--- name: codeengine-virtualprivateendpt title: Using Virtual Private Endpoints with Code Engine description: All IBM Cloud® Code Engine projects offer integration with IBM Cloud® Virtual Private Endpoints (VPE) for Virtual Private Cloud (VPC). This support gives you the ability to connect from your VPC network to Code Engine applications or functions by using the IP addresses of your choosing, which are allocated from a subnet within your VPC. last-updated: 2024-01-11 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/codeengine?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Using Virtual Private Endpoints with Code Engine {: #vpe} All IBM Cloud® Code Engine projects offer integration with IBM Cloud® Virtual Private Endpoints (VPE) for Virtual Private Cloud (VPC). This support gives you the ability to connect from your VPC network to Code Engine applications or functions by using the IP addresses of your choosing, which are allocated from a subnet within your VPC. {: shortdesc} With Code Engine, you can use the following types of VPEs: - [Virtual Private Endpoints to manage project resources](https://cloud.ibm.com/docs/codeengine?topic=codeengine-regions&format=markdown#endpoints-project). There is one static VPE per region. - [Virtual Private Endpoints to access applications](https://cloud.ibm.com/docs/codeengine?topic=codeengine-regions&format=markdown#endpoints-app). There is one VPE per Code Engine project. All apps within the project can be accessed by using this VPE. Private endpoints provide a connection to your project resources, applications, or functions on the IBM Cloud Private network. When you connect through a virtual private endpoint, all traffic is routed to hardware that is dedicated to Code Engine applications and remains on the IBM Cloud Private network. There are no additional charges for all traffic to and from this endpoint on the condition that the traffic remains in IBM Cloud. A Code Engine project is automatically configured with both a public and a virtual private endpoint. You can control the [visibility](https://cloud.ibm.com/docs/codeengine?topic=codeengine-application-workloads&format=markdown#optionsvisibility) of Code Engine applications and specify whether to expose the application or functions to public or private endpoints. An application or function that is configured for the private network can be accessed through the VPE or by other Code Engine applications or functions. Applications or functions that are accessed through the VPE do not leave the IBM network and stay within the IBM Cloud network. ## Using your VPE to manage project resources securely {: #using-vpes-project} Before you begin, you must have an [IBM Cloud account](https://cloud.ibm.com/registration). 1. Create an IBM Cloud® Virtual Private Cloud. Follow the [Getting started](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started&format=markdown) instructions. 2. Make sure that your VPC has at least one VSI (virtual server instance) and can connect to the VSI. You can use the VPC console, CLI, and API to provision a VSI from the IBM Cloud® Virtual Private Cloud page in the IBM Cloud console. 1. Create an [SSH key](https://cloud.ibm.com/docs/vpc?topic=vpc-ssh-keys&format=markdown) to access the VSI. 2. [Create a virtual server instance by using the console](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-virtual-servers&format=markdown). 3. [Reserve a floating IP address](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-ibm-cloud-console&format=markdown#reserving-a-floating-ip-address) so your instance is reachable from the internet. 4. [Connect to your VSI](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-ibm-cloud-console&format=markdown#connecting-to-your-instance). 3. In the IBM Cloud console, click the Menu icon and select **VPC Infrastructure -> Network -> Virtual private endpoint gateways**. Create a VPE for the regional Code Engine endpoint `api..codeengine.cloud.ibm.com` by completing this [instruction](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe&format=markdown). 4. After you create your VPE, it might take a few minutes for the new VPE and private DNS (pDNS) to complete the process and begin working for your VPC. Completion is confirmed when you see an IP address set in the [details view](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-viewing-details-of-an-endpoint-gateway&format=markdown) of the VPE. 5. SSH into your VSI and use `root@`. For example, `ssh root@`. 6. To access Code Engine resources from within the VSI, [set up your Code Engine CLI environment](https://cloud.ibm.com/docs/codeengine?topic=codeengine-install-cli&format=markdown). Make sure your IBM Cloud CLI is connected to `private.cloud.ibm.com`. 7. Specify a Code Engine project to use the private endpoint. To create a project, use the [**`ibmcloud ce project create`**](https://cloud.ibm.com/docs/codeengine?topic=codeengine-cli&format=markdown#cli-project-create) command with the `--endpoint=private` option. ```txt ibmcloud ce project create --name myproject --endpoint=private ``` {: pre} Wait until the project is in `active` status. With the CLI, you can confirm the project status by using the [**`ibmcloud ce project get`**](https://cloud.ibm.com/docs/codeengine?topic=codeengine-cli&format=markdown#cli-project-get) command. If you want an existing Code Engine project to use the private endpoint, use the [**`ibmcloud ce project select`**](https://cloud.ibm.com/docs/codeengine?topic=codeengine-cli&format=markdown#cli-project-select) command with the `--endpoint=private` option. ```txt ibmcloud ce project select --name myproject --endpoint=private ``` {: pre} For the **`project create`** and **`project select`** commands, if the `--endpoint` option is not explicitly specified, the behavior is determined by the system. If the IBM Cloud CLI is connected to `private.cloud.ibm.com`, the Code Engine project behaves as if `--endpoint` is `private`. If the IBM Cloud CLI is connected to `cloud.ibm.com`, the Code Engine project behaves as if `--endpoint` is `public`. {: important} 8. If you did not create a new project and you selected an existing project, and you want your app or function to be visible only to the private endpoint, confirm the existing project supports applications with private visibility. Use the [**`ibmcloud ce project get`**](https://cloud.ibm.com/docs/codeengine?topic=codeengine-cli&format=markdown#cli-project-get) command to verify the output for `Application Private Visibility Supported` is set to `true`. If the value is `false`, [contact IBM support](https://cloud.ibm.com/docs/codeengine?topic=codeengine-get-support&format=markdown) to enable this capability within your existing project. ```txt ibmcloud ce project get -n myproject ``` {: pre} Example output ```txt Getting project 'myproject'... OK Name: myproject ID: abcdabcd-abcd-abcd-abcd-f1de4aab5d5d Status: active Enabled: true Application Private Visibility Supported: false Selected: true Region: us-south Resource Group: default Service Binding Service ID: ServiceId-1234abcd-abcd-abcd-1111-1a2b3c4d5e6f Age: 52d Created: Tue, 28 Sep 2021 05:12:16 -0500 Updated: Tue, 28 Sep 2021 05:12:19 -0500 Quotas: Category Used Limit App revisions 1 60 Apps 1 20 Build runs 1 100 Builds 2 100 Configmaps 2 100 CPU 0 64 Ephemeral storage 0 256G Instances (active) 0 250 Instances (total) 0 2500 Job runs 0 100 Jobs 0 100 Memory 0 256G Secrets 6 100 Subscriptions (cron) 0 100 Subscriptions (IBM Cloud Object Storage) 0 100 Subscriptions (Kafka) 0 100 ``` {: screen} 9. Create an application that is only visible to the private endpoint. Use the [**`ibmcloud ce application create`**](https://cloud.ibm.com/docs/codeengine?topic=codeengine-cli&format=markdown#cli-application-create) command with the `--visibility=private` option. Alternatively, you can use the console to create an app or update an existing app and set the [visibility of your app](https://cloud.ibm.com/docs/codeengine?topic=codeengine-application-workloads&format=markdown#optionsvisibility). ```txt ibmcloud ce application create -n myapp --visibility=private ``` {: pre} You have now configured and set up your virtual private endpoint to manage project resources. If you want to control which app to expose to the private endpoint, you can [set up a VPE to access your application](https://cloud.ibm.com/docs/codeengine?topic=codeengine-vpe&format=markdown#using-vpes-app). ## Using your VPE to access an app securely {: #using-vpes-app} Before you begin, you must have an [IBM Cloud account](https://cloud.ibm.com/registration). You can only use your VPE to access your app with a private endpoint if your selected project supports [application private visibility](https://cloud.ibm.com/docs/codeengine?topic=codeengine-application-workloads&format=markdown#app-endpoint-private). To confirm if the project supports application private visibility, use the [**`ibmcloud ce project get`**](https://cloud.ibm.com/docs/codeengine?topic=codeengine-cli&format=markdown#cli-project-get) command to verify the output for `Application Private Visibility Supported` is set to `true`. {: important} 1. Create an IBM Cloud® Virtual Private Cloud. Follow the [Getting started](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started&format=markdown) instructions. 2. Make sure that your VPC has at least one VSI (virtual server instance) and can connect to the VSI. You can use the console, CLI, and API to quickly provision Virtual server instances from the IBM Cloud® Virtual Private Cloud page in the IBM Cloud console. 1. Create an [SSH key](https://cloud.ibm.com/docs/vpc?topic=vpc-ssh-keys&format=markdown) to access the VSI. 2. [Create a virtual server instance by using the UI](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-virtual-servers&format=markdown). 3. [Reserve a floating IP address](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-ibm-cloud-console&format=markdown#reserving-a-floating-ip-address) so your instance is reachable from the internet. 4. [Connect to your VSI](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-ibm-cloud-console&format=markdown#connecting-to-your-instance). 3. From your Code Engine project, confirm that your application is configured with a `visibility=private` setting. See [Deploying your app with a private endpoint](https://cloud.ibm.com/docs/codeengine?topic=codeengine-application-workloads&format=markdown#app-endpoint-public). 4. In the IBM Cloud console, click the Menu icon and select **VPC Infrastructure -> Network -> Virtual private endpoint gateways**. Create a VPE for the regional Code Engine endpoint for the specific project that you are using for private application visibility by completing this [instruction](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe&format=markdown). This project is listed in the table with its endpoint in the format, `*..private..codeengine.appdomain.cloud`. 5. After you create your VPE, it might take a few minutes for the new VPE and private DNS (pDNS) to complete the process and begin working for your VPC. Completion is confirmed when you see an IP address set in the [details view](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-viewing-details-of-an-endpoint-gateway&format=markdown) of the VPE. 6. Retrieve the URL of the Code Engine application that is exposed to the private network. The URL is in the following format: `..private..codeengine.appdomain.cloud`. From the Code Engine console, go to the **Domain mappings** tab for your application to view the visibility of an app and its available URLs. From the [Code Engine CLI](https://cloud.ibm.com/docs/codeengine?topic=codeengine-install-cli&format=markdown), you can use the [**`ibmcloud ce application get`**](https://cloud.ibm.com/docs/codeengine?topic=codeengine-cli&format=markdown#cli-application-get) command with the `--option url` option. Because the visibility of the `myapp` is set to `visibility=private`, specifying `--option url` with this command outputs the URL to the private network. ```txt ibmcloud ce application get -n myapp -output url ``` {: pre} Example output ```txt http://myapp.4svg40kna19.private.us-south.codeengine.appdomain.cloud ``` {: screen} 7. You can now use your instance in the VSI. Call the application. The `myapp` application is a simple Hello World application. When you curl the `myapp` app, `Hello World` is returned. ```txt curl http://myapp.4svg40kna19.private.us-south.codeengine.appdomain.cloud ``` {: pre} ## Using your VPE to access a function securely {: #using-vpes-fun} Before you begin, you must have an [IBM Cloud account](https://cloud.ibm.com/registration). You can only use your VPE to access your function with a private endpoint if your selected project supports [function private visibility](https://cloud.ibm.com/docs/codeengine?topic=codeengine-fun-work&format=markdown#fun-endpoint-private). To confirm if the project supports function private visibility, use the [**`ibmcloud ce project get`**](https://cloud.ibm.com/docs/codeengine?topic=codeengine-cli&format=markdown#cli-project-get) command to verify the output for `Application Private Visibility Supported` is set to `true`. {: important} 1. Create an IBM Cloud® Virtual Private Cloud. Follow the [Getting started](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started&format=markdown) instructions. 2. Make sure that your VPC has at least one VSI (virtual server instance) and can connect to the VSI. You can use the console, CLI, and API to quickly provision Virtual server instances from the IBM Cloud® Virtual Private Cloud page in the IBM Cloud console. 1. Create an [SSH key](https://cloud.ibm.com/docs/vpc?topic=vpc-ssh-keys&format=markdown) to access the VSI. 2. [Create a virtual server instance by using the UI](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-virtual-servers&format=markdown). 3. [Reserve a floating IP address](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-ibm-cloud-console&format=markdown#reserving-a-floating-ip-address) so your instance is reachable from the internet. 4. [Connect to your VSI](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-ibm-cloud-console&format=markdown#connecting-to-your-instance). 3. From your Code Engine project, confirm that your application is configured with a `visibility=private` setting. See [Deploying your app with a private endpoint](https://cloud.ibm.com/docs/codeengine?topic=codeengine-application-workloads&format=markdown#app-endpoint-public). 4. In the IBM Cloud console, click the Menu icon and select **VPC Infrastructure -> Network -> Virtual private endpoint gateways**. Create a VPE for the regional Code Engine endpoint for the specific project that you are using for private application visibility by completing this [instruction](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe&format=markdown). This project is listed in the table with its endpoint in the format, `*..private..codeengine.appdomain.cloud`. 5. After you create your VPE, it might take a few minutes for the new VPE and private DNS (pDNS) to complete the process and begin working for your VPC. Completion is confirmed when you see an IP address set in the [details view](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-viewing-details-of-an-endpoint-gateway&format=markdown) of the VPE. 6. Retrieve the URL of the Code Engine function that is exposed to the private network. The URL is in the following format: `..private..codeengine.appdomain.cloud`. From the Code Engine console, go to the **Domain mappings** tab for your function to view the visibility of your function and its available URLs. From the [Code Engine CLI](https://cloud.ibm.com/docs/codeengine?topic=codeengine-install-cli&format=markdown), you can use the [**`ibmcloud ce function get`**](https://cloud.ibm.com/docs/codeengine?topic=codeengine-cli&format=markdown#cli-function-get) command. Because the visibility of the `myfunction` is set to `visibility=private`, this command displays the URL to the private network. ```txt ibmcloud ce function get -n myfunction ``` {: pre} Example output ```txt http://myfunction.1abc23def19.private.us-south.codeengine.appdomain.cloud ``` {: screen} You can now use your instance in the VSI.