Service endpoints integration

All Cloud Databases deployments offer integration with IBM Cloud service endpoints to enable connections to your deployments from the public internet and over the IBM Cloud private network.

Service endpoints are available in all IBM Cloud multizone regions and some single-campus multizone regions. Deployments in all other regions are able to use service endpoints.

Private endpoints

A deployment with a service endpoint on the private network gets an endpoint that is not accessible from the public internet. At provision, this is the default option for all deployments. All traffic is routed to hardware dedicated to Cloud Databases deployments and remains on the IBM Cloud private network. All traffic to and from this endpoint is free and unmetered on the condition that the traffic remains in IBM Cloud. After your environment has access to the IBM Cloud private network, an internet connection is not required to connect to your deployment.

For more information, see Secure access to services using service endpoints.

Deployments with private endpoints are reachable from any account within the private network and access to each instance requires authentication. To restrict this access to specific IP addresses, or ranges of IP addresses, configure Context-based restrictions.

Public endpoints

Public endpoints provide a connection to your deployment on the public network. Your environment needs to have internet access to connect to a deployment.

For enhanced security, it is recommended that users connect to their Cloud Databases deployments using private endpoints instead of public endpoints.

Enabling service endpoints

To use connections over the public internet, you do not have to enable service endpoints on your IBM Cloud account. To enable private networking on your deployments, follow the instructions at Enabling VRF and service endpoints.

Currently, enabling virtual routing and forwarding (VRF) on your account in classic is a manual step that is handled by support ticket. VRF is automatically enabled for VPC. After you complete the request, check on the status of the ticket by going to your Support page on IBM Cloud.

Provisioning with service endpoints through the UI

To configure your deployment's endpoints on provision, use the Endpoints field on the Provisioning page. Select from the following available options:

Private network
Public network
Both public and private network

A MongoDB deployment cannot support both public and private endpoints simultaneously. This cannot be changed after provisioning.

Provisioning with service endpoints through the CLI

Service endpoints are specified using a required flag when you provision through the CLI. Provisioning is handled by the Resource Controller. You can change the endpoints by passing the --service-endpoints flag with one of the following values: public, private, or public-and-private. It is recommended to use private endpoints.

ibmcloud resource service-instance-create <INSTANCE_NAME> <SERVICE_NAME> <SERVICE_PLAN_NAME> <LOCATION> <SERVICE_ENDPOINTS_TYPE> <RESOURCE_GROUP> -p '{"members_host_flavor": "<host_flavor value>"}' --service-endpoints=<ENDPOINT>

Cloud Databases deployments except Databases for MongoDB allow for both public and private networking to be enabled at the same time.

Provisioning with service endpoints through the API

Service endpoints are enabled through a required parameter when you provision through the API. Provisioning is handled by the Resource Controller. Pass the service-endpoints parameter with one of the following options: public, private, or public-and-private. It is recommended to use private endpoints.

curl -X POST   https://resource-controller.cloud.ibm.com/v2/resource_instances   -H "Authorization: Bearer <TOKEN>"   -H 'Content-Type: application/json'     -d '{
    "name": "<INSTANCE_NAME",
    "location": "<LOCATION>",
    "resource_group": "RESOURCE_GROUP_ID",
    "resource_plan_id": "<SERVICE_PLAN_NAME>"
    "parameters": {
        "service-endpoints": "private"
   }
  }'

Cloud Databases deployments except Databases for MongoDB allow for both public and private networking to be enabled at the same time.

Changing service endpoints

After you deploy, it is possible to change your public and private service endpoints configuration, except for Databases for MongoDB.

Changing service endpoints through the UI

In the Settings tab of your deployment's dashboard, go to the Service endpoints section. Toggle which types of connections are available to your deployment.

Changing the type of endpoints available on your deployment does not cause any downtime from a database perspective. However, if you disable an endpoint that is being used by you or your applications, those connections are dropped.

Changing service endpoints through the CLI

Use the ibmcloud resource service-instance-update command in the CLI, specifying the endpoint with the --service-endpoints flag.

ibmcloud resource service-instance-update <INSTANCE_NAME_OR_CRN> --service-endpoints <ENDPOINT-TYPE>

Changing service endpoints through the API

Use the Resource Controller API, with a PATCH request to the /resource_instances/{id} endpoint.

Credentials for private endpoints

Use either public or private connection strings with any set of credentials that you make on your deployment. By default, the connection strings for a set of credentials are filled with strings for connecting over a public endpoint. If you are using private endpoints, specify connection strings that contain the private endpoint to be generated instead.

When you create credentials in the Service credentials UI, use either the { "service-endpoints": "public" } or the { "service-endpoints": "private" } parameter to specify which endpoint gets filled into the connection strings. For the steps to follow to create credentials, see the topic Managing users and roles in the documentation for your chosen service.

In the API, use the /deployments/{id}/users/{userid}/connections/{endpoint_type} to retrieve connection strings for both public or private endpoints.

If you have only private endpoints on your deployments, then all new credentials have private endpoints in the connection strings.

Connecting through private endpoints

Cloud Databases offers both private and public cloud service endpoints. To run your application or access the endpoint from a browser that is not on the private network, take the following additional steps:

Ensure your Cloud IaaS or SL account is enabled for private endpoints.
Create a virtual machine (VSI) that runs Linux.
Configure a user account with SSH access.
From your workstation, run ssh -D 2345 user@vsi-host to start an SSH session and open a SOCKS proxy on port 2345 that forwards all traffic through the VSI.
Configure your browser or application to use a SOCKS5 proxy on localhost:2345.
Run your application or open the preferred private endpoint in your browser (for example, a management UI).

Using virtual private endpoints

For more information, see Virtual private endpoints.