PCA 3.x Compute Enclave concepts: tenancies, compartments, VCNs, instances, images and shapes

This entry applies to Oracle Private Cloud Appliance release 3.x. In the Compute Enclave, Oracle aims for an experience that is practically identical to Oracle Cloud Infrastructure (OCI), so the vocabulary is the same. If you know OCI, most of this will be familiar.

Tenancy

A tenancy is an isolated slice of the appliance for one organization or team. The appliance administrator creates it in the Service Enclave, together with one Compute Enclave account: the tenancy administrator, who has full access to everything in that tenancy. Tenancies share the same hardware, but users and resources in one tenancy cannot interact with another; the docs say they are isolated by tunneling and encapsulation in the appliance network.

Users, groups and policies

The tenancy administrator creates more users and groups and writes policies that grant groups permission to manage resources. Access control uses the Identity and Access Management (IAM) policy framework, as in OCI. Whether a user works in the Compute Web UI or the OCI CLI makes no difference to their permissions: both send requests to the same API, which authorizes or rejects them.

From the OCI CLI you can see the same structure. These read-only commands come from the PCA User Guide:

oci iam compartment list --compartment-id-in-subtree true
oci iam availability-domain list
oci network vcn list --compartment-id ocid1.compartment.unique_ID
oci compute instance list --compartment-id ocid1.compartment.unique_ID

Compartments

Compartments are folders for cloud resources inside a tenancy. Oracle’s guide suggests patterns such as one compartment per team or project, with a compartment administrator, plus separate compartments for shared network and storage resources. Policies can be written per compartment, so compartments are your main tool for delegating control.

Instances, images and shapes

• A compute instance is a virtual machine running on a compute node.
• An image contains a preconfigured operating system and optional extra software. You choose a platform image provided with the appliance or a custom image you imported.
• A shape is a template of virtual hardware: OCPUs and memory. Flexible shapes let you choose the OCPU count and memory at creation time.
• Every instance needs at least a boot volume and a connection to a VCN.

Networking

A virtual cloud network (VCN) is a private software-defined network with a CIDR range you choose. Inside it you create subnets, which can be public or private, plus route tables, security lists and gateways. Instances attach to a subnet through a virtual network interface (VNIC).

Storage

Beyond the boot volume, the docs list typical extras: block volumes attached to instances, file systems shared over NFS, and object storage buckets. All of it is backed by the appliance’s ZFS Storage Appliance.

Fault domains and availability domain

When you create an instance you can optionally pick a fault domain, a grouping of compute nodes; by default the system chooses one. CLI examples in the PCA docs use a single availability domain named AD-1.

Portability with OCI

The docs state that Compute Enclave resources are compatible with OCI and can be ported between your private and public cloud environments. That does not mean every OCI service exists on PCA; check the PCA documentation for the services and features available in your release.

Official documentation

• Oracle PCA Concepts Guide (3.0): Enclaves and Interfaces
• Oracle PCA User Guide (3.0): Creating and Managing VCNs and Subnets