forked from docs/doc-exports
zhengxiu
2125539080
Reviewed-by: Pruthi, Vineet <vineet.pruthi@t-systems.com> Co-authored-by: zhengxiu <zhengxiu@huawei.com> Co-committed-by: zhengxiu <zhengxiu@huawei.com>
59 lines
12 KiB
HTML
59 lines
12 KiB
HTML
<a name="css_01_0476"></a><a name="css_01_0476"></a>
|
|
|
|
<h1 class="topictitle1">Configuring Public Network Access for an OpenSearch Cluster</h1>
|
|
<div id="body0000001992205825"><p id="css_01_0476__css_01_0076_p12915914145514">Public network access is supported only when <strong id="css_01_0476__css_01_0076_b1588043919442">Security Mode</strong> and <strong id="css_01_0476__css_01_0076_b1588003910445">HTTPS Access</strong> are enabled for a cluster. When <strong id="css_01_0476__css_01_0076_b45047151456">Public IP Address</strong> is enabled, a public IP address is automatically assigned, which will enable access to the security cluster from the public network. Additionally, you can configure access control from the public network by IP addresses or IP address ranges.</p>
|
|
<p id="css_01_0476__css_01_0076_en-us_topic_0000001223434404_p8060118">To enable public network access for Elasticsearch or OpenSearch clusters, a shared load balancer is typically used for load balancing. If your workloads require quicker access, you are advised to use a dedicated load balancer to connect to your clusters. For details about its configuration, see <a href="css_01_0413.html">Configuring a Dedicated Load Balancer for an Elasticsearch Cluster</a>.</p>
|
|
<div class="section" id="css_01_0476__css_01_0076_section0594164011518"><h4 class="sectiontitle">Constraints</h4><ul id="css_01_0476__css_01_0076_ul16345551125110"><li id="css_01_0476__css_01_0076_li2034510517515">Enabling public network access for a CSS cluster may incur some fees, as it will need to use EIP and bandwidth resources.</li><li id="css_01_0476__css_01_0076_li11702172312528">The security mode can be enabled only for Elasticsearch 6.5.4 clusters or later and OpenSearch clusters.</li><li id="css_01_0476__css_01_0076_li11530152413476">Public network access and the VPC Endpoint service share a load balancer. If you configure a whitelist for public network access, and because this whitelist is deployed to the shared load balancer, it will control not only access from the public network, but also access using private IP addresses through VPCEP. In this case, you need to add IP address <strong id="css_01_0476__css_01_0076_b2474121113146">198.19.128.0/17</strong> to the public network access whitelist to allow traffic through VPCEP.</li></ul>
|
|
</div>
|
|
<div class="section" id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_section1638913302523"><h4 class="sectiontitle">Configuring Public Network Access</h4><ol id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_ol1346120407506"><li id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_li154611240175011">Log in to the <span id="css_01_0476__css_01_0076_text21595321510">CSS</span> management console.</li><li id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_li10902641195015">On the <strong id="css_01_0476__css_01_0076_b2267115594811">Create Cluster</strong> page, enable <strong id="css_01_0476__css_01_0076_b18111194135518">Security Mode</strong>. Set the administrator password and enable HTTPS access.</li><li id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_li0180112411579">Select <strong id="css_01_0476__css_01_0076_b52176551438">Automatically assign</strong> for <strong id="css_01_0476__css_01_0076_b3673111514416">Public IP Address</strong> and set related parameters.
|
|
<div class="tablenoborder"><table cellpadding="4" cellspacing="0" summary="" id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_table138801874019" frame="border" border="1" rules="all"><caption><b>Table 1 </b>Public network access parameters</caption><thead align="left"><tr id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_row1888010718010"><th align="left" class="cellrowborder" valign="top" width="23.830000000000002%" id="mcps1.3.4.2.3.3.2.3.1.1"><p id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_p28805717017">Parameter</p>
|
|
</th>
|
|
<th align="left" class="cellrowborder" valign="top" width="76.17%" id="mcps1.3.4.2.3.3.2.3.1.2"><p id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_p78801371205">Description</p>
|
|
</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody><tr id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_row17880271203"><td class="cellrowborder" valign="top" width="23.830000000000002%" headers="mcps1.3.4.2.3.3.2.3.1.1 "><p id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_p38801710019">Bandwidth</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="76.17%" headers="mcps1.3.4.2.3.3.2.3.1.2 "><p id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_p98801171002">Bandwidth for accessing Kibana with the public IP address</p>
|
|
</td>
|
|
</tr>
|
|
<tr id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_row18880197202"><td class="cellrowborder" valign="top" width="23.830000000000002%" headers="mcps1.3.4.2.3.3.2.3.1.1 "><p id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_p108801179017">Access Control</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="76.17%" headers="mcps1.3.4.2.3.3.2.3.1.2 "><p id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_p168801175012">If you disable this function, all IP addresses can access the cluster through the public IP address. If you enable access control, only IP addresses in the whitelist can access the cluster through the public IP address.</p>
|
|
</td>
|
|
</tr>
|
|
<tr id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_row2088013718014"><td class="cellrowborder" valign="top" width="23.830000000000002%" headers="mcps1.3.4.2.3.3.2.3.1.1 "><p id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_p20880127602">Whitelist</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="76.17%" headers="mcps1.3.4.2.3.3.2.3.1.2 "><p id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_p9880275012">IP address or IP address range allowed to access a cluster. Use commas (,) to separate multiple addresses. This parameter can be configured only when <strong id="css_01_0476__css_01_0076_b36731595374">Access Control</strong> is enabled.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
</li></ol>
|
|
</div>
|
|
<div class="section" id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_section18851031541"><h4 class="sectiontitle">Configuring Public Network Access for an Existing Cluster</h4><p id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_p2871748088">You can configure, modify, view the public network access of, or disassociate the public IP address from a cluster.</p>
|
|
<ol id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_ol179019266146"><li id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_li7625635121410">Log in to the <span id="css_01_0476__css_01_0076_text186221420182">CSS</span> management console.</li><li id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_li106254357143">On the <span class="wintitle" id="css_01_0476__css_01_0076_wintitle803835227104550"><b>Clusters</b></span> page, click the name of the target cluster. On the <strong id="css_01_0476__css_01_0076_b472203816382">Basic Information</strong> page that is displayed, manage the public network access configurations.<ul id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_ul2615124316115"><li id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_li86151943141116">Configuring public network access<p id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_p16141643121114"><a name="css_01_0476__css_01_0076_en-us_topic_0000001223434408_li86151943141116"></a><a name="css_01_0076_en-us_topic_0000001223434408_li86151943141116"></a>If you enabled HTTPS but did not configure the public network access during security cluster creation, you can configure it on the <strong id="css_01_0476__css_01_0076_b1992163710402">Basic Information</strong> page after configuring the cluster.</p>
|
|
<p id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_p10615104331113">Click <strong id="css_01_0476__css_01_0076_b10111186185514">Associate</strong> next to <strong id="css_01_0476__css_01_0076_b46841030115517">Public IP Address</strong>, set the access bandwidth, and click <strong id="css_01_0476__css_01_0076_b5241046185514">OK</strong>.</p>
|
|
<p id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_p2615144321117">If the association fails, wait for a few minutes and try again.</p>
|
|
</li><li id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_li196151143111114">Modifying public network access<p id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_p17615154381118"><a name="css_01_0476__css_01_0076_en-us_topic_0000001223434408_li196151143111114"></a><a name="css_01_0076_en-us_topic_0000001223434408_li196151143111114"></a>For a cluster for which you have configured public network access, you can click <strong id="css_01_0476__css_01_0076_b07989296279">Edit</strong> next to <strong id="css_01_0476__css_01_0076_b132681411315">Bandwidth</strong> to modify the bandwidth, or you can click <strong id="css_01_0476__css_01_0076_b6143152183112">Set</strong> next to <strong id="css_01_0476__css_01_0076_b269183912312">Access Control</strong> to set the access control function and the whitelist for access.</p>
|
|
</li><li id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_li1361516431116">Checking public network access settings<p id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_p3615184381118"><a name="css_01_0476__css_01_0076_en-us_topic_0000001223434408_li1361516431116"></a><a name="css_01_0076_en-us_topic_0000001223434408_li1361516431116"></a>On the <strong id="css_01_0476__css_01_0076_b1771565534414">Basic Information</strong> page, you can see the public IP address associated with the current cluster.</p>
|
|
</li><li id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_li106151143201118">Disassociating a public IP address from a cluster<p id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_p146155436110"><a name="css_01_0476__css_01_0076_en-us_topic_0000001223434408_li106151143201118"></a><a name="css_01_0076_en-us_topic_0000001223434408_li106151143201118"></a>To disassociate a public IP address, click <strong id="css_01_0476__css_01_0076_b615153014719">Disassociate</strong> next to <strong id="css_01_0476__css_01_0076_b189482040154714">Public IP Address</strong>.</p>
|
|
<div class="note" id="css_01_0476__css_01_0076_note2033753713445"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p id="css_01_0476__css_01_0076_p4337153794412">After the public IP address is disassociated, the cluster can no longer be accessed through this IP address. If you disable public network access for a cluster and then re-enable it, the public IP address for accessing the cluster may change. Exercise caution.</p>
|
|
</div></div>
|
|
</li></ul>
|
|
</li></ol>
|
|
</div>
|
|
<div class="section" id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_section2022235142517"><h4 class="sectiontitle">Accessing a Cluster Through the Public IP Address</h4><p id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_p5950195234910">After configuring the public IP address, you can use it to access the cluster.</p>
|
|
<div class="p" id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_p1243345415167">For example, if the public IP address is <span class="parmname" id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_parmname15981543155911"><b>10.62.179.32</b></span> and the port number is <span class="parmname" id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_parmname189821543115912"><b>9200</b></span>, run the following cURL command to view indexes in the cluster.<pre class="screen" id="css_01_0476__css_01_0076_en-us_topic_0000001223434408_screen85820524178">curl -u username:password -k 'https://10.62.179.32:9200/_cat/indices'</pre>
|
|
</div>
|
|
<p id="css_01_0476__css_01_0076_p7424193312575">where, <strong id="css_01_0476__css_01_0076_b223485632013">username</strong> and <strong id="css_01_0476__css_01_0076_b916781213">password</strong> indicate the username and password of the HTTPS-enabled security-mode cluster.</p>
|
|
</div>
|
|
</div>
|
|
<div>
|
|
<div class="familylinks">
|
|
<div class="parentlink"><strong>Parent topic:</strong> <a href="css_01_0475.html">Configuring Networking for an OpenSearch Cluster</a></div>
|
|
</div>
|
|
</div>
|
|
|