM)"
skill_support: "reference"
skill_notes: "Delivery team execution"
customer_facing: false
- id: "DEL-12"
name: "Security Build"
what: "Final review and build of security configuration"
why: "Confirm solution built per Identity & Access Design"
how: "Delivery partner method"
skill_support: "reference"
skill_notes: "Delivery team execution"
customer_facing: false
- id: "DEL-13"
name: "Data Migration"
what: "Extract, load, validate data from source to target"
why: "Confirm data migrates correctly and safely"
how: "DMS, GoldenGate, Data Pump, RMAN, ZDM"
skill_support: "assist"
skill_notes: "Skill recommends migration tools in architecture"
customer_facing: false
- id: "DEL-14"
name: "Validation & Testing"
what: "Business process validation and technical testing"
why: "Confirm solution ready for production"
how: "Process playback, final validation, sign-off"
skill_support: "reference"
skill_notes: "Delivery team + customer execution"
customer_facing: true
- id: "DEL-15"
name: "Business Enablement"
what: "End-user training delivery"
why: "Users must be effective with new solution"
how: "Per Training Plan, Oracle University"
skill_support: "reference"
skill_notes: "Training team responsibility"
customer_facing: true
- id: "DEL-16"
name: "Go-Live & Hypercare"
what: "Cutover to production + intensive post-go-live support"
why: "Reduce risk and provide better customer experience"
how: "Support, data integrity, availability monitoring"
skill_support: "auto_generate"
skill_notes: "Skill generates go-live-checklist.yaml"
customer_facing: true
operate:
- id: "DEL-17"
name: "Cloud Operating Framework"
what: "Detailed 52-week operational plan based on Operating Model"
why: "Cloud operations very different from on-premise"
how: "Create plan covering all 9 operational capability areas"
skill_support: "reference"
skill_notes: "ACS/delivery partner responsibility"
customer_facing: true
- id: "DEL-18"
name: "OCI Operationalization Framework"
what: "5-milestone methodology for deploying workloads to OCI"
why: "Blueprint for operationalizing OCI quickly"
how: "Preparation → Conceptual Arch → Physical Arch → Operations → Workloads"
skill_support: "reference"
skill_notes: "NAC framework; skill aligns architecture with milestones"
customer_facing: true
improve:
- id: "DEL-19"
name: "Retrospective"
what: "Team review: what worked, what didn't, what to improve"
why: "Key ECAL principle: learn fast, capture feedback"
how: "3-4 hour meeting, inspect → identify → output actions"
skill_support: "auto_generate"
skill_notes: "Skill generates via templates/lessons-learned.yaml"
customer_facing: false
- id: "DEL-20"
name: "Value Realization"
what: "Post-implementation review against Business Case metrics"
why: "Validate if benefits were actually realized"
how: "Formal or informal review of adoption, impact, benefits"
skill_support: "auto_generate"
skill_notes: "Skill generates via templates/success-criteria.yaml"
customer_facing: true
- id: "DEL-21"
name: "Customer Success Story"
what: "Single-slide summary: who, challenge, approach, value"
why: "Share success with wider community and other customers"
how: "Collect from Business Case, build storyline with customer"
skill_support: "reference"
skill_notes: "Account team responsibility; skill can structure"
customer_facing: true
- id: "DEL-22"
name: "Improvement Actions"
what: "Consolidated improvement plan from operations insights"
why: "Continuous improvement, may lead back to new DEFINE cycle"
how: "Consolidate actions, discuss with customer PM, track"
skill_support: "reference"
skill_notes: "Feeds back into DEFINE for next engagement"
customer_facing: true
# ═══════════════════════════════════════════════════════════════
# SUMMARY STATS
# ═══════════════════════════════════════════════════════════════
summary:
total_artefacts: 60
auto_generate: 16 # skill produces complete artefact
assist: 14 # skill provides partial content
reference: 30 # skill references but team produces
define_phase: 8
design_phase: 38
deliver_phase: 22

916
kb/patterns/engagement-raci.yaml Normal file
View File

@@ -0,0 +1,916 @@
---
last_verified: 2026-03-18
pattern:
id: engagement-raci
name: "ECAL Engagement RACI"
category: governance
---
description: >
Defines who is Responsible, Accountable, Consulted, and Informed for each
ECAL artefact during the engagement lifecycle. This is the PROCESS RACI
(who does what during pre-sales), not the operational RACI (who runs
the solution post-go-live). Source: ECAL 3.1 Practitioners Guides.
roles:
EA: "Enterprise Architect"
SE: "Solution Engineer"
BA: "Business Architect"
CS: "Customer Success"
DA: "Deployment Architect"
VC: "Value Consulting"
Sales: "Sales"
MS: "Managed Services"
CloudOps: "Cloud Operations"
Customer: "Customer"
raci_definitions:
R: "Responsible — executes and delivers the artefact"
A: "Accountable — signs off, owns the outcome (max one per artefact)"
C: "Consulted — contributes expertise, reviewed before completion"
I: "Informed — notified of the result"
# ═══════════════════════════════════════════════════════════════
# DEFINE PHASE
# ═══════════════════════════════════════════════════════════════
define:
ideate:
step_purpose: >
Understand the customer situation and propose a potential solution
(value story) that resonates with their business drivers.
artefacts:
- name: "Customer Profile"
EA: "A/R"
SE: "R"
BA: "C"
CS: "C"
DA: "C"
VC: ""
Sales: ""
MS: ""
CloudOps: "C"
Customer: "I"
- name: "Strategy Map"
EA: "C"
SE: "R/A"
BA: "I"
CS: "I"
DA: "I"
VC: ""
Sales: ""
MS: ""
CloudOps: "C"
Customer: ""
- name: "Point of View"
EA: "A/R"
SE: "R"
BA: "C"
CS: "C"
DA: "C"
VC: ""
Sales: ""
MS: ""
CloudOps: "C"
Customer: ""
- name: "Ideation Workshop"
EA: "C"
SE: "A/R"
BA: "C"
CS: "C"
DA: "C"
VC: ""
Sales: ""
MS: ""
CloudOps: "C"
Customer: "R"
- name: "Business Case"
# Roles filled during Ideate are minimal; revisited in Confirm
EA: ""
SE: ""
BA: ""
CS: ""
DA: ""
VC: ""
Sales: ""
MS: ""
CloudOps: ""
Customer: ""
- name: "Value Story"
EA: "A/R"
SE: "R"
BA: "C"
CS: "C"
DA: "C"
VC: ""
Sales: ""
MS: ""
CloudOps: "C"
Customer: ""
validate:
step_purpose: >
Present the Point of View to the customer and validate the ideas.
Assess impact and customer willingness to investigate a solution.
artefacts:
- name: "Value Story Delivery"
EA: "A/R"
SE: "R"
BA: "C"
CS: ""
DA: "C"
VC: ""
Sales: ""
MS: ""
CloudOps: "R"
Customer: "R"
plan:
step_purpose: >
Once the PoV is validated, plan the Design phase activities,
resources, and timeline as a joint plan with the customer.
artefacts:
- name: "Joint Engagement Plan"
EA: "A/R"
SE: "C"
BA: "R"
CS: ""
DA: "C"
VC: ""
Sales: ""
MS: ""
CloudOps: "C"
Customer: "R"
# ═══════════════════════════════════════════════════════════════
# DESIGN PHASE
# ═══════════════════════════════════════════════════════════════
design:
current:
step_purpose: >
Understand the customer's context: current architecture, business
processes, constraints, and priorities relevant to the engagement.
artefacts:
- name: "Business Constraints"
EA: "R/A"
SE: ""
BA: "R"
CS: ""
DA: "C"
VC: "I"
Sales: "C"
MS: "C"
CloudOps: "I"
Customer: "C"
- name: "Security Constraints"
EA: "R/A"
SE: ""
BA: "R"
CS: ""
DA: "C"
VC: "C"
Sales: "C"
MS: "C"
CloudOps: "I"
Customer: "C"
- name: "Current State Process & Capability Map"
EA: "R/A"
SE: "R"
BA: "C"
CS: "C"
DA: "C"
VC: "C"
Sales: ""
MS: ""
CloudOps: "I"
Customer: "R/C"
- name: "Discovery Questionnaire"
EA: "R/A"
SE: ""
BA: "R"
CS: ""
DA: "C"
VC: "R"
Sales: "C"
MS: "C"
CloudOps: "I"
Customer: "R/C"
- name: "Current State Apps & Tech Portfolio"
EA: "R/A"
SE: ""
BA: "R"
CS: ""
DA: "C"
VC: "I"
Sales: "C"
MS: "C"
CloudOps: "I"
Customer: "R/C"
- name: "Operational RACI (Current)"
EA: "R/A"
SE: ""
BA: ""
CS: "C"
DA: "C"
VC: ""
Sales: "C"
MS: ""
CloudOps: ""
Customer: "R/C"
- name: "Prioritization Matrix"
EA: "R/A"
SE: ""
BA: "R"
CS: ""
DA: "C"
VC: "I"
Sales: "C"
MS: "C"
CloudOps: "I"
Customer: "C"
- name: "Current State Architecture"
EA: "R/A"
SE: ""
BA: "R"
CS: ""
DA: "C"
VC: "I"
Sales: "C"
MS: "C"
CloudOps: "I"
Customer: ""
future:
step_purpose: >
Create the overall solution: architecture, deployment design,
transition plan, service design, sizing, and BoM.
solution_design:
- name: "Future State Process & Capability Map"
EA: "R/A"
SE: "C"
BA: "C"
CS: ""
DA: "C"
VC: ""
Sales: ""
MS: ""
CloudOps: "I"
Customer: "C"
- name: "Future State Apps & Tech Portfolio"
EA: "R/A"
SE: "C"
BA: "C"
CS: ""
DA: "C"
VC: ""
Sales: ""
MS: ""
CloudOps: "I"
Customer: "C"
- name: "Future State Architecture"
EA: "R/A"
SE: "C"
BA: "C"
CS: ""
DA: "C"
VC: ""
Sales: ""
MS: ""
CloudOps: "I"
Customer: "C"
- name: "Solution Roadmap"
EA: "R/A"
SE: "C"
BA: "C"
CS: ""
DA: "C"
VC: ""
Sales: ""
MS: ""
CloudOps: "I"
Customer: "C"
- name: "Extension Catalog"
EA: "R/A"
SE: "C"
BA: "C"
CS: ""
DA: "C"
VC: ""
Sales: ""
MS: ""
CloudOps: "I"
Customer: "C"
- name: "Integration Catalog"
EA: "R/A"
SE: "C"
BA: "C"
CS: ""
DA: "C"
VC: ""
Sales: ""
MS: ""
CloudOps: "I"
Customer: "C"
- name: "Information & BI Model"
EA: "R/A"
SE: "C"
BA: "C"
CS: ""
DA: "C"
VC: ""
Sales: ""
MS: ""
CloudOps: "I"
Customer: "C"
deployment_design:
- name: "Deployment Design"
EA: "R/A"
SE: ""
BA: "C"
CS: "I"
DA: "R/C"
VC: ""
Sales: ""
MS: "C"
CloudOps: "I"
Customer: "C"
- name: "Datacentre Design"
EA: "R/A"
SE: ""
BA: "C"
CS: ""
DA: "R/C"
VC: ""
Sales: ""
MS: "C"
CloudOps: "I"
Customer: "C"
- name: "Lifecycle Management Design"
EA: "R/A"
SE: ""
BA: "C"
CS: ""
DA: "R/C"
VC: ""
Sales: ""
MS: "C"
CloudOps: "I"
Customer: "C"
- name: "Network Design"
EA: "R/A"
SE: ""
BA: "C"
CS: ""
DA: "R/C"
VC: ""
Sales: ""
MS: "C"
CloudOps: "I"
Customer: "C"
- name: "Identity & Access Design"
EA: "R/A"
SE: ""
BA: "C"
CS: ""
DA: "R/C"
VC: ""
Sales: ""
MS: ""
CloudOps: "I"
Customer: "C"
- name: "Environment Catalog"
EA: "R/A"
SE: ""
BA: "C"
CS: ""
DA: "R/C"
VC: ""
Sales: ""
MS: "C"
CloudOps: "I"
Customer: "C"
- name: "Recovery Model"
EA: "R/A"
SE: ""
BA: "C"
CS: ""
DA: "R/C"
VC: ""
Sales: ""
MS: "C"
CloudOps: "I"
Customer: "C"
- name: "Management Design"
EA: "R/A"
SE: ""
BA: "C"
CS: ""
DA: "R/C"
VC: ""
Sales: ""
MS: ""
CloudOps: "I"
Customer: "C"
- name: "Data Locality & Data Security"
EA: "R/A"
SE: ""
BA: "C"
CS: ""
DA: "R/C"
VC: ""
Sales: ""
MS: ""
CloudOps: "I"
Customer: "C"
transition_design:
- name: "Implementation Plan"
EA: "A"
SE: "C"
BA: ""
CS: "I"
DA: "R/C"
VC: ""
Sales: "C"
MS: ""
CloudOps: "I"
Customer: "C"
- name: "Implementation RACI"
EA: "A"
SE: "C"
BA: ""
CS: ""
DA: "R"
VC: ""
Sales: ""
MS: ""
CloudOps: "I"
Customer: "C"
- name: "Provisioning Plan / Map"
EA: "A"
SE: "C"
BA: "C"
CS: ""
DA: "R"
VC: ""
Sales: ""
MS: "C"
CloudOps: "I"
Customer: "C"
- name: "Adoption Plan"
EA: "A"
SE: "C"
BA: ""
CS: ""
DA: "R"
VC: ""
Sales: ""
MS: ""
CloudOps: "I"
Customer: "C"
service_design:
- name: "Operational Services RACI"
EA: "A"
SE: ""
BA: ""
CS: ""
DA: ""
VC: ""
Sales: "R"
MS: "C"
CloudOps: "I"
Customer: "C"
- name: "Operational Services Design"
EA: "A"
SE: ""
BA: ""
CS: ""
DA: ""
VC: ""
Sales: "R"
MS: "C"
CloudOps: "I"
Customer: "C"
demo_poc:
- name: "PoC Joint Execution Plan"
EA: "A"
SE: ""
BA: "R"
CS: ""
DA: "C"
VC: ""
Sales: ""
MS: ""
CloudOps: "C"
Customer: "I"
- name: "Demo / PoC Delivery"
EA: "A"
SE: ""
BA: "R"
CS: ""
DA: "C"
VC: ""
Sales: ""
MS: ""
CloudOps: "C"
Customer: "I"
bom_sizing:
- name: "Architecture Review"
EA: "C/I"
SE: ""
BA: "C/R"
CS: ""
DA: "C/I"
VC: ""
Sales: "C/I"
MS: ""
CloudOps: "R/A"
Customer: ""
- name: "Bill of Materials & Sizing"
EA: "C/I"
SE: ""
BA: "C/R"
CS: ""
DA: "C/I"
VC: ""
Sales: "C/I"
MS: ""
CloudOps: "R/A"
Customer: ""
confirm:
step_purpose: >
Assemble design work into a high-impact Solution Proposal that
enables the customer to validate and decide to proceed.
artefacts:
- name: "Solution Proposal"
EA: "A/R"
SE: "C"
BA: "C"
CS: ""
DA: "C"
VC: "C"
Sales: ""
MS: ""
CloudOps: "C"
Customer: "I"
- name: "Partner / Services Proposal"
EA: "C"
SE: ""
BA: ""
CS: ""
DA: "A/R"
VC: ""
Sales: "R"
MS: ""
CloudOps: "C"
Customer: "C"
- name: "RFx Response"
EA: "C"
SE: "C"
BA: "A/R/C"
CS: "I"
DA: ""
VC: ""
Sales: ""
MS: ""
CloudOps: "C"
Customer: "I"
- name: "Commercial Agreement"
EA: "C"
SE: "C"
BA: "C"
CS: ""
DA: "C"
VC: ""
Sales: "C"
MS: ""
CloudOps: "A/R"
Customer: "R"
# ═══════════════════════════════════════════════════════════════
# DELIVER PHASE
# ═══════════════════════════════════════════════════════════════
deliver:
adopt:
step_purpose: >
Transition from proposed architecture to implementation.
Pre-sales → delivery handover without rework.
establish_governance:
- name: "Architecture Governance"
EA: "C"
SE: ""
BA: "I"
CS: ""
DA: "R/A"
VC: "R/C/I"
Sales: "R"
MS: "I"
CloudOps: ""
Customer: "R"
- name: "Operating Model"
EA: "C"
SE: ""
BA: "I"
CS: ""
DA: "R/A"
VC: "R/C/I"
Sales: "R"
MS: "I"
CloudOps: ""
Customer: "R"
- name: "Business Transition Plan"
EA: "C"
SE: ""
BA: "I"
CS: ""
DA: "R/A"
VC: "R/C/I"
Sales: "R"
MS: "I"
CloudOps: ""
Customer: "R"
- name: "Training & Communication Plan"
EA: "C"
SE: ""
BA: "I"
CS: ""
DA: "R/A"
VC: "R/C/I"
Sales: "R"
MS: "I"
CloudOps: ""
Customer: "R"
manage_project:
- name: "Project Governance"
EA: "C"
SE: ""
BA: "I"
CS: ""
DA: "R/A"
VC: "R/C/I"
Sales: "R"
MS: "I"
CloudOps: ""
Customer: "R"
- name: "Project Plan"
EA: "C"
SE: ""
BA: "I"
CS: ""
DA: "R/A"
VC: "R/C/I"
Sales: "R"
MS: "I"
CloudOps: ""
Customer: "R"
- name: "Project Delivery"
EA: "C"
SE: ""
BA: "I"
CS: ""
DA: "R/A"
VC: "R/C/I"
Sales: "R"
MS: "I"
CloudOps: ""
Customer: "R"
- name: "Signoff & Close"
EA: "C"
SE: ""
BA: "I"
CS: ""
DA: "R/A"
VC: "R/C/I"
Sales: "R"
MS: "I"
CloudOps: ""
Customer: "R"
customer_adoption:
- name: "Contracts & Policy Review"
EA: "C"
SE: ""
BA: "I"
CS: ""
DA: "R/A"
VC: "R/C/I"
Sales: "R"
MS: "I"
CloudOps: ""
Customer: "R"
- name: "Readiness Assessment"
EA: "C"
SE: ""
BA: "I"
CS: ""
DA: "R/A"
VC: "R/C/I"
Sales: "R"
MS: "I"
CloudOps: ""
Customer: "R"
- name: "Configuration & Customization"
EA: "A/R"
SE: ""
BA: "I"
CS: ""
DA: "R"
VC: "R/C/I"
Sales: "R"
MS: "I"
CloudOps: ""
Customer: "R"
- name: "Security Build"
EA: "C"
SE: ""
BA: "I"
CS: ""
DA: "R/A"
VC: "R/C/I"
Sales: "R"
MS: "I"
CloudOps: ""
Customer: "R"
- name: "Data Migration"
EA: "C"
SE: ""
BA: "I"
CS: ""
DA: "R/A"
VC: "R/C/I"
Sales: "R"
MS: "I"
CloudOps: ""
Customer: "R"
- name: "Validation & Testing"
EA: "C"
SE: ""
BA: "I"
CS: ""
DA: "R/A"
VC: "R/C/I"
Sales: "R"
MS: "I"
CloudOps: ""
Customer: "R"
- name: "Business Enablement"
EA: "C"
SE: ""
BA: "I"
CS: ""
DA: "R/A"
VC: "R/C/I"
Sales: "R"
MS: "I"
CloudOps: ""
Customer: "R"
- name: "Go-Live & Hypercare"
EA: "C"
SE: ""
BA: "I"
CS: ""
DA: "R/A"
VC: "R/C/I"
Sales: "R"
MS: "I"
CloudOps: ""
Customer: "R"
operate:
step_purpose: >
Solution is live. Operational capabilities from the Operating Model
are performed to retain vitality. Business outcome reporting active.
artefacts:
- name: "Cloud Operating Framework"
EA: ""
SE: ""
BA: ""
CS: "I"
DA: "R"
VC: ""
Sales: "R"
MS: "R"
CloudOps: ""
Customer: "R/A"
- name: "OCI Operationalization Framework"
EA: ""
SE: ""
BA: ""
CS: ""
DA: "R/A"
VC: ""
Sales: "R/C"
MS: ""
CloudOps: ""
Customer: "C/I"
improve:
step_purpose: >
Capture learnings, validate value delivery, identify next
hypothesis to tackle. Feed improvements back into ECAL.
artefacts:
- name: "Retrospective"
EA: "C/I"
SE: "C/I"
BA: ""
CS: "R"
DA: "R/A"
VC: ""
Sales: "R"
MS: "R"
CloudOps: ""
Customer: "C"
- name: "Value Realization"
EA: "C/I"
SE: "C/I"
BA: ""
CS: "R"
DA: "R/A"
VC: ""
Sales: "R"
MS: "R"
CloudOps: ""
Customer: "C"
- name: "Customer Success Story"
EA: "C/I"
SE: "C/I"
BA: ""
CS: "R"
DA: "R/A"
VC: ""
Sales: "R"
MS: "R"
CloudOps: ""
Customer: "C"
- name: "Improvement Actions"
EA: "C/I"
SE: "C/I"
BA: ""
CS: "R/A"
DA: "R"
VC: ""
Sales: "R"
MS: "R"
CloudOps: ""
Customer: "C"
# ═══════════════════════════════════════════════════════════════
# LESSONS LEARNED PER STEP (from ECAL Practitioners Guides)
# ═══════════════════════════════════════════════════════════════
lessons_learned:
define:
- "Listen to the customer and also to each other"
- "Don't defend your Point of View to the customer, listen for ideas"
- "Understand what the customer is saying"
- "Make Point of View SMART: Specific, Measurable, Attainable, Relevant, Time-based"
- "Think carefully about whether it's right to proceed"
- "Do you have a senior customer sponsor that will support you?"
current:
- "Frame the problem — don't gather requirements"
- "Capture current state in terms of people, process and technology"
- "Be collaborative with the customer and share everything"
- "Use whatever works — try top down and bottom up"
- "Understand the business context, business drivers and desired outcomes"
- "Be very clear about the scope — which systems are in and out"
future:
- "Always look for a quick win for the customer"
- "The operational model is just as important as the architecture"
- "Don't forget non-production environments"
- "Security and data locality must be understood early, don't leave it too late"
confirm:
- "Propositions must be SMART in a customer context"
- "Ensure you have evidence to support all positions"
- "The Roadmap must be achievable"
- "Think about the person you are presenting to — what does it mean for them"
- "Quality of the presentation is very important — it must look professional"
adopt:
- "Look for a Minimum Viable Product (or service) that delivers real customer benefits early"
- "Incremental delivery phases should maximize customer value per the roadmap"
- "Always consider how to help the customer with adoption and ownership"
- "Architecture artifacts are constantly refined as more is learned during Deliver"
improve:
- "Leverage any opportunity to capture a successful outcome as a customer story"
- "Look back at every project for opportunities to improve"
- "Keep in touch with the customer and track how the project is going"
- "Share your learning with your team"
- "Feed back suggested improvements to the ECAL process"

48
kb/patterns/environment-catalogue.yaml Normal file
View File

@@ -0,0 +1,48 @@
---
last_verified: 2026-03-16
pattern:
id: environment-catalogue
name: "Environment Catalogue"
category: operations
---
description: >
Defines the standard environments for each workload tier. The skill
generates the catalogue from the workload profile by expanding each
database into its required environments based on tier.
environment_templates:
platinum:
environments:
- { env: "Production", sizing: "full", isolation: "dedicated CDB, dedicated infra", ha: "RAC + ADG sync" }
- { env: "Pre-Production", sizing: "75% of prod", isolation: "dedicated CDB", ha: "optional RAC" }
- { env: "Dev/Test", sizing: "25% of prod", isolation: "shared CDB OK", ha: "none" }
- { env: "DR", sizing: "100% of prod", isolation: "same as prod", ha: "sync ADG or GG active-active" }
gold:
environments:
- { env: "Production", sizing: "full", isolation: "dedicated CDB, private endpoint", ha: "TAC + ADG local" }
- { env: "Pre-Production", sizing: "50% of prod", isolation: "refreshable clone OK", ha: "none" }
- { env: "Dev/Test", sizing: "25% of prod", isolation: "full clone, auto-stop nights", ha: "none" }
- { env: "DR", sizing: "100% of prod", isolation: "cross-region ADG", ha: "async ADG" }
silver:
environments:
- { env: "Production", sizing: "full", isolation: "shared CDB OK", ha: "single instance" }
- { env: "Pre-Production", sizing: "50% of prod", isolation: "refreshable clone", ha: "none" }
- { env: "Dev/Test", sizing: "25% of prod", isolation: "full clone, auto-stop", ha: "none" }
- { env: "DR", sizing: "N/A", isolation: "backup to Object Storage", ha: "restore from backup" }
bronze:
environments:
- { env: "Production", sizing: "full", isolation: "shared CDB, oversubscribed OK", ha: "none" }
- { env: "Dev/Test", sizing: "same as prod", isolation: "shared CDB", ha: "none" }
- { env: "DR", sizing: "N/A", isolation: "DB export only", ha: "restore from export" }
cost_optimization_rules:
- "Pre-Prod: use Refreshable Clones when read-only testing is sufficient"
- "Dev/Test: auto-stop weeknights (7PM-7AM) + weekends = ~65% savings"
- "Dev/Test: use minimum OCPU (1-2), no auto-scaling"
- "DR standby: consider pilot light (Terraform on-demand) for Silver/Bronze"
- "Bronze DR: DB export to Object Storage is cheapest, no standby OCPU"

98
kb/patterns/networking-basic.yaml Normal file
View File

@@ -0,0 +1,98 @@
# Pattern: Basic VCN Networking
# Composable architecture block for single-VCN 3-tier network layout
pattern:
name: "Basic VCN Networking"
id: networking_basic
category: networking
description: |
Single VCN with a 3-tier subnet layout providing public, application, and data
tiers. Suitable for standalone workloads, small-to-medium deployments, and as a
starting point before evolving to hub-spoke topology. Public subnet hosts load
balancers and bastion, private app subnet hosts compute/containers, and private
data subnet hosts databases and storage.
topology:
vcn:
cidr: "10.0.0.0/16"
dns_label: "vcnmain"
subnets:
- name: "Public Subnet"
cidr: "10.0.0.0/24"
type: public
purpose: "Load balancers, bastion host, WAF endpoints"
usable_ips: 251
- name: "App Private Subnet"
cidr: "10.0.1.0/24"
type: private
purpose: "Compute instances, OKE worker nodes, application servers"
usable_ips: 251
- name: "Data Private Subnet"
cidr: "10.0.2.0/24"
type: private
purpose: "Databases (ADB-S, DBCS), file storage, object storage private endpoints"
usable_ips: 251
components:
- name: "VCN"
purpose: "Virtual Cloud Network — isolated network boundary"
- name: "Public Subnet"
purpose: "Internet-facing resources (LBaaS, Bastion)"
- name: "App Private Subnet"
purpose: "Application tier — no direct internet access"
- name: "Data Private Subnet"
purpose: "Database tier — no direct internet access"
- name: "Internet Gateway (IGW)"
purpose: "Inbound and outbound internet access for public subnet"
- name: "NAT Gateway"
purpose: "Outbound-only internet access for private subnets (patches, APIs)"
- name: "Service Gateway"
purpose: "Private access to OCI services (Object Storage, ADB-S) without internet"
- name: "Route Tables"
purpose: "Per-subnet routing rules for IGW, NAT GW, and Service GW"
- name: "Network Security Groups (NSGs)"
purpose: "Stateful firewall rules applied per VNIC for fine-grained access control"
preconditions:
- "Compartment created for the workload"
- "CIDR ranges planned and non-overlapping with other VCNs or on-premises networks"
- "Region and availability domain selected"
implied_services:
- service: igw
reason: "Internet access for public subnet resources"
- service: nat_gateway
reason: "Outbound internet for private subnets without exposing inbound"
- service: service_gateway
reason: "Private connectivity to OCI services (Object Storage, Autonomous DB)"
design_rules:
- "Place application and database resources in private subnets — never expose directly to internet"
- "Use Network Security Groups (NSGs) instead of Security Lists for per-resource granularity"
- "Use Service Gateway for all OCI service access to avoid internet routing and egress costs"
- "Assign one route table per subnet for clarity and maintainability"
- "Use DNS hostnames within the VCN for service discovery"
- "Enable VCN Flow Logs on all subnets for security auditing"
- "Place load balancers in the public subnet; backends in the app private subnet"
gotchas:
- "VCN CIDR blocks are immutable after creation — plan address space carefully before provisioning"
- "NSG rules are limited to 120 rules per NSG (60 ingress + 60 egress by default)"
- "Security Lists are stateful by default but have a 5-tuple limit; prefer NSGs for complex rule sets"
- "NAT Gateway is regional and supports up to 20 Gbps; may need multiple for high-throughput workloads"
- "Service Gateway only routes to OCI services — not a general-purpose private link"
- "Subnet size cannot be changed after creation; plan for growth"
- "Default security list allows all egress; tighten for production"
cost_impact:
- "VCN: free (no charge for the VCN itself)"
- "Subnets: free"
- "Internet Gateway: free"
- "NAT Gateway: per-hour charge + per-GB data processing"
- "Service Gateway: free"
- "VCN Flow Logs: charged via Logging service ingestion rates"
references:
- "https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/overview.htm"
- "https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/bestpractices.htm"

86
kb/patterns/networking-hub-spoke/hub-spoke-drg.yaml Normal file
View File

@@ -0,0 +1,86 @@
# Pattern: Hub-Spoke Network Topology via DRG
# Composable architecture block for enterprise networking
pattern:
name: "Hub-Spoke Network via DRG"
id: hub_spoke_drg
category: networking
description: |
Hub-spoke topology using OCI Dynamic Routing Gateway (DRG) v2 as the central
routing hub. Spoke VCNs attach to the DRG for inter-VCN routing, on-premises
connectivity (FastConnect/VPN), and centralized security inspection.
topology:
hub:
components:
- "DRG (Dynamic Routing Gateway) — central router"
- "Hub VCN (optional) — for shared services, Network Firewall, Bastion"
- "Service Gateway — OCI service access without internet"
- "NAT Gateway — outbound internet for private subnets"
- "Network Firewall (optional) — deep packet inspection, IDS/IPS"
spokes:
components:
- "Spoke VCN per workload/environment"
- "VCN attachment to DRG"
- "Route table on DRG attachment for traffic steering"
use_when:
- "Multiple workloads or environments needing isolation"
- "On-premises connectivity via FastConnect or VPN"
- "Centralized security inspection required"
- "Shared services (Bastion, DNS, NTP) across workloads"
- "Enterprise landing zone deployment"
when_not_to_use:
- "Single VCN deployment (no need for hub-spoke complexity)"
- "< 3 VCNs and no on-prem connectivity"
- "POC or dev-only environment"
preconditions:
- "DRG v2 (default in all regions)"
- "Non-overlapping CIDR ranges across VCNs"
- "Sufficient IP address planning"
implied_services:
- service: drg
reason: "Central routing hub"
- service: vcn
reason: "Hub and spoke VCNs"
- service: service_gateway
reason: "OCI service access"
- service: nat_gateway
reason: "Outbound internet for private subnets"
- service: route_tables
reason: "Traffic steering via DRG attachments"
optional_services:
- service: network_firewall
when: "Deep packet inspection, IDS/IPS required"
placement: "Hub VCN, inline between DRG and spokes"
- service: fastconnect
when: "On-premises connectivity"
- service: vpn
when: "Backup connectivity or lower-cost option"
conflicts:
- pattern: "local_peering"
reason: "DRG replaces local peering for inter-VCN routing. Don't mix both."
cidr_guidance:
- "Use /16 per VCN for growth headroom"
- "Use /24 per subnet (251 usable IPs)"
- "Reserve /8 or /12 supernet for all OCI CIDRs"
- "Avoid overlapping with on-prem ranges"
- "Example: 10.0.0.0/16 (hub), 10.1.0.0/16 (spoke 1), 10.2.0.0/16 (spoke 2)"
cost_impact:
- "DRG: free (no charge for the gateway itself)"
- "VCN peering via DRG: no data transfer charges within same region"
- "Cross-region via DRG: data transfer charges apply"
- "Network Firewall: per-hour + per-GB processing"
- "FastConnect: port fee + data transfer (inbound free)"
references:
- "https://docs.oracle.com/en-us/iaas/Content/Network/Tasks/managingDRGs.htm"
- "https://docs.oracle.com/en/solutions/hub-spoke-network-drg/"

72
kb/patterns/networking-hub-spoke/pattern.yaml Normal file
View File

@@ -0,0 +1,72 @@
---
last_verified: 2026-03-14
pattern: Hub-and-Spoke Networking
category: networking
---
description: |
Hub-and-spoke VCN topology for enterprise OCI deployments.
Centralizes shared services (firewalls, DNS, connectivity) in a hub VCN
with spoke VCNs for workloads.
architecture:
hub_vcn:
purpose: "Shared services, connectivity, security inspection"
components:
- "DRG (Dynamic Routing Gateway)"
- "Network Firewall (optional)"
- "DNS resolver"
- "FastConnect / VPN termination"
- "Bastion service"
- "Management subnet"
cidr_example: "10.0.0.0/16"
spoke_vcns:
purpose: "Workload isolation"
examples:
- name: "Production"
cidr: "10.1.0.0/16"
subnets:
- "Public subnet (LB): 10.1.0.0/24"
- "Private subnet (App): 10.1.1.0/24"
- "Private subnet (DB): 10.1.2.0/24"
- name: "Non-Production"
cidr: "10.2.0.0/16"
- name: "DMZ"
cidr: "10.3.0.0/16"
connectivity:
hub_to_spoke: "VCN attachments via DRG"
spoke_to_spoke: "Transit routing through DRG (no direct peering needed)"
on_prem: "FastConnect or VPN to DRG in hub"
when_to_use:
- "Multiple environments (prod, non-prod, DMZ)"
- "Centralized connectivity to on-prem"
- "Security inspection required between workloads"
- "Shared services (DNS, NTP, monitoring) across workloads"
when_NOT_to_use:
- "Single-VCN deployments"
- "Simple architectures with 1-2 workloads"
ip_planning:
recommendation: |
Plan CIDR ranges before deployment. Overlapping CIDRs prevent peering.
Use /16 for VCNs, /24 for subnets. Reserve ranges for future growth.
example_scheme:
hub: "10.0.0.0/16"
production: "10.1.0.0/16"
non_production: "10.2.0.0/16"
dmz: "10.3.0.0/16"
dr_region: "10.128.0.0/9"
gotchas:
- id: HUB-001
issue: "DRG route table limits"
impact: "Max 200 route rules per DRG route table"
recommendation: "Aggregate routes where possible, plan for scale"
- id: HUB-002
issue: "Network Firewall throughput"
impact: "Inspect all traffic adds latency and cost"
recommendation: "Only inspect north-south and selected east-west traffic"

70
kb/patterns/operational-raci.yaml Normal file
View File

@@ -0,0 +1,70 @@
---
last_verified: 2026-03-16
pattern:
id: operational-raci
name: "Operational RACI Matrix"
category: operations
---
description: >
Defines responsibilities across customer and Oracle/partner teams for
ongoing operations. R=Responsible (does the work), A=Accountable (owns
the outcome), C=Consulted, I=Informed. Generated from the engagement
model (fully managed, co-managed, or self-managed).
# Three operational models — the skill selects based on discovery
models:
fully_managed:
description: "Oracle/partner manages everything. Customer consumes DB as a service."
trigger: "Customer says 'DBA-less', 'no DBA team', 'fully managed', or team_skills is low"
raci:
- { activity: "DB provisioning", customer: "I", oracle: "R/A" }
- { activity: "DB patching & upgrades", customer: "I", oracle: "R/A" }
- { activity: "Backup & recovery", customer: "I", oracle: "R/A" }
- { activity: "Performance monitoring", customer: "I", oracle: "R/A" }
- { activity: "Performance tuning", customer: "C", oracle: "R/A" }
- { activity: "Security configuration", customer: "A", oracle: "R" }
- { activity: "Access control (IAM)", customer: "R/A", oracle: "C" }
- { activity: "Data Safe / audit review", customer: "A", oracle: "R" }
- { activity: "Incident response (DB)", customer: "I", oracle: "R/A" }
- { activity: "Incident response (app)", customer: "R/A", oracle: "C" }
- { activity: "Capacity planning", customer: "C", oracle: "R/A" }
- { activity: "DR testing", customer: "A", oracle: "R" }
- { activity: "Schema changes", customer: "R/A", oracle: "I" }
- { activity: "App deployment", customer: "R/A", oracle: "I" }
- { activity: "Network changes", customer: "R/A", oracle: "C" }
- { activity: "Cost optimization review", customer: "A", oracle: "R" }
- { activity: "Oracle SR escalation", customer: "C", oracle: "R/A" }
- { activity: "Compliance reporting", customer: "A", oracle: "R" }
co_managed:
description: "Customer has DBAs but wants Oracle/partner for complex ops."
trigger: "Customer says 'we have DBAs but no cloud experience', or team exists but is small"
raci:
- { activity: "DB provisioning", customer: "R", oracle: "C" }
- { activity: "DB patching & upgrades", customer: "R", oracle: "C" }
- { activity: "Backup & recovery", customer: "R/A", oracle: "C" }
- { activity: "Performance monitoring", customer: "R", oracle: "I" }
- { activity: "Performance tuning", customer: "R", oracle: "C" }
- { activity: "Security configuration", customer: "R/A", oracle: "C" }
- { activity: "Access control (IAM)", customer: "R/A", oracle: "I" }
- { activity: "Incident response (DB)", customer: "R", oracle: "C" }
- { activity: "Incident response (app)", customer: "R/A", oracle: "I" }
- { activity: "Capacity planning", customer: "R", oracle: "C" }
- { activity: "DR testing", customer: "R", oracle: "C" }
- { activity: "Schema changes", customer: "R/A", oracle: "I" }
- { activity: "Oracle SR escalation", customer: "R", oracle: "C" }
self_managed:
description: "Customer manages everything. Oracle provides platform only."
trigger: "Customer has strong DBA team with cloud experience, or explicitly says 'we manage'"
raci:
- { activity: "DB provisioning", customer: "R/A", oracle: "I" }
- { activity: "DB patching & upgrades", customer: "R/A", oracle: "I" }
- { activity: "Backup & recovery", customer: "R/A", oracle: "I" }
- { activity: "Performance monitoring", customer: "R/A", oracle: "I" }
- { activity: "Security configuration", customer: "R/A", oracle: "I" }
- { activity: "Incident response", customer: "R/A", oracle: "I" }
- { activity: "DR testing", customer: "R/A", oracle: "I" }
- { activity: "Oracle SR escalation", customer: "R/A", oracle: "C" }

64
kb/patterns/security-baseline/cis-baseline.yaml Normal file
View File

@@ -0,0 +1,64 @@
# Pattern: CIS Security Baseline
# Composable architecture block for security foundation
pattern:
name: "CIS OCI Security Baseline"
id: cis_baseline
category: security
description: |
Security baseline aligned with CIS Oracle Cloud Infrastructure Foundations
Benchmark. Provides IAM, network, encryption, monitoring, and governance
controls as a foundation for all OCI deployments.
always_include: true
applies_to: "all_workloads"
controls:
identity:
- "Least-privilege IAM policies per compartment"
- "MFA for all human users"
- "Break-glass admin account (not used for daily ops)"
- "Instance principals for service-to-service auth"
- "Federation with customer IdP (AD, Okta, SAML)"
- "No API keys stored in code or config files"
compartments:
- "Hierarchical compartment structure by workload/environment"
- "Network, Security, AppDev, Database compartments at minimum"
- "Defined tags for cost tracking, environment, owner"
networking:
- "NSGs preferred over Security Lists"
- "No SSH from 0.0.0.0/0 — use Bastion Service"
- "Service Gateway for OCI service access"
- "VCN Flow Logs enabled"
- "WAF on all internet-facing endpoints"
encryption:
- "OCI Vault for customer-managed keys"
- "TDE with customer-managed keys for databases"
- "Encryption at rest for all storage services"
- "TLS on all load balancers"
monitoring:
- "Cloud Guard enabled with detector recipes"
- "OCI Audit with 365-day retention"
- "Vulnerability Scanning for compute instances"
- "Security Zones for production compartments"
governance:
- "Budgets and cost alerts per compartment"
- "Notification topics for security events"
- "Tagging enforcement via tag defaults"
implied_services:
- cloud_guard
- oci_vault
- bastion
- vulnerability_scanning
- notifications
references:
- "https://www.cisecurity.org/benchmark/oracle_cloud"
- "https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart"

96
kb/patterns/security-baseline/pattern.yaml Normal file
View File

@@ -0,0 +1,96 @@
---
last_verified: 2026-03-14
pattern: Security Baseline
category: security
---
description: |
Minimum security configuration for any OCI deployment. Covers IAM,
networking, encryption, monitoring, and compliance foundations.
layers:
identity:
name: "Identity & Access Management"
requirements:
- item: "MFA for all users"
implementation: "Enable MFA in IAM, enforce via policy"
priority: critical
- item: "Least-privilege policies"
implementation: "Use compartments + IAM policies, avoid broad allow statements"
priority: critical
- item: "No API keys for production"
implementation: "Use instance principals or resource principals"
priority: high
- item: "Federated identity"
implementation: "SAML/OIDC federation with corporate IdP"
priority: high
- item: "Break-glass procedure"
implementation: "Documented emergency access with MFA-protected tenancy admin"
priority: high
network:
name: "Network Security"
requirements:
- item: "Private subnets for all workloads"
implementation: "Only load balancers and bastion in public subnets"
priority: critical
- item: "NSGs over security lists"
implementation: "Granular VNIC-level firewall rules"
priority: high
- item: "Service Gateway for OCI services"
implementation: "Private path to Object Storage, ADB, etc."
priority: high
- item: "WAF for public-facing applications"
implementation: "OCI WAF with OWASP rule sets"
priority: high
- item: "No public IPs on databases"
implementation: "Use private endpoints, Bastion for admin access"
priority: critical
encryption:
name: "Encryption"
requirements:
- item: "Encryption at rest (default)"
implementation: "OCI encrypts all data at rest by default (Oracle-managed keys)"
priority: critical
- item: "Customer-managed keys for sensitive data"
implementation: "OCI Vault with HSM-backed keys"
priority: high
- item: "TLS 1.2+ for all connections"
implementation: "Enforce in load balancer, database, API configurations"
priority: critical
- item: "TDE for databases"
implementation: "Enabled by default on ADB, configure on DBCS/ExaCS"
priority: critical
monitoring:
name: "Monitoring & Audit"
requirements:
- item: "Audit logging enabled"
implementation: "OCI Audit service (enabled by default, 365-day retention)"
priority: critical
- item: "Cloud Guard enabled"
implementation: "Detect misconfigurations and threats"
priority: high
- item: "VCN Flow Logs"
implementation: "Enable on critical subnets for network forensics"
priority: medium
- item: "Alarms for security events"
implementation: "Monitoring alarms + Notifications for critical events"
priority: high
- item: "Data Safe for databases"
implementation: "Security assessment, user assessment, data masking"
priority: high
compute:
name: "Compute Security"
requirements:
- item: "OS Management for patching"
implementation: "OCI OS Management service for automated patching"
priority: high
- item: "Bastion service for SSH"
implementation: "No direct SSH from internet, use OCI Bastion"
priority: critical
- item: "Instance metadata v2"
implementation: "Disable v1 to prevent SSRF attacks"
priority: high

106
kb/patterns/service-tiering.yaml Normal file
View File

@@ -0,0 +1,106 @@
---
last_verified: 2026-03-16
pattern:
id: service-tiering
name: "Database Service Tiering Model"
category: operations
---
description: >
Maps customer workloads to standardized service tiers based on business
criticality, availability requirements, and compliance needs. Each tier
defines the HA/DR topology, support model, backup strategy, and operational
responsibilities. Derived from Oracle's ECAL transformational framework.
tiers:
platinum:
label: "Platinum"
description: "Mission-critical, zero tolerance for downtime"
example_workloads: ["Core banking", "Payment processing", "Trading systems", "Telco network"]
sla:
uptime: "99.999%"
rto: "0 (near-zero with TAC + RAC)"
rpo: "0 (synchronous replication)"
planned_downtime: "0 (even for upgrades — edition-based redefinition)"
support: "24x7, 10 min response"
architecture:
ha: "RAC (multi-node) + TAC/AC"
dr: "Synchronous ADG + GoldenGate active-active (optional)"
backup: "ZDLRA or Autonomous Recovery Service, continuous"
isolation: "Full physical isolation — dedicated CDB, dedicated infrastructure"
encryption: "TDE + DB Vault + Key Vault + SQL*Net encryption"
oci_mapping:
primary: "ExaCS or ADB-D (for RAC + full control)"
alternative: "ADB-S only if application is TAC-compatible and RPO=0 is met by local ADG"
cost_impact: "Highest — dedicated infra, dual-site, 24x7 support"
gold:
label: "Gold"
description: "Business-critical, tolerable brief outage"
example_workloads: ["CRM", "ERP", "eCommerce", "Risk analytics"]
sla:
uptime: "99.99%"
rto: "1-4 hours"
rpo: "5-15 minutes"
planned_downtime: "4x 4hr/year maintenance windows"
support: "24x7, 4 hour response"
architecture:
ha: "TAC + local ADG (auto-failover)"
dr: "Asynchronous cross-region ADG"
backup: "Autonomous Recovery Service, incremental forever"
isolation: "Dedicated CDB (dedicated home), instance caged (not oversubscribed)"
encryption: "TDE + Key Vault"
oci_mapping:
primary: "ADB-S Serverless (with TAC + ADG)"
alternative: "ExaCS if RAC explicitly needed or >128 OCPU sustained"
cost_impact: "High — primary + standby OCPU cost, cross-region DR"
silver:
label: "Silver"
description: "Important but recoverable from backup"
example_workloads: ["HR systems", "Financials", "Internal portals", "Reporting"]
sla:
uptime: "99.5%"
rto: "1 day"
rpo: "1 day"
planned_downtime: "4x 4hr/year maintenance windows"
support: "24x7, 8 hour response"
architecture:
ha: "Single instance or RAC optional"
dr: "Offsite backup only — no real-time replication"
backup: "Automated daily backup, 30-day retention"
isolation: "Shared CDB (shared binaries) acceptable"
encryption: "TDE recommended, DB Vault optional"
oci_mapping:
primary: "ADB-S Serverless (no ADG needed)"
alternative: "Base DB Service for legacy compatibility"
cost_impact: "Medium — no standby cost, shared infrastructure"
bronze:
label: "Bronze"
description: "Non-critical, best-effort recovery"
example_workloads: ["Dev/Test", "Room booking", "Internal tools", "Sandbox"]
sla:
uptime: "98%"
rto: "Best effort"
rpo: "Best effort"
planned_downtime: "Flexible"
support: "Business hours, 2 day response"
architecture:
ha: "None — single instance"
dr: "Database export or backup to Object Storage"
backup: "Weekly backup, 7-day retention"
isolation: "Shared CDB, oversubscribed OK"
encryption: "TDE optional"
oci_mapping:
primary: "ADB-S Serverless (minimum OCPU, auto-scaling off)"
alternative: "VM DB Standard Edition for cost"
cost_impact: "Lowest — minimal resources, no redundancy"
auto_assignment_rules:
- "If customer says '99.99%' or 'zero downtime' → Platinum or Gold (ask which)"
- "If customer says 'PCI' or 'banking regulations' → minimum Gold"
- "If workload type is 'dev/test' → Bronze unless explicitly stated otherwise"
- "If customer says 'reporting' or 'read-only' → Silver unless SLA says otherwise"
- "If no SLA stated → assign Silver and flag for confirmation"

69
kb/pricing/ai-ml.yaml Normal file
View File

@@ -0,0 +1,69 @@
---
last_verified: 2025-09-11
source: https://www.oracle.com/cloud/price-list/
description: OCI AI and Machine Learning service pricing.
currency: USD
---
# ── OCI Generative AI ─────────────────────────────────────────────
generative_ai:
cohere_models:
per_10k_transactions: 0.0001 - 0.0003
notes: "Command, Embed models"
meta_llama:
per_10k_transactions: 0.0001 - 0.0004
xai_grok:
per_1m_tokens_range: "$0.00015 – $0.0018"
google_gemini:
per_1m_tokens_range: "$0.000075 – $0.0006"
generative_ai_agents:
per_10k_transactions: 0.0001
notes: "Plus storage and ingestion fees"
# ── Anomaly Detection ─────────────────────────────────────────────
anomaly_detection:
training: "Free up to 100M data points/month per region"
# ── Data Science ───────────────────────────────────────────────────
data_science:
notebook_sessions:
notes: "Billed at compute shape rates (OCPU/hour + GB memory/hour + GPU options)"
jobs:
notes: "Same compute pricing as notebook sessions"
model_deployment:
notes: "Compute + networking + storage combined pricing"
model_catalog_storage:
notes: "Object Storage rates"
# ── Document Understanding ─────────────────────────────────────────
document_understanding:
training_per_hour: 0.50 - 1.00
ocr_per_1k_transactions: 0.025 - 0.050
# ── Language Services ──────────────────────────────────────────────
language:
pretrained_per_transaction: 0.0001 - 0.0003
custom_training: "Available at additional cost"
# ── Vision ─────────────────────────────────────────────────────────
vision:
image_analysis_per_1k: 0.0001 - 0.0003
custom_training_per_hour: 0.50 - 1.00
# ── Speech ─────────────────────────────────────────────────────────
speech:
per_transcription_hour: 0.0025 - 0.005
# ── Digital Assistant ──────────────────────────────────────────────
digital_assistant:
per_request: 0.009
minimum: "250 requests/hour"

36
kb/pricing/analytics.yaml Normal file
View File

@@ -0,0 +1,36 @@
---
last_verified: 2025-09-11
source: https://www.oracle.com/cloud/price-list/
description: OCI Analytics and BI pricing.
currency: USD
---
# ── Oracle Analytics Cloud ─────────────────────────────────────────
oracle_analytics_cloud:
per_user_month:
professional: 0.99
enterprise: 2.00
ocpu_based:
notes: "Also available as OCPU-based pricing for embedded/API use"
# ── Essbase ────────────────────────────────────────────────────────
essbase:
ocpu_per_hour: 0.0252
# ── Data Lake / Big Data ──────────────────────────────────────────
ai_data_platform:
notes: "Pricing by AI Data Platform unit"
big_data_service_oracle:
ocpu_per_hour: 0.0252
notes: "Oracle distribution, includes Spark SQL compute"
big_data_service_cloudera:
ocpu_per_hour: 0.0168 - 0.0336
data_flow:
ocpu_usage: "Free"
notes: "Apache Spark, no charge for OCPU usage"

191
kb/pricing/compute.yaml Normal file
View File

@@ -0,0 +1,191 @@
---
last_verified: 2025-09-11
source: https://www.oracle.com/cloud/price-list/
description: OCI Compute pricing for estimation purposes.
Prices are approximate and subject to change. Always verify with
OCI pricing calculator for final quotes.
currency: USD
---
# ── Virtual Machine Instances ──────────────────────────────────────
flexible_shapes:
VM.Standard.E6.Flex:
ocpu_per_hour: 0.0168
memory_per_gb_hour: 0.0011
monthly_730h:
ocpu: 12.26
memory_per_gb: 0.80
notes: "AMD EPYC (latest gen), best price/performance for general workloads"
VM.Standard.E5.Flex:
ocpu_per_hour: 0.0210
memory_per_gb_hour: 0.0014
monthly_730h:
ocpu: 15.33
memory_per_gb: 1.02
notes: "AMD EPYC, general-purpose workloads"
VM.Standard.E4.Flex:
ocpu_per_hour: 0.0252
memory_per_gb_hour: 0.0017
monthly_730h:
ocpu: 18.40
memory_per_gb: 1.24
notes: "AMD EPYC (previous gen)"
VM.Standard.E3.Flex:
ocpu_per_hour: 0.0252
memory_per_gb_hour: 0.0017
monthly_730h:
ocpu: 18.40
memory_per_gb: 1.24
notes: "AMD EPYC (older gen)"
VM.Standard3.Flex:
ocpu_per_hour: 0.0336
memory_per_gb_hour: 0.0022
monthly_730h:
ocpu: 24.53
memory_per_gb: 1.61
notes: "Intel Xeon, for Intel-optimized workloads"
VM.Standard.A2.Flex:
ocpu_per_hour: 0.0254
memory_per_gb_hour: 0.0017
monthly_730h:
ocpu: 18.54
memory_per_gb: 1.24
notes: "Ampere Arm (latest A2), best cost for Arm-compatible workloads"
VM.Standard.A1.Flex:
ocpu_per_hour: 0.0127
memory_per_gb_hour: 0.0008
monthly_730h:
ocpu: 9.27
memory_per_gb: 0.58
free_tier: "3,000 OCPU-hours + 18,000 GB-hours per month"
notes: "Ampere Arm A1, eligible for Always Free tier"
VM.Standard.x86.Generic:
ocpu_per_hour: 0.0252
memory_per_gb_hour: 0.0017
notes: "Generic x86 pricing when specific shape not yet selected"
VM.Optimized3.Flex:
ocpu_per_hour: 0.0504
memory_per_gb_hour: 0.0034
monthly_730h:
ocpu: 36.79
memory_per_gb: 2.48
notes: "Highest single-thread performance"
# ── Bare Metal Instances ───────────────────────────────────────────
bare_metal_shapes:
BM.Standard.E5:
ocpu_per_hour: 0.0168
notes: "AMD EPYC bare metal"
BM.Standard.E4:
ocpu_per_hour: 0.0210
notes: "AMD EPYC bare metal (previous gen)"
BM.Standard.E3:
ocpu_per_hour: 0.0420
notes: "AMD EPYC bare metal (older gen)"
BM.Standard3:
ocpu_per_hour: 0.0504
notes: "Intel Xeon bare metal"
BM.Standard.A1:
ocpu_per_hour: 0.0127
notes: "Ampere Arm bare metal"
BM.Standard.x9:
ocpu_per_hour: 0.0672
notes: "Intel Xeon x9 bare metal"
# ── GPU Accelerated Compute ────────────────────────────────────────
gpu_shapes:
# NVIDIA Blackwell (latest)
BM.GPU.B300:
per_gpu_hour: 26.88
gpu_count: 8
gpu_model: "NVIDIA B300"
notes: "Blackwell latest, HPC/AI training"
BM.GPU.B200:
per_gpu_hour: 20.16
gpu_count: 8
gpu_model: "NVIDIA B200"
notes: "Blackwell, large-scale training"
# NVIDIA Hopper
BM.GPU.H200:
per_gpu_hour: 18.54
gpu_count: 8
gpu_model: "NVIDIA H200"
notes: "Hopper H200, large model training"
BM.GPU.H100:
per_gpu_hour: 12.96
gpu_count: 8
gpu_model: "NVIDIA H100"
notes: "Hopper H100, training workloads"
# NVIDIA Ampere / Ada
BM.GPU.A100:
per_gpu_hour: 6.72
gpu_count: 8
gpu_model: "NVIDIA A100 40GB/80GB"
notes: "Training and inference, 40GB or 80GB HBM2e"
VM.GPU.A10.1:
per_gpu_hour: 0.72
gpu_count: 1
gpu_model: "NVIDIA A10"
notes: "Inference workloads, cost-effective"
VM.GPU.A10.2:
per_gpu_hour: 0.72
gpu_count: 2
gpu_model: "NVIDIA A10"
notes: "Inference workloads"
BM.GPU.L40S:
per_gpu_hour: 2.42
gpu_count: 4
gpu_model: "NVIDIA L40S"
notes: "Ada Lovelace, inference and graphics"
# ── Secure Desktops ───────────────────────────────────────────────
secure_desktops:
per_desktop_month: 1750.00
notes: "Managed virtual desktop infrastructure"
# ── Estimation Helpers ─────────────────────────────────────────────
estimation_helpers:
typical_app_server:
config: "VM.Standard.E5.Flex, 4 OCPU, 64 GB"
monthly: 126.60 # (4 * 15.33) + (64 * 1.02)
typical_web_server:
config: "VM.Standard.E5.Flex, 2 OCPU, 16 GB"
monthly: 46.98 # (2 * 15.33) + (16 * 1.02)
typical_bastion:
config: "VM.Standard.E5.Flex, 1 OCPU, 8 GB"
monthly: 23.49 # (1 * 15.33) + (8 * 1.02)
typical_arm_app_server:
config: "VM.Standard.A1.Flex, 4 OCPU, 24 GB"
monthly: 50.96 # (4 * 9.27) + (24 * 0.58)
discounts:
preemptible: "~50% off on-demand"
capacity_reservation: "~15% off on-demand (85% of list)"
reserved_1yr: "~35% off on-demand"
reserved_3yr: "~55% off on-demand"
universal_credits: "Volume discounts on committed spend"
os_pricing:
free:
- "Oracle Linux"
- "CentOS"
- "Ubuntu"
- "Oracle Autonomous Linux"
paid:
windows_server:
notes: "Pricing varies by edition, added to compute cost"

46
kb/pricing/containers-serverless.yaml Normal file
View File

@@ -0,0 +1,46 @@
---
last_verified: 2025-09-11
source: https://www.oracle.com/cloud/price-list/
description: OCI Containers, Kubernetes, and Serverless pricing.
currency: USD
---
# ── Oracle Kubernetes Engine (OKE) ────────────────────────────────
oke:
basic_cluster:
per_hour: "Free"
notes: "Basic cluster management at no cost"
enhanced_cluster:
per_cluster_hour: 0.10
monthly_per_cluster: 73.00
notes: "Enhanced features: virtual nodes, workload identity, etc."
virtual_nodes:
notes: "Additional per-pod pricing on enhanced clusters"
worker_nodes:
notes: "Billed at standard compute shape rates"
# ── Container Instances ────────────────────────────────────────────
container_instances:
notes: "Billed at compute rates: OCPU/hour + GB memory/hour"
shapes_available:
- "A1 (Arm)"
- "E3 (AMD)"
- "E4 (AMD)"
# ── Functions (Serverless) ─────────────────────────────────────────
functions:
invocations:
free_per_month: 2000000
per_invocation_beyond: 0.0000002
memory:
free_gb_seconds_per_month: 400000
per_gb_second_beyond: 0.00001417
notes: "Generous free tier, very cost-effective for event-driven workloads"
# ── OCI Batch ──────────────────────────────────────────────────────
batch:
notes: "Pay-as-you-go compute pricing, no additional service charge"

283
kb/pricing/database.yaml Normal file
View File

@@ -0,0 +1,283 @@
---
last_verified: 2025-09-11
source: https://www.oracle.com/cloud/price-list/
description: OCI Database Service pricing for estimation purposes.
currency: USD
disclaimer: |
Approximate pricing for estimation (within ~15%). Actual pricing varies by
region, commitment level, and negotiated discounts. Always verify against
https://www.oracle.com/cloud/pricing/
---
# ── Autonomous AI Database (Serverless) ───────────────────────────
# NOTE: ADB now uses ECPU billing model (not OCPU)
autonomous_database_serverless:
billing_unit: ECPU
license_included:
ecpu_per_hour: 0.0420
byol:
ecpu_per_hour: 0.0168
storage:
per_gb_month: 0.0850
per_tb_month: 87.04
auto_scaling:
notes: "Billed per ECPU-second for additional ECPUs above base. Same rate."
adg_standby:
notes: "Standby ECPU cost at same rate as primary. Storage shared (no extra)."
backup:
notes: "Automated backups included in storage cost. Manual backups use Object Storage rates."
examples:
8_ecpu_2tb_payg:
monthly_li: "$2,699"
monthly_byol: "$1,150"
breakdown: "8 ECPU × $0.0420/hr × 730hr + 2048GB × $0.0850"
8_ecpu_2tb_byol_with_adg:
monthly: "$2,300"
breakdown: "2 × (8 ECPU × $0.0168/hr × 730hr) + 2048GB × $0.0850"
# ── Autonomous AI JSON Database ────────────────────────────────────
autonomous_json_database:
billing_unit: ECPU
ecpu_per_hour: 0.0420
storage_per_gb_month: 0.0850
notes: "Same pricing as ADB-S, optimized for JSON document workloads"
# ── Autonomous Database Dedicated ──────────────────────────────────
autonomous_database_dedicated:
billing_unit: ECPU
infrastructure:
# X9M / X8M — fixed rack shapes (legacy, still available in some regions)
x9m:
quarter_rack:
base_per_hour: "~$10.50"
monthly_estimate: "$7,500–$8,000"
included: "2 DB servers, 3 storage servers, 100TB usable"
half_rack:
base_per_hour: "~$21.00"
monthly_estimate: "$15,000–$16,000"
included: "4 DB servers, 6 storage servers, 200TB usable"
full_rack:
base_per_hour: "~$42.00"
monthly_estimate: "$30,000–$32,000"
included: "8 DB servers, 12 storage servers, 400TB usable"
# X11M — elastic scaling (new default as of 2025, replaces fixed rack shapes)
x11m:
model: "Elastic — 2 to 32 DB servers + 3 to 64 storage servers (no fixed rack shapes)"
minimum_config: "2 DB servers minimum (cannot order 1 DB server) + 3 storage servers"
billing: "Per ECPU per second (8-ECPU minimum per active DB VM)"
infrastructure_rate: "NOT PUBLICLY LISTED — requires OCI PDM/sales confirmation"
monthly_estimate: "Confirm with Oracle sales; X9M rates used as proxy for estimation"
notes: |
X11M is the current-generation Exadata infrastructure (announced 2025).
Key changes vs X9M:
- No fixed quarter/half/full rack — elastic scale in/out
- MINIMUM: 2 DB servers + 3 storage servers (cannot provision less)
- Infrastructure pricing parity with X9M (no premium) per Oracle comms,
but exact per-hour rates are not published in the public price list
- ECPU billing by the second (vs hourly in older generations)
- Improved compute, storage density, and RDMA throughput vs X9M
ecpu_pricing:
license_included_per_hour: 0.0672
byol_per_hour: 0.0504
notes: |
Infrastructure cost is fixed per rack size (X9M) or elastic per server (X11M). ECPU cost is on top.
DEP (Database Enterprise Patching) co-location is at next maintenance window.
Billing starts only at AVAILABLE state.
Provisioning takes days to weeks depending on capacity.
IMPORTANT: For X11M sizing, confirm infrastructure rates with PDM — use X9M as proxy only.
# ── Base Database Service (DBCS) ──────────────────────────────────
dbcs:
billing_unit: ECPU
license_included:
ecpu_per_hour_se: 0.0336 # Standard Edition
ecpu_per_hour_ee: 0.0420 # Enterprise Edition
ecpu_per_hour_ee_hp: 0.0504 # High Performance
ecpu_per_hour_ee_ep: 0.0672 # Extreme Performance — BYOL only on newer docs
byol:
ecpu_per_hour: 0.0168
storage_per_gb_month: 0.0255
notes: |
SE = Standard Edition, EE = Enterprise Edition,
HP = High Performance (partitioning, advanced compression, etc.),
EP = Extreme Performance (RAC, Active Data Guard, In-Memory).
Backup storage charged separately at Object Storage rates.
examples:
4_ecpu_ee_hp_500gb:
monthly_li: "$160"
breakdown: "4 ECPU × $0.0504/hr × 730hr + 500GB × $0.0255"
# ── Exadata Database Service Dedicated ─────────────────────────────
exadata_dedicated:
billing_unit: ECPU
infrastructure:
# X9M — fixed rack shapes (available in all regions)
x9m:
quarter_rack:
per_hour: 2.10
monthly_estimate: "$1,533"
half_rack:
per_hour: 6.30
monthly_estimate: "$4,599"
full_rack:
per_hour: 12.60
monthly_estimate: "$9,198"
# X11M — elastic scaling (current generation, replaces fixed rack shapes)
x11m:
model: "Elastic — 2 to 32 DB servers + 3 to 64 storage servers"
minimum_config: "2 DB servers + 3 storage servers (hard minimum — applies to ADB-D and ExaCS)"
billing: "Per ECPU per second (8-ECPU minimum per active DB VM)"
infrastructure_rate: "Line items exist in OCI price list ('Database Server - X11M' and 'Storage Server - X11M') but dollar amounts not visible without Oracle Cost Estimator or authenticated access"
proxy_for_estimation: "Use X9M quarter rack ($2.10/hr) as proxy for 2 DB + 3 storage"
notes: |
X11M is confirmed current-gen Exadata for both ExaCS and ADB-D on OCI.
MINIMUM: 2 DB servers + 3 storage servers — cannot provision less (verified against Oracle datasheets).
Per-server line items exist in price list but amounts require Oracle Cost Estimator or PDM quote.
Use X9M quarter rack ($2.10/hr infrastructure) as proxy for minimum config estimation.
ecpu_pricing:
license_included_per_hour: 0.0504
byol_per_hour: 0.0420
what_is_included:
- "Exadata smart storage (flash cache, storage indexes)"
- "Automated patching (GI + DB separate schedules)"
- "Automated backups to Object Storage"
- "RAC licensing included in Extreme Performance edition"
what_is_extra:
- "Data Guard setup and standby infrastructure"
- "Additional storage beyond rack capacity"
- "Object Storage for long-term backup retention"
gotchas:
- "Infrastructure cost is fixed regardless of ECPU utilization (X9M)."
- "X11M elastic model: scale in/out by server, not by rack."
- "Provisioning takes 4-8 hours."
- "X11M has improved storage density, RDMA throughput, and CPU vs X9M."
# ── Exadata Exascale ───────────────────────────────────────────────
exadata_exascale:
billing_unit: ECPU
ecpu_per_hour: 0.0504
storage:
notes: "Storage priced separately per Exascale vault capacity"
notes: "Elastic scaling of compute and storage independently. Next-gen Exadata."
# ── Exadata Cloud@Customer ─────────────────────────────────────────
exadata_cloud_at_customer:
billing_unit: ECPU
ecpu_pricing:
license_included_per_hour: 0.0504
byol_per_hour: 0.0420
infrastructure:
base_per_hour: 7.35
monthly_estimate: "$5,365"
notes: "Exadata infrastructure in customer datacenter, managed by Oracle"
# ── MySQL HeatWave ─────────────────────────────────────────────────
mysql_heatwave:
billing_unit: ECPU
ecpu_per_hour: 0.0180
storage_per_gb_month: 0.0085
heatwave_cluster:
notes: "Additional capacity pricing for HeatWave in-memory acceleration"
free_tier:
notes: "MySQL HeatWave Free Tier available with limits"
mysql_heatwave_on_aws:
ecpu_per_hour: 0.0180
notes: "Cross-cloud deployment, same base pricing"
# ── PostgreSQL ─────────────────────────────────────────────────────
postgresql:
ocpu_per_hour: 0.0168
storage_per_gb_month: 0.0850
notes: "Managed PostgreSQL, includes HA options"
# ── Cache with Redis ───────────────────────────────────────────────
cache_redis:
up_to_10gb:
per_gb_hour: 0.0194
monthly_per_gb: 14.16
above_10gb:
per_gb_hour: 0.0136
monthly_per_gb: 9.93
# ── OpenSearch ─────────────────────────────────────────────────────
opensearch:
per_node_hour: 0.0252
notes: "HA configuration, pricing per node"
# ── NoSQL Database ─────────────────────────────────────────────────
nosql:
provisioned:
storage_per_gb_month: 0.0085
write_unit_per_month: 0.0001
read_unit_per_month: 0.000020
on_demand:
storage_per_gb_month: 0.0085
notes: "Auto-scaled read/write units"
free_tier:
storage_gb: 25
write_units: 50
read_units: 50
max_tables: 3
# ── TimesTen for OKE ──────────────────────────────────────────────
timesten:
x86_ocpu_per_hour: 0.0252
arm_ocpu_per_hour: 0.0168
notes: "In-memory relational database deployed on Kubernetes"
# ── Data Safe ──────────────────────────────────────────────────────
data_safe:
per_target_month: 0.0150
audit_records_per_10k_month: 0.0001
# ── Database Migration ─────────────────────────────────────────────
database_migration:
per_migration_hour: 0.0420
notes: "First 183 days free if migration is active"
# ── Database Autonomous Recovery ───────────────────────────────────
database_autonomous_recovery:
per_gb_virtualized_month: 0.0085
notes: "Autonomous backup recovery service"
# ── GoldenGate ─────────────────────────────────────────────────────
goldengate:
ocpu_per_hour: 0.0252
byol_available: true
notes: "Real-time data integration and replication"
# ── Estimation Helpers ─────────────────────────────────────────────
estimation_helpers:
monthly_hours: 730
byol_savings: "50-60% on ECPU cost for Oracle Database products"
adb_s_sweet_spot: "4-32 ECPUs with auto-scaling. Below 4, consider Always Free. Above 128, consider ADB-D or ExaCS."
cost_comparison_tip: |
When comparing with AWS RDS or Azure SQL MI, include:
- OCI inbound data transfer is free
- OCI outbound is ~80% cheaper than AWS
- OCI BYOL discount is deeper than AWS BYOL
- ADB-S includes patching, tuning, indexing — RDS does not
- ADB now uses ECPU (not OCPU) — 1 ECPU ≈ fraction of an OCPU
reserved_discounts:
one_year: "~35-40% vs PAYG"
three_year: "~55-65% vs PAYG"
notes: "Available for all database services. Commitment is per-region."

59
kb/pricing/developer.yaml Normal file
View File

@@ -0,0 +1,59 @@
---
last_verified: 2025-09-11
source: https://www.oracle.com/cloud/price-list/
description: OCI Developer Services pricing.
currency: USD
---
# ── APEX Application Development ──────────────────────────────────
apex:
ecpu_per_hour: 0.36
free_tier: true
notes: "Low-code development platform, free tier available"
# ── Visual Builder ─────────────────────────────────────────────────
visual_builder:
ocpu_per_hour: 0.0252
notes: "Low-code app builder with storage"
# ── DevOps ─────────────────────────────────────────────────────────
devops:
pipeline_execution: "Free"
notes: "No charge for pipeline execution; compute/memory billed separately"
# ── Blockchain Platform ───────────────────────────────────────────
blockchain:
ocpu_per_hour: 0.0252 - 0.0504
notes: "Plus storage costs"
# ── IoT Platform ──────────────────────────────────────────────────
iot:
ecpu_per_hour: 0.0360
notes: "Plus storage costs"
# ── Media Flow ─────────────────────────────────────────────────────
media_flow:
per_minute: 0.005 - 0.120
notes: "Varies by codec, resolution, and fps"
# ── Media Streams ──────────────────────────────────────────────────
media_streams:
per_gb_packaged: 0.015
# ── Tuxedo ─────────────────────────────────────────────────────────
tuxedo:
ocpu_per_hour: 0.0252 - 0.0504
notes: "For legacy Tuxedo workload migration"
# ── WebCenter ──────────────────────────────────────────────────────
webcenter:
ocpu_per_hour: 0.0252 - 0.0504

53
kb/pricing/hybrid-vmware.yaml Normal file
View File

@@ -0,0 +1,53 @@
---
last_verified: 2025-09-11
source: https://www.oracle.com/cloud/price-list/
description: OCI Hybrid Cloud and VMware Solution pricing.
currency: USD
---
# ── Oracle Cloud VMware Solution (OCVS) ───────────────────────────
vmware_solution:
base_nodes:
BM.Standard2.12:
per_node_hour: 2.10 - 4.20
notes: "Hourly to 3-year commitment range"
BM.Standard3.16:
per_node_hour: 3.03 - 6.06
BM.Standard.E4.32:
per_node_hour: 4.20 - 8.40
BM.Standard.E5.48:
per_node_hour: 4.99 - 9.98
expansion:
ocpu_per_hour: 0.0168 - 0.0420
notes: "Commitment-based pricing"
hcx_enterprise:
ocpu_per_hour: 0.0084
minimum_commitment: "1 month"
gpu_storage_nodes:
per_node_hour: 2.10 - 4.20
notes: "Commitment-based pricing"
# ── Compute Cloud@Customer ─────────────────────────────────────────
compute_cloud_at_customer:
e6_compute:
ocpu_per_hour: 0.0336 - 0.0504
storage:
per_gb_month: 0.0085 - 0.0170
load_balancer:
per_hour: 0.10
# ── Managed Service for Mac ────────────────────────────────────────
managed_mac:
per_server_hour:
m2_pro: 1.20
m4_pro: 4.20
notes: "Range depends on Mac model (M2 Pro to M4 Pro)"
# ── Roving Edge Infrastructure ─────────────────────────────────────
roving_edge:
per_device_day: 300 - 1000
notes: "Portable compute/GPU/storage for edge and disconnected scenarios"

55
kb/pricing/integration.yaml Normal file
View File

@@ -0,0 +1,55 @@
---
last_verified: 2025-09-11
source: https://www.oracle.com/cloud/price-list/
description: OCI Integration and Middleware pricing.
currency: USD
---
# ── Integration Cloud ─────────────────────────────────────────────
integration_cloud:
per_5k_messages_hour: 0.36 - 0.72
notes: "Standard and Enterprise editions"
# ── API Management ─────────────────────────────────────────────────
api_management:
per_api_call: 0.0000005
monthly_1m_calls: 0.50
notes: "Very low cost per call"
# ── Data Integration ───────────────────────────────────────────────
data_integration:
workspace_per_hour: 0.0252
data_processed_per_gb_hour: 0.0252
# ── Data Integrator ────────────────────────────────────────────────
data_integrator:
ocpu_per_hour: 0.0252
# ── Streaming (Kafka compatible) ──────────────────────────────────
streaming:
storage_per_gb_hour: 0.025
data_transfer_per_gb: 0.025
streaming_with_kafka:
ocpu_per_hour: 0.0252
# ── Queue ──────────────────────────────────────────────────────────
queue:
free_per_month: 1000000 # requests
per_request_beyond: 0.0000005
notes: "1M free requests/month, very cost-effective for decoupling"
# ── SOA Suite ──────────────────────────────────────────────────────
soa_suite:
ocpu_per_hour: 0.0504 - 0.0672
notes: "For legacy SOA workload migration"
# ── GoldenGate ─────────────────────────────────────────────────────
# See database.yaml for GoldenGate pricing

70
kb/pricing/networking.yaml Normal file
View File

@@ -0,0 +1,70 @@
---
last_verified: 2025-09-11
source: https://www.oracle.com/cloud/price-list/
description: OCI Networking pricing for estimation purposes.
currency: USD
---
# ── Load Balancing ─────────────────────────────────────────────────
load_balancer:
base_instance_per_hour: 0.10
bandwidth_per_mbps_hour: 0.0084
monthly_base: 73.00
notes: "Flexible shape, bandwidth billed separately"
network_load_balancer:
per_hour: "Free"
notes: "Layer 4, no per-hour charge, data processing fees apply"
# ── FastConnect ────────────────────────────────────────────────────
fastconnect:
port_per_hour:
1gbps: 0.30
2gbps: 0.50
5gbps: 1.26
10gbps: 2.52
40gbps: 5.04
100gbps: 6.30
400gbps: 12.60
monthly_730h:
1gbps: 219.00
10gbps: 1839.60
100gbps: 4599.00
data_transfer: "Free (ingress and egress)"
notes: "Private dedicated connectivity. No data transfer charges."
# ── VPN Connect ────────────────────────────────────────────────────
vpn_connect:
notes: "No additional charge for IPSec VPN tunnels. Included with DRG."
# ── DNS ────────────────────────────────────────────────────────────
dns:
queries_included_per_month: 1000000
additional: "Free for most use cases"
notes: "1M queries/month included at no cost"
# ── WAF ────────────────────────────────────────────────────────────
waf:
notes: "Pricing based on requests processed. See OCI price list for current rates."
# ── Data Transfer Summary ──────────────────────────────────────────
data_transfer:
ingress: "Free (all sources)"
egress_internet:
first_10tb_month: "Free"
per_gb_beyond: 0.0085
inter_region:
per_gb: 0.0085
fastconnect: "Free (both directions)"
key_advantage: |
OCI is dramatically cheaper than hyperscalers for data transfer:
- AWS charges $0.09/GB egress (OCI: $0.0085 after 10TB free)
- Azure charges $0.087/GB egress
- GCP charges $0.12/GB egress
- OCI FastConnect egress is FREE (AWS DirectConnect charges per GB)

89
kb/pricing/observability.yaml Normal file
View File

@@ -0,0 +1,89 @@
---
last_verified: 2025-09-11
source: https://www.oracle.com/cloud/price-list/
description: OCI Observability and Management pricing.
currency: USD
---
# ── Monitoring ─────────────────────────────────────────────────────
monitoring:
ingestion:
free_per_month: 500000000 # 500M datapoints
per_datapoint_beyond: 0.00002
retrieval:
free_per_month: 1000000000 # 1B datapoints
per_datapoint_beyond: 0.00002
notes: "Very generous free tier for most workloads"
# ── Logging ────────────────────────────────────────────────────────
logging:
free_per_month_gb: 10
per_gb_month_beyond: 0.0050
notes: "10 GB/month free, very affordable"
# ── Log Analytics ──────────────────────────────────────────────────
log_analytics:
per_storage_unit_month: 2.50 - 5.00
storage_unit_size_gb: 300
notes: "1 storage unit = 300 GB"
# ── Notifications ──────────────────────────────────────────────────
notifications:
free_per_month:
deliveries: 1000000
emails: 1000
per_operation_beyond: 0.00001
per_email_beyond: 0.00001
# ── Events ─────────────────────────────────────────────────────────
events:
notes: "No additional charge for Events service"
# ── APM / Application Performance Monitoring ──────────────────────
apm:
notes: "Pricing based on data ingestion volume and synthetic monitors"
# ── Database Management ────────────────────────────────────────────
database_management:
ecpu_per_hour: 0.0360
notes: "Fleet-level database monitoring and management"
# ── Ops Insights ───────────────────────────────────────────────────
ops_insights:
basic: "Free"
autonomous: "Free"
cloud_external:
ocpu_per_hour: 0.0420
notes: "Basic and Autonomous tiers are free"
# ── Email Delivery ─────────────────────────────────────────────────
email_delivery:
per_1k_emails: 0.00001 - 0.000015
# ── Full Stack Disaster Recovery ───────────────────────────────────
full_stack_dr:
ecpu_per_hour: 0.0360
ocpu_per_hour: 0.0420
notes: "Orchestrates DR failover across compute, database, and networking"
# ── Fleet Application Management ──────────────────────────────────
fleet_app_management:
per_managed_resource_month: 3.00 - 7.50
# ── OS & Java Management ──────────────────────────────────────────
os_management_hub: "Free"
java_management_service: "Free"
autonomous_linux: "Free"
resource_analytics: "Free"

83
kb/pricing/pricing-models.yaml Normal file
View File

@@ -0,0 +1,83 @@
---
last_verified: 2025-09-11
source: https://www.oracle.com/cloud/price-list/
description: OCI pricing models and discount structures.
---
models:
payg:
name: "Pay As You Go"
commitment: none
discount: none
billing: "Per second (compute), per hour (database), per month (storage)"
when_to_use:
- "Variable/unpredictable workloads"
- "Short-term projects"
- "Dev/test environments"
- "Initial cloud adoption (before committing)"
monthly_flex:
name: "Monthly Flex (Universal Credits)"
commitment: "Minimum $1,000/month or custom commitment"
discount: "Volume discounts on committed spend"
billing: "Committed credits consumed by usage"
when_to_use:
- "Steady-state production workloads"
- "Known baseline consumption"
- "Multiple services across OCI"
discount_tiers:
- spend: "$1K-$10K/month"
discount: "~5-10%"
- spend: "$10K-$50K/month"
discount: "~10-20%"
- spend: "$50K+/month"
discount: "~20-30% (negotiated)"
annual_flex:
name: "Annual Flex (Committed)"
commitment: "1-year or 3-year commitment"
discount: "Deeper discounts than monthly flex"
when_to_use:
- "Established production workloads with predictable spend"
- "Organizations committed to OCI long-term"
byol:
name: "Bring Your Own License"
discount: "~50% on database OCPU costs"
eligible:
- "Oracle Database Enterprise Edition"
- "Oracle Database Standard Edition 2"
- "Oracle WebLogic"
- "Oracle Java SE"
conversion: "1 processor license = 2 OCPUs"
when_to_use:
- "Existing Oracle on-prem licenses with active support"
- "Licenses not being used elsewhere"
when_NOT_to_use:
- "No existing licenses"
- "Licenses still needed for on-prem during migration"
- "Standard Edition workloads on ADB (requires EE)"
reserved_capacity:
name: "Reserved Capacity"
commitment: "1-year or 3-year for specific shapes"
discount:
1_year: "~35% off on-demand"
3_year: "~55% off on-demand"
when_to_use:
- "Known compute shapes running 24/7"
- "Predictable database capacity"
notes: "Shape-specific, less flexible than Universal Credits"
estimation_approach:
step_1: "Calculate PAYG cost first (baseline)"
step_2: "Apply BYOL if customer has eligible licenses"
step_3: "Show savings with Monthly Flex / Annual Flex for steady-state"
step_4: "Compare total annual cost vs current on-prem spending"
step_5: "Include migration costs in year 1"
assumptions_to_state:
- "Hours per month (730 for 24/7)"
- "Auto-scaling hours per day (estimate)"
- "Data transfer volumes"
- "Backup retention"
- "Support tier"

56
kb/pricing/security.yaml Normal file
View File

@@ -0,0 +1,56 @@
---
last_verified: 2025-09-11
source: https://www.oracle.com/cloud/price-list/
description: OCI Security service pricing.
currency: USD
---
# ── Access Governance ──────────────────────────────────────────────
access_governance:
premium:
workforce_user_month: 0.0018 - 0.0036
consumer_user_month: 0.36
for_oracle_workloads:
workforce_user_month: 0.0009 - 0.0018
consumer_user_month: 0.36
for_oci:
workforce_user_month: 0.00009 - 0.00018
# ── Vault ──────────────────────────────────────────────────────────
vault:
notes: "Key management — see OCI price list for current rates. Free tier for software keys."
# ── Cloud Guard ────────────────────────────────────────────────────
cloud_guard:
notes: "Free for OCI tenancy monitoring and threat detection"
# ── Security Zones ─────────────────────────────────────────────────
security_zones:
notes: "Free — policy enforcement on compartments"
# ── Vulnerability Scanning ─────────────────────────────────────────
vulnerability_scanning:
notes: "Free — host and container image scanning"
# ── Certificates ───────────────────────────────────────────────────
certificates:
notes: "Free — TLS certificate management"
# ── Bastion ────────────────────────────────────────────────────────
bastion:
notes: "Free — managed SSH/RDP bastion service"
# ── Network Firewall ──────────────────────────────────────────────
network_firewall:
notes: "Pricing based on instance hours and data processed"
# ── Data Safe ──────────────────────────────────────────────────────
# See database.yaml for Data Safe pricing

60
kb/pricing/storage.yaml Normal file
View File

@@ -0,0 +1,60 @@
---
last_verified: 2025-09-11
source: https://www.oracle.com/cloud/price-list/
description: OCI Storage pricing for estimation purposes.
currency: USD
---
block_volume:
balanced:
per_gb_month: 0.0255
per_tb_month: 26.11
higher_performance:
per_gb_month: 0.0340
per_tb_month: 34.82
lower_cost:
per_gb_month: 0.0170
per_tb_month: 17.41
uhp:
notes: "Priced per VPU, varies by configuration"
boot_volume:
free_tier: "200 GB included"
additional: "Same as block volume pricing"
backup:
per_gb_month: 0.0050
object_storage:
standard:
per_gb_month: 0.0255
per_tb_month: 26.11
infrequent_access:
per_gb_month: 0.0100
per_tb_month: 10.24
archive:
per_gb_month: 0.0026
per_tb_month: 2.66
api_requests:
per_10k_put: 0.0040
per_10k_get: 0.0003
free_tier:
storage_gb: 10
requests: 50000
file_storage:
per_gb_month: 0.0340
per_tb_month: 34.82
data_transfer:
ingress: "Free"
egress_internet:
first_10tb_month: "Free"
per_gb_after: 0.0085
inter_region:
per_gb: 0.0085
fastconnect:
ingress: "Free"
egress: "Free"
notes: |
OCI egress pricing is significantly cheaper than AWS/Azure/GCP.
First 10 TB/month internet egress is free.
FastConnect egress is free (no per-GB charge).

80
kb/services/adb-dedicated.yaml Normal file
View File

@@ -0,0 +1,80 @@
---
last_verified: 2026-03-14
service: Autonomous Database Dedicated (ADB-D)
category: database
oci_color: "#AA643B"
---
what: Autonomous Database on dedicated Exadata infrastructure. Provides isolation,
higher resource limits, and more control while retaining autonomous operations
(auto-patching, auto-tuning, auto-scaling).
when_to_use:
- Regulatory/compliance requirement for dedicated infrastructure
- Need for container database (CDB) level control
- Sustained workloads >128 OCPUs per database
- Multiple databases that benefit from shared Exadata infrastructure
- Organizations that want autonomous features but need infrastructure isolation
- Need to control maintenance windows precisely
when_NOT_to_use:
- Small/medium workloads (ADB-S is simpler and cheaper)
- Teams that don't need infrastructure isolation
- Budget-constrained projects (dedicated infrastructure has higher base cost)
- Rapid prototyping or dev/test (ADB-S provisions faster)
limits:
max_ocpu_per_vm_cluster: 400
max_adb_per_vm_cluster: 200
max_storage_per_vm_cluster_tb: 192
min_exadata_infrastructure: "Quarter rack (base)"
max_vm_clusters_per_infra: 8
features:
auto_scaling: true
auto_indexing: true
auto_partitioning: true
autonomous_data_guard: true
cross_region_adg: true
private_endpoint: true
customer_managed_keys: true
fleet_management: true
maintenance_window_control: true
resource_pool_management: true
os_access: false
rac: false # Not traditional RAC, but Exadata-managed HA
ha_dr:
local_ha: "Exadata-managed, automatic failover within infrastructure"
autonomous_data_guard:
same_region: "Synchronous, automatic failover"
cross_region: "Asynchronous, manual or automatic failover"
sizing_rules:
minimum_infrastructure: "Quarter rack equivalent"
ocpu_allocation: "Shared across all ADBs in the VM cluster"
storage_allocation: "Shared Exadata storage pool"
pricing:
model: dedicated_infrastructure
infrastructure_base: "Exadata infrastructure (fixed cost per shape)"
ocpu_payg: "Per OCPU per hour on top of infrastructure"
byol_discount: "~50% on OCPU costs"
notes:
- "Infrastructure cost is fixed regardless of utilization"
- "OCPU billing is for databases provisioned on the infrastructure"
- "Higher base cost but better economics at scale (>128 OCPUs sustained)"
gotchas:
- id: ADB-D-001
issue: "Provisioning infrastructure takes hours, not minutes"
impact: "Cannot spin up quickly like ADB-S"
recommendation: "Plan infrastructure provisioning well ahead of database needs"
- id: ADB-D-002
issue: "Minimum infrastructure commitment"
impact: "Even at low utilization, you pay for the base infrastructure"
recommendation: "Only choose ADB-D when sustained usage justifies the base cost"
- id: ADB-D-003
issue: "Maintenance windows affect all databases on the infrastructure"
impact: "Need to coordinate maintenance across all tenants"
recommendation: "Use maintenance window control to schedule during off-peak"

49
kb/services/adb-elastic-pool.yaml Normal file
View File

@@ -0,0 +1,49 @@
---
last_verified: 2026-03-14
service: Autonomous Database Serverless Elastic Pool
category: database
oci_color: "#AA643B"
---
what: Pool of pre-provisioned ADB-S resources that multiple databases share.
Reduces provisioning time and allows resource sharing across databases.
when_to_use:
- Many small databases (SaaS per-tenant model)
- Need fast provisioning (<1 minute vs 2-5 minutes for standard ADB-S)
- Workloads with staggered peak times across databases
- Dev/test environments with many short-lived databases
when_NOT_to_use:
- Single large database (just use ADB-S directly)
- All databases peak simultaneously (no benefit from pooling)
- Need strict resource isolation between databases
limits:
max_ocpu_per_pool: 512
max_databases_per_pool: 1000
max_storage_per_pool_tb: 4096
features:
shared_resources: true
fast_provisioning: true
auto_scaling: "Per database within pool limits"
leader_follower: "Leader database manages pool, followers consume"
pricing:
model: pool_based
pool_ocpu_payg: "Per OCPU per hour for the pool"
notes:
- "Pool resources are billed whether databases use them or not"
- "Individual databases draw from the pool allocation"
- "Cost-effective when average utilization across pool is >50%"
gotchas:
- id: EP-001
issue: "Pool resources are committed even when idle"
impact: "Under-utilized pools cost more than individual ADB-S instances"
recommendation: "Size pool for aggregate average, not sum of peaks"
- id: EP-002
issue: "Noisy neighbor risk within pool"
impact: "One database can consume disproportionate resources"
recommendation: "Set per-database OCPU limits to prevent resource hogging"

146
kb/services/adb-serverless.yaml Normal file
View File

@@ -0,0 +1,146 @@
# OCI Service: Autonomous Database Serverless (ADB-S)
# Last verified: 2026-03
service:
name: "Autonomous Database Serverless (ADB-S)"
id: adb_serverless
category: database
color: "#AA643B"
features:
auto_scaling: true
auto_indexing: true
auto_tuning: true
auto_patching: true
transparent_application_continuity: true
autonomous_data_guard: true
private_endpoints: true
byol_eligible: true
ha_dr_options:
local_ha: "Built-in TAC (Transparent Application Continuity) — ~0 perceived RTO"
same_region_adg: "Autonomous Data Guard standby — synchronous, RPO 0"
cross_region_adg: "Cross-region ADG — asynchronous only, RPO seconds, RTO < 15 min"
limits:
max_ocpu: 128
max_storage_tb: 383
max_auto_scale: "3x base OCPUs"
auto_scale_activation: "2-3 minutes"
min_ocpu: 1
min_storage_tb: 1
variants:
- id: adb_s
name: "Autonomous Database Serverless (ADB-S)"
description: "Shared Exadata infrastructure, fully managed, auto-scaling"
workload_types:
- ATP (Transaction Processing / Mixed)
- ADW (Data Warehouse / Analytics)
- AJD (JSON Document Store)
- APEX (Low-code application development)
- id: adb_d
name: "Autonomous Database on Dedicated Exadata (ADB-D)"
description: "Dedicated Exadata infrastructure, full isolation"
use_when:
- "Strict isolation requirements (regulatory, multi-tenant)"
- "Predictable performance with no noisy-neighbor risk"
- "Need RAC for horizontal compute scaling"
- "> 128 OCPUs sustained"
when_to_use:
- "Oracle Database workloads migrating to cloud"
- "Need automated patching, tuning, and scaling"
- "BYOL opportunity with existing Oracle DB licenses"
- "JSON document workloads (AJD)"
- "Rapid APEX application development"
- "Data warehouse / analytics with auto-scaling"
when_not_to_use:
- "Non-Oracle database engines (use MySQL HeatWave, PostgreSQL, NoSQL)"
- "Need OS-level access or custom DB home configuration → use DBCS"
- "Need RAC but not ADB-D budget → use ExaCS or DBCS VM"
- "Workloads requiring specific DB patches not yet in ADB"
- "Extreme IOPS requirements > what Exadata provides"
sizing:
adb_s:
min_ocpu: 1
max_ocpu: 128
auto_scaling: "Up to 3x base OCPUs (takes 2-3 minutes to activate)"
sizing_guidance: "Size base OCPUs for P75 sustained load, not P50. Auto-scaling covers peaks but has activation latency."
storage_min_tb: 1
storage_max_tb: 383
iops: "Proportional to OCPU count, Exadata storage servers"
adb_d:
min_ocpu: "2 per VM (minimum 2 VMs for HA)"
max_ocpu: "Per Exadata infrastructure shape"
rac: true
storage: "Exadata storage dependent on infrastructure shape"
gotchas:
- id: adb_s_autoscale_latency
severity: MEDIUM
description: "Auto-scaling activation takes 2-3 minutes. Size base OCPUs for P75, not average."
- id: adb_s_private_endpoint
severity: HIGH
description: "Always use private endpoints for production. Public endpoints allow internet access to the DB listener."
- id: adb_s_service_gateway
severity: MEDIUM
description: "ADB-S requires a Service Gateway in the VCN for automated backups to Object Storage."
- id: adb_s_byol_savings
severity: LOW
description: "BYOL pricing is ~50% cheaper than License Included. Always check if customer has existing Oracle DB licenses."
- id: adb_d_minimum_infra
severity: HIGH
description: "ADB-D requires dedicated Exadata infrastructure — minimum cost is significant. Don't recommend for small workloads."
- id: adb_data_guard_async
severity: MEDIUM
description: "Cross-region Autonomous Data Guard is async only (RPO > 0). For zero RPO, need same-region standby or ADB-D with local Data Guard."
- id: adb_19c_only
severity: LOW
description: "ADB currently runs Oracle 19c. If customer needs 23ai features, verify availability."
implied_dependencies:
- service: service_gateway
reason: "Required for automated backups to Object Storage"
- service: private_endpoint
reason: "Production workloads must use private endpoints"
- service: oci_vault
reason: "Customer-managed encryption keys (recommended for production)"
- service: data_safe
reason: "Security assessment, audit, and data masking"
competitive:
vs_aws_rds:
advantages:
- "Autonomous operations (auto-patching, auto-tuning, auto-scaling)"
- "Dramatically lower DB licensing cost with BYOL"
- "Exadata performance for Oracle workloads"
disadvantages:
- "No multi-engine support (Oracle only)"
- "Auto-scaling latency vs. Aurora's faster scale-out"
vs_azure_sql:
advantages:
- "Oracle-native features (RAC, Data Guard, Advanced Compression)"
- "BYOL cost advantage"
disadvantages:
- "Azure has broader SQL Server ecosystem integration"
references:
documentation: "https://docs.oracle.com/en/cloud/paas/autonomous-database/"
pricing: "https://www.oracle.com/autonomous-database/pricing/"
sizing_guide: "https://docs.oracle.com/en/cloud/paas/autonomous-database/adbsa/autonomous-database-cpu.html"
changelog:
- date: "2026-03-14"
contributor: { name: "Diego Cabrera", team: "Field Architecture" }
change: "Initial creation with sizing rules, gotchas, competitive notes, HA/DR options"

73
kb/services/compute.yaml Normal file
View File

@@ -0,0 +1,73 @@
---
last_verified: 2026-03-14
service: OCI Compute
category: compute
oci_color: "#4F7B6E"
---
what: Virtual machines and bare metal instances. Flexible shapes allow custom
OCPU/memory ratios. AMD, Intel, and Arm options available.
shape_families:
- name: VM.Standard.E5.Flex
processor: "AMD EPYC 9J14 (Genoa)"
max_ocpu: 94
memory_per_ocpu_gb: "1-64 GB per OCPU"
use_for: "General purpose, most workloads"
- name: VM.Standard3.Flex
processor: "Intel Xeon (Ice Lake)"
max_ocpu: 32
memory_per_ocpu_gb: "1-64 GB per OCPU"
use_for: "Intel-optimized workloads"
- name: VM.Standard.A2.Flex
processor: "Ampere Altra (Arm)"
max_ocpu: 80
memory_per_ocpu_gb: "1-64 GB per OCPU"
use_for: "Arm-compatible workloads, cost optimization"
- name: VM.Optimized3.Flex
processor: "Intel Xeon (Ice Lake)"
max_ocpu: 18
memory_per_ocpu_gb: "1-64 GB per OCPU"
use_for: "High-frequency trading, HPC"
- name: VM.GPU.A10.1
processor: "NVIDIA A10"
gpu_count: 1
use_for: "AI/ML inference, GPU workloads"
- name: BM.GPU.H100.8
processor: "NVIDIA H100 (8 GPUs)"
gpu_count: 8
use_for: "AI/ML training, large model inference"
when_to_use:
- Traditional VM-based applications
- Applications not suited for containers
- Database clients and application servers
- Bastion hosts and jump boxes
- GPU workloads (AI/ML, rendering)
when_NOT_to_use:
- Containerized microservices (use OKE)
- Serverless event-driven workloads (use Functions)
- Managed database workloads (use ADB/DBCS)
features:
flexible_shapes: true
burstable: "Burstable instances available (VM.Standard.E5.Flex.Burstable)"
preemptible: "Preemptible instances at reduced cost"
dedicated_hosts: true
live_migration: true
boot_volume_backup: true
instance_pools: true
autoscaling: "Instance pool autoscaling"
pricing:
model: per_ocpu_per_hour
e5_flex_per_ocpu: 0.0230
standard3_flex_per_ocpu: 0.0360
a2_flex_per_ocpu: 0.0100
memory_per_gb: 0.0015
preemptible_discount: "~50% off on-demand"
notes:
- "Flexible shapes: OCPU + memory billed separately"
- "Always Free tier: 1 VM.Standard.E2.1.Micro (AMD)"
- "Preemptible instances can be reclaimed with 30s notice"

186
kb/services/database-at-aws.yaml Normal file
View File

@@ -0,0 +1,186 @@
# Oracle Database@AWS — KB Service Card
# Last verified: 2026-03-17
# Sources:
# - https://www.oracle.com/cloud/aws/
# - https://docs.oracle.com/en-us/iaas/Content/database-at-aws/oaaws.htm
# - https://docs.oracle.com/en/solutions/network-topology-oracle-database-at-aws/
# - https://aws.amazon.com/about-aws/whats-new/2025/12/oracle-database-aws-available-three-additional-regions/
# - https://www.oracle.com/news/announcement/oracle-database-at-aws-now-generally-available-2025-07-08/
service:
name: "Oracle Database@AWS"
also_known_as:
- "ADB Multicloud (AWS)"
- "ODB@AWS"
- "Oracle Database Service for AWS (legacy name)"
category: "Multicloud Database"
ga_date: "2025-07-08"
what: |
Oracle Database running on OCI Exadata infrastructure co-located inside
AWS datacenters. AWS apps connect via ODB peering (private, low-latency
network bridging AWS VPC to OCI infrastructure in the same AZ).
Control plane runs in OCI; data plane is physically in the AWS region.
Single invoice through AWS Marketplace. Usage counts toward AWS commitments.
services_available:
- name: "OCI Exadata Database Service on Dedicated Infrastructure"
versions: ["19c", "26ai"]
notes: "Full Exadata performance, RAC, Data Guard"
- name: "OCI Autonomous AI Database on Dedicated Exadata Infrastructure (ADB-D)"
versions: ["19c", "26ai"]
notes: "Autonomous Database on dedicated Exadata — NOT serverless"
- name: "OCI Autonomous Recovery Service"
notes: "Automated backup and recovery"
services_NOT_available:
- name: "Autonomous Database Serverless (ADB-S)"
reason: |
ADB-S is NOT available on Database@AWS. Only ADB on Dedicated
Exadata Infrastructure (ADB-D) is supported. This is a critical
distinction when designing architectures — if the customer
specifically needs ADB-S serverless, they must use native OCI
or connect via FastConnect/VPN.
# --- Regions ---
regions_ga:
- {aws_region: "us-east-1", name: "US East (N. Virginia)", ga_date: "2025-07-08"}
- {aws_region: "us-west-2", name: "US West (Oregon)", ga_date: "2025-07-08"}
- {aws_region: "us-east-2", name: "US East (Ohio)", ga_date: "2025-12-23"}
- {aws_region: "eu-central-1", name: "Europe (Frankfurt)", ga_date: "2025-12-23"}
- {aws_region: "ap-northeast-1", name: "Asia Pacific (Tokyo)", ga_date: "2025-12-23"}
- {aws_region: "ca-central-1", name: "Canada (Central)", ga_date: "2026-Q1"}
- {aws_region: "eu-west-1", name: "Europe (Ireland)", ga_date: "2026-Q1"}
- {aws_region: "ap-southeast-2", name: "Asia Pacific (Sydney)", ga_date: "2026-Q1"}
regions_planned:
- "US West (N. California)"
- "South America (São Paulo)"
- "Europe (London)"
- "Europe (Milan)"
- "Europe (Paris)"
- "Europe (Spain)"
- "Europe (Stockholm)"
- "Europe (Zurich)"
- "Asia Pacific (Hyderabad)"
- "Asia Pacific (Melbourne)"
- "Asia Pacific (Mumbai)"
- "Asia Pacific (Osaka)"
- "Asia Pacific (Seoul)"
- "Asia Pacific (Singapore)"
regions_planned_notes: "Oracle and AWS announced plans to expand to 20+ total regions"
# --- Network Architecture ---
network:
connectivity: "ODB Peering"
description: |
ODB peering creates a private, direct connection between an AWS VPC
and the OCI-managed ODB network inside the same AWS AZ. Traffic never
traverses the public internet. This is NOT a standard FastConnect —
it's a co-located, same-datacenter interconnect.
latency:
same_az: "~200-400 microseconds RTT (extrapolated from Database@Azure benchmarks)"
cross_az: "~1 ms+ (variable, must validate)"
cross_region: "Variable, depends on distance"
notes: |
Oracle does not publish official RTT benchmarks for Database@AWS.
Database@Azure (same architecture pattern) shows 200-400μs same-AZ
and ~1.5ms cross-AZ per Accenture testing (32,000+ tests, 2 weeks).
Database@AWS should be comparable since the architecture is identical
(co-located OCI infra inside cloud provider datacenter).
best_practices:
- "Deploy app EC2 and ODB network in the SAME Availability Zone"
- "Use Transit Gateway with attachment in same AZ as ODB network"
- "CIDR blocks must not overlap with AWS VPC subnets or OCI VCNs"
- "Client subnet minimum /27, recommended /24 for expansion"
- "Backup subnet minimum /28 (optional for ADB-D)"
- "Use Direct Connect for hybrid (on-premises) connectivity"
topologies:
- name: "Same-AZ Direct Peering"
use_case: "Latency-sensitive apps"
path: "App VPC → ODB Peering → ODB Network → Oracle DB"
recommendation: "Primary topology for low-latency workloads"
- name: "Hub-and-Spoke via Transit Gateway"
use_case: "Multi-VPC architectures"
path: "Spoke VPCs → Transit Gateway → ODB Network → Oracle DB"
caveat: "Cross-VPC latency varies — must validate"
- name: "Cross-Region via Transit Gateway Peering"
use_case: "Multi-region apps"
caveat: "Significant latency increase — not for latency-sensitive"
# --- Pricing ---
pricing:
model: |
Single invoice through AWS Marketplace.
- Exadata: Upfront subscription for infrastructure + pay-per-use for CPUs
- ADB-D: Upfront subscription + pay-per-use for active CPUs
aws_commitment: "Oracle Database@AWS usage counts toward AWS spending commitments"
# --- When to use vs alternatives ---
when_to_use:
- "App runs on AWS and needs Oracle Database with Exadata performance"
- "Customer wants single AWS bill (Marketplace billing)"
- "Low-latency (<1ms) app-to-DB connectivity required without migrating app"
- "Customer has AWS spending commitments to burn down"
- "Data residency requires DB to be in same region as app"
when_NOT_to_use:
- "Need ADB-S Serverless — use native OCI + FastConnect instead"
- "Target AWS region not yet GA — check availability"
- "Workload fits RDS Oracle or doesn't need Exadata performance"
- "Budget-sensitive: minimum Exadata infra commitment applies"
- "Need full OCI service breadth beyond database (OKE, Functions, etc.)"
# --- Gotchas ---
gotchas:
- id: "DBAWS-001"
severity: HIGH
issue: "ADB-S Serverless NOT available — only ADB-D Dedicated"
impact: |
Customers expecting serverless auto-scaling and pay-per-query will
need to use ADB-D with manual OCPU scaling, or use native OCI ADB-S
with FastConnect from AWS.
recommendation: |
If the customer specifically needs serverless, design with native
OCI ADB-S + FastConnect. If they need co-located low latency,
use ADB-D on Database@AWS and size Exadata appropriately.
- id: "DBAWS-002"
severity: MEDIUM
issue: "Minimum Exadata infrastructure commitment"
impact: |
Database@AWS requires dedicated Exadata infrastructure.
Minimum quarter-rack equivalent — not suitable for small workloads.
recommendation: |
For workloads < 16 OCPUs, evaluate if the latency benefit of
co-location justifies the Exadata minimum vs FastConnect to
native OCI ADB-S.
- id: "DBAWS-003"
severity: MEDIUM
issue: "VM clusters cannot be moved between ODB networks"
impact: "Once deployed in an AZ, the cluster stays there."
recommendation: "Choose the AZ carefully — align with app tier AZ placement."
- id: "DBAWS-004"
severity: LOW
issue: "Control plane runs in OCI region, not in AWS"
impact: |
Management operations (provisioning, patching, scaling) go through
OCI control plane. If OCI region has issues, management is affected
but data plane continues to serve queries.
recommendation: "Monitor both OCI and AWS health dashboards."
# --- Integration with AWS services ---
aws_integrations:
- "Amazon VPC (ODB peering)"
- "AWS IAM (federated access)"
- "Amazon CloudWatch (monitoring)"
- "Amazon EventBridge (events)"
- "Amazon S3 (data integration)"
- "AWS SageMaker / Bedrock (AI/ML via zero-ETL)"
- "AWS Transit Gateway / Cloud WAN (networking)"
- "AWS Direct Connect (hybrid connectivity)"

77
kb/services/dbcs.yaml Normal file
View File

@@ -0,0 +1,77 @@
---
last_verified: 2026-03-14
service: Database Cloud Service (DBCS)
category: database
oci_color: "#AA643B"
---
what: Oracle Database on VM or Bare Metal in OCI. Full DBA control with
automated provisioning and backup. Available as single-instance or 2-node RAC.
editions:
- Standard Edition
- Enterprise Edition
- Enterprise Edition High Performance
- Enterprise Edition Extreme Performance
when_to_use:
- Standard Edition workloads (ADB requires EE)
- Need full OS and database control without Exadata
- Moderate workloads that don't need Exadata performance
- Budget-conscious deployments where Exadata is over-provisioned
- Development and test environments mirroring production DB config
- Applications requiring specific Oracle versions or patches
when_NOT_to_use:
- High-performance OLTP (Exadata or ADB better)
- Variable workloads benefiting from auto-scaling (use ADB-S)
- No DBA team available (use ADB-S)
- Need Exadata features (Smart Scan, HCC, Flash Cache)
limits:
vm_shapes:
- "VM.Standard.E5.Flex: 1-94 OCPUs"
- "VM.Standard3.Flex: 1-32 OCPUs"
bm_shapes:
- "BM.Standard.E5: 128 OCPUs"
- "BM.DenseIO.E5: 128 OCPUs with NVMe"
max_storage_tb: 80 # block storage
rac_max_nodes: 2
features:
os_access: true
rac: "2-node RAC on VM shapes"
data_guard: true
cross_region_data_guard: true
custom_db_home: true
custom_patches: true
automated_backup: true
database_management: true
ha_dr:
local_ha: "2-node RAC for HA, single-instance with automated restart"
data_guard:
same_region: "Synchronous or async, FSFO available"
cross_region: "Asynchronous, manual or auto failover"
pricing:
model: per_ocpu_per_hour
vm_ocpu_payg: 0.1360 # per OCPU per hour (EE)
vm_ocpu_byol: 0.0680
bm_per_hour: "Fixed per shape"
storage: "Block Volume pricing applies"
notes:
- "VM shapes billed per enabled OCPU per hour"
- "BM shapes billed per hour for the full shape"
- "Storage is separate (Block Volume pricing)"
- "Backup storage at Object Storage rates"
gotchas:
- id: DBCS-001
issue: "2-node RAC is maximum on VM shapes"
impact: "Cannot scale RAC beyond 2 nodes (use ExaCS for more)"
recommendation: "If >2 RAC nodes needed, evaluate ExaCS"
- id: DBCS-002
issue: "Performance limited by block storage"
impact: "Cannot match Exadata IOPS/latency"
recommendation: "Use higher performance block volumes or move to ExaCS for I/O intensive workloads"

89
kb/services/dbexpert-api-reference.yaml Normal file
View File

@@ -0,0 +1,89 @@
---
last_verified: 2026-03-17
description: |
Oracle DBExpert public REST API reference for refreshing the database service catalog.
Use this to keep kb/services/dbexpert-catalog.yaml up to date.
---
# ── DBExpert ORDS REST API ─────────────────────────────────────────
swagger_ui: https://oracle-dbexpert.github.io/swagger/
base_url: https://apexadb.oracle.com/ords/dbexpert
endpoints:
all_db_services:
method: GET
url: https://apexadb.oracle.com/ords/dbexpert/db-services/v1/all
description: "Complete database service catalog with capabilities, multicloud, compliance"
response_format: JSON
fields_per_service:
- DATABASE_SERVICE_NAME
- DATABASE_TYPE # Single Database, Distributed, Consolidation Pool
- MANAGEMENT_MODEL # Fully Managed PaaS, Co-managed PaaS, Customer Managed
- SUPPORTED_CLOUD_ENVIRONMENTS
- RECOMMENDED_WORKLOADS
- RECOMMENDED_DATA_MODELS
- CERTIFIED_ORACLE_APPLICATIONS
- ORACLE_AI_DATABASE_BYOL_SUPPORT
- CPU_RANGE
- SHAPES
- CPU_SCALING # Online, Auto scale up/down
- STORAGE_SCALING
- MAX_IOPS
- MAX_THROUGHPUT
- MAX_MEMORY
- NINES_OF_AVAILABILITY # SLA/SLO
- ORACLE_DB_MAXIMUM_AVAILABILITY_ARCHITECTURE_MEDALS
- AUTOMATED_BACKUPS_MAX_RETENTION
- AZURE_COMPLIANCE
- GOOGLE_CLOUD_COMPLIANCE
- AWS_COMPLIANCE
- ALLOWS_SYSDBA_ACCESS
- SELECTAI_SUPPORT
- MONGO-COMPATIBLE_API
- SUPPORTED_DATABASE_VERSIONS
- AUTONOMOUS
- HARDWARE_INFRASTRUCTURE
- INCLUDED_ORACLE_DB_OPTIONS_FOR_LICENSE-INCLUDED_SERVICE
- FREE_ADD-ONS_(NO_EXTRA_LICENSING_REQUIRED)
- OCI_LOCATIONS
- ORACLE_DATABASE@AZURE_LOCATIONS
- ORACLE_DATABASE@GOOGLE_CLOUD_LOCATIONS
- ORACLE_DATABASE@AWS_LOCATIONS
- IS_AVAILABLE_AT_GOOGLE_CLOUD_(GCP)
- IS_AVAILABLE_AT_AZURE
- IS_AVAILABLE_AT_AWS
multicloud_regions:
url: https://apexadb.oracle.com/ords/r/dbexpert/multicloud-capabilities/multicloud-regions
description: "Multicloud region availability matrix (APEX app, WAF-blocked for curl)"
notes: "Must use browser or Swagger UI"
service_advisor:
url: https://apexadb.oracle.com/ords/r/dbexpert/dbsn/service-advisor
description: "Interactive service advisor/comparison tool (APEX app, WAF-blocked for curl)"
notes: "Must use browser"
dbsn_home:
url: https://apexadb.oracle.com/ords/r/dbexpert/dbsn/home
description: "Cloud Tools home page (APEX app)"
access_notes: |
- The REST API at /ords/dbexpert/db-services/v1/all is accessible from Swagger UI
but blocked by Akamai WAF when called from curl/Python/programmatic clients
- The APEX apps (multicloud-capabilities, dbsn) are fully WAF-blocked
- To refresh data: open Swagger UI, execute the endpoint, copy JSON response
refresh_procedure:
step_1: "Open https://oracle-dbexpert.github.io/swagger/"
step_2: "Find GET /db-services/v1/all and click 'Try it out' → 'Execute'"
step_3: "Copy the Response body JSON"
step_4: "Paste to Claude with instruction: 'actualiza kb/services/dbexpert-catalog.yaml con esto'"
alternative: |
curl -s 'https://apexadb.oracle.com/ords/dbexpert/db-services/v1/all' \
-H 'accept: application/json'
(may fail due to WAF — use browser if it does)
kb_target_file: kb/services/dbexpert-catalog.yaml
services_count: 35
last_data_date: 2026-03-17

679
kb/services/dbexpert-catalog.yaml Normal file
View File

@@ -0,0 +1,679 @@
---
last_verified: 2026-03-17
source: https://apexadb.oracle.com/ords/dbexpert/db-services/v1/all
swagger: https://oracle-dbexpert.github.io/swagger/
description: Oracle Database services catalog from DBExpert API. Comprehensive capabilities, multicloud availability, SLAs, workload recommendations, and compliance data.
refresh_command: "curl -s 'https://apexadb.oracle.com/ords/dbexpert/db-services/v1/all' -H 'accept: application/json'"
notes: |
API may be blocked by Akamai WAF from non-browser clients.
Use Swagger UI at https://oracle-dbexpert.github.io/swagger/ to test.
(A) = Azure colocated region, (G) = Google Cloud colocated region
---
# =============================================================================
# Fully Managed PaaS
# =============================================================================
fully_managed_paas:
- short_name: ATP Dedicated
full_name: Autonomous AI Transaction Processing on Dedicated Infrastructure
management_model: Fully Managed PaaS
cloud_environments: [OCI, AWS]
multicloud: { azure: false, gcp: false, aws: true }
autonomous: true
sla: "99.995"
maa_medals: [Silver, Gold, Platinum]
cpu_unit: ECPU
cpu_range: "2-21504"
max_storage_tb: 1572
select_ai: true
mongo_api: true
open_source: false
recommended_workloads: [OLTP, Mixed, AI/ML, JSON, Graph, Blockchain, IoT]
byol_support: true
db_versions: ["26ai", "19c"]
- short_name: LAK Dedicated
full_name: Autonomous AI Lakehouse on Dedicated Infrastructure
management_model: Fully Managed PaaS
cloud_environments: [OCI, AWS]
multicloud: { azure: false, gcp: false, aws: true }
autonomous: true
sla: "99.995"
maa_medals: [Silver, Gold, Platinum]
cpu_unit: ECPU
cpu_range: "2-21504"
max_storage_tb: 1572
select_ai: true
mongo_api: true
open_source: false
recommended_workloads: [DW, Analytics, Data Lake, AI/ML, Mixed]
byol_support: true
db_versions: ["26ai", "19c"]
- short_name: ATP Serverless
full_name: Autonomous AI Transaction Processing Serverless
management_model: Fully Managed PaaS
cloud_environments: [OCI, Azure, GCP]
multicloud: { azure: true, gcp: true, aws: false }
autonomous: true
sla: "99.995"
sla_note: "with Autonomous Data Guard"
maa_medals: [Silver, Gold]
cpu_unit: ECPU
cpu_range: "2-16128"
max_storage_tb: 393
select_ai: true
mongo_api: true
open_source: false
recommended_workloads: [OLTP, Mixed, Microservices, AI/ML, JSON, Graph, Blockchain, IoT]
byol_support: true
db_versions: ["26ai", "19c"]
- short_name: LAK Serverless
full_name: Autonomous AI Lakehouse Serverless
management_model: Fully Managed PaaS
cloud_environments: [OCI, Azure, GCP]
multicloud: { azure: true, gcp: true, aws: false }
autonomous: true
sla: "99.995"
sla_note: "with Autonomous Data Guard"
maa_medals: [Silver, Gold]
cpu_unit: ECPU
cpu_range: "2-16128"
max_storage_tb: 393
select_ai: true
mongo_api: true
open_source: false
recommended_workloads: [DW, Analytics, Data Lake, AI/ML, Mixed]
byol_support: true
db_versions: ["26ai", "19c"]
- short_name: AJD Serverless
full_name: Autonomous AI JSON Database Serverless
management_model: Fully Managed PaaS
cloud_environments: [OCI, Azure, GCP]
multicloud: { azure: true, gcp: true, aws: false }
autonomous: true
sla: "99.95"
maa_medals: []
cpu_unit: ECPU
cpu_range: "2-512"
max_storage_tb: 10
select_ai: true
mongo_api: true
open_source: false
recommended_workloads: [JSON, Document Store, Microservices, IoT]
byol_support: false
db_versions: ["26ai", "19c"]
- short_name: ADB-S Elastic Pool
full_name: Autonomous AI Database Serverless in an Elastic Pool
management_model: Fully Managed PaaS
cloud_environments: [OCI, Azure, GCP]
multicloud: { azure: true, gcp: true, aws: false }
autonomous: true
sla: "99.995"
maa_medals: [Silver, Gold]
cpu_unit: ECPU
cpu_range: "128-16384"
max_storage_tb: 393
select_ai: true
mongo_api: true
open_source: false
recommended_workloads: [Multi-tenant SaaS, ISV, Consolidated workloads]
byol_support: true
db_versions: ["26ai", "19c"]
- short_name: ADB-D Elastic Pool
full_name: Autonomous AI Database Dedicated in an Elastic Pool
management_model: Fully Managed PaaS
cloud_environments: [OCI, AWS]
multicloud: { azure: false, gcp: false, aws: true }
autonomous: true
sla: "99.95"
maa_medals: [Silver]
cpu_unit: ECPU
cpu_range: "128-16384"
max_storage_tb: 1572
select_ai: true
mongo_api: true
open_source: false
recommended_workloads: [Multi-tenant SaaS, ISV, Consolidated workloads]
byol_support: true
db_versions: ["26ai", "19c"]
- short_name: Globally Distributed ATP-D
full_name: Globally Distributed Autonomous AI Transaction Processing
management_model: Fully Managed PaaS
cloud_environments: [OCI]
multicloud: { azure: false, gcp: false, aws: false }
autonomous: true
sla: "99.995"
maa_medals: []
cpu_unit: ECPU
cpu_range: "2-16128"
max_storage_tb: 393
select_ai: false
mongo_api: false
open_source: false
recommended_workloads: [Globally distributed OLTP, Sharded databases, Low-latency geo-distributed]
byol_support: false
db_versions: ["26ai", "19c"]
- short_name: NoSQL
full_name: NoSQL Database Cloud Service
management_model: Fully Managed PaaS
cloud_environments: [OCI]
multicloud: { azure: false, gcp: false, aws: false }
autonomous: false
sla: "99.995"
sla_note: "99.999 with Global Active Tables"
maa_medals: []
cpu_unit: Serverless
cpu_range: serverless
max_storage_tb: unlimited
select_ai: false
mongo_api: false
open_source: false
recommended_workloads: [IoT, Mobile backend, Gaming, Ad-tech, Key-value, Document]
byol_support: false
db_versions: []
- short_name: MySQL HeatWave
full_name: MySQL Database Service with HeatWave
management_model: Fully Managed PaaS
cloud_environments: [OCI]
multicloud: { azure: false, gcp: false, aws: false }
autonomous: false
sla: "99.99"
sla_note: "with High Availability"
maa_medals: []
cpu_unit: OCPU
cpu_range: "1-128"
max_storage_tb: 64
select_ai: false
mongo_api: false
open_source: true
recommended_workloads: [Web applications, SaaS, E-commerce, OLTP+Analytics, HeatWave ML/GenAI]
byol_support: false
db_versions: ["8.4", "8.0"]
# =============================================================================
# Co-managed PaaS
# =============================================================================
co_managed_paas:
- short_name: ExaDB-D
full_name: Exadata Database Service on Dedicated Infrastructure
management_model: Co-managed PaaS
cloud_environments: [OCI, Azure, GCP, AWS]
multicloud: { azure: true, gcp: true, aws: true }
autonomous: false
sla: "99.95"
maa_medals: [Bronze, Silver, Gold, Platinum]
cpu_unit: ECPU
cpu_range: "16-24320"
max_storage_tb: 3924
select_ai: false
mongo_api: true
open_source: false
recommended_workloads: [Mission-critical OLTP, Large DW, Consolidation, EBS, RAC, Data Guard]
byol_support: true
db_versions: ["26ai", "19c", "12.2", "12.1", "11.2"]
- short_name: ExaDB-XS
full_name: Exadata Database Service on Exascale Infrastructure (ExaDB-XS)
management_model: Co-managed PaaS
cloud_environments: [OCI, Azure, GCP]
multicloud: { azure: true, gcp: true, aws: false }
autonomous: false
sla: "99.95"
maa_medals: [Bronze, Silver, Gold, Platinum]
cpu_unit: ECPU
cpu_range: "0-2000"
max_storage_tb: 300
select_ai: false
mongo_api: true
open_source: false
recommended_workloads: [Small-to-medium Exadata, Dev/Test on Exadata, Entry-level mission-critical]
byol_support: true
db_versions: ["26ai", "19c"]
- short_name: ExaDB-C@C
full_name: Exadata Database Service on Cloud@Customer
management_model: Co-managed PaaS
cloud_environments: [Cloud@Customer]
multicloud: { azure: false, gcp: false, aws: false }
autonomous: false
sla: "99.95"
sla_note: SLO
maa_medals: [Bronze, Silver, Gold, Platinum]
cpu_unit: ECPU
cpu_range: "16-24320"
max_storage_tb: 3924
select_ai: false
mongo_api: true
open_source: false
recommended_workloads: [Data sovereignty, Regulated industries, Latency-sensitive on-prem, EBS]
byol_support: true
db_versions: ["26ai", "19c", "12.1", "11.2"]
- short_name: BaseDB SE
full_name: Base Database Service - Standard Edition - VM
management_model: Co-managed PaaS
cloud_environments: [OCI]
multicloud: { azure: false, gcp: false, aws: false }
autonomous: false
sla: "99.9"
sla_note: SLO
maa_medals: [Bronze]
cpu_unit: OCPU
cpu_range: "1-8"
max_storage_tb: 40
select_ai: false
mongo_api: false
open_source: false
recommended_workloads: [Small departmental, Dev/Test, Non-critical OLTP]
byol_support: true
db_versions: ["26ai", "19c"]
- short_name: BaseDB EE
full_name: Base Database Service - Enterprise Edition - VM
management_model: Co-managed PaaS
cloud_environments: [OCI]
multicloud: { azure: false, gcp: false, aws: false }
autonomous: false
sla: "99.9"
sla_note: SLO
maa_medals: [Bronze]
cpu_unit: OCPU
cpu_range: "1-64"
max_storage_tb: 40
select_ai: false
mongo_api: false
open_source: false
recommended_workloads: [Enterprise OLTP, Mixed workloads, Moderate DW]
byol_support: true
db_versions: ["26ai", "19c"]
- short_name: BaseDB EE HP
full_name: Base Database Service - Enterprise Edition High Performance - VM
management_model: Co-managed PaaS
cloud_environments: [OCI]
multicloud: { azure: false, gcp: false, aws: false }
autonomous: false
sla: "99.9"
sla_note: SLO
maa_medals: [Bronze]
cpu_unit: OCPU
cpu_range: "1-64"
max_storage_tb: 40
select_ai: false
mongo_api: false
open_source: false
recommended_workloads: [Enterprise OLTP with partitioning, Advanced compression, OLAP]
byol_support: true
db_versions: ["26ai", "19c"]
- short_name: BaseDB EE EP
full_name: Base Database Service - Enterprise Edition Extreme Performance - VM
management_model: Co-managed PaaS
cloud_environments: [OCI]
multicloud: { azure: false, gcp: false, aws: false }
autonomous: false
sla: "99.9"
sla_note: SLO
maa_medals: [Bronze, Silver, Gold, Platinum]
cpu_unit: OCPU
cpu_range: "1-128"
cpu_note: "RAC up to 128 OCPUs across 2 nodes"
max_storage_tb: 40
select_ai: false
mongo_api: false
open_source: false
recommended_workloads: [Mission-critical OLTP, RAC, Data Guard, In-Memory, Active Data Guard]
byol_support: true
db_versions: ["26ai", "19c"]
- short_name: BaseDB SE - ECPU
full_name: Base Database Service - Standard Edition - ECPU
management_model: Co-managed PaaS
cloud_environments: [OCI, Azure, GCP]
multicloud: { azure: true, gcp: true, aws: false }
autonomous: false
sla: "99.9"
sla_note: SLO
maa_medals: [Bronze]
cpu_unit: ECPU
cpu_range: "4-32"
max_storage_tb: 40
select_ai: false
mongo_api: false
open_source: false
recommended_workloads: [Small departmental, Dev/Test, Non-critical OLTP, Multicloud]
byol_support: true
db_versions: ["26ai", "19c"]
- short_name: BaseDB EE - ECPU
full_name: Base Database Service - Enterprise Edition - ECPU
management_model: Co-managed PaaS
cloud_environments: [OCI, Azure, GCP]
multicloud: { azure: true, gcp: true, aws: false }
autonomous: false
sla: "99.9"
sla_note: SLO
maa_medals: [Bronze]
cpu_unit: ECPU
cpu_range: "4-256"
max_storage_tb: 40
select_ai: false
mongo_api: false
open_source: false
recommended_workloads: [Enterprise OLTP, Mixed workloads, Multicloud]
byol_support: true
db_versions: ["26ai", "19c"]
- short_name: BaseDB EE HP - ECPU
full_name: Base Database Service - Enterprise Edition High Performance - ECPU
management_model: Co-managed PaaS
cloud_environments: [OCI, Azure, GCP]
multicloud: { azure: true, gcp: true, aws: false }
autonomous: false
sla: "99.9"
sla_note: SLO
maa_medals: [Bronze]
cpu_unit: ECPU
cpu_range: "4-256"
max_storage_tb: 40
select_ai: false
mongo_api: false
open_source: false
recommended_workloads: [Enterprise OLTP with partitioning, Advanced compression, Multicloud]
byol_support: true
db_versions: ["26ai", "19c"]
- short_name: Globally Distributed ExaDB-XS
full_name: Globally Distributed Exadata Database on Exascale Infrastructure
management_model: Co-managed PaaS
cloud_environments: [OCI]
multicloud: { azure: false, gcp: false, aws: false }
autonomous: false
sla: "99.95"
sla_note: SLO
maa_medals: []
cpu_unit: ECPU
cpu_range: "0-2000"
max_storage_tb: 300
select_ai: false
mongo_api: false
open_source: false
recommended_workloads: [Globally distributed databases, Sharded Exadata, Geo-distributed OLTP]
byol_support: true
db_versions: ["26ai"]
- short_name: PostgreSQL
full_name: Oracle Cloud Infrastructure Database with PostgreSQL
management_model: Co-managed PaaS
cloud_environments: [OCI]
multicloud: { azure: false, gcp: false, aws: false }
autonomous: false
sla: "99.99"
sla_note: "with multi-node HA"
maa_medals: []
cpu_unit: OCPU
cpu_range: "2-64"
max_storage_tb: 64
select_ai: false
mongo_api: false
open_source: true
recommended_workloads: [PostgreSQL workloads, Open source migration, Web applications]
byol_support: false
db_versions: ["15", "14"]
- short_name: LAK-ExaC@C
full_name: Autonomous AI Lakehouse on Dedicated Infrastructure Cloud@Customer
management_model: Co-managed PaaS
cloud_environments: [Cloud@Customer]
multicloud: { azure: false, gcp: false, aws: false }
autonomous: true
sla: "99.995"
maa_medals: [Silver, Gold, Platinum]
cpu_unit: ECPU
cpu_range: "2-21504"
max_storage_tb: 1572
select_ai: true
mongo_api: true
open_source: false
recommended_workloads: [Data sovereignty DW, On-prem analytics, Regulated data lake]
byol_support: true
db_versions: ["26ai", "19c"]
- short_name: ATP-ExaC@C
full_name: Autonomous AI Transaction Processing on Dedicated Infrastructure Cloud@Customer
management_model: Co-managed PaaS
cloud_environments: [Cloud@Customer]
multicloud: { azure: false, gcp: false, aws: false }
autonomous: true
sla: "99.995"
maa_medals: [Silver, Gold, Platinum]
cpu_unit: ECPU
cpu_range: "2-21504"
max_storage_tb: 1572
select_ai: true
mongo_api: true
open_source: false
recommended_workloads: [Data sovereignty OLTP, On-prem mission-critical, Regulated workloads]
byol_support: true
db_versions: ["26ai", "19c"]
- short_name: BaseDB Arm EE
full_name: Base Database Service Arm - Enterprise Edition - VM
management_model: Co-managed PaaS
cloud_environments: [OCI]
multicloud: { azure: false, gcp: false, aws: false }
autonomous: false
sla: "99.9"
sla_note: SLO
maa_medals: [Bronze]
cpu_unit: OCPU
cpu_range: "2-80"
max_storage_tb: 40
select_ai: false
mongo_api: false
open_source: false
recommended_workloads: [Cost-optimized Enterprise, Arm-native workloads]
byol_support: true
db_versions: ["26ai", "19c"]
- short_name: BaseDB Arm EE EP
full_name: Base Database Service Arm - Enterprise Edition Extreme Performance - VM
management_model: Co-managed PaaS
cloud_environments: [OCI]
multicloud: { azure: false, gcp: false, aws: false }
autonomous: false
sla: "99.9"
sla_note: SLO
maa_medals: [Bronze, Silver, Gold, Platinum]
cpu_unit: OCPU
cpu_range: "2-160"
max_storage_tb: 40
select_ai: false
mongo_api: false
open_source: false
recommended_workloads: [Cost-optimized mission-critical, Arm RAC, Arm Data Guard]
byol_support: true
db_versions: ["26ai", "19c"]
- short_name: BaseDB Arm EE HP
full_name: Base Database Service Arm - Enterprise Edition High Performance - VM
management_model: Co-managed PaaS
cloud_environments: [OCI]
multicloud: { azure: false, gcp: false, aws: false }
autonomous: false
sla: "99.9"
sla_note: SLO
maa_medals: [Bronze]
cpu_unit: OCPU
cpu_range: "2-80"
max_storage_tb: 40
select_ai: false
mongo_api: false
open_source: false
recommended_workloads: [Cost-optimized with partitioning, Arm advanced compression]
byol_support: true
db_versions: ["26ai", "19c"]
# =============================================================================
# Customer Managed
# =============================================================================
customer_managed:
- short_name: IaaS Bare Metal
full_name: OCI Compute - Bare Metal
management_model: Customer Managed
cloud_environments: [OCI]
multicloud: { azure: false, gcp: false, aws: false }
autonomous: false
sla: null
maa_medals: [Bronze]
cpu_unit: OCPU
cpu_range: "64-192"
max_storage_tb: unlimited
select_ai: false
mongo_api: false
open_source: false
recommended_workloads: [Full OS control, Custom RAC, Legacy versions, Bare-metal performance]
byol_support: true
db_versions: ["26ai", "19c", "12.2", "12.1", "11.2"]
- short_name: IaaS VM
full_name: OCI Compute - Virtual Machine
management_model: Customer Managed
cloud_environments: [OCI]
multicloud: { azure: false, gcp: false, aws: false }
autonomous: false
sla: null
maa_medals: [Bronze]
cpu_unit: OCPU
cpu_range: "1-94"
cpu_note: "E6.Flex up to 126 OCPUs"
max_storage_tb: unlimited
select_ai: false
mongo_api: false
open_source: false
recommended_workloads: [Dev/Test, Custom config, Legacy versions, Full OS control]
byol_support: true
db_versions: ["26ai", "19c", "12.2", "12.1", "11.2"]
- short_name: Exadata DB Machine
full_name: Oracle Database on Exadata Database Machine (on-prem)
management_model: Customer Managed
cloud_environments: [On-Premises]
multicloud: { azure: false, gcp: false, aws: false }
autonomous: false
sla: null
maa_medals: [Bronze, Silver, Gold, Platinum]
cpu_unit: Cores
cpu_range: "0-2880"
max_storage_tb: unlimited
select_ai: false
mongo_api: false
open_source: false
recommended_workloads: [On-prem Exadata, Air-gapped, Full hardware control]
byol_support: true
db_versions: ["26ai", "19c", "12.2", "12.1", "11.2"]
# =============================================================================
# Always Free & Developer Editions
# =============================================================================
always_free_and_developer:
- short_name: ATP Serverless - Always Free
full_name: Autonomous AI Transaction Processing Serverless - Always Free
base_service: ATP Serverless
management_model: Fully Managed PaaS
cloud_environments: [OCI]
autonomous: true
cpu_unit: ECPU
cpu_range: "2"
max_storage_tb: 0.02
select_ai: true
mongo_api: true
db_versions: ["26ai", "19c"]
notes: "Always Free tier, 20 GB storage, no SLA"
- short_name: LAK Serverless - Always Free
full_name: Autonomous AI Lakehouse Serverless - Always Free
base_service: LAK Serverless
management_model: Fully Managed PaaS
cloud_environments: [OCI]
autonomous: true
cpu_unit: ECPU
cpu_range: "2"
max_storage_tb: 0.02
select_ai: true
mongo_api: true
db_versions: ["26ai", "19c"]
notes: "Always Free tier, 20 GB storage, no SLA"
- short_name: AJD Serverless - Always Free
full_name: Autonomous AI JSON Database Serverless - Always Free
base_service: AJD Serverless
management_model: Fully Managed PaaS
cloud_environments: [OCI]
autonomous: true
cpu_unit: ECPU
cpu_range: "2"
max_storage_tb: 0.02
select_ai: true
mongo_api: true
db_versions: ["26ai", "19c"]
notes: "Always Free tier, 20 GB storage, no SLA"
- short_name: ADB-S Developer
full_name: Autonomous AI Database Serverless - Developer
base_service: ATP Serverless
management_model: Fully Managed PaaS
cloud_environments: [OCI]
autonomous: true
cpu_unit: ECPU
cpu_range: "2-512"
max_storage_tb: 10
select_ai: true
mongo_api: true
db_versions: ["26ai", "19c"]
notes: "Developer edition, reduced cost, non-production use"
- short_name: BaseDB Arm Developer
full_name: Base Database Service Arm - Developer Edition - VM
base_service: BaseDB Arm EE
management_model: Co-managed PaaS
cloud_environments: [OCI]
autonomous: false
cpu_unit: OCPU
cpu_range: "2-80"
max_storage_tb: 40
select_ai: false
mongo_api: false
db_versions: ["26ai", "19c"]
notes: "Arm Developer edition, non-production use"
# =============================================================================
# Quick-reference: Multicloud availability matrix
# =============================================================================
# Service | OCI | Azure | GCP | AWS | C@C
# -------------------------|-----|-------|-----|-----|----
# ExaDB-D | Y | Y | Y | Y |
# ExaDB-XS | Y | Y | Y | |
# ATP Dedicated | Y | | | Y |
# LAK Dedicated | Y | | | Y |
# ATP Serverless | Y | Y | Y | |
# LAK Serverless | Y | Y | Y | |
# AJD Serverless | Y | Y | Y | |
# ADB-S Elastic Pool | Y | Y | Y | |
# ADB-D Elastic Pool | Y | | | Y |
# BaseDB SE/EE/HP - ECPU | Y | Y | Y | |
# ExaDB-C@C | | | | | Y
# LAK-ExaC@C / ATP-ExaC@C | | | | | Y
# All others | Y | | | |

102
kb/services/exacs.yaml Normal file
View File

@@ -0,0 +1,102 @@
---
last_verified: 2026-03-14
service: Exadata Cloud Service (ExaCS)
category: database
oci_color: "#AA643B"
---
what: Full Oracle Exadata system in OCI. Provides OS access, RAC, full DBA control
with cloud elasticity. Runs the same Exadata software as on-prem.
when_to_use:
- Need OS-level access for custom agents, scripts, or compliance tools
- RAC required for application architecture
- Sustained high OCPU workloads (>128 OCPUs)
- Lift-and-shift from on-prem Exadata with minimal changes
- Need custom database parameters not available in ADB
- Applications that use features incompatible with ADB (e.g., dblinks to non-Oracle)
when_NOT_to_use:
- Small/medium workloads (over-provisioned)
- No DBA team (ExaCS requires database administration)
- Variable workloads that benefit from ADB auto-scaling
- Budget-constrained (high minimum commitment)
limits:
shapes:
- name: "Exadata.Quarter3.100"
base_ocpu: 100
max_ocpu: 100
storage_tb: 49.5
- name: "Exadata.Half3.200"
base_ocpu: 200
max_ocpu: 200
storage_tb: 99
- name: "Exadata.Full3.400"
base_ocpu: 400
max_ocpu: 400
storage_tb: 198
max_vm_clusters: 8
max_databases_per_cluster: "Limited by resources"
max_pdb_per_cdb: 252
features:
os_access: true
rac: true
data_guard: true
cross_region_data_guard: true
custom_db_home: true
custom_patches: true
grid_infrastructure: true
flash_cache: true
smart_scan: true
storage_compression: true
hybrid_columnar_compression: true
ha_dr:
local_ha: "RAC across Exadata nodes, automatic failover"
data_guard:
same_region: "Synchronous, automatic failover with FSFO"
cross_region: "Asynchronous or far-sync, manual or automatic failover"
sizing_rules:
minimum: "Quarter rack (100 OCPUs base)"
scaling: "Can enable additional OCPUs in increments"
storage: "Comes with infrastructure, expandable"
pricing:
model: infrastructure_plus_ocpu
infrastructure_monthly: "Fixed per shape"
enabled_ocpu_per_hour: 0.336 # approximate
byol_ocpu_per_hour: 0.168
notes:
- "Infrastructure cost is fixed per shape"
- "Only enabled OCPUs are billed"
- "BYOL provides ~50% discount on OCPU portion"
- "Storage included with infrastructure"
gotchas:
- id: EXACS-001
issue: "Provisioning takes hours to days"
impact: "Cannot provision on-demand like ADB-S"
recommendation: "Plan capacity well in advance"
- id: EXACS-002
issue: "Minimum quarter rack commitment"
impact: "Significant base cost even at low utilization"
recommendation: "Ensure sustained usage justifies the infrastructure cost"
- id: EXACS-003
issue: "DBA team required for ongoing operations"
impact: "Patching, tuning, and maintenance are customer responsibility"
recommendation: "Ensure DBA team capacity before choosing ExaCS over ADB"
- id: EXACS-004
issue: "Scale-down requires VM cluster modification"
impact: "Not as elastic as ADB-S for variable workloads"
recommendation: "Right-size for steady-state, not peak"
migration_tools:
- name: Oracle Data Guard
use_for: "On-prem Exadata to ExaCS with minimal downtime"
- name: RMAN Restore
use_for: "Backup-based migration with planned downtime"
- name: Zero Downtime Migration (ZDM)
use_for: "Automated physical migration"

101
kb/services/exadata-cloud.yaml Normal file
View File

@@ -0,0 +1,101 @@
# OCI Service: Exadata Cloud Service (ExaCS)
# Last verified: 2026-03
service:
name: "Exadata Cloud Service (ExaCS)"
id: exacs
category: database
color: "#AA643B"
description: "Dedicated Exadata infrastructure running in OCI, providing the full performance and isolation of Exadata hardware with cloud elasticity. Supports Oracle RAC, Data Guard, and direct OS/CDB-level access for maximum DBA control."
when_to_use:
- "Oracle RAC workloads requiring multi-node clustering"
- "Regulatory or compliance scenarios demanding dedicated infrastructure isolation"
- "High IOPS / low-latency database workloads (OLTP or mixed)"
- "Sustained compute needs exceeding 128 OCPUs"
- "Need direct OS-level or CDB-level access for custom patching, tuning, or agents"
when_not_to_use:
- "Small workloads under 16 OCPUs — use Autonomous Database Serverless (ADB-S) or Base Database Service"
- "No dedicated DBA team to manage patching, RAC, and infrastructure"
- "Simple OLTP with no RAC or isolation requirements — use ADB-S instead"
- "Dev/test environments where cost efficiency matters more than performance"
variants:
- id: exacs_x9m
name: "ExaCS X9M"
description: "Exadata X9M shape — current-generation infrastructure with RDMA over Converged Ethernet and persistent memory acceleration."
- id: exacs_x10m
name: "ExaCS X10M"
description: "Exadata X10M shape — next-generation infrastructure with improved compute, storage density, and throughput."
sizing:
rack_configurations:
quarter_rack:
ocpus: "100 (scalable)"
memory: "1.44 TB"
storage: "Up to 76.8 TB usable (Exadata Storage)"
db_nodes: 2
storage_servers: 3
half_rack:
ocpus: "200 (scalable)"
memory: "2.88 TB"
storage: "Up to 153.6 TB usable"
db_nodes: 4
storage_servers: 6
full_rack:
ocpus: "400 (scalable)"
memory: "5.76 TB"
storage: "Up to 307.2 TB usable"
db_nodes: 8
storage_servers: 12
ocpu_scaling: "OCPUs can be scaled online in increments without downtime. You pay for enabled OCPUs, not the total available in the rack."
sizing_guidance: "Start with a quarter rack for most production workloads. Scale OCPUs on demand. Choose half/full rack only when storage capacity or aggregate memory requirements exceed quarter rack limits."
gotchas:
- id: exacs_minimum_cost
severity: HIGH
description: "Minimum infrastructure cost is approximately $6,000+/month for a quarter rack, regardless of OCPU usage. Ensure sustained workload justifies the commitment."
- id: exacs_provisioning_time
severity: MEDIUM
description: "Exadata infrastructure provisioning takes 4-8 hours. Plan deployments accordingly — this is not an instant resource like a Compute VM."
- id: exacs_patching_window
severity: MEDIUM
description: "Patching requires a scheduled maintenance window. Database nodes are patched in a rolling fashion but plan for reduced capacity during the process."
- id: exacs_gi_db_patch_separate
severity: MEDIUM
description: "Grid Infrastructure (GI) and Database Home patches are applied separately and may have different schedules. Coordinate both to avoid version skew."
- id: exacs_overprovisioning_risk
severity: HIGH
description: "Customers frequently over-provision by choosing half or full racks when a quarter rack with OCPU scaling would suffice. Always validate actual IOPS and CPU requirements before sizing up."
- id: exacs_network_placement
severity: LOW
description: "ExaCS requires placement in a private subnet with sufficient IP addresses. Each DB node and each virtual IP consumes an IP; plan your subnet CIDR accordingly."
implied_dependencies:
- service: vcn
reason: "ExaCS infrastructure must be deployed in a VCN"
- service: private_subnet
reason: "DB nodes and SCAN listeners require private subnet placement"
- service: service_gateway
reason: "Access to OCI object storage for backups and patching from private subnets"
- service: oci_vault
reason: "TDE wallet management and encryption key storage"
competitive_notes:
vs_aws: "AWS has no equivalent dedicated Oracle Exadata infrastructure offering. RDS Oracle and RDS Custom lack RAC support and Exadata storage acceleration. Customers needing true Exadata performance have no AWS-native path."
references:
documentation: "https://docs.oracle.com/en-us/iaas/Content/Database/Concepts/exaoverview.htm"
pricing: "https://www.oracle.com/cloud/price-list/#exadata"
changelog:
- date: "2026-03-14"
contributor: { name: "Diego Cabrera", team: "Field Architecture" }
change: "Initial creation with shapes, sizing, gotchas, dependencies"

91
kb/services/networking.yaml Normal file
View File

@@ -0,0 +1,91 @@
---
last_verified: 2026-03-14
service: OCI Networking
category: networking
oci_color: "#4F7B6E"
---
what: Software-defined networking layer in OCI. Includes VCN, subnets, gateways,
load balancers, DNS, and connectivity options.
components:
vcn:
what: "Virtual Cloud Network — isolated network in OCI"
cidr: "Supports multiple CIDR blocks, /16 to /30"
max_per_region: 50
subnet:
what: "Subdivision of VCN, can be regional (spans all ADs)"
types: ["public", "private"]
recommendation: "Always use private subnets for databases and app servers"
security_list:
what: "Stateful firewall rules at subnet level"
recommendation: "Prefer NSGs (Network Security Groups) for granular control"
nsg:
what: "Network Security Group — firewall rules at VNIC level"
recommendation: "Preferred over security lists for micro-segmentation"
internet_gateway:
what: "Enables internet access for public subnets"
nat_gateway:
what: "Enables outbound internet for private subnets"
service_gateway:
what: "Private access to OCI services (Object Storage, ADB, etc.)"
recommendation: "Always use for database and storage access — no internet traversal"
drg:
what: "Dynamic Routing Gateway — hub for VCN peering and on-prem connectivity"
supports: ["VCN peering", "FastConnect", "IPSec VPN", "Remote peering"]
load_balancer:
types:
- name: "Flexible Load Balancer"
what: "Layer 7 (HTTP/HTTPS) load balancer"
bandwidth: "10 Mbps to 8 Gbps (flexible)"
- name: "Network Load Balancer"
what: "Layer 4 (TCP/UDP) load balancer"
bandwidth: "Up to line rate"
connectivity:
fastconnect:
what: "Dedicated private connection to OCI (like AWS Direct Connect)"
speeds: ["1 Gbps", "2 Gbps", "5 Gbps", "10 Gbps", "100 Gbps"]
redundancy: "Always deploy 2 circuits for HA"
notes: "Partner or co-location model, typical setup takes 2-4 weeks"
ipsec_vpn:
what: "Encrypted tunnel over internet"
bandwidth: "Up to 250 Mbps per tunnel, aggregate with multiple tunnels"
notes: "Good for dev/test or backup connectivity, not production data transfer"
vcn_peering:
local: "Within same region, no bandwidth limits"
remote: "Cross-region via DRG, standard inter-region latency"
pricing:
vcn: "Free"
subnet: "Free"
nat_gateway_per_hour: 0.0084
service_gateway: "Free"
drg_per_hour: 0.016
fastconnect:
port_per_month:
1gbps: 180
10gbps: 680
data_ingress: "Free"
data_egress: "Free over FastConnect"
load_balancer:
flexible_base: 0.014 # per hour
per_mbps: 0.0013
notes:
- "Inter-region data transfer: $0.0085/GB"
- "Internet egress: first 10 TB/month free, then $0.0085/GB"
- "OCI egress pricing is significantly cheaper than AWS/Azure/GCP"
gotchas:
- id: NET-001
issue: "VCN CIDR blocks cannot overlap for peering"
impact: "Plan CIDR ranges carefully for multi-VCN architectures"
recommendation: "Use a documented IP addressing scheme before deployment"
- id: NET-002
issue: "FastConnect provisioning takes 2-4 weeks with partners"
impact: "Can delay migration timelines"
recommendation: "Start FastConnect procurement early, use VPN as interim"
- id: NET-003
issue: "Security lists apply to entire subnet, NSGs to specific VNICs"
impact: "Security lists can be too broad for micro-segmentation"
recommendation: "Use NSGs as primary, security lists as fallback"

97
kb/services/oci-networking-core.yaml Normal file
View File

@@ -0,0 +1,97 @@
# OCI Service: OCI Networking Core (VCN, Subnets, Gateways)
# Last verified: 2026-03
service:
name: "OCI Networking Core"
id: networking_core
category: infrastructure
description: "Foundational networking bundle covering Virtual Cloud Networks (VCN), subnets, and gateways. Every OCI deployment depends on these components for connectivity, segmentation, and traffic routing."
components:
- name: "Virtual Cloud Network (VCN)"
id: vcn
description: "Software-defined private network in OCI. Provides the IP address space, DNS, and route table framework for all attached resources."
when_to_use:
- "Required for every OCI deployment — compute, database, Kubernetes, and managed services all reside in a VCN"
- name: "Subnet (Public)"
id: public_subnet
description: "Subnet where instances can receive public IP addresses and are reachable from the internet via an Internet Gateway."
when_to_use:
- "Load balancers, bastion hosts, or resources that must accept inbound internet traffic"
- "Dev/test instances needing direct internet access"
- name: "Subnet (Private)"
id: private_subnet
description: "Subnet with no public IP assignment. Resources communicate outbound via NAT Gateway and access OCI services via Service Gateway."
when_to_use:
- "Application servers, databases, and backend services that should not be internet-facing"
- "Any workload subject to security or compliance restrictions on public exposure"
- name: "Internet Gateway (IGW)"
id: igw
description: "Provides a path for inbound and outbound internet traffic to/from resources in public subnets."
when_to_use:
- "Public-facing load balancers or bastion hosts need internet connectivity"
- name: "NAT Gateway"
id: nat_gateway
description: "Enables outbound-only internet access for resources in private subnets. No inbound initiation from the internet."
when_to_use:
- "Private subnet resources need to pull OS patches, container images, or call external APIs"
- name: "Service Gateway"
id: service_gateway
description: "Private pathway from a VCN to supported OCI services (e.g., Object Storage, Autonomous Database) without traffic traversing the internet."
when_to_use:
- "Any private subnet workload that needs to reach OCI Object Storage, streaming, or other supported services"
- "Backup traffic from databases or compute that should stay on the Oracle backbone"
- name: "Dynamic Routing Gateway (DRG)"
id: drg
description: "Virtual router that connects a VCN to on-premises networks (via FastConnect or IPSec VPN), other VCNs, or remote regions."
when_to_use:
- "Hybrid cloud connectivity to on-premises data centers"
- "VCN-to-VCN peering across regions or tenancies"
- "Hub-and-spoke network topologies"
- name: "Local Peering Gateway (LPG)"
id: lpg
description: "Connects two VCNs in the same region for private traffic exchange without traversing the internet or a DRG."
when_to_use:
- "Intra-region VCN-to-VCN peering when a DRG hub is not needed"
- "Simple two-VCN peering scenarios"
design_rules:
- "Allocate a /16 CIDR block per VCN to allow room for future subnet expansion"
- "Plan CIDR ranges for growth — adding non-overlapping CIDRs later is supported but the original CIDR cannot be changed"
- "Avoid CIDR overlap with on-premises networks and other VCNs that will be peered"
- "Create separate subnets per tier (web, app, database) and per availability domain when needed for fault isolation"
- "Prefer Network Security Groups (NSGs) over Security Lists — NSGs are attached to individual resources and are easier to manage at scale"
gotchas:
- id: vcn_cidr_immutable
severity: HIGH
description: "A VCN's original CIDR block cannot be modified or removed after creation. Additional non-overlapping CIDRs can be added, but plan the initial range carefully."
- id: security_rule_limit
severity: MEDIUM
description: "Each security list supports a maximum of 200 rules (ingress + egress combined). For complex environments, use multiple NSGs instead of overloading a single security list."
- id: service_gateway_required
severity: HIGH
description: "Resources in private subnets cannot reach OCI services (Object Storage, Autonomous Database, etc.) without a Service Gateway and corresponding route rule. This is a common misconfiguration."
- id: drg_required_hybrid
severity: MEDIUM
description: "A DRG is required for FastConnect, IPSec VPN, and cross-VCN peering via transit routing. Plan DRG attachment early — retrofitting routing later adds complexity."
references:
documentation: "https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/overview.htm"
vcn_best_practices: "https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/bestpractices.htm"
changelog:
- date: "2026-03-14"
contributor: { name: "Diego Cabrera", team: "Field Architecture" }
change: "Initial creation with VCN, subnets, gateways, DRG design rules and gotchas"

45
kb/services/oci-queue.yaml Normal file
View File

@@ -0,0 +1,45 @@
---
last_verified: 2026-03-14
service: OCI Queue
category: integration
oci_color: "#6B4D9A"
---
what: Fully managed serverless message queue. Supports standard queue semantics
with at-least-once delivery, visibility timeout, and dead letter queues.
when_to_use:
- Decoupling microservices
- Work distribution across consumers
- Buffering requests during traffic spikes
- Simple pub/sub messaging without Kafka complexity
when_NOT_to_use:
- Need strict ordering (use OCI Streaming)
- Need real-time streaming analytics (use OCI Streaming)
- Need message replay (use OCI Streaming)
- Complex routing/filtering (use OCI Streaming or third-party)
limits:
max_message_size_kb: 512
max_retention_days: 7
max_queues_per_compartment: 100
max_channels_per_queue: 10
max_visibility_timeout_hours: 12
features:
dead_letter_queue: true
visibility_timeout: true
long_polling: true
batched_operations: true
encryption_at_rest: true
private_endpoint: true
pricing:
model: per_request
per_million_requests: 0.40
data_transfer: "Standard OCI egress pricing"
notes:
- "No minimum commitment"
- "Billed per API request (send, receive, delete)"
- "Very cost-effective for moderate throughput"

74
kb/services/oke.yaml Normal file
View File

@@ -0,0 +1,74 @@
# OCI Service: Oracle Container Engine for Kubernetes (OKE)
# Last verified: 2026-03
service:
name: "Oracle Container Engine for Kubernetes (OKE)"
id: oke
category: infrastructure
color: "#2D5967"
description: "Managed Kubernetes service with Oracle-optimized control plane, integrated with OCI networking, IAM, and observability."
when_to_use:
- "Containerized applications (microservices, 12-factor apps)"
- "Need horizontal auto-scaling for application tier"
- "Multi-team environments needing namespace isolation"
- "CI/CD-driven deployments"
- "Workloads requiring service mesh, ingress controllers"
when_not_to_use:
- "Simple stateless functions → use OCI Functions instead"
- "Single monolithic app with no container strategy → use Compute VMs"
- "Team has no Kubernetes experience and timeline is tight"
- "Batch processing only → consider OCI Data Flow or Compute"
variants:
- id: oke_managed
name: "OKE Managed Nodes"
description: "Customer manages worker nodes (OS patching, scaling config)"
- id: oke_virtual
name: "OKE Virtual Nodes"
description: "Serverless worker nodes — no OS management, pay per pod"
use_when:
- "Want zero node management overhead"
- "Bursty workloads with variable pod count"
- "Cost optimization for intermittent workloads"
sizing:
control_plane: "Free (managed by Oracle)"
worker_nodes:
recommended_shapes:
- "VM.Standard.E4.Flex (general purpose, best price/performance)"
- "VM.Standard.A1.Flex (ARM/Ampere, 30-50% cheaper for compatible workloads)"
- "VM.Standard3.Flex (Intel, when Intel compatibility required)"
- "VM.GPU.A10.1 / VM.GPU.A100 (GPU workloads)"
sizing_guidance: "Start with 3 nodes across fault domains for HA. Size OCPUs based on aggregate pod CPU requests + 20% headroom."
gotchas:
- id: oke_lb_shape
severity: LOW
description: "OKE creates OCI Load Balancers for LoadBalancer-type services. Default is 10 Mbps flexible — adjust annotation for production bandwidth."
- id: oke_cni_choice
severity: MEDIUM
description: "VCN-Native Pod Networking (OCI CNI) gives pods VCN IPs directly — better for NSG integration but consumes subnet IPs. Flannel overlay is simpler but no direct VCN integration."
- id: oke_pv_block_volume
severity: LOW
description: "Persistent volumes use OCI Block Volumes. For ReadWriteMany, use OCI File Storage (FSS) CSI driver."
implied_dependencies:
- service: vcn
reason: "Worker nodes and pods need VCN subnets"
- service: load_balancer
reason: "Ingress traffic to services"
- service: block_storage
reason: "Persistent volumes for stateful pods"
references:
documentation: "https://docs.oracle.com/en-us/iaas/Content/ContEng/home.htm"
changelog:
- date: "2026-03-14"
contributor: { name: "Diego Cabrera", team: "Field Architecture" }
change: "Initial creation with managed/virtual nodes, sizing, gotchas, dependencies"

70
kb/services/storage.yaml Normal file
View File

@@ -0,0 +1,70 @@
---
last_verified: 2026-03-14
service: OCI Storage Services
category: storage
oci_color: "#4F7B6E"
---
what: OCI storage services including Block Volume, Object Storage, File Storage,
and Archive Storage.
services:
block_volume:
what: "Network-attached block storage for compute instances"
performance_tiers:
- name: Lower Cost
iops_per_gb: 2
throughput_kbps_per_gb: 240
- name: Balanced
iops_per_gb: 60
throughput_kbps_per_gb: 480
- name: Higher Performance
iops_per_gb: 75
throughput_kbps_per_gb: 600
- name: Ultra High Performance
max_iops: 450000
max_throughput_mbps: 2680
max_volume_size_tb: 32
max_volumes_per_instance: 32
object_storage:
what: "S3-compatible object storage"
tiers:
- name: Standard
use_for: "Frequently accessed data"
- name: Infrequent Access
use_for: "Data accessed less than once per month"
- name: Archive
use_for: "Long-term retention, compliance"
retrieval_time: "1 hour (standard), 1 minute (expedited)"
features:
- "S3-compatible API"
- "Versioning"
- "Lifecycle policies"
- "Server-side encryption (SSE)"
- "Replication (same-region and cross-region)"
max_object_size_tb: 10
file_storage:
what: "NFSv3-compatible managed file system"
use_for: "Shared file access across multiple compute instances"
max_size: "8 EB (exabytes)"
iops: "Up to 25,000 IOPS per file system"
throughput: "Up to 1.2 GB/s per mount target"
pricing:
block_volume:
balanced_per_gb_month: 0.0255
higher_performance_per_gb_month: 0.0340
uhp_per_gb_month: "Varies by VPU"
object_storage:
standard_per_gb_month: 0.0255
infrequent_per_gb_month: 0.0100
archive_per_gb_month: 0.0026
api_per_10k_requests: 0.0034
file_storage:
per_gb_month: 0.0340
notes:
- "Block Volume: first 200 GB free (boot volume)"
- "Object Storage: first 10 GB free, 50k API requests free"
- "Data transfer to Object Storage: free (within region)"

57
kb/sizing/adb-scaling-behavior.yaml Normal file
View File

@@ -0,0 +1,57 @@
---
last_verified: 2026-03-14
description: ADB-S auto-scaling behavior, timing, and sizing implications.
---
auto_scaling:
ocpu_scaling:
trigger: "CPU demand exceeds current allocation"
max_scale: "3x base OCPUs (up to 128 OCPU maximum)"
ramp_up_time: "2-3 minutes to begin scaling"
ramp_down_time: "After sustained low utilization (5-10 minutes)"
billing: "Only billed during active scaling period, per OCPU per second"
storage_scaling:
trigger: "Storage usage approaches allocated storage"
behavior: "Auto-expands storage allocation"
billing: "Billed for allocated storage"
sizing_recommendations:
base_ocpu_strategy: |
Size base OCPUs for P75 utilization, not average.
Auto-scaling handles P95+ bursts, but the 2-3 minute ramp-up
means very short spikes may complete before scaling activates.
guidelines:
- scenario: "Steady OLTP workload"
base: "P75 utilization"
auto_scale: "Enable, set max to P95 or 2x base"
- scenario: "Highly variable workload (2x+ peak/baseline)"
base: "P50 utilization"
auto_scale: "Enable, set max to 3x base"
- scenario: "Batch processing with known peak times"
base: "Baseline requirement"
auto_scale: "Enable, supplement with scheduled scaling if available"
- scenario: "Dev/test"
base: "1-2 OCPUs"
auto_scale: "Disable to control costs"
connection_impact:
connections_per_ocpu: 300
example: |
Base 8 OCPUs → 2,400 connections
Auto-scale to 16 OCPUs → 4,800 connections
Connection limits scale with OCPUs automatically
performance_during_scaling:
notes:
- "Active sessions are not interrupted during scale-up"
- "New connections get additional capacity immediately"
- "Scale-down uses connection draining — active sessions complete normally"
- "Brief performance dip possible during scaling transition"
gotchas:
- "Short bursts (<3 min) may complete before auto-scaling activates"
- "Very rapid burst from 0 to max can cause connection queuing"
- "Auto-scaling cost can surprise if workload is consistently above base"
- "Monitor auto-scaling events to right-size base OCPUs over time"

72
kb/sizing/cpu-conversion-ratios.yaml Normal file
View File

@@ -0,0 +1,72 @@
# CPU Conversion Ratios: vCPU → OCPU
# Used for right-sizing when migrating from other platforms
conversion_ratios:
description: |
OCI uses OCPUs (Oracle Compute Units). 1 OCPU = 1 physical core = 2 vCPUs.
When migrating from AWS/Azure/GCP, convert vCPUs to OCPUs using these ratios.
# Source → OCI OCPU conversion
aws:
general:
ratio: "2 AWS vCPUs = 1 OCI OCPU"
notes: "AWS vCPU = 1 hyperthread. OCI OCPU = 1 physical core (2 threads)."
by_processor:
intel_xeon_2nd_gen: # m5, c5, r5
vcpu_to_ocpu: 2.0
intel_xeon_3rd_gen: # m6i, c6i, r6i
vcpu_to_ocpu: 2.0
amd_epyc_2nd_gen: # m5a, c5a, r5a
vcpu_to_ocpu: 2.0
notes: "OCI E4 (AMD EPYC 3rd gen) is typically faster per core"
graviton2: # m6g, c6g, r6g
vcpu_to_ocpu: 1.0
notes: "Graviton2 vCPU = 1 physical core. Map 1:1 to Ampere A1."
graviton3: # m7g, c7g, r7g
vcpu_to_ocpu: 1.0
notes: "Map to Ampere A2 for comparable performance."
azure:
general:
ratio: "2 Azure vCores = 1 OCI OCPU (for Intel/AMD)"
by_processor:
intel_dv5:
vcpu_to_ocpu: 2.0
amd_dv5a:
vcpu_to_ocpu: 2.0
on_prem:
oracle_database:
description: "Use AWR Top Activity to determine actual core utilization"
approach: |
1. Get AWR "DB Time per second" for P75 interval
2. Divide by number of available cores
3. Result = core utilization ratio
4. Multiply by source cores to get required OCPUs
5. Apply 1.2x headroom factor
fallback: "If no AWR data: 1 on-prem core = 1 OCPU (conservative)"
vmware:
ratio: "2 VMware vCPUs = 1 OCI OCPU"
notes: "VMware vCPU is a hyperthread equivalent"
adb_s_sizing:
description: |
For ADB-S, size base OCPUs for P75 sustained load:
- Auto-scaling can go up to 3x base OCPUs
- Auto-scaling activation takes 2-3 minutes
- If P95 spikes are short (< 2 min), they may hit before scale-out
- Size base for P75 to ensure good baseline performance
formula: |
base_ocpus = ceil(p75_cpu_usage / cores_per_ocpu * headroom_factor)
headroom_factor = 1.2 (default)
auto_scale_max = base_ocpus * 3
memory_sizing:
oci_shapes:
standard_e4: "16 GB per OCPU (VM.Standard.E4.Flex)"
standard_e5: "16 GB per OCPU (VM.Standard.E5.Flex)"
standard_a1: "6 GB per OCPU (VM.Standard.A1.Flex / Ampere)"
standard_a2: "8 GB per OCPU (VM.Standard.A2.Flex / Ampere)"
optimized3: "14 GB per OCPU (VM.Optimized3.Flex)"
dense_io_e4: "32 GB per OCPU + local NVMe (VM.DenseIO.E4.Flex)"

57
kb/sizing/memory-sizing-rules.yaml Normal file
View File

@@ -0,0 +1,57 @@
---
last_verified: 2026-03-14
description: Memory sizing guidelines for OCI compute and database workloads.
---
compute_memory:
flexible_shapes:
min_gb_per_ocpu: 1
max_gb_per_ocpu: 64
default_gb_per_ocpu: 16
recommendation: |
Start with 16 GB per OCPU for general workloads.
Java applications: 8-16 GB per OCPU.
In-memory caches (Redis, Memcached): size for data set + 20%.
Database client/app servers: 8 GB per OCPU usually sufficient.
common_ratios:
general_purpose: 16 # GB per OCPU
memory_intensive: 32
compute_intensive: 8
java_application: 12
web_server: 8
database_memory:
adb_s:
notes: "Memory managed automatically by ADB. Not directly configurable."
sga_estimate: "~7 GB per OCPU"
pga_estimate: "~2.5 GB per OCPU"
exacs:
notes: "Memory allocated per VM cluster from Exadata infrastructure pool"
recommendation: "Size VM cluster memory based on SGA+PGA requirements"
typical_sga_per_ocpu: 8
typical_pga_per_ocpu: 3
dbcs:
notes: "Memory = compute shape memory. Choose shape accordingly."
recommendation: |
Total DB memory = SGA + PGA aggregate
SGA = 60-80% of available memory
PGA = 10-20% of available memory
OS overhead = 10-15%
sizing_from_source:
on_prem_oracle_to_oci:
steps:
- "Get current SGA + PGA sizes from AWR/ASH"
- "Add 15% for OS overhead"
- "Map to compute shape with sufficient memory"
- "For ADB: translate to OCPU count (memory scales automatically)"
notes: "ADB auto-tunes memory, so OCPU sizing is the key input"
aws_rds_to_oci:
steps:
- "Note current instance class memory"
- "Map to equivalent OCI shape memory"
- "For ADB: divide memory by 10 to estimate OCPU count"

74
kb/sizing/storage-iops.yaml Normal file
View File

@@ -0,0 +1,74 @@
# OCI Storage IOPS and Throughput Reference
# Used for right-sizing block and file storage
block_volume:
description: "OCI Block Volume performance tiers"
tiers:
- name: "Lower Cost"
iops_per_gb: 2
max_iops: 3000
throughput_mbps_per_gb: 0.024
max_throughput_mbps: 480
use_when: "Archive, cold data, infrequent access"
- name: "Balanced"
iops_per_gb: 60
max_iops: 25000
throughput_mbps_per_gb: 0.48
max_throughput_mbps: 480
use_when: "General purpose, boot volumes, typical workloads"
default: true
- name: "Higher Performance"
iops_per_gb: 75
max_iops: 35000
throughput_mbps_per_gb: 0.6
max_throughput_mbps: 480
use_when: "Database data files, high-throughput applications"
- name: "Ultra High Performance"
iops_per_gb: 90
max_iops: 120000
throughput_mbps_per_gb: 0.72
max_throughput_mbps: 2680
use_when: "Extreme IOPS requirements, OLTP databases"
notes: "Only available with certain compute shapes"
sizing_guidance: |
1. Determine required IOPS (from AWR, CloudWatch, or application benchmarks)
2. Select tier that provides needed IOPS/GB ratio
3. Calculate minimum volume size: required_iops / iops_per_gb
4. Ensure volume size also covers storage capacity needs
5. If capacity-driven size exceeds IOPS needs, lower tier may suffice
object_storage:
tiers:
- name: "Standard"
use_when: "Frequently accessed data"
first_10tb_per_month: "$0.0255/GB"
- name: "Infrequent Access"
use_when: "Accessed < once per month"
retrieval_fee: true
min_retention: "31 days"
- name: "Archive"
use_when: "Rarely accessed, long-term retention"
restore_time: "1 hour"
min_retention: "90 days"
auto_tiering: |
Enable auto-tiering to automatically move objects between Standard and
Infrequent Access based on access patterns. No retrieval fee when
auto-tiering moves data back to Standard.
file_storage:
description: "OCI File Storage Service (NFS)"
performance: "Scales with file system size — larger = more IOPS/throughput"
iops_baseline: "Up to 50,000 IOPS"
throughput: "Up to 1.2 GB/s"
use_when:
- "Shared file system across multiple compute instances"
- "NFS-compatible workloads"
- "Kubernetes ReadWriteMany persistent volumes"
pricing: "$0.30/GB/month"

70
kb/sizing/storage-performance.yaml Normal file
View File

@@ -0,0 +1,70 @@
---
last_verified: 2026-03-14
description: Storage performance characteristics across OCI storage tiers.
---
storage_tiers:
adb_serverless:
type: "Exadata managed storage"
iops_random_read: "Up to 600K per ADB instance"
iops_random_write: "Workload dependent"
throughput: "Scales with OCPUs"
latency_read_us: "<200 (Smart Scan eligible)"
latency_write_us: "<500"
notes: "Performance scales with OCPU count, Exadata Smart Scan offloads queries"
exadata_storage:
type: "Exadata Smart Storage"
iops_random_read: "Up to 6.4M per rack (X9M)"
throughput_gbps: "Up to 100 GB/s (X9M)"
smart_scan: true
flash_cache: true
hcc: true
notes: "Highest performance tier, Smart Scan can offload full table scans"
block_volume_balanced:
type: "Block Volume (Balanced)"
iops_per_gb: 60
max_iops: 25000
throughput_kbps_per_gb: 480
max_throughput_mbps: 480
latency_us: "Sub-millisecond"
block_volume_higher_performance:
type: "Block Volume (Higher Performance)"
iops_per_gb: 75
max_iops: 35000
throughput_kbps_per_gb: 600
max_throughput_mbps: 600
latency_us: "Sub-millisecond"
block_volume_uhp:
type: "Block Volume (Ultra High Performance)"
max_iops: 450000
max_throughput_mbps: 2680
notes: "Requires UHP-enabled shapes"
object_storage:
type: "Object Storage"
throughput: "High (parallel multipart uploads)"
latency: "Milliseconds (first byte)"
use_for: "Backups, archives, unstructured data"
not_for: "Random IOPS workloads"
file_storage:
type: "File Storage (NFS)"
max_iops: 25000
max_throughput_mbps: 1200
latency: "Sub-millisecond"
use_for: "Shared file access, NFS workloads"
sizing_from_source:
exadata_to_adb:
notes: "ADB-S on Exadata infra — performance is comparable or better"
recommendation: "Map directly, ADB auto-tunes storage"
physical_server_to_block_volume:
notes: "Match IOPS and throughput requirements to block volume tier"
recommendation: "Use Higher Performance for database, Balanced for app tier"
san_to_block_volume:
notes: "SAN IOPS vary widely — get actual metrics"
recommendation: "Size for P95 IOPS, test with fio before migration"

131
kb/well-architected/distributed-cloud.yaml Normal file
View File

@@ -0,0 +1,131 @@
# OCI Well-Architected Framework — Pillar 5: Distributed Cloud
# Source: https://docs.oracle.com/en/solutions/oci-best-practices/effective-strategies-distributed-cloud-implementation1.html
pillar:
name: "Distributed Cloud"
id: distributed_cloud
wa_reference: "https://docs.oracle.com/en/solutions/oci-best-practices/effective-strategies-distributed-cloud-implementation1.html"
reference: "https://docs.oracle.com/en/solutions/oci-best-practices/effective-strategies-distributed-cloud-implementation1.html"
conditional: true
applies_when: "multi_region OR hybrid_cloud OR multicloud OR data_residency_requirements OR sovereign_requirements"
categories:
- name: "Deployment Strategy"
id: dc_deployment_strategy
checks:
- id: DC-DEP-001
name: "Deployment model selected"
description: "Appropriate deployment model selected (public, dedicated, hybrid, multicloud)"
auto_detect:
pass_if: "deployment model explicitly chosen with justification"
gap_if: "no explicit deployment model decision"
severity: HIGH
applies_when: "distributed_cloud_applicable"
- id: DC-DEP-002
name: "Data residency mapping"
description: "Data residency requirements mapped to region selection"
auto_detect:
pass_if: "data residency requirements documented with region mapping"
gap_if: "data residency requirements exist but no region mapping"
severity: HIGH
applies_when: "has_data_residency_requirements"
- id: DC-DEP-003
name: "Sovereign/Dedicated Region"
description: "Sovereign Cloud or Dedicated Region considered if required"
auto_detect:
pass_if: "Sovereign Cloud or Dedicated Region evaluated"
gap_if: "sovereignty requirements exist without cloud model evaluation"
severity: HIGH
applies_when: "has_sovereign_requirements"
- name: "Integration Across Environments"
id: dc_integration
checks:
- id: DC-INT-001
name: "Consistent IAM"
description: "Consistent IAM across all locations"
auto_detect:
pass_if: "unified IAM strategy across all deployment locations"
gap_if: "separate, uncoordinated IAM in different locations"
severity: HIGH
applies_when: "distributed_cloud_applicable"
- id: DC-INT-002
name: "Data synchronization"
description: "Data synchronization strategy between sites"
auto_detect:
pass_if: "data sync strategy defined (replication, ETL, streaming)"
gap_if: "no data synchronization strategy between sites"
severity: HIGH
applies_when: "distributed_cloud_applicable"
- id: DC-INT-003
name: "Cross-environment networking"
description: "Network connectivity between environments (FastConnect, VPN, DRG)"
auto_detect:
pass_if: "network connectivity defined between all environments"
gap_if: "no network connectivity plan between environments"
severity: HIGH
applies_when: "distributed_cloud_applicable"
- name: "Compliance & Sovereignty"
id: dc_compliance
checks:
- id: DC-CMP-001
name: "Data residency laws"
description: "Regional data residency laws addressed"
auto_detect:
pass_if: "applicable data residency laws identified and addressed"
gap_if: "data residency laws not evaluated"
severity: HIGH
applies_when: "has_data_residency_requirements"
- id: DC-CMP-002
name: "Encryption key locality"
description: "Encryption key locality requirements met"
auto_detect:
pass_if: "encryption keys stored in required jurisdictions"
gap_if: "key locality requirements not addressed"
severity: HIGH
applies_when: "has_data_residency_requirements"
- id: DC-CMP-003
name: "Cross-environment audit"
description: "Audit trail spans all environments"
auto_detect:
pass_if: "unified audit across all deployment locations"
gap_if: "audit gaps between environments"
severity: MEDIUM
applies_when: "distributed_cloud_applicable"
- name: "Unified Operations"
id: dc_operations
checks:
- id: DC-OPS-001
name: "Single pane of glass"
description: "Single pane of glass monitoring across environments"
auto_detect:
pass_if: "centralized monitoring spanning all environments"
gap_if: "separate monitoring per environment"
severity: MEDIUM
applies_when: "distributed_cloud_applicable"
- id: DC-OPS-002
name: "IaC consistency"
description: "IaC consistency across all deployment targets"
auto_detect:
pass_if: "same IaC tooling and patterns across all environments"
gap_if: "different IaC approaches in different environments"
severity: MEDIUM
applies_when: "distributed_cloud_applicable"
- id: DC-OPS-003
name: "Operations feedback loop"
description: "Feedback loop from operations to design"
auto_detect:
pass_if: "operational feedback process defined"
gap_if: "no formal feedback loop from operations to architecture"
severity: LOW
applies_when: "distributed_cloud_applicable"

115
kb/well-architected/landing-zones.yaml Normal file
View File

@@ -0,0 +1,115 @@
# OCI Well-Architected Framework — Landing Zone Patterns
# Reference: https://docs.oracle.com/en/solutions/cis-oci-benchmark/
landing_zones:
- name: "CIS OCI Landing Zone"
id: cis_landing_zone
description: "CIS Benchmark-aligned landing zone with security best practices baked in"
reference: "https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart"
use_when:
- "Enterprise customers requiring CIS compliance"
- "Greenfield OCI deployments"
- "Customers with regulatory requirements"
provides:
compartments:
- name: "Network"
purpose: "Hub VCN, DRG, FastConnect, VPN"
- name: "Security"
purpose: "Cloud Guard, Vault, Bastion, VSS"
- name: "AppDev"
purpose: "Application workloads, OKE, Functions"
- name: "Database"
purpose: "Database services, Data Safe"
- name: "ExaCS"
purpose: "Exadata Cloud Service (if applicable)"
networking:
- "Hub-spoke VCN topology via DRG"
- "Service Gateway for OCI service access"
- "NAT Gateway for outbound internet"
- "Bastion service for secure access"
- "NSGs for fine-grained network security"
identity:
- "Break-glass admin account"
- "Separation of duties (network, security, appdev admins)"
- "Least-privilege IAM policies"
- "Dynamic groups for instance principals"
security:
- "Cloud Guard with default recipes"
- "Security Zones for production"
- "VCN Flow Logs enabled"
- "OCI Vault for key management"
- "Vulnerability Scanning service"
governance:
- "Defined tags for cost tracking"
- "Budgets per compartment"
- "Notification topics for events"
- name: "Oracle Enterprise Landing Zone"
id: oelz
description: "Multi-environment enterprise landing zone with full lifecycle management"
reference: "https://github.com/oracle-quickstart/terraform-oci-open-lz"
use_when:
- "Large enterprise deployments"
- "Multi-workload environments"
- "Customers needing full environment isolation"
provides:
compartments:
- name: "Shared Infrastructure"
purpose: "Common services, networking hub, security"
- name: "Production"
purpose: "Production workloads with Security Zones"
- name: "Non-Production"
purpose: "Dev, test, staging environments"
- name: "Logging"
purpose: "Centralized logging and audit"
networking:
- "Hub VCN with Network Firewall option"
- "Spoke VCNs per workload/environment"
- "DRG for transit routing"
- "DNS views per environment"
identity:
- "Multiple Identity Domains"
- "Federated authentication"
- "Role-based access control"
security:
- "Cloud Guard with custom recipes"
- "Security Zones"
- "WAF integration"
- "Data Safe"
- name: "Minimal Landing Zone"
id: minimal_lz
description: "Lightweight landing zone for POCs, small workloads, or single-application deployments"
use_when:
- "Proof of concept"
- "Small workloads (< 10 resources)"
- "Single application deployment"
- "Developer sandbox"
provides:
compartments:
- name: "Workload"
purpose: "All resources for the workload"
networking:
- "Single VCN"
- "Public and private subnets"
- "Internet Gateway + NAT Gateway"
- "Service Gateway"
identity:
- "Basic IAM policies"
- "Instance principals for compute"
security:
- "Cloud Guard (default)"
- "Default encryption"
selection_criteria:
- condition: "regulatory_compliance OR enterprise_customer"
recommendation: "cis_landing_zone"
rationale: "CIS compliance provides strong security baseline and meets audit requirements"
- condition: "multi_environment AND large_enterprise"
recommendation: "oelz"
rationale: "Full environment isolation with centralized governance"
- condition: "poc OR small_workload OR single_application"
recommendation: "minimal_lz"
rationale: "Fast deployment without over-engineering; can upgrade to CIS later"

174
kb/well-architected/operational-efficiency.yaml Normal file
View File

@@ -0,0 +1,174 @@
# OCI Well-Architected Framework — Pillar 4: Operational Efficiency
# Source: https://docs.oracle.com/en/solutions/oci-best-practices/best-practices-operating-cloud-deployments-efficiency.html
pillar:
name: "Operational Efficiency"
id: operational_efficiency
wa_reference: "https://docs.oracle.com/en/solutions/oci-best-practices/best-practices-operating-cloud-deployments-efficiency.html"
reference: "https://docs.oracle.com/en/solutions/oci-best-practices/best-practices-operating-cloud-deployments-efficiency.html"
categories:
- name: "Deployment Strategy"
id: deployment_strategy
checks:
- id: OPS-DEP-001
name: "Infrastructure as Code"
description: "Infrastructure as Code (Terraform, Resource Manager) for all resources"
auto_detect:
pass_if: "Terraform or Resource Manager specified for infrastructure provisioning"
gap_if: "no IaC strategy specified"
severity: HIGH
applies_when: always
- id: OPS-DEP-002
name: "CI/CD pipeline"
description: "CI/CD pipeline defined for application deployment"
auto_detect:
pass_if: "CI/CD pipeline specified (OCI DevOps, Jenkins, GitLab, etc.)"
gap_if: "no CI/CD pipeline defined"
severity: MEDIUM
applies_when: "has_application_workloads"
- id: OPS-DEP-003
name: "Deployment strategy"
description: "Blue/green or canary deployment strategy for production changes"
auto_detect:
pass_if: "deployment strategy (blue/green, canary, rolling) defined"
gap_if: "no deployment strategy for production changes"
severity: MEDIUM
applies_when: "has_production_applications"
- id: OPS-DEP-004
name: "Environment parity"
description: "Environment parity (dev/staging/prod use same IaC templates)"
auto_detect:
pass_if: "same IaC templates used across environments with variable overrides"
gap_if: "different provisioning methods across environments"
severity: MEDIUM
applies_when: "has_multiple_environments"
- name: "Workload Monitoring"
id: workload_monitoring
checks:
- id: OPS-MON-001
name: "OCI Monitoring alarms"
description: "OCI Monitoring alarms configured for key metrics"
auto_detect:
pass_if: "monitoring alarms defined for CPU, memory, disk, network"
gap_if: "no monitoring alarms configured"
severity: HIGH
applies_when: always
- id: OPS-MON-002
name: "Custom application metrics"
description: "Custom metrics for application-specific KPIs"
auto_detect:
pass_if: "custom metrics defined for application performance"
gap_if: "no application-level monitoring beyond infrastructure metrics"
severity: MEDIUM
applies_when: "has_application_workloads"
- id: OPS-MON-003
name: "Logging Analytics"
description: "Logging Analytics for centralized log analysis"
auto_detect:
pass_if: "OCI Logging Analytics configured"
gap_if: "no centralized log analysis solution"
severity: MEDIUM
applies_when: always
- id: OPS-MON-004
name: "APM configured"
description: "APM configured for application tracing"
auto_detect:
pass_if: "OCI APM or third-party APM configured"
gap_if: "no application performance monitoring"
severity: LOW
applies_when: "has_application_workloads"
- id: OPS-MON-005
name: "Database Management"
description: "Database Management enabled for DB performance monitoring"
auto_detect:
pass_if: "OCI Database Management service enabled"
gap_if: "databases without performance monitoring"
severity: MEDIUM
applies_when: "has_databases"
- id: OPS-MON-006
name: "Ops Insights"
description: "Ops Insights for capacity planning"
auto_detect:
pass_if: "Ops Insights configured for capacity planning"
gap_if: "no capacity planning solution"
severity: LOW
applies_when: "has_production_workloads"
- name: "OS Management"
id: os_management
checks:
- id: OPS-OSM-001
name: "OS Management Hub"
description: "OS Management Hub for patch management"
auto_detect:
pass_if: "OS Management Hub configured for compute fleet"
gap_if: "no automated OS patch management"
severity: MEDIUM
applies_when: "has_compute_instances"
- id: OPS-OSM-002
name: "Automated patching schedule"
description: "Automated patching schedule for compute instances"
auto_detect:
pass_if: "patching schedule defined with maintenance windows"
gap_if: "no patching schedule for compute instances"
severity: MEDIUM
applies_when: "has_compute_instances"
- id: OPS-OSM-003
name: "Vulnerability remediation SLA"
description: "Vulnerability remediation SLA defined"
auto_detect:
pass_if: "vulnerability remediation timelines defined by severity"
gap_if: "no vulnerability remediation SLA"
severity: MEDIUM
applies_when: "has_compute_instances"
- name: "Operations Support"
id: operations_support
checks:
- id: OPS-SUP-001
name: "Support plan level"
description: "Support plan level appropriate for workload criticality"
auto_detect:
pass_if: "Oracle support plan level specified and matches criticality"
gap_if: "no support plan consideration"
severity: LOW
applies_when: always
- id: OPS-SUP-002
name: "Notification topics"
description: "Notification topics configured for operational events"
auto_detect:
pass_if: "OCI Notifications configured for operational events"
gap_if: "no notification configuration"
severity: MEDIUM
applies_when: always
- id: OPS-SUP-003
name: "Operational runbooks"
description: "Runbooks documented for common operational procedures"
auto_detect:
pass_if: "operational runbooks planned or documented"
gap_if: "no operational runbooks"
severity: LOW
applies_when: "has_production_workloads"
- id: OPS-SUP-004
name: "Automated remediation"
description: "OCI Events + Functions for automated remediation"
auto_detect:
pass_if: "event-driven automation configured for common issues"
gap_if: "no automated remediation"
severity: LOW
applies_when: "has_production_workloads"

156
kb/well-architected/performance-cost.yaml Normal file
View File

@@ -0,0 +1,156 @@
# OCI Well-Architected Framework — Pillar 3: Performance and Cost Optimization
# Source: https://docs.oracle.com/en/solutions/oci-best-practices/index.html
pillar:
name: "Performance and Cost Optimization"
id: performance_cost
wa_reference: "https://docs.oracle.com/en/solutions/oci-best-practices/index.html"
reference: "https://docs.oracle.com/en/solutions/oci-best-practices/index.html"
categories:
- name: "Compute Sizing"
id: compute_sizing
checks:
- id: PERF-CMP-001
name: "Right-sized shapes"
description: "Shapes selected based on workload profile (not over-provisioned)"
auto_detect:
pass_if: "compute shapes justified by workload requirements"
gap_if: "shapes selected without workload sizing analysis"
severity: MEDIUM
applies_when: "has_compute_instances"
- id: PERF-CMP-002
name: "Flex shapes used"
description: "Flex shapes used where possible (pay for what you use)"
auto_detect:
pass_if: "flex shapes specified for variable workloads"
gap_if: "fixed shapes used where flex would be more cost-effective"
severity: LOW
applies_when: "has_compute_instances"
- id: PERF-CMP-003
name: "Burstable for dev/test"
description: "Burstable instances considered for dev/test"
auto_detect:
pass_if: "burstable or preemptible instances for non-production"
gap_if: "production-grade shapes used for dev/test"
severity: LOW
applies_when: "has_dev_test_environments"
- id: PERF-CMP-004
name: "ARM (Ampere) considered"
description: "ARM (Ampere) considered for compatible workloads (better price/performance)"
auto_detect:
pass_if: "Ampere (A1/A2) shapes evaluated for compatible workloads"
gap_if: "x86 shapes used where ARM would provide better price/performance"
severity: LOW
applies_when: "has_compute_instances"
- name: "Storage Strategy"
id: storage_strategy
checks:
- id: PERF-STR-001
name: "Storage tier matches access pattern"
description: "Storage tier matches access pattern (Standard, Infrequent Access, Archive)"
auto_detect:
pass_if: "storage tiers aligned with data access frequency"
gap_if: "all data on Standard tier without tiering analysis"
severity: MEDIUM
applies_when: "has_object_storage"
- id: PERF-STR-002
name: "Block Volume performance tier"
description: "Block Volume performance tier matches IOPS needs"
auto_detect:
pass_if: "block volume performance tier matches documented IOPS requirements"
gap_if: "block volume tier not aligned with workload IOPS needs"
severity: MEDIUM
applies_when: "has_block_volumes"
- id: PERF-STR-003
name: "Object Storage auto-tiering"
description: "Auto-tiering enabled for Object Storage where applicable"
auto_detect:
pass_if: "auto-tiering configured for applicable buckets"
gap_if: "large object storage without auto-tiering evaluation"
severity: LOW
applies_when: "has_large_object_storage"
- name: "Network Tuning"
id: network_tuning
checks:
- id: PERF-NET-001
name: "Right-sized bandwidth"
description: "Bandwidth provisioned matches actual needs (not over-provisioned FastConnect)"
auto_detect:
pass_if: "FastConnect bandwidth justified by traffic analysis"
gap_if: "bandwidth provisioned without traffic analysis"
severity: MEDIUM
applies_when: "has_fastconnect"
- id: PERF-NET-002
name: "LB type justified"
description: "Network Load Balancer vs. Flexible Load Balancer decision justified"
auto_detect:
pass_if: "load balancer type selection documented with rationale"
gap_if: "load balancer type chosen without justification"
severity: LOW
applies_when: "has_load_balancers"
- name: "Cost Management"
id: cost_management
checks:
- id: PERF-CST-001
name: "BYOL analysis"
description: "BYOL vs. License Included analysis done"
auto_detect:
pass_if: "BYOL vs. License Included comparison documented"
gap_if: "licensing model chosen without analysis"
severity: HIGH
applies_when: "has_oracle_licensed_services"
- id: PERF-CST-002
name: "Reserved capacity considered"
description: "Reserved capacity considered for stable workloads (1-year or 3-year)"
auto_detect:
pass_if: "reserved capacity evaluated for stable production workloads"
gap_if: "all on-demand pricing for stable workloads"
severity: MEDIUM
applies_when: "has_stable_production_workloads"
- id: PERF-CST-003
name: "Budgets and cost alerts"
description: "Budgets and cost alerts configured per compartment"
auto_detect:
pass_if: "OCI Budgets configured with alert thresholds"
gap_if: "no budget alerts configured"
severity: MEDIUM
applies_when: always
- id: PERF-CST-004
name: "Cost attribution tagging"
description: "Tagging strategy enables cost attribution"
auto_detect:
pass_if: "cost-tracking tags defined and enforced"
gap_if: "no cost attribution tagging strategy"
severity: MEDIUM
applies_when: always
- id: PERF-CST-005
name: "Auto-scaling cost controls"
description: "Auto-scaling min/max configured to prevent runaway costs"
auto_detect:
pass_if: "auto-scaling policies include max limits"
gap_if: "auto-scaling without upper bounds"
severity: MEDIUM
applies_when: "has_auto_scaling"
- id: PERF-CST-006
name: "Non-prod optimization"
description: "Non-production environments use smaller shapes or are scheduled off"
auto_detect:
pass_if: "non-prod environments use reduced shapes or have schedules"
gap_if: "non-prod environments running same shapes as production 24/7"
severity: LOW
applies_when: "has_dev_test_environments"

156
kb/well-architected/personas.yaml Normal file
View File

@@ -0,0 +1,156 @@
# OCI Well-Architected Framework — Personas and Role-to-Pillar Mapping
# Used to target Deal Accelerator outputs to the right audience
personas:
- name: "Cloud Architect"
id: cloud_architect
description: "Responsible for overall cloud architecture design and implementation"
primary_pillars:
- reliability_resilience
- security_compliance
- operational_efficiency
output_emphasis:
- "Full architecture diagram with all service interactions"
- "ADRs for all major design decisions"
- "Reliability and HA patterns"
- "Operational readiness checklist"
scorecard_focus:
lead_with: "Overall architecture health"
highlight_gaps: ["HIGH severity across all pillars"]
de_emphasize: ["LOW severity cost optimizations"]
- name: "Security Architect"
id: security_architect
description: "Responsible for security posture, compliance, and risk management"
primary_pillars:
- security_compliance
output_emphasis:
- "Security scorecard with all checks detailed"
- "IAM policy structure and federation design"
- "Encryption strategy (at-rest, in-transit, key management)"
- "Cloud Guard configuration and detector recipes"
- "Data Safe assessment and recommendations"
- "Network security architecture (NSGs, WAF, Firewall)"
- "Compliance mapping to regulatory requirements"
scorecard_focus:
lead_with: "Security and Compliance pillar"
highlight_gaps: ["All security gaps regardless of severity"]
de_emphasize: ["Performance optimization", "Cost management"]
- name: "Enterprise Architect"
id: enterprise_architect
description: "Responsible for strategic alignment, cost optimization, and enterprise governance"
primary_pillars:
- performance_cost
- distributed_cloud
- operational_efficiency
output_emphasis:
- "TCO analysis with BYOL and reserved capacity"
- "Business case with competitive positioning"
- "Distributed cloud strategy if applicable"
- "Governance model and tagging strategy"
- "Migration roadmap and phasing"
scorecard_focus:
lead_with: "Cost optimization and business alignment"
highlight_gaps: ["Cost management gaps", "Governance gaps"]
de_emphasize: ["Technical implementation details"]
- name: "Network Architect"
id: network_architect
description: "Responsible for network design, connectivity, and security"
primary_pillars:
- security_compliance
- reliability_resilience
output_emphasis:
- "VCN topology with CIDR ranges and subnet design"
- "FastConnect/VPN connectivity with redundancy"
- "DRG routing and transit networking"
- "NSG rules and WAF configuration"
- "DNS and Traffic Management design"
- "Network Firewall placement and rules"
scorecard_focus:
lead_with: "Network security and reliability checks"
highlight_gaps: ["Network-related gaps across all pillars"]
de_emphasize: ["Database security", "Application monitoring"]
- name: "Database Administrator"
id: dba
description: "Responsible for database architecture, performance, and operations"
primary_pillars:
- security_compliance
- reliability_resilience
- performance_cost
output_emphasis:
- "Database service selection rationale"
- "Data Guard / ADG configuration"
- "Backup and recovery strategy"
- "Data Safe configuration"
- "Performance tuning and monitoring"
- "TDE and encryption key management"
scorecard_focus:
lead_with: "Database security and reliability checks"
highlight_gaps: ["Database-related gaps across all pillars"]
de_emphasize: ["Network design", "Compute sizing"]
- name: "DevOps Engineer"
id: devops_engineer
description: "Responsible for CI/CD, IaC, and operational automation"
primary_pillars:
- operational_efficiency
output_emphasis:
- "Terraform module structure and Resource Manager stacks"
- "CI/CD pipeline design (OCI DevOps or third-party)"
- "Deployment strategy (blue/green, canary)"
- "Monitoring and alerting configuration"
- "Automated remediation with Events + Functions"
- "OS Management Hub setup"
scorecard_focus:
lead_with: "Operational Efficiency pillar"
highlight_gaps: ["IaC gaps", "CI/CD gaps", "Monitoring gaps"]
de_emphasize: ["Cost optimization", "Distributed cloud"]
- name: "CTO / VP Engineering"
id: cto
description: "Executive decision maker focused on risk, timeline, and strategic value"
primary_pillars:
- security_compliance
- reliability_resilience
- performance_cost
output_emphasis:
- "Executive summary (1-page)"
- "Risk register with mitigation strategies"
- "Competitive positioning vs AWS/Azure"
- "Implementation timeline with milestones"
- "Cost summary with optimization opportunities"
- "Well-Architected scorecard summary"
scorecard_focus:
lead_with: "Overall status with HIGH severity gaps"
highlight_gaps: ["HIGH severity only"]
de_emphasize: ["Technical implementation details", "LOW severity items"]
- name: "Finance / Procurement"
id: finance
description: "Focused on cost, licensing, and commercial terms"
primary_pillars:
- performance_cost
output_emphasis:
- "Detailed cost breakdown by service"
- "BYOL vs. License Included analysis"
- "Reserved capacity savings (1yr vs 3yr)"
- "Monthly and annual cost projections"
- "Budget configuration per compartment"
- "Comparison with current spend (on-prem or competitor)"
scorecard_focus:
lead_with: "Performance and Cost Optimization pillar"
highlight_gaps: ["Cost-related gaps only"]
de_emphasize: ["All technical pillars"]
# Mapping from political decision drivers to personas
decision_driver_mapping:
technical_leadership: [cloud_architect, cto]
security_focused: [security_architect]
cost_conscious: [enterprise_architect, finance]
operations_focused: [devops_engineer]
database_centric: [dba]
network_focused: [network_architect]
executive_sponsorship: [cto, finance]

213
kb/well-architected/reliability-resilience.yaml Normal file
View File

@@ -0,0 +1,213 @@
# OCI Well-Architected Framework — Pillar 2: Reliability and Resilience
# Source: https://docs.oracle.com/en/solutions/oci-best-practices/reliable-and-resilient-cloud-topology-practices1.html
pillar:
name: "Reliability and Resilience"
id: reliability_resilience
wa_reference: "https://docs.oracle.com/en/solutions/oci-best-practices/reliable-and-resilient-cloud-topology-practices1.html"
reference: "https://docs.oracle.com/en/solutions/oci-best-practices/reliable-and-resilient-cloud-topology-practices1.html"
categories:
- name: "Scalability"
id: scalability
checks:
- id: REL-SCL-001
name: "Auto-scaling configured"
description: "Auto-scaling configured for variable workloads"
auto_detect:
pass_if: "auto-scaling policies defined for compute or OKE"
gap_if: "variable workloads without auto-scaling"
severity: MEDIUM
applies_when: "has_variable_workloads"
- id: REL-SCL-002
name: "Service limits reviewed"
description: "Service limits reviewed and increased where needed"
auto_detect:
pass_if: "service limit review mentioned in deployment plan"
gap_if: "no service limit review planned"
severity: LOW
applies_when: always
- id: REL-SCL-003
name: "Capacity reservations"
description: "Capacity reservations for critical workloads"
auto_detect:
pass_if: "capacity reservations specified for critical compute"
gap_if: "critical production workloads without capacity reservations"
severity: MEDIUM
applies_when: "has_critical_workloads"
- name: "Fault-Tolerant Networking"
id: fault_tolerant_networking
checks:
- id: REL-NET-001
name: "Redundant FastConnect"
description: "Redundant FastConnect circuits (2 virtual circuits, different physical paths)"
auto_detect:
pass_if: "dual FastConnect circuits on diverse paths"
gap_if: "single FastConnect circuit without redundancy"
severity: HIGH
applies_when: "has_fastconnect"
- id: REL-NET-002
name: "VPN backup for FastConnect"
description: "VPN as backup if FastConnect is primary"
auto_detect:
pass_if: "IPSec VPN configured as FastConnect backup"
gap_if: "FastConnect without VPN backup"
severity: MEDIUM
applies_when: "has_fastconnect"
- id: REL-NET-003
name: "Redundant DRG tunnels"
description: "DRG with redundant tunnels"
auto_detect:
pass_if: "DRG configured with redundant IPSec tunnels"
gap_if: "DRG with single tunnel"
severity: MEDIUM
applies_when: "has_drg"
- id: REL-NET-004
name: "Load Balancer health checks"
description: "Load Balancer health checks configured"
auto_detect:
pass_if: "health check policies defined on load balancers"
gap_if: "load balancers without health checks"
severity: HIGH
applies_when: "has_load_balancers"
- id: REL-NET-005
name: "Multi-AD/FD compute placement"
description: "Multiple ADs or FDs used for compute placement"
auto_detect:
pass_if: "compute instances distributed across ADs or FDs"
gap_if: "all compute in single AD/FD"
severity: HIGH
applies_when: "has_production_compute"
- name: "Data Backup"
id: data_backup
checks:
- id: REL-BAK-001
name: "Automated database backups"
description: "Automated backups enabled for all databases"
auto_detect:
pass_if: "automated backup configured for all database services"
gap_if: "any database without automated backup"
severity: HIGH
applies_when: "has_databases"
- id: REL-BAK-002
name: "Backup retention policy"
description: "Backup retention policy defined and documented"
auto_detect:
pass_if: "backup retention periods specified"
gap_if: "no backup retention policy defined"
severity: MEDIUM
applies_when: "has_databases"
- id: REL-BAK-003
name: "Block Volume backups"
description: "Block Volume backups scheduled"
auto_detect:
pass_if: "block volume backup policies configured"
gap_if: "block volumes without backup schedules"
severity: MEDIUM
applies_when: "has_block_volumes"
- id: REL-BAK-004
name: "Cross-region backup copy"
description: "Cross-region backup copy for critical data"
auto_detect:
pass_if: "cross-region backup replication configured"
gap_if: "critical data without cross-region backup"
severity: MEDIUM
applies_when: "has_critical_data"
- id: REL-BAK-005
name: "Boot volume backups"
description: "Boot volume backups for compute instances"
auto_detect:
pass_if: "boot volume backup policies configured"
gap_if: "compute instances without boot volume backups"
severity: LOW
applies_when: "has_compute_instances"
- name: "Data Replication"
id: data_replication
checks:
- id: REL-REP-001
name: "Data Guard / ADG"
description: "Data Guard (or ADG for ADB) configured for HA databases"
auto_detect:
pass_if: "Data Guard or Autonomous Data Guard configured"
gap_if: "production databases without HA replication"
severity: HIGH
applies_when: "has_production_databases"
- id: REL-REP-002
name: "RPO/RTO documented"
description: "RPO/RTO documented and validated with actual testing"
auto_detect:
pass_if: "RPO and RTO targets defined with validation plan"
gap_if: "no RPO/RTO targets documented"
severity: HIGH
applies_when: "has_production_workloads"
- id: REL-REP-003
name: "Cross-region Object Storage replication"
description: "Cross-region replication for Object Storage"
auto_detect:
pass_if: "Object Storage replication configured to DR region"
gap_if: "critical object storage without cross-region replication"
severity: MEDIUM
applies_when: "has_critical_object_storage"
- name: "Disaster Recovery"
id: disaster_recovery
checks:
- id: REL-DR-001
name: "DR region identified"
description: "DR region identified and provisioned"
auto_detect:
pass_if: "DR region specified in architecture"
gap_if: "no DR region identified"
severity: HIGH
applies_when: "requires_dr"
- id: REL-DR-002
name: "DR architecture documented"
description: "DR architecture documented with switchover/failover procedures"
auto_detect:
pass_if: "DR runbook with switchover/failover procedures defined"
gap_if: "no DR procedures documented"
severity: HIGH
applies_when: "requires_dr"
- id: REL-DR-003
name: "DR drill schedule"
description: "DR drill schedule defined (quarterly minimum)"
auto_detect:
pass_if: "DR drill schedule defined"
gap_if: "no DR drill schedule"
severity: MEDIUM
applies_when: "requires_dr"
- id: REL-DR-004
name: "DNS failover"
description: "DNS failover or traffic management configured"
auto_detect:
pass_if: "OCI Traffic Management or DNS failover configured"
gap_if: "no automated DNS failover for DR"
severity: MEDIUM
applies_when: "requires_dr"
- id: REL-DR-005
name: "Application tier DR"
description: "Application tier DR strategy (pre-provisioned, Terraform-on-demand, or pilot light)"
auto_detect:
pass_if: "application DR strategy defined and documented"
gap_if: "no application tier DR strategy"
severity: HIGH
applies_when: "requires_dr"

324
kb/well-architected/security-compliance.yaml Normal file
View File

@@ -0,0 +1,324 @@
# OCI Well-Architected Framework — Pillar 1: Security and Compliance
# Source: https://docs.oracle.com/en/solutions/oci-best-practices/effective-strategies-security-and-compliance1.html
pillar:
name: "Security and Compliance"
id: security_compliance
wa_reference: "https://docs.oracle.com/en/solutions/oci-best-practices/effective-strategies-security-and-compliance1.html"
reference: "https://docs.oracle.com/en/solutions/oci-best-practices/effective-strategies-security-and-compliance1.html"
categories:
- name: "Identity & Access"
id: identity_access
checks:
- id: SEC-IAM-001
name: "Least-privilege IAM policies"
description: "IAM policies follow least-privilege (not using broad 'manage all-resources')"
auto_detect:
pass_if: "architecture specifies granular IAM policies per compartment/service"
gap_if: "no IAM policy strategy defined or broad permissions used"
severity: HIGH
applies_when: always
- id: SEC-IAM-002
name: "MFA for human users"
description: "MFA enabled for all human users"
auto_detect:
pass_if: "MFA is specified in identity configuration"
gap_if: "no MFA mentioned in identity setup"
severity: HIGH
applies_when: always
- id: SEC-IAM-003
name: "Tenancy admin restricted"
description: "Tenancy admin account NOT used for day-to-day operations"
auto_detect:
pass_if: "separate admin groups defined for operations"
gap_if: "no mention of admin account restrictions"
severity: HIGH
applies_when: always
- id: SEC-IAM-004
name: "Instance/resource principals"
description: "Service accounts use instance principals or resource principals, not stored credentials"
auto_detect:
pass_if: "instance principals or resource principals specified for service-to-service auth"
gap_if: "stored credentials or API keys used for service accounts"
severity: HIGH
applies_when: always
- id: SEC-IAM-005
name: "Multiple Identity Domains"
description: "Multiple Identity Domains if multi-tenant or multi-environment"
auto_detect:
pass_if: "multiple identity domains defined"
gap_if: "single identity domain for multi-tenant setup"
severity: MEDIUM
applies_when: "multi_tenant or multi_environment"
- id: SEC-IAM-006
name: "IdP Federation"
description: "Federation configured with customer's IdP (AD, Okta, SAML)"
auto_detect:
pass_if: "federation with external IdP configured"
gap_if: "no IdP federation mentioned when enterprise customer"
severity: MEDIUM
applies_when: "enterprise_customer"
- name: "Resource Isolation"
id: resource_isolation
checks:
- id: SEC-ISO-001
name: "Compartment organization"
description: "Compartments organized by workload/environment (not flat)"
auto_detect:
pass_if: "hierarchical compartment structure defined"
gap_if: "flat compartment structure or no compartment strategy"
severity: HIGH
applies_when: always
- id: SEC-ISO-002
name: "Tagging strategy"
description: "Tags defined for cost tracking, environment, owner"
auto_detect:
pass_if: "defined tag namespaces with cost, environment, and owner tags"
gap_if: "no tagging strategy defined"
severity: MEDIUM
applies_when: always
- id: SEC-ISO-003
name: "Security Zones"
description: "Security Zones enabled for production compartments"
auto_detect:
pass_if: "Security Zones configured for production compartments"
gap_if: "no Security Zones for production workloads"
severity: MEDIUM
applies_when: "has_production_workloads"
- id: SEC-ISO-004
name: "Resource principal for cross-resource access"
description: "Cross-resource access uses resource principals, not user credentials"
auto_detect:
pass_if: "resource principals used for cross-service access"
gap_if: "user credentials used for cross-resource access"
severity: HIGH
applies_when: always
- name: "Database Security"
id: database_security
checks:
- id: SEC-DB-001
name: "Databases in private subnets"
description: "Databases in private subnets only"
auto_detect:
pass_if: "all database services placed in private subnets"
gap_if: "any database accessible from public subnet"
severity: HIGH
applies_when: "has_databases"
- id: SEC-DB-002
name: "TDE with customer-managed keys"
description: "TDE enabled with customer-managed keys (OCI Vault)"
auto_detect:
pass_if: "TDE with OCI Vault customer-managed keys specified"
gap_if: "Oracle-managed keys or no encryption key management specified"
severity: HIGH
applies_when: "has_databases"
- id: SEC-DB-003
name: "Key rotation policy"
description: "Key rotation < 90 days"
auto_detect:
pass_if: "key rotation policy defined with < 90 day interval"
gap_if: "no key rotation policy or > 90 day interval"
severity: MEDIUM
applies_when: "has_databases"
- id: SEC-DB-004
name: "Data Safe enabled"
description: "Data Safe enabled (audit, masking, VPD assessment)"
auto_detect:
pass_if: "Data Safe configured for database security assessment"
gap_if: "Data Safe not included in architecture"
severity: MEDIUM
applies_when: "has_databases"
- id: SEC-DB-005
name: "Private endpoints for ADB"
description: "Private endpoints for Autonomous Database"
auto_detect:
pass_if: "Autonomous Database configured with private endpoints"
gap_if: "Autonomous Database using public endpoints"
severity: HIGH
applies_when: "has_autonomous_database"
- id: SEC-DB-006
name: "Restricted DELETE permissions"
description: "DELETE permissions restricted to minimal users/groups"
auto_detect:
pass_if: "explicit restriction on DELETE permissions documented"
gap_if: "no mention of DELETE permission restrictions"
severity: MEDIUM
applies_when: "has_databases"
- id: SEC-DB-007
name: "Database security patches"
description: "Database security patches applied (CPU/PSU)"
auto_detect:
pass_if: "patching strategy defined for databases"
gap_if: "no database patching strategy"
severity: HIGH
applies_when: "has_databases"
- name: "Data Protection"
id: data_protection
checks:
- id: SEC-DAT-001
name: "Encryption at rest"
description: "Encryption at rest for all storage (Block, File, Object)"
auto_detect:
pass_if: "encryption at rest specified for all storage services"
gap_if: "any storage service without encryption at rest"
severity: HIGH
applies_when: always
- id: SEC-DAT-002
name: "OCI Vault key management"
description: "Keys managed in OCI Vault (not Oracle-managed)"
auto_detect:
pass_if: "OCI Vault specified for key management"
gap_if: "using Oracle-managed keys or no key management strategy"
severity: MEDIUM
applies_when: always
- id: SEC-DAT-003
name: "No public Object Storage"
description: "Object Storage buckets not publicly accessible"
auto_detect:
pass_if: "Object Storage buckets configured as private"
gap_if: "any Object Storage bucket publicly accessible without justification"
severity: HIGH
applies_when: "has_object_storage"
- id: SEC-DAT-004
name: "Retention rules"
description: "Retention rules on critical buckets"
auto_detect:
pass_if: "retention rules configured for critical data buckets"
gap_if: "no retention rules on critical data"
severity: MEDIUM
applies_when: "has_critical_data_in_object_storage"
- name: "Network Security"
id: network_security
checks:
- id: SEC-NET-001
name: "NSGs over Security Lists"
description: "NSGs preferred over Security Lists for fine-grained control"
auto_detect:
pass_if: "NSGs used as primary network security mechanism"
gap_if: "only Security Lists used without NSGs"
severity: MEDIUM
applies_when: always
- id: SEC-NET-002
name: "No default SSH from anywhere"
description: "Default security list modified (no SSH from 0.0.0.0/0)"
auto_detect:
pass_if: "SSH access restricted to specific CIDR ranges or bastion"
gap_if: "SSH open to 0.0.0.0/0"
severity: HIGH
applies_when: always
- id: SEC-NET-003
name: "WAF on internet-facing endpoints"
description: "WAF on all internet-facing endpoints"
auto_detect:
pass_if: "WAF configured for all internet-facing services"
gap_if: "internet-facing endpoints without WAF"
severity: HIGH
applies_when: "has_internet_facing_services"
- id: SEC-NET-004
name: "Service Gateway"
description: "Service Gateway for OCI service access (no internet traversal)"
auto_detect:
pass_if: "Service Gateway configured in VCN"
gap_if: "OCI services accessed via internet gateway"
severity: MEDIUM
applies_when: always
- id: SEC-NET-005
name: "Network Firewall"
description: "Network Firewall for hub VCN if required"
auto_detect:
pass_if: "Network Firewall deployed in hub VCN"
gap_if: "no Network Firewall in hub-spoke topology requiring deep packet inspection"
severity: LOW
applies_when: "hub_spoke_topology"
- id: SEC-NET-006
name: "TLS on Load Balancers"
description: "Load Balancers with TLS termination"
auto_detect:
pass_if: "TLS termination configured on load balancers"
gap_if: "load balancers without TLS"
severity: HIGH
applies_when: "has_load_balancers"
- id: SEC-NET-007
name: "Zero Trust Packet Routing"
description: "Zero Trust Packet Routing considered for sensitive workloads"
auto_detect:
pass_if: "ZTPR evaluated or configured"
gap_if: "ZTPR not considered for sensitive workloads"
severity: LOW
applies_when: "has_sensitive_workloads"
- name: "Monitoring & Audit"
id: monitoring_audit
checks:
- id: SEC-MON-001
name: "Cloud Guard enabled"
description: "Cloud Guard enabled with detector and responder recipes"
auto_detect:
pass_if: "Cloud Guard configured with appropriate recipes"
gap_if: "Cloud Guard not included in architecture"
severity: HIGH
applies_when: always
- id: SEC-MON-002
name: "OCI Audit enabled"
description: "OCI Audit service enabled"
auto_detect:
pass_if: "Audit service enabled (enabled by default, verify retention)"
gap_if: "audit service not mentioned or retention not configured"
severity: MEDIUM
applies_when: always
- id: SEC-MON-003
name: "VCN Flow Logs"
description: "VCN Flow Logs enabled"
auto_detect:
pass_if: "VCN Flow Logs enabled for critical subnets"
gap_if: "no VCN Flow Logs configured"
severity: MEDIUM
applies_when: always
- id: SEC-MON-004
name: "Vulnerability Scanning"
description: "Vulnerability Scanning enabled"
auto_detect:
pass_if: "OCI Vulnerability Scanning configured for compute instances"
gap_if: "no vulnerability scanning in architecture"
severity: MEDIUM
applies_when: "has_compute_instances"
- id: SEC-MON-005
name: "SIEM integration"
description: "Logs aggregated to SIEM if enterprise requirement"
auto_detect:
pass_if: "SIEM integration configured or Logging Analytics used"
gap_if: "no centralized log aggregation for enterprise workload"
severity: MEDIUM
applies_when: "enterprise_customer"