An OCI Architect's First Walk Through Generative AI

Every enterprise architect eventually gets that request from leadership: "Can we use AI on our data — without shipping it off to some third-party SaaS we don't control?" For me, that request landed on a Tuesday, and it sent me straight into the OCI Console, into a service I'd only skimmed the docs on: OCI Generative AI, tucked under Analytics & AI.

How Generative AI Actually Works

The intro walkthrough boiled the whole service down to three steps, and honestly, it's the cleanest mental model I've seen for explaining LLMs to a room full of database people:

1. Input — you provide text, examples, or instructions in natural language.
2. Analysis — the service processes that input and generates, summarizes, transforms, extracts, or classifies the text.
3. Output — you get a response back in the format you asked for.

Beyond the Pretrained Models: Fine-Tuning

The walkthrough didn't stop at "use what Oracle gives you." It also explained the path to a custom model: pick a pretrained base model, supply your own training file, and let OCI Generative AI fine-tune it for you — but only on dedicated AI clusters that belong exclusively to your tenancy. And fine-tuning is only half the story: once you have a custom model, you still need to create an endpoint and host that model on a dedicated cluster before anything can call it.

OCI Generative AI offers the following pretrained foundational models. Review the key features, regions, on-demand and dedicated AI cluster offerings, deprecation and retirement dates, and benchmarks for the models.

Ref: https://docs.oracle.com/en-us/iaas/Content/generative-ai/pretrained-models.htm

Two Doors: Chat and Embedding

The Playground, I learned, isn't one tool — it's two modes wearing the same UI:

• Chat lets you ask questions and get conversational responses. The chat models hold context across the conversation, so you can ask follow-ups, and you control format, length, and tone.
• Embedding converts text into vector representations — the raw material for semantic search, text classification, and clustering.

A few things I'll be repeating in the design review:

1. **Pretrained models get you started for free** — on-demand, no cluster required — but production fine-tuning and hosting custom models both require dedicated AI clusters scoped to your tenancy.

2. **Watch the lifecycle labels.** The model picker flags deprecated models inline; it's worth building a habit of checking that before locking a model into an application.

3. **Chat and Embedding are two ends of the same pipeline.** Chat is the conversational front door; Embedding is the semantic index underneath it. Most real projects need both.

4. **The console mirrors infrastructure thinking a DBA already has** — clusters, capacity, endpoints, versioning — which makes this a much shorter ramp-up for an OCI architect than the "AI" branding might suggest.

OCI - Networking draft

Classless Inter-Domain Routing (CIDR):

Classless Inter-Domain Routing (CIDR) allows network routers to route data packets to the respective device based on the indicated subnet. Instead of classifying the IP address based on classes, routers retrieve the network and host address as specified by the CIDR suffix.

Range of IP Addresses (From IP) to (Last IP)

Virtual Cloud Network (VCN):

Reserved IPs:

N/W Address  (192.168.0.0)

Subnet Default Gateway Address - (192.168.0.1)

Broadcast Address - (192.168.0.255)

OCI: Identity and Access Management - Basics

Create Compartment:

Creating Identity Domain

Default Domain:

Note: All Domain Users cant be deleted

Groups

Note: First create the group and assign it to Users

Users:

Who can create users

    a. Tenancy Admin, b. Domain Admin, c. User Manager Admin Role d. Using Policies (allow group domain1/group1 to manage users in tenancy)

a. Create User using Console:

b. Create User using CSV import:

Dynamic Groups

Integrated Applications

Oracle Cloud Services

Jobs

Reports

Security  -->

               

Settings

Notifications

Branding

Managing Group:

a. Collection of Users

b. Simplify Access Management

c. Audit & Compliance

Managing User

OCI FastConnect Overview

 

FastConnect Overview:

Oracle Cloud Infrastructure FastConnect provides an easy way to create a dedicated, private connection between your data center and Oracle Cloud Infrastructure. FastConnect provides higher-bandwidth options, and a more reliable and consistent networking experience compared to internet-based connections. This setup offers higher bandwidth, lower latency, and improved reliability compared to typical internet-based connections.

Key Features:

--> Private and Public Peering: Connect to OCI resources using private IP addresses (private peering) or access public OCI services like Object Storage and APIs over a dedicated connection 

--> Bandwidth Options: Supports port speeds ranging from 1 Gbps to 400 Gbps.

--> Cost Efficiency: No charges for inbound or outbound data transfer.

--> Flexible Peering Options:

• Private Peering: Extends your on-premises network into your OCI Virtual Cloud Network (VCN) using private IP addresses.

• Public Peering: Provides access to public OCI services (e.g., Object Storage, OCI Console) over a dedicated connection using public IP addresses.

--> No Data Transfer Charges: Unlike standard internet connections, FastConnect does not incur per-byte data transfer charges, making it cost-effective for large data movements

--> Routing Protocol: Utilizes BGP (Border Gateway Protocol) for dynamic routing.

-->Encryption Support: Options to encrypt public peering connections using IPSec VPN for enhanced security.

How does OCI FastConnect work?

FastConnect provides a dedicated private connection between  OCI environment and  data center or trusted third-party provider.

There are three physical connection types.

• -->Customers who have a presence in an existing FastConnect location (A) can provision redundant cross-connects directly to an Oracle FastConnect edge device. Port speeds of 1 Gb/sec, 10 Gb/sec, 100 Gb/sec, or 400 Gb/sec are available.
• -->Customers who have an existing connection to a FastConnect partner (B) can provision a connection to OCI, typically within hours to days. Partners can also provide connections to other clouds, enabling a multicloud deployment. Port speeds vary depending on the partner’s capabilities.
• -->Customers can independently contract with a third-party provider (C) to establish connectivity to an Oracle FastConnect location.

For resiliency and high availability, best practices recommend establishing multiple physical connections to the same OCI region.

Once a physical connection is established, there are two virtual circuit options. Public peering (D) enables you to access both private resources in a VCN as well as public resources without traversing the internet, similar in concept to using OCI as an ISP. Private peering (E) enables you to extend your on-premises private networks to OCI.

FastConnect supports the Border Gateway Protocol (BGP) to automate route updates between your environment, OCI, and (optionally) FastConnect partners or third-party providers.

North America Oracle FastConnect locations

Use Cases of OCI FastConnect:

Source: https://www.oracle.com/cloud/networking/fastconnect/

OCI IAM draft

 

Oracle Cloud Infrastructure Identity and Access Management (IAM):

Oracle Cloud Infrastructure Identity and Access Management (IAM) provides identity and access management features such as authentication, single sign-on (SSO), and identity lifecycle management for Oracle Cloud as well as Oracle and non-Oracle applications, whether SaaS, cloud-hosted, or on-premises.

I. OCI IAM: Authentication (AuthN)

 

Source: Oracle 

a. User Credentials:

b. API Keys:

c. OAuth 2.0 Tokens

d. Instance Principals

e. Federated Identity

f. Multi Factor Authentication (MFA)

II. OCI IAM: Authorization (AuthZ):

Source: Oracle

a. Policies

b. Groups

c. Dynamic Groups

OCI Storage Refresher

 

I. Object Storage:

  --> Bucket Creation --Data/Object

 --> Managing Buckets/Objects

 --> Multipart Uploads

--> Tiers and Auto Tiering Vs Object Lifecycle Management

--> Object Storage Replication

--> Object Copy and Versioning - how to enable versioining

--> How to configure Retention Rules

--> Security of object storage

     a. Pre-Auth Request

     b. Customer managed Keys

     c. Logging 

II. Block Storage:

Block Volume

a. Performance  and Dynamic Perf Scalability

b. Resize of Block Volume

c. Block Volume vs Clone

d. Replicate BV from one region to other region

Volume attachment types

a. ISCSI

b. Para virtualized

Volume Access Types

Multiple Instance Volume Attachments

Boot Volume

Security 

III. File Storage:

 

1. File System Concepts

2. How to create FS and Mount FS

3. NFS Export Option

4. File System Paths

5. Snapshot of FS

6. Clone FS

7. In-transit Encryption

8. FS Usage and Metering

OCI Compute Refresher

 

Images:

a. Platform

b. Custom

c. Bring your own Image

Shapes:

 GPU Shapes

Bare Metal Vs Virtual Machines vs Dedicated VM Hosts

Generate  - SSH Keypair

Launch Compute Instance & Connect

Capacity Type

a. Preemptible

b. Capacity Reservation

c. Dedicated VM Host

Scaling:

a. Vertical

b. Horizonal - AutoScaling

Operating System Managed Service - OSMS:

a. Instance Console Connection 

Burstable 

Shielded 

Confidential Computing

Infrastructure Maintenance Concepts

OCI Network Refresher

 

                                                              OCI Network Refresher

Ram Nanubalu

I. Virtual Cloud Network (VCN):

a. Route Tables (RT)

b. Gateways (GW)

c. VCN Security

II. IP Management Concepts:

 a. Reserved Public IP

-- Bring your own IP

--Public IP Pools

III. Connectivity:

a. Peering

     i. Local and Remote

b. Dynamic Routing Gateway

c. Site to Site VPN Connection

d. Fast Connect

e. Transit Routing

IV. Load Balancers:

a. Load Balancer

b. Network Load Balancer

c. Web Application Acceleration

V. DNS Management

a. Public DNS vs Private DNS

b. Private View

c. Traffic Management Steering Policies

VI. Network Command Center (NCC):

a. Inter Region Regency (IRR)

b. Network Path Analyzer (NPA)

c. Network Path Visualizer (NPV)

d. Capture Filters

e. Virtual Text Access Points

  

OCI IAM Refresher

 

1. Identity Domains:

2. Users/Groups:

3. Administrator Roles

4. IAM Policies

a. Syntax

b. Policy Actions & Placement

5. Compartments

6. Quotas/Budgets:

7. Granular Access Control

8. Policy Inheritance

Conditional Policies

TBAC

9. Network Source

10. Dynamic Groups