When you create an Alibaba Cloud data source or configure a migration task in OceanBase Cloud, you can use a peering connection to access the VPC where the data source resides. This topic describes how to create an Alibaba Cloud data service peering connection and how to use an existing connection to configure a data source.
Background
A VPC peering connection enables private communication between two VPCs. OceanBase Cloud supports the following types of peering connections:
- Instance peering connection: Connects the VPC of your application to the VPC of an OceanBase Cloud instance so that the application can access the database.
- Data service peering connection: Connects the OceanBase Cloud data service VPC to the VPC of a data source so that data migration, synchronization, and validation tasks can access the data source.
This topic describes how to configure and use an Alibaba Cloud data service peering connection.
Prerequisites
You have registered an OceanBase Cloud account and have the Organization Admin, Project Admin, or Data Services Admin role required to manage data service peering connections.
You use an Alibaba Cloud account that has the permissions required to accept peering connection requests, configure route tables, and adjust security groups or other network rules.
You have obtained the primary account ID, VPC ID, and IPv4 CIDR block of the VPC where the data source resides. To find this information:
- View the VPC ID and IPv4 CIDR block in the Virtual Private Cloud console.
- View the primary account ID in the account information in the upper-right corner of the Alibaba Cloud console. Use the ID of the Alibaba Cloud primary account that owns the VPC. For instructions, see View your Alibaba Cloud account ID.
Considerations
- The Local Region selected in OceanBase Cloud must be the same as the Alibaba Cloud region of the peer VPC.
- The CIDR blocks of the two VPCs cannot overlap. For more information, see VPC peering connection.
- In the same cloud vendor and region, you cannot create multiple data service peering connections for the same peer VPC. Use an existing connection if one is available.
- By default, you can create up to five data service peering connections for the same Alibaba Cloud primary account ID in the same region. If the limit is reached, delete connections that are no longer used before you create another one.
Create a peering connection for the first time
If no data service peering connection is available, create one in OceanBase Cloud, accept the request and configure the route in Alibaba Cloud, and then use the connection to configure a data source.
Step 1: Configure the peering connection
Log in to the OceanBase Cloud console. In the left-side navigation pane, click Networking.
On the Peering connection (Data services) page, click Create.
In the Create data service peering connection dialog box, under Step 1: Configure the peering connection, configure Cloud provider and Local region.
ParameterDescriptionCloud provider Select Alibaba Cloud. Local region Select the Alibaba Cloud region where the peer VPC resides. In the VPC of the peer data source instance section, click Virtual Private Cloud to go to the Alibaba Cloud VPC console. Obtain the VPC information and configure the following parameters.
ParameterDescriptionPeer primary account ID Enter the ID of the Alibaba Cloud primary account that owns the VPC where the data source resides. You can view it in the account information in the upper-right corner of the Alibaba Cloud console. For instructions, see View your Alibaba Cloud account ID. Peer VPC ID Enter the ID of the VPC where the data source resides. You can view it in the Virtual Private Cloud console. Peer CIDR View the IPv4 CIDR block of the VPC where the data source resides in the Virtual Private Cloud console. Note
- Enter the IPv4 CIDR blocks to access in the peer VPC. Make sure that they include the private IP address of the data source.
- To add multiple CIDR blocks, press Enter after each CIDR block.
Click Create. After you submit the creation request, record the peering connection ID, local VPC ID, and local CIDR block for accepting the connection and configuring the route.
Step 2: Accept the connection
Under Step 2: Accept the connection, view the connection status and local information. If the status is Waiting for connection, accept the request in Alibaba Cloud.
ParameterDescriptionPeering connection ID The ID used to locate the peering connection request in Alibaba Cloud. Local primary account ID The Alibaba Cloud primary account ID of the OceanBase Cloud data service VPC. Local VPC ID The ID of the OceanBase Cloud data service VPC. Local CIDR The CIDR block of the OceanBase Cloud data service VPC. Use it when you configure the route. Click Peering connections to go to the VPC peering connection page in Alibaba Cloud, and accept the request from the local VPC.
Complete the operation before the Alibaba Cloud acceptance period expires. Otherwise, the peering connection request becomes invalid. For more information, click Learn more in OceanBase Cloud.
Return to the OceanBase Cloud console. Under Step 2: Accept the connection, click Checking connection status. After OceanBase Cloud confirms that the request is accepted, configure the route.
Step 3: Add a routing policy
Under Step 3: Add a route policy, click Peering connections to go to the VPC peering connection page in Alibaba Cloud.
Locate the connection by using the Peering connection ID displayed in OceanBase Cloud.
In the Accepter column, click Configure Route. Select the route table associated with the vSwitch where the data source resides, and set Destination CIDR Block to the Local CIDR displayed in OceanBase Cloud.
Return to the OceanBase Cloud console. Under Step 3: Add a route policy, click Done. The connection status changes to Connected after the configuration takes effect.
Use an existing peering connection
If a data service peering connection is in the Connected state, you can select it when you create a data source.
Log in to the OceanBase Cloud console. In the left-side navigation pane, choose Data Services > Data Source.
Click Create Data Source, and select the data source type.
Set Cloud provider to Alibaba Cloud, select the region and an instance type that supports peering connections, and set Connection type to Peering connection.
Select the target connection from the Peering connection ID drop-down list. Verify that its peer VPC ID and peer CIDR block match the network of the data source.
The list displays only connections in the Connected state for the selected cloud vendor and region. If no connection is available, complete the steps in Create a peering connection for the first time.
Enter the private connection address, port, and authentication information required for the data source type. The connection address can be an IP address or domain name. If you use a domain name, make sure that it can be resolved to a reachable private IP address in the data service network. For a Kafka data source, enter the Kafka endpoint.
Click Test Connection. After the connection test succeeds, click Save.
For information about other data source parameters, see Create a data source. You can reference the data source in a migration task or select the peering connection when you directly configure a data source in the task. For task-specific instructions, see the relevant topic under Migrate data.
Note
A Connected peering connection does not indicate that the database connection test will succeed. If the test fails, check whether the route table is associated with the vSwitch where the data source resides and whether the security group, network ACL, DNS resolution, database listening port, and account permissions are correctly configured.
Follow-up operations
Continue the configuration
If the connection configuration is incomplete, on the Networking > Peering connection (Data services) page, find the connection in the Pending acceptance or Route configuration pending state, and click Continue to complete the remaining steps.
Delete a peering connection
On the Peering connection (Data services) page, check Associated resources for the target connection. If the connection has associated resources, release the resources after you confirm that they are no longer required.
If the connection is in the Connected state, go to the VPC peering connection page in Alibaba Cloud, locate the connection by its ID, and delete the user-side route whose destination is the OceanBase Cloud local CIDR and whose next hop is the peering connection. If the route is not deleted first, OceanBase Cloud cannot delete the peering connection.
Return to the OceanBase Cloud console. In the Actions column of the target connection, click the Delete icon and confirm the operation.
In Alibaba Cloud, remove other user-side configurations that are no longer required for the peering connection.
Warning
- Deleting a route or peering connection interrupts network access through the connection and cannot be undone. OceanBase Cloud removes only the configuration that it manages. You must remove the remaining user-side configuration.
- You cannot modify the peering connection of an existing data source. To use another peering connection, create a data source and select it when you configure subsequent tasks.