This topic describes how to create an AWS VPC peering connection and a tenant peering connection address in OceanBase Cloud, and use the address to connect to a database. The example uses an Oracle-mode tenant in an AWS international region.
Prerequisites
- You have registered an OceanBase Cloud account and created a cluster instance and a tenant. For more information, see Create an instance and Create a tenant. Peering connection addresses must be available in the instance region, with the corresponding creation option displayed in the console.
- You have an AWS account with permissions to view the target VPC, accept peering connection requests, and configure route tables.
- You have selected or created the VPC that hosts your application in AWS. The application VPC must be in the same region as the OceanBase Cloud instance.
- You have obtained the AWS account ID, VPC ID, and IPv4 CIDR of the application VPC, and identified the application subnets and their associated route tables.
- The IPv4 CIDR blocks of the application VPC and the local OceanBase VPC provided in the OceanBase Cloud console do not overlap. If either VPC has multiple IPv4 CIDR blocks, check all of them. For more information, see VPC peering limitations.
- You have added the client IP addresses or required CIDR blocks to the tenant allowlist. Application-side security groups, network ACLs, and other network policies must allow access to the target database address and port. For more information, see Configure an IP address allowlist.
Note
A peering connection connects the application VPC to the OceanBase Cloud service network. A peering connection address provides access to a specific tenant. When using VPC peering for the first time, configure the peering connection before creating a tenant address.
Set up a peering connection for the first time
If no peering connection is available in the current project, create one first. Then follow the steps in Use an existing peering connection to create a tenant access address.
Step 1: Create a peering connection in OceanBase Cloud
Log in to the OceanBase Cloud console, switch to the project that contains the target instance, and click Networking in the left-side navigation pane.
On the Networking page, click Create peering connection.
In the dialog box, complete Step 1: Configure peering connection as described below, and click Create.
Configuration itemDescription1. Select cloud provider Select AWS. OceanBase VPC Select the region of the target OceanBase Cloud instance and use the local VPC information provided on the page. Record its IPv4 CIDR block for application-side routing. Peer application VPC Configure the following parameters in the Peer application VPC section: - AWS account ID: Enter the 12-digit ID of the AWS account that owns the application VPC. You can find it in the account menu in the upper-right corner of the AWS Management Console.
- Peer VPC ID: Enter the application VPC ID, available on the Your VPCs page in the Amazon VPC console.
- Peer CIDR: Enter the IPv4 CIDR block of the application VPC, such as
10.20.0.0/16. It must not overlap with the local OceanBase VPC CIDR block.
Wait for the peering connection request to be created. Record the local OceanBase VPC ID and the peer application VPC ID.
Note
In this topic, "local" refers to the OceanBase VPC provided by OceanBase Cloud, and "peer" refers to your application VPC. Use this distinction when entering peer VPC information and configuring routes.
Step 2: Accept the peering connection request in AWS
Log in to the Amazon VPC console with the AWS account that owns the application VPC, and select the region of that VPC.
In the left-side navigation pane, choose Peering connections.
Find the request in the Pending acceptance state. Verify that the requester VPC is the local OceanBase VPC and the accepter VPC is your application VPC. Record the AWS peering connection ID, which starts with
pcx-.Select the connection, choose Actions > Accept request, and confirm acceptance.
Refresh the connection list and verify that the connection is Active.
For detailed instructions, see Accept or reject a VPC peering connection.
Step 3: Configure application-side routes and complete setup
In the OceanBase Cloud peering connection wizard, copy the IPv4 CIDR block of the local OceanBase VPC.
Return to the Amazon VPC console, choose Route tables, and find the route table used by the application subnet.
Choose Routes > Edit routes > Add route, enter the following information, and save the route.
ParameterDescriptionDestination Enter the local OceanBase VPC CIDR block copied from the OceanBase Cloud console. Target Select Peering connection, and select the AWS peering connection ID ( pcx-…) recorded in Step 2.Verify that the route is active and is not in the Blackhole state. If the application spans multiple subnets, check the route table used by each subnet and add the required routes.
Return to the OceanBase Cloud console. In Step 3: Accept connection and add route, click Done.
Use an existing peering connection
If a peering connection is already available, you can reuse it to create a tenant access address. The connection must belong to the same project as the target instance and use the same cloud provider and region. Its peer VPC must be the application VPC.
Log in to the OceanBase Cloud console. On the Instances page, expand the target instance and choose Connect > Get connection string for the target tenant.
In the dialog box, select VPC peering.
Under Step 1: Configure peering connection address, select the peering connection ID to use for database access and click Create peering connection address.
Wait for address creation to complete and verify that an available peering connection address and port are displayed.
Under Step 2: Access database, select an existing database and account, or create them as needed.
Note
If you create an account, securely store the generated password.
Select a connection method, such as OBClient, and copy the connection command generated by the console. Run it from a client in the application VPC. Once connected, you can use the database.
Follow-up operations
View addresses and use other address types
After creating the address, you can view it in the Deployment diagram on the tenant workspace page.
VPC peering supports primary, read-only, and read/write splitting addresses. Obtain the connection string for each address type according to your application requirements.
Peering connection addresses can coexist with existing PrivateLink addresses. Select the appropriate address for the network where your application runs.
Change the application VPC or delete an address
If you need to reconfigure an address, for example, after changing the application VPC, perform the following steps:
On the Instances page in the OceanBase Cloud console, click the target tenant name to open the tenant workspace.
In the Deployment diagram on the tenant workspace page, click the delete button to delete the peering connection address.
After the address is deleted, follow the procedure in this topic to select or create a peering connection to the new application VPC. Recreate the tenant address and verify connectivity.
Warning
Deleting an address affects applications that use it. Arrange for applications to switch to another address before deletion.
A peering connection may be used by multiple tenants or addresses. Before deleting the connection itself, delete all associated primary, read-only, and read/write splitting addresses. You cannot delete a peering connection while addresses are still associated with it.
Troubleshoot connection issues
Symptom |
What to check |
|---|---|
| No request awaiting acceptance appears in AWS | Verify the AWS account, selected region, and requester and accepter VPCs for this configuration. |
| The peering connection cannot be created | Verify the AWS account, VPC ID, and CIDR block. Check all IPv4 CIDR blocks on both sides for overlap, and check the AWS VPC peering quotas. |
| The peering connection is Active, but database connections time out | Check the route table used by the application subnet, the destination CIDR block, and the pcx-… ID. Check application-side security groups, network ACLs, the tenant allowlist, and the database port. If these settings are correct but connections still time out, contact OceanBase Cloud technical support to investigate the service-side connection. |
| The database address cannot be resolved | Verify that you are using the tenant peering connection address. Check the application VPC DNS configuration and the client DNS resolution results. |
| The database is reachable, but account authentication fails | Verify the full username generated by the console, the password, the selected database, and account permissions. |