How to change network configuration for a service instance-Compute Nest(Compute Nest)-阿里云帮助中心

Usage

Compute Nest supports two private access modes: PrivateLink and VPC peering connection. You can choose a connection mode based on your needs.

VPC peering connection
- This mode is available only in scenarios where the service creates a new VPC. You must define the parameters for this new VPC in the ROS template. When creating a service instance, users specify their existing VPC to establish a peering connection with the newly created service VPC.
- You can add, delete, or modify VPC peering connections after the service instance is deployed.
PrivateLink
- This mode enables private network connectivity within the same zone. Traffic does not traverse the public internet, providing higher security and better network quality. For more information, see What is PrivateLink?.
- You can add, delete, or modify PrivateLink connections after the service instance is deployed.

Billing

Compute Nest is a free platform service. However, you are charged for the cloud resources used during service deployment, such as data transfer for VPC peering connections, SLB instances, and ECS instances. For detailed pricing information, see Billing.

Modify a VPC peering connection

This section describes how service providers can enable and configure VPC peering connection changes, and then apply them to a service instance.

Create a fully managed service

This section shows only the settings for changing private network access configurations. For complete instructions on how to create a fully managed service, see Create a fully managed service.

On the Create Service page, in the Service Deployment section, the ROS template must include resources for creating a new VPC.

The Resources section must contain a resource of type ALIYUN::ECS::VPC. Example:

Resources:
  EcsVpc:
    Type: ALIYUN::ECS::VPC
    Properties:
      CidrBlock:
        Ref: VpcCidrBlock

The Parameters section must contain a CIDR input parameter. The AssociationProperty of this parameter must be ALIYUN::VPC::VPC::CIDRBLOCK. Example:

Parameters:
  VpcCidrBlock:
    Type: String
    AssociationProperty: ALIYUN::VPC::VPC::CidrBlock
    AllowedValues:
      - 192.168.0.0/16
      - 172.16.0.0/12
      - 10.0.0.0/8
    Description:
      en: The IP address range of the VPC in the CIDR block form.
      zh-cn: 专有网络的网段，可选值：192.168.0.0/16，172.16.0.0/12，10.0.0.0/8。
    Default: 192.168.0.0/16

For a quick test, you can use the following sample template.

MySQL on an ECS instance (supports VPC peering connection)

ROSTemplateFormatVersion: '2015-09-01'
# Define parameters
Parameters:
  # The zone where the resources are deployed
  ZoneId:
    Type: String
    AssociationProperty: ALIYUN::ECS::Instance:ZoneId
    Label:
      en: VSwitch Available Zone
      zh-cn: 可用区
  # The password for the root and admin accounts of the database
  Password:
    # When this parameter is queried, only asterisks (*) are returned
    NoEcho: true
    Type: String
    Description:
      en: 'Database root and admin account password, 8-32 characters, including uppercase and lowercase letters, numbers and special symbols (including: !@#$%^&*-+=_).'
      zh-cn: 数据库root和admin账户密码，长度8-32个字符，可包含大小字母、数字及特殊符号（包含：!@#$%^&*-+=_）。
    Label:
      en: root and admin Account Password
      zh-cn: 数据库root和admin账户密码
    ConstraintDescription:
      en: '8-32 characters, including uppercase and lowercase letters, numbers and special symbols (including: !@#$%^&*-+=_).'
      zh-cn: 8-32个字符，可包含大小字母、数字及特殊符号（包含：!@#$%^&*-+=_）。
    MinLength: '8'
    MaxLength: '32'
    AssociationProperty: ALIYUN::ECS::Instance::Password
  # The IPv4 CIDR block for the new VPC
  VpcCidrBlock:
    Type: String
    Label:
      en: VPC CIDR IPv4 Block
      zh-cn: 专有网络IPv4网段
    Description:
      zh-cn: VPC的ip地址段范围，<br>您可以使用以下的ip地址段或其子网:<br><font color='green'>[10.0.0.0/8]</font><br><font
        color='green'>[172.16.0.0/12]</font><br><font color='green'>[192.168.0.0/16]</font>
      en: 'The IP address range of the VPC in CIDR block format; <br>You can use
          the following IP address ranges and their subnets: <br><font color=''green''>[10.0.0.0/8]</font><br><font
          color=''green''>[172.16.0.0/12]</font><br><font color=''green''>[192.168.0.0/16]</font>'
    AssociationProperty: ALIYUN::VPC::VPC::CidrBlock
    Default: 192.168.0.0/16
  # The CIDR block for the new vSwitch
  VSwitchCidrBlock:
    Type: String
    Label:
      en: VSwitch CIDR Block
      zh-cn: 交换机子网网段
    Description:
      zh-cn: 必须属于VPC的子网段。
      en: Must be a subnet of the VPC.
    AssociationProperty: ALIYUN::VPC::VSwitch::CidrBlock
    AssociationPropertyMetadata:
      VpcCidrBlock: VpcCidrBlock
    Default: 192.168.1.0/24
  # The instance type of the ECS instance
  EcsInstanceType:
    Type: String
    Label:
      en: Instance Type
      zh-cn: Ecs实例类型
    AssociationProperty: ALIYUN::ECS::Instance::InstanceType
    AllowedValues:
      - ecs.c6.large
      - ecs.c6.xlarge
      - ecs.c6.2xlarge
      - ecs.c6.4xlarge
# Define resources
Resources:
  # Define WaitCondition and WaitConditionHandle to wait for the command to finish executing on the ECS instance after successful deployment
  WaitCondition:
    Type: ALIYUN::ROS::WaitCondition
    Properties:
      Count: 1
      Handle:
        Ref: WaitConditionHandle
      Timeout: 1800
  WaitConditionHandle:
    Type: ALIYUN::ROS::WaitConditionHandle
  EcsSecurityGroup:
    Type: 'ALIYUN::ECS::SecurityGroup'
    Properties:
      VpcId:
        Ref: EcsVpc
      SecurityGroupIngress:
        - Priority: 1
          PortRange: 3306/3306
          NicType: internet
          SourceCidrIp: 0.0.0.0/0
          IpProtocol: tcp
  # VPC
  EcsVpc:
    Type: ALIYUN::ECS::VPC
    Properties:
      CidrBlock:
        Ref: VpcCidrBlock
      VpcName:
        Ref: ALIYUN::StackName
  # vSwitch
  EcsVSwitch:
    Type: ALIYUN::ECS::VSwitch
    Properties:
      ZoneId:
        Ref: ZoneId
      VpcId:
        Ref: EcsVpc
      CidrBlock:
        Ref: VSwitchCidrBlock
  # ECS instance
  EcsInstanceGroup:
    Type: ALIYUN::ECS::InstanceGroup
    Properties:
      # I/O-optimized instance
      IoOptimized: optimized
      ZoneId:
        Ref: ZoneId
      DiskMappings:
        - Category: cloud_essd
          Device: /dev/xvdb
          Size: 200
      SystemDiskSize: 40
      # Use cloud-init to run user commands
      # You can view execution logs in /var/log/cloud-init.log and /var/log/cloud-init-output.log
      # The script is located at /var/lib/cloud/instance/scripts/part-001. You can run it with `sh` to troubleshoot issues
      UserData:
        Fn::Sub:
          - |
            #!/bin/sh

            # Pause for a period to ensure the network is ready
            sleep 10

            # Partition the data disk

            cat >> /root/InitDataDisk.sh << EOF
            #!/bin/bash
            echo "p
            n
            p



            w
            " |  fdisk -u /dev/vdb
            EOF
            /bin/bash /root/InitDataDisk.sh
            rm -f /root/InitDataDisk.sh
            rm -f InitDataDisk.sh
            # Create a file system on the new partition
            mkfs.ext4 /dev/vdb1
            # Create the directory where MySQL will be installed
            mkdir /data1
            # Mount the file system
            mount /dev/vdb1 /data1
            # Write the new partition information to /etc/fstab
            echo /dev/vdb1 /data1 ext4 defaults,nodelalloc,noatime 0 2 >> /etc/fstab
            cd /data1/

            # Install MySQL Community Edition
            wget '{{ computenest::file::MySQL }}' -O mysql-community-release-el6-5.noarch.rpm
            rpm -ivh mysql-community-release-el6-5.noarch.rpm
            yum repolist all | grep mysql
            yum install mysql-community-server -y

            # Start the MySQL service
            service mysqld start

            # Log in as the superuser, create the admin user, and grant remote login permissions with the specified password
            mysqladmin -u root password '${Password}'
            echo "create database test character set utf8 collate utf8_bin;" > ./test.sql
            echo "CREATE USER 'admin'@'%' IDENTIFIED BY '${Password}';" >> ./test.sql
            echo "GRANT ALL PRIVILEGES ON *.* TO 'admin'@'%' WITH GRANT OPTION;" >> ./test.sql
            mysql -u root -p'${Password}' < ./test.sql

            # Move the MySQL configuration and data path to the data disk
            systemctl stop mysqld
            rsync -av /var/lib/mysql /data1
            # Modify the configuration file
            sed -i 's/\/var\/lib/\/data1/g' /etc/my.cnf
            echo -e '\n' >> /etc/my.cnf
            echo '[client]' >> /etc/my.cnf
            echo 'port=3306' >> /etc/my.cnf
            echo 'socket=/data1/mysql/mysql.sock' >> /etc/my.cnf
            # Restart MySQL
            systemctl start mysqld

            # Invoke the callback to signal the wait condition upon successful script execution
            ${CurlCli} -d "{\"Data\" : \"SUCCESS\", \"Status\" : \"SUCCESS\"}"

          # Get the WaitConditionHandle URL and store it in the ${CurlCli} variable
          - CurlCli:
              Fn::GetAtt:
                - WaitConditionHandle
                - CurlCli
            # The password for the database root account
            Password:
              Ref: Password
      # Billing method: Pay-as-you-go
      InstanceChargeType: PostPaid
      MaxAmount: 1
      # System disk type: ESSD
      SystemDiskCategory: cloud_essd
      # Instance name
      InstanceName:
        Ref: ALIYUN::StackName
      VpcId:
        Ref: EcsVpc
      SecurityGroupId:
        Ref: EcsSecurityGroup
      VSwitchId:
        Ref: EcsVSwitch
      # Specify the CentOS 7.9 image. If you change the image, you must adapt the UserData script.
      ImageId: "centos_7_9_x64_20G_alibase_20220727.vhd"
      InstanceType:
        Ref: EcsInstanceType
      # Hostname
      HostName:
        Ref: ALIYUN::StackName
      # ECS login password
      Password:
        Ref: Password
      # Specify whether to assign a public IP address to the instance
      AllocatePublicIP: true
      InternetMaxBandwidthOut: 1
# Define outputs
Outputs:
  MysqlUserName:
    Label: MySQL login username
    Value: admin
  PrivateIps:
    Label: Private IP address
    Value:
      Fn::Select:
        - 0
        - Fn::GetAtt:
            - EcsInstanceGroup
            - PrivateIps
# Define metadata
Metadata:
  ALIYUN::ROS::Interface:
    # Define parameter groups. Parameters in the same group are displayed together when you create a service instance.
    ParameterGroups:
      - Parameters:
          - EcsInstanceType
        Label:
          en: Instance Type
          zh-cn: 实例规格
      - Parameters:
          - Password
        Label:
          en: Basic Configuration
          zh-cn: 基础配置
      - Parameters:
          - ZoneId
          - VpcCidrBlock
          - VSwitchCidrBlock
        Label:
          en: Network Configuration
          zh-cn: 网络配置

In the Advanced Settings section, enable VPC Access and select VPC Peering as the connection mode.

In the Service O&M section, enable Support service instance configuration change. In the Add Operation dialog box, configure the operation.

Parameter	Description
Select Template	Select the template for which you want to enable the configuration change.
Operation Name	Enter a name for the operation.
Operation Description	Enter a description for the operation.
Method	Set the method for the operation.
Network Change	Set the method for the network configuration change.

Click OK, and then complete the steps to create and launch the service.

Create and modify a service instance

Create a fully managed service instance.

For more information, see Create a fully managed service instance.
Modify the service instance.
1. On the details page of the service instance, click Modify Configuration in the upper-right corner. In the dialog box that appears, select Network Change and click Next to go to the Specify Parameters step.
2. If no VPC peering connection is configured for the service instance, click Add Peering Connection, and then select or Create VPC.
  Important
  - The CIDR block of the selected VPC cannot overlap with the CIDR blocks of existing connections or the service instance's VPC.
  - You can add multiple peering connections, but their CIDR blocks cannot overlap.
3. Click Next to preview the parameters. After confirming the parameters, click OK to start the configuration change.
4. After the configuration change is complete, the service instance status changes to Deployed. Go to the Network Settings tab to view the new VPC peering connection.
  - Before:
  - After:

Modify a PrivateLink connection

This section describes how service providers can enable and configure PrivateLink changes, and then apply them to a service instance.

Create a fully managed service

This section shows only the settings for changing private network access configurations. For complete instructions on how to create a fully managed service, see Create a fully managed service.

On the Create Service page, configure the service information.
In the Advanced Configuration section, enable VPC Access, select PrivateLink as the connection mode, and then select an access resource.

Note
You can select SLB or Endpoint Service as the access resource. This section uses SLB as an example. For more configuration information, see VPC private access configuration notes.

In the Service O&M section, enable Support service instance configuration change. In the Add Operation dialog box, configure the operation.

Parameter	Description
Select Template	Select the template for which you want to enable the configuration change.
Operation Name	Enter a name for the operation.
Operation Description	Enter a description for the operation.
Method	Set the method for the operation.
Network Change	Set the method for the network configuration change. If you use a custom domain name, we recommend that you also select the Support custom domain name modification checkbox.

Click OK, and then complete the steps to create and launch the service.

Create and modify a service instance

Create a fully managed service instance.

For more information, see Create a fully managed service instance.
Modify the service instance.
1. On the details page of the service instance, click Modify Configuration in the upper-right corner. In the dialog box that appears, select Network Change and click Next to go to the Specify Parameters step.
2. On the Specify Parameters page, this example shows how to add a zone and enable the custom domain name feature.
3. Click Next to preview the parameters. After confirming the parameters, click OK to start the configuration change.
4. After the configuration change is complete, the service instance status changes to Deployed. Go to the Network Settings tab to view the newly added zone.
  - Before:
  - After:

Network configuration change

Usage

Billing

Modify a VPC peering connection

Create a fully managed service

Create and modify a service instance

Modify a PrivateLink connection

Create a fully managed service

Create and modify a service instance

Related topics