Access a database by using an Azure private network connection

This topic describes how to access a database by using an Azure private network connection.

Prerequisites

• You have registered an Azure account, subscribed to the OceanBase Cloud product in the Azure Marketplace using an Azure Subscription, and have a valid Virtual Network (Virtual Network) and Subnets under the Azure Subscription.
• You have registered an OceanBase Cloud account and created a cluster instance and a tenant. For more information, see Create a cluster instance and Create a tenant.
• Ensure that your client IP address has been added to the allowlist of the tenant. For specific operations, refer to Configure an IP address allowlist.

Procedure

Step 1: Create your endpoint service

1. Log in to the OceanBase Cloud console and click Networking in the left-side navigation pane.

2. On the Private Connectivity tab, click Create Private Connection.

3. In Step 1: Create your endpoint service, select Azure as the cloud service provider, and select the target instance and tenant.

4. Open the Azure console and click Subsriptions under Navigate.

5. On the Subscriptions page, view the target subscription name.

6. Return to the OceanBase Cloud console and enter this subscription name in the Azure Account ID field of Step 1.

Step 2: Create Endpoint on Azure and Connect

Log in to the Azure console to create a Private Endpoint. This process takes about 10 minutes.

1. Log in to the Azure console.

2. Go to the Network foundation > Private Link > Private endpoints page.

   

3. Click Create.

   

4. On the Create a private endpoint page, enter the following information as configured:

   • basic

     Parameter	Description
     Subscription	Select the subscription.
     Resource group	Select the resource group.
     Name	Enter the name of the private endpoint.
     Network Interface Name	Automatically generated based on the name.
     Region	The region information.

     

   • Resource

     Parameter	Description
     Connection method	Select whether to connect to an Azure resource by resource ID or alias.
     Resource ID or alias	Enter the Service ID provided in Step 2 of the OceanBase Cloud console.

     

   • Virtual Network

     Parameter	Description
     Virtual network	Select the Vnet to connect to.
     Subnet	The subnet configuration of the target Vnet.

     

   • DNS

     The current Azure Private Endpoint does not support DNS integration in this mode.

     

   • Tags

     Configure tags as needed.

     

5. On the details confirmation page, click create.

   

6. On the Private Endpoint details page, wait for the Status to change to Ok, then click the resource name to go to its details.

   

7. Obtain the Endpoint configuration information.

   1. On the details page, click the JSON View button in the upper-right corner.

   2. In the opened Resource JSON dialog box, copy the Resource ID.

      

   3. On the details page, click Network interface to go to the NIC details page.

      

   4. On the details page, view the IP address of the Private IPv4 address. This address is used to access the OceanBase Cloud database instance.

      

8. In the OceanBase Cloud console, enter the Endpoint ID and Endpoint IP Address.

   • Endpoint ID: The resource ID obtained in Step 7-2.
   • Endpoint IP Address: The IP address of the Private IPv4 address obtained in Step 7-4.

   

Step 3: Access Database

After completing the Private Link configuration, you can select the access information on the Step 3: Access Database page to generate a connection string for verification access.

Verify access to the database using the following command:

obclient -h<host> -P<port> -u<username>@<tenantId> -p

Parameter description:

• host: The IP address of the Private Endpoint.
• port: The database access port, default is 1521.
• username: The database account used for the connection.
• tenantId: The tenant ID, which can be viewed and copied on the tenant list page and tenant details page.

Example:

obclient -h10.0.0.5 -P1521 -utest@t70zh******** -p

You can click the Enable One-Part Connection String button on the page to enable the one-part connection string feature. After enabling, the connection string format changes to:

obclient -h <host> -P <port> -u <username> --ssl-ca=<path>/ca.pem -p