COMP347 Unit 8 – Network Management and Network Operations
After completing this extended tutorial, you should be able to:
Cloud and data-center networking have evolved dramatically over the past decade, driven by the need for agility, scalability, and automation. This tutorial provides a comprehensive, in‑depth exploration of cloud, virtualized, and data-center network operations, from the physical architecture of modern data centers to the software-defined overlays that enable virtualization and multi-tenancy. We begin with an overview of cloud networking drivers and architectures, then dive into network virtualization concepts, including VXLAN, NVGRE, and Geneve overlay technologies that decouple logical networks from physical infrastructure. We examine modern data-center topologies such as spine-leaf (Clos) that provide high-bandwidth, low-latency connectivity.
We then explore cloud-network monitoring and operations, including native cloud tools (AWS CloudWatch, Azure Monitor) and how they integrate with telemetry. Hybrid-cloud and multi-cloud management is addressed, covering connectivity (VPN, Direct Connect, ExpressRoute), unified monitoring, and policy consistency. Container networking (Docker, Kubernetes CNI plugins) is explained, with a focus on observability in Kubernetes (metrics, logs, traces, and network policies). Service meshes (Istio, Linkerd) are presented as a means for application-layer networking and observability. Automation and orchestration tools (Terraform, AWS CloudFormation, Kubernetes Operators) are discussed, along with security considerations (zero-trust, micro-segmentation, and network policies). Case studies illustrate real-world cloud operations.
Modern data centers and cloud environments are characterized by:
Cloud networking provides virtual networks, load balancers, firewalls, and connectivity services as on-demand resources. This tutorial covers the operational aspects of managing these environments.
Network virtualization abstracts physical network resources to create logical networks. Key concepts:
Benefits: isolation, scalability, mobility (VMs can move across physical locations), and simplified operations.
Overlays decouple tenant addressing from physical infrastructure, enabling mobility and isolation.
Traditional three-tier architectures (core, aggregation, access) have been replaced by:
This architecture supports east-west traffic (server-to-server) efficiently, which is common in modern applications.
Cloud providers offer native monitoring tools:
Monitoring covers:
Integration with third-party tools (Prometheus, Grafana, Datadog) is common for unified observability.
Hybrid-cloud: Combines on-premises infrastructure with public cloud(s). Connectivity options:
Multi-cloud: Using multiple public cloud providers simultaneously. Challenges:
Tools: Terraform, CloudFormation, Azure Resource Manager, Google Deployment Manager.
Containers have revolutionized application deployment. Container networking models:
Observability in Kubernetes:
A service mesh provides infrastructure-level networking for microservices, handling:
Popular service meshes: Istio (Envoy-based), Linkerd, Consul Connect. They use sidecar proxies to intercept traffic.
Automation is critical for cloud operations. Key tools:
Automation enables rapid provisioning, consistent environments, and reduced human error.
All answers are hidden; click Show Answer to reveal.
What are the key characteristics of modern cloud and data-center environments?
Define network virtualization and its main benefit.
What is VXLAN and what is its key advantage over traditional VLANs?
Explain the concept of a VTEP in VXLAN.
What is a spine-leaf (Clos) architecture and why is it used in data centers?
What is ECMP and how does it relate to spine-leaf architecture?
Name three cloud-native monitoring services (AWS, Azure, GCP).
What is the purpose of VPC Flow Logs in AWS?
What is the difference between hybrid-cloud and multi-cloud?
Name two common methods for connecting on-premises to a cloud.
What is the Container Network Interface (CNI)?
Name three Kubernetes CNI plugins.
What is a Kubernetes Network Policy?
What are the three pillars of observability in Kubernetes?
What is a service mesh and what problems does it solve?
Name two popular service meshes.
What is a sidecar proxy in a service mesh?
What is Infrastructure as Code (IaC)?
Name two IaC tools.
What is the purpose of a CI/CD pipeline in cloud operations?
What is the zero-trust security model?
Define micro-segmentation and how it is achieved in cloud networks.
What is the role of AWS GuardDuty?
What are the main challenges of multi-cloud management?
What is a Kubernetes Operator?
Explain the difference between overlay and underlay networks.
What is the purpose of a network load balancer in the cloud?
What is a VPC (Virtual Private Cloud) and why is it used?
How does the CNI plugin Calico enforce network policies in Kubernetes?
What is distributed tracing and why is it important in microservices?
What is the purpose of mTLS in a service mesh?
What is a Kubernetes Ingress controller?
Explain the purpose of AWS CloudTrail.
What is the difference between a load balancer and a service mesh?
How does a cloud provider ensure network isolation between tenants?
What is the role of a network security group (NSG) in Azure?
What is a service endpoint in the context of cloud networking?
Explain the concept of "canary deployment" and how a service mesh supports it.
What is the difference between a security group and a network ACL in AWS?
How can you monitor network performance in a hybrid-cloud environment?
What is the main purpose of Azure Network Watcher?
What is a Kubernetes DaemonSet and how is it used for monitoring?
What is the role of a service registry in microservices?
What is a private link (e.g., AWS PrivateLink) used for?
Explain the concept of "network transparency" in the context of container networking.
How does a service mesh handle retries and timeouts?
What is the purpose of a cloud's "service level agreement" (SLA) for network services?
What is the advantage of using a Kubernetes operator for network configuration?
What is the difference between a public and private cloud?
How can you ensure consistent network policies across a multi-cloud environment?
Sample solutions are hidden – click to reveal.
Design a VXLAN-based overlay network for a data center with 10,000 VMs. Specify VNI range, VTEP placement, and control plane design (e.g., EVPN).
Explain how you would design a spine-leaf network for a data center with 100 racks, each with 48 servers. Calculate the required number of spine and leaf switches for a non-blocking design.
Write a Terraform configuration to create a VPC in AWS with subnets and a security group allowing SSH access.
resource "aws_vpc" "main" {
cidr_block = "10.0.0.0/16"
}
resource "aws_subnet" "subnet" {
vpc_id = aws_vpc.main.id
cidr_block = "10.0.1.0/24"
}
resource "aws_security_group" "sg" {
name = "allow-ssh"
vpc_id = aws_vpc.main.id
ingress {
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
}
Describe the steps to set up a Kubernetes cluster with Calico as the CNI, and how to apply a network policy that restricts traffic to only pods in the same namespace.
You are responsible for monitoring a Kubernetes cluster. What metrics would you collect and what tools would you use?
Compare and contrast VXLAN and Geneve as overlay protocols. When would you choose Geneve?
Design a hybrid-cloud architecture connecting an on-premises data center to AWS. Include connectivity, security, and monitoring components.
Explain how to implement canary deployments using Istio. Include traffic routing and rollback strategies.
You have a multi-cloud environment using AWS and GCP. How would you set up unified monitoring and alerting across both?
What are the key differences between Docker bridge networking and Kubernetes overlay networking?
Write a Kubernetes NetworkPolicy that allows ingress to pods labeled `app=web` only from pods labeled `app=frontend` in the same namespace.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: web-allow-frontend
spec:
podSelector:
matchLabels:
app: web
ingress:
- from:
- podSelector:
matchLabels:
app: frontend
Explain how AWS VPC Flow Logs can be used to troubleshoot network connectivity issues between two EC2 instances.
What is the role of the Kubernetes Service object and how does it relate to network operations?
Design a zero-trust network policy architecture for a cloud-native application using micro-segmentation.
Compare AWS Direct Connect and Azure ExpressRoute. What are the similarities and differences?
What is the purpose of a cluster mesh in Istio and how does it support multi-cluster deployments?
Explain the difference between a Deployment and a StatefulSet in Kubernetes, and how they affect networking.
You notice high latency between services in a microservices application. How would you use distributed tracing to identify the bottleneck?
Describe how to use a Kubernetes CronJob for automated network policy compliance checks.
What is the role of a network operator in a cloud-native environment, and how does the role differ from traditional networking?
Explain the concept of "east-west" and "north-south" traffic in data-center networking. Why is east-west traffic dominant in cloud applications?
Design a monitoring and alerting strategy for a Kubernetes-based application using Prometheus and Alertmanager.
What is the role of a cloud service provider's network security group (e.g., AWS Security Group) and how does it compare to a Kubernetes network policy?
How can you use AWS Transit Gateway to simplify networking in a multi-VPC environment?
Write a Kubernetes manifest for an Ingress resource that routes traffic based on the host header.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: my-ingress
spec:
rules:
- host: app.example.com
http:
paths:
- pathType: Prefix
path: "/"
backend:
service:
name: my-service
port:
number: 80
Discuss the security implications of using sidecar proxies in a service mesh, and how to mitigate risks.
Sample answers are hidden; use them to guide your study.
Write a detailed analysis of overlay network technologies (VXLAN, NVGRE, Geneve), comparing their encapsulation formats, control plane approaches, and use cases.
VXLAN: UDP encapsulation with VNI; uses EVPN for control plane. NVGRE: GRE encapsulation with VSID. Geneve: flexible options. VXLAN is most widely deployed; Geneve offers more extensibility.
Design a complete monitoring architecture for a hybrid-cloud environment including on-premises, AWS, and Azure. Include metrics, logs, traces, and alerts.
On-prem: Prometheus + Loki. AWS: CloudWatch + X-Ray. Azure: Azure Monitor. Central: Grafana for visualization. Alertmanager and PagerDuty for alerting.
Research and explain the Kubernetes CNI plugin Cilium, focusing on its eBPF-based networking and security capabilities. How does it compare to Calico?
Cilium uses eBPF for high-performance networking, load balancing, and security (e.g., L7 policies). Calico uses iptables/eBPF. Cilium offers deeper observability (Hubble).
Create a Terraform module that provisions a Kubernetes cluster on AWS (EKS) with a VPC, subnets, and a security group.
Module defines: VPC, subnets, EKS cluster, node group, IAM roles. Outputs: cluster endpoint, node group name.
Explain the concept of "service mesh" and its role in cloud-native applications. Compare Istio and Linkerd in terms of architecture, features, and performance.
Service mesh provides traffic management, security, and observability. Istio uses Envoy, more feature-rich but heavier. Linkerd is lighter, uses Rust-based proxies.
Design a multi-cloud networking strategy for a company using AWS and GCP. Include VPC/network design, connectivity (VPN/interconnect), and security.
Use VPN or dedicated interconnects (AWS Direct Connect + GCP Interconnect). Design VPCs with non-overlapping CIDRs. Implement consistent security groups and IAM policies.
Write a research paper on network observability in Kubernetes: metrics, logs, traces, and events. Include tools like Prometheus, Fluentd, Jaeger, and Hubble.
Cover: Prometheus for metrics, Fluentd/EFK for logs, Jaeger for tracing, Hubble for network flow logs. Discuss correlation and visualization.
Explain the concept of "network as code" and how it applies to cloud networking. Provide examples using Terraform and cloud-specific tools.
Network as code: defining network infrastructure declaratively in code. Example: Terraform for VPC, subnets, load balancers; CloudFormation; Google Deployment Manager.
Discuss the challenges of monitoring containerized applications and how a service mesh can assist.
Challenges: dynamic IPs, short-lived containers, complex service interactions. Service mesh provides consistent observability: metrics, traces, and logs for service-to-service communication.
Design a zero-trust network architecture for a cloud-native application using Kubernetes Network Policies and Istio mTLS.
Use Network Policies to restrict pod-to-pod communication. Use Istio for mTLS between services. Implement identity-based access controls (SPIFFE).
Compare AWS VPC, Azure VNet, and GCP VPC in terms of features, scalability, and management complexity.
AWS VPC: mature, many features. Azure VNet: similar, with integrated load balancer. GCP VPC: global, with subnets per region. Management complexity varies with scale.
Explain how to set up a CI/CD pipeline for a Kubernetes application using GitLab CI and Kubernetes. Include build, test, and deploy stages.
GitLab CI stages: build (Docker image), test (unit/integration), deploy (kubectl apply to staging/production). Use environment variables for config.
Describe the concept of "network slicing" and its applicability in cloud and 5G networks.
Network slicing creates multiple logical networks on shared physical infrastructure, each with tailored resources and policies. Used in 5G for different service types (e.g., IoT, low-latency).
Research and explain the role of eBPF in modern cloud networking. How does it improve performance and observability?
eBPF allows programmable packet processing in the kernel, enabling high-performance networking, load balancing, and security (Cilium). Provides low-overhead observability.
Design a disaster recovery plan for a multi-cloud application, including network configuration, failover, and data synchronization.
Use active-active or active-passive deployment. Replicate data across clouds. Use DNS-based failover (e.g., AWS Route53, Azure Traffic Manager). Automate network failover using scripts.
Explain the concept of "network automation" in the cloud and the role of tools like Terraform and Ansible.
Network automation: using code to provision and manage network resources. Terraform for cloud resources; Ansible for configuration management on devices.
Analyze the security benefits and challenges of using a service mesh (e.g., Istio) in a production environment.
Benefits: mTLS, fine-grained authorization, observability. Challenges: complexity, performance overhead, and increased attack surface.
Write a case study on a company that successfully adopted Kubernetes and cloud-native networking, including the challenges faced and how they were overcome.
Company: e-commerce. Challenges: networking complexity, security, and performance. Solutions: used Calico for policy, Istio for traffic management, and Prometheus for monitoring.
Discuss the future of cloud networking: trends like serverless, edge computing, and AI-driven operations.
Serverless: reduced network management overhead. Edge computing: distributed network policies. AI-driven operations: predictive scaling and anomaly detection.
Explain how to implement a hybrid-cloud network policy that ensures consistent security across on-premises and AWS.
Use a cloud-agnostic policy framework (e.g., OPA). Define policies in code and deploy to both on-premises firewalls and AWS security groups using automation.
This extended tutorial has provided a comprehensive exploration of cloud, virtualized, and data-center network operations. We covered the architecture of modern data centers, network virtualization overlays (VXLAN, NVGRE, Geneve), and spine-leaf topologies. Cloud-network monitoring and operations using native tools were discussed, along with hybrid-cloud and multi-cloud management challenges. Container networking and Kubernetes observability were explained, and service meshes were presented for application-layer networking. Automation tools, security considerations, and real-world case studies rounded out the content.
Cloud and virtualized networking require a shift in mindset from traditional device-centric management to API-driven, automation-focused operations. The quiz, exercises, and homework assignments are designed to reinforce both theoretical understanding and practical skills. In the next tutorial, we will explore Security Operations and Network Performance Management, integrating security and performance in network operations.
COMP347 Unit 8 – Extended Tutorial 12 • TrustOpen University • Last updated: August 2026