The architecture has the following components:

On-premises/Internet

• Research/Engineers use Browser/Secure Shell (SSH) access to reach OCI DNS and the platform endpoint.
• HPC Platform Admins use Admin Access to reach OCI DNS and administer platform entry points.
• Customer premises equipment represents the customer network equipment shown for the on-premises environment.
• OCI DNS resolves access names and sends traffic toward the internet gateway in the OCI Region.

OCI Region

• The Oracle Cloud Infrastructure (OCI) Region contains Availability Domain 1, Availability Domain 2, and Availability Domain 3.
• The virtual cloud network (VCN) contains Public Subnet, Private Subnet, Private HPC Compute Subnet, and Private Storage/Runtime Subnet.
• The internet gateway receives traffic from OCI DNS and provides the public entry path into the VCN.
• The network address translation (NAT) gateway supports controlled updates for compute resources in the Private HPC Compute Subnet.
• The service gateway sends Backup/Lifecycle traffic from the OCI Region to OCI Object Storage.

Public Subnet

• OCI Web Application Firewall performs Policy Check before traffic reaches application services.
• Hypertext Transfer Protocol Secure (HTTPS) traffic passes from OCI Web Application Firewall to the Public Load Balancer.
• The Public Load Balancer fronts Open OnDemand (OOD) application access for browser users.
• Bastion provides Private SSH access to the Login Node in OCI HPC Stack 3.0.

Private Subnet

• OOD provides the browser-based user entry point for files, shells, jobs, and interactive applications.
• OOD Reverse Proxy routes user sessions by using the /node and /rnode paths.
• OOD Apps Proxy Routing sends /node and /rnode traffic to interactive compute sessions.
• Slurm command-line interface (CLI) traffic connects Open OnDemand services to the Slurm control plane.
• OCI HPC Stack 3.0 contains Login Node, Golden Image Factory, Slurm Controller, and FreeIPA Portable Operating System Interface (POSIX) Identity.
• Login Node receives Private SSH from Bastion and provides administrative access into the HPC stack.
• Golden Image Factory prepares images that support central processing unit (CPU) and graphics processing unit (GPU) node provisioning.
• Slurm Controller schedules jobs and coordinates controlled updates for compute node pools.
• FreeIPA POSIX Identity manages Linux identity data and participates in Federated Identity/IAM flows.
• Secrets/keys flow from OCI Vault to the private platform services that require protected values.

Private HPC Compute Subnet

• Permanent CPU provides always-available CPU capacity for workloads that should not wait for autoscaling.
• Autoscale CPU provides elastic CPU capacity for batch and interactive workloads.
• Autoscale Ubuntu GPU provides elastic GPU capacity for workloads that use Ubuntu images.
• Autoscale Oracle Linux GPU provides elastic GPU capacity for workloads that use Oracle Linux images.
• Future GPU Expansion represents an additional GPU capacity pool for later platform growth.
• Controlled Updates connect update flows to Permanent CPU, Autoscale CPU, Autoscale Ubuntu GPU, Autoscale Oracle Linux GPU, and Future GPU Expansion.

Private Storage/Runtime Subnet

• OCI File Storage provides shared /home, /scratch, and /apps storage paths.
• JuiceFS/oradata provides a mounted data path for shared data access.
• LustreFS/oradata active I/O provides high-throughput active input/output (I/O) storage for HPC and AI workloads.
• Shared Runtimes /apps Modules provides shared application runtimes and module content for compute nodes.

Oracle Services Network

• OCI Registry supplies Runtime images to the platform image and runtime workflow.
• OCI Identity and Access Management participates in Federated Identity/IAM for platform authentication and authorization.
• OCI Vault provides Secrets/keys to protected platform components.
• Logging receives operational log data from platform components.
• Monitoring receives platform metrics and exchanges operational signals with Logging.
• OCI Object Storage receives Backup/Lifecycle data through the service gateway.