Designing Cloud-Native Architecture
1. Designing Containerization Architecture
| Practice | Detail |
|---|---|
| Multi-stage builds | Smaller final images |
| Distroless / Alpine | Minimal attack surface |
| Non-root user | USER 1000+ |
| Image scan | Trivy, Grype in CI |
| SBOM + signing | cosign, syft |
| OCI registry | ECR, GCR, GHCR, Harbor |
2. Designing Kubernetes Orchestration
| Object | Detail |
|---|---|
| Deployment | Stateless workloads |
| StatefulSet | Stable identity, storage |
| DaemonSet | Per-node agents |
| Job / CronJob | Batch / scheduled |
| Service / Ingress / Gateway API | Networking |
| PDB | Min available during disruption |
3. Designing Cloud Service Integration
| Service | Equivalents |
|---|---|
| Object storage | S3 / GCS / Azure Blob |
| Managed DB | RDS / Cloud SQL / Azure DB |
| Managed queue | SQS / Pub/Sub / Service Bus |
| Managed K8s | EKS / GKE / AKS |
| Cloud-provider SDKs | Use IRSA / Workload Identity |
4. Designing Serverless Architecture
| Pattern | Detail |
|---|---|
| FaaS | Lambda, Cloud Functions, Azure Functions |
| Event-driven | S3 / queue / HTTP triggers |
| Cold starts | Provisioned concurrency / SnapStart |
| Stateless | External state (DB / cache) |
| Cost | Pay-per-invocation; spiky workloads ideal |
5. Designing Infrastructure as Code
| Tool | Detail |
|---|---|
| Terraform / OpenTofu | Multi-cloud declarative |
| Pulumi | General programming languages |
| CloudFormation / CDK | AWS-native |
| Ansible | Config mgmt |
| Practice | State in remote backend; review via PR; plan/apply |
6. Designing Auto-Scaling Architecture
| Type | Detail |
|---|---|
| HPA | Scale pods on CPU / custom metric |
| VPA | Right-size CPU/mem requests |
| Cluster Autoscaler / Karpenter | Add nodes |
| KEDA | Event-driven (queue depth, etc.) |
| Predictive | ML-based pre-scaling |
7. Designing Cloud Storage Architecture
| Type | Use |
|---|---|
| Object | S3-style; static + media |
| Block | EBS / PD; VM disks |
| File | EFS / Filestore; shared POSIX |
| Lifecycle | Auto-tier transitions |
8. Designing Cloud Networking
| Element | Detail |
|---|---|
| VPC + subnets | Public / private / isolated |
| NAT / IGW | Egress / ingress |
| Private endpoints | VPC endpoints / PrivateLink |
| Transit Gateway | Hub-and-spoke connectivity |
| Security groups + NACLs | Layered firewalls |
9. Designing Cloud Security Architecture
| Practice | Detail |
|---|---|
| IAM least privilege | Roles, no static keys |
| SCP / Org policies | Guardrails |
| KMS | Encrypt everywhere |
| CSPM | Wiz, Prisma, native (Security Hub) |
| Workload identity | IRSA / WI; no node-wide perms |
10. Designing Cloud Cost Optimization
| Lever | Detail |
|---|---|
| Right-sizing | Match instance to workload |
| Spot / Preemptible | For fault-tolerant |
| Savings plans / RIs | Commit for steady workloads |
| Storage tiering | Lifecycle to cheaper tiers |
| Idle resource cleanup | Tag + reaper |
| FinOps tooling | Cloudability, Vantage, Kubecost |
11. Designing Multi-Cloud Strategy
| Pattern | Detail |
|---|---|
| Active-active | Cross-cloud HA; complex |
| Best-of-breed | Different workloads per cloud |
| DR fallback | Secondary cloud for DR |
| Abstraction | K8s, Terraform, Crossplane |
| Trade-off | Operational complexity vs lock-in |
12. Designing Kubernetes Networking
| Concept | Detail |
|---|---|
| CNI | Calico, Cilium, AWS VPC CNI |
| Services | ClusterIP / NodePort / LoadBalancer |
| Ingress / Gateway API | L7 routing |
| NetworkPolicy | Default deny + explicit allow |
| Service mesh | Cilium, Istio, Linkerd |
| CoreDNS | In-cluster DNS |