Prerequisite Concepts

A Virtual Machine (VM) is an isolated computing environment that simulates the functionality of a physical system through software. Each VM has its own operating system, applications, and configurations but shares hardware resources (such as CPU, memory, and storage) with other VMs on a physical server.
This isolation enables running multiple virtual machines on a single host without interference. Virtual machines are commonly used for:

• Optimizing hardware resource usage
• Running applications on different operating systems
• Testing software in controlled environments
• Enhancing infrastructure flexibility and scalability

An SSH key is a cryptographic authentication mechanism for securely connecting to virtual machines (Linux-based). It consists of a pair of public and private keys:

• Public Key: Stored on the virtual machine.
• Private Key: Kept by the user and must not be disclosed.

Using SSH keys, users can securely log into virtual machines without a password. This method enhances access security and eliminates risks associated with weak passwords.

A Subnet is a logical subdivision of an IP range within a Virtual Private Cloud (VPC). Each subnet has a specific IP range for:

• Resource separation (e.g., separating databases from web servers)
• More precise traffic and security control
• Simplifying network management

Dividing a VPC into subnets helps structure the cloud architecture and enables applying different security policies to various network segments.

A Floating IP is a public IPv4 address that can be dynamically assigned to any virtual machine in a specific geographic region. Key features include:

• Transferable between servers without requiring a restart
• Suitable for High Availability and Failover scenarios
• Easy traffic routing to the active server in real-time

Using a floating IP ensures continuous access to services even when switching between machines.

Backup is a scheduled and ongoing process for maintaining copies of data or virtual machines. In the Kubit system, backups are performed through Backup Rules on a periodic basis (daily, weekly, or monthly). Each rule specifies:

• Which virtual machine to back up
• The time interval (Frequency)
• The number of backup versions (Slots) to retain

Backups are used for long-term data protection, recovery in critical situations, and migration between environments. They are typically stored in a separate and stable storage space.

A Snapshot is a point-in-time copy of a virtual machine or disk’s state at a specific moment. This copy includes the operating system, data, configurations, and file structure. Snapshots are useful for:

• Quick restoration to a previous state before changes or errors
• Testing or applying changes without permanent risk
• Creating clones for development or testing

Snapshots are typically suitable for short-term, in-system backups and are directly linked to the original volume, not a separate storage space.

A Security Group is a virtual firewall at the virtual machine or cloud resource level that provides precise control over inbound and outbound traffic. The rules of each security group can specify:

• Allowed or disallowed protocols (TCP, UDP, ICMP)
• Open or closed ports
• IP ranges (IPv4 or IPv6) permitted for access

Security groups enable precise and flexible security policy enforcement and operate in a Stateful manner, meaning return traffic is automatically allowed if the inbound connection was permitted (bidirectional communication).

These three layers complement each other:

1. Security Groups

• Play the primary role in filtering network traffic.
• Traffic is checked before reaching the OS.
• Example: Only allow SSH access from a specific IP.

2. OS Firewall

• Examines traffic that has passed the Security Group.
• Provides more precise control over protocols, connections, timing, and behaviors.
• Example: Use ufw or iptables to allow connections only for specific users.

3. Access Control

• Assumes a user has logged into the system via SSH; this layer determines what they can access.
• Examples:
  • Cannot view a file (chmod)
  • Cannot connect to a database unless in a specific role
  • Cannot call a specific API endpoint