Cloud network, zones, regions và disaster recovery
Private subnet không tự là secure; HA diagram cần routing, identity, data behavior, detection và recovery drills.
Network model
VPC/VNet address spaces, subnets, route tables, internet/NAT gateways, security groups/NSGs, NACLs, DNS, peering/transit/hub-spoke, private endpoints and egress controls. Avoid overlapping CIDR and uncontrolled flat connectivity.
Public/private
Public IP/route + firewall determine reachability; subnet name does not. NAT enables outbound, not inbound, adds cost/port capacity/failure consideration. Private endpoint keeps service traffic private but DNS/routing/policy must align.
HA
Multi-zone stateless compute + load balancer and zonal-aware data. Zone failure capacity headroom and cross-zone data/traffic cost. Health checks must reflect traffic eligibility. Managed service HA semantics vary.
DR
Backup/restore, pilot light, warm standby, active-active map increasing RTO/cost/complexity. RPO/RTO per data/workflow; replication may copy corruption. Run restore, failover and failback drills; DNS TTL/session/data consistency matter.
Multi-region
Choose for RTO/latency/residency, not prestige. Need global routing, data replication/conflict/fencing, secrets/config, capacity and operational ownership. Active-active write semantics are application-specific.