Use Azure Private Link with Aiven services#

Important

Azure Private Link is a limited availability feature, which you can request from the sales team (sales@Aiven.io) or your account manager. During the limited availability stage, you can use the feature at no cost. If you want to continue using Azure Private Link after it reaches general availability, you’ll be billed according to the latest applicable price.

Azure Private Link lets you bring your Aiven services into your virtual network (VNet) over a private endpoint. The endpoint creates a network interface into one of the VNet subnets, and receives a private IP address from its IP range. The private endpoint is routed to your Aiven service.

Azure Private Link is supported for the following services:

Aiven for Apache Kafka®
Aiven for Apache Kafka Connect®
Aiven for ClickHouse®
Aiven for Grafana®
Aiven for InfluxDB®
Aiven for MySQL®
Aiven for OpenSearch®
Aiven for PostgreSQL®
Aiven for Redis®*

Prerequisites#

Aiven CLI is installed.
The Aiven service is in a project VPC. This ensures the service is not accessible from the public internet.

Note

If you are not using regular VNet peerings, any private IP range can be used for the VPC. There is no network routing between your Azure subscription and the Aiven VPC, so overlapping IP ranges are not an issue.
The Aiven service is using static IP addresses.

Note

Even though services in a VPC only communicate using private IP addresses, Azure load balancers require standard SKU IP addresses for target virtual machines. Azure sends TCP health probes to load balancer target ports from a public IP address.

Variables#

Variable	Description
`SUBSCRIPTION_ID`	Azure subscription ID
`AIVEN_SERVICE`	Name of your Aiven service

Set up a Private Link connection#

There are three steps to setting up an Azure Private Link with your Aiven service:

Create a Private Link service
Create a private endpoint
Enable Private Link access service components

Step 1: Create a Private Link service#

In the Aiven CLI, create a Private Link resource on your Aiven service:
```
avn service privatelink azure create AIVEN_SERVICE --user-subscription-id SUBSCRIPTION_ID
```
This creates an Azure Standard Internal Load Balancer dedicated to your Aiven service and attaches it to an Azure Private Link service. Connections from other subscriptions are automatically rejected.
Check the status of the Private Link service:
```
avn service privatelink azure get AIVEN_SERVICE
```
The service is in the creating state until Azure provisions a load balancer and Private Link service.
When the state changes to active, note the azure_service_alias and azure_service_id:
```
avn service privatelink azure get AIVEN_SERVICE
```

Step 2: Create a private endpoint#

Azure resources in the Aiven service are now ready to be connected to your Azure subscription and virtual network.

In the Azure web console or Azure CLI, create a private endpoint. If you are using the console, select Connect to an Azure resource by resource ID or alias and enter the azure_service_alias or azure_service_id.
Refresh the Aiven Private Link service:
```
avn service privatelink azure refresh AIVEN_SERVICE
```
Note

Azure does not provide notifications about endpoint connections and the Aiven API will not be aware of new endpoints until it’s refreshed.

In the Aiven CLI, check that the endpoint is connected to the service:

avn service privatelink azure connection list AIVEN_SERVICE

The output will look similar to this:

PRIVATELINK_CONNECTION_ID  PRIVATE_ENDPOINT_ID                                                                                                                                         STATE                  USER_IP_ADDRESS
=========================  ==========================================================================================================================================================  =====================  ===============
plc35843e8054b             /subscriptions/8eefec94-5d63-40c9-983c-03ab083b411d/resourceGroups/test-privatelink/providers/Microsoft.Network/privateEndpoints/my-endpoint                pending-user-approval  null

Check that the endpoint ID matches the one created in your subscription and approve it:
```
avn service privatelink azure connection approve AIVEN_SERVICE PRIVATELINK_CONNECTION_ID
```
The endpoint in your Azure subscription is now connected to the Private Link service in the Aiven service. The state of the endpoint is pending.
In the Azure web console, go to the private endpoint and select Network interface. Copy the private IP address.

In the Aiven CLI, add the endpoint’s IP address you copied to the connection:

avn service privatelink azure connection update \
   --endpoint-ip-address IP_ADDRESS             \
   AIVEN_SERVICE PRIVATELINK_CONNECTION_ID

Once the endpoint IP address is added, the connection’s status changes to active. A DNS name for the service is registered pointing to that IP address.

Step 3: Enable Private Link access for Aiven service components#

Finally, enable Private Link access on your Aiven services using either the Aiven CLI or Aiven Console.

Aiven CLI

To enable Private Link access for your service in the Aiven CLI, set user_config.privatelink_access.<service component> to true for the components you want to enable. For example, for PostgreSQL the command is:

avn service update -c privatelink_access.pg=true AIVEN_SERVICE

Aiven Console

To enable Private Link access in Aiven Console:

On the Overview page of your service, select Service settings from the sidebar.
On the Service settings page, navigate to the Cloud and network section and select More network configurations from the actions (…) menu.
In the Network configuration window, take the following actions:
1. Select Add configuration options.
2. In the search field, enter privatelink_access.
3. From the displayed component names, select the names of the components that you want to enable (privatelink_access.<service component>).
4. Select the toggle switches for the selected components to enable them.
5. Select Save configuration.

Tip

Each service component can be controlled separately. For example, you can enable Private Link access for your Aiven for Apache Kafka® service, while allowing Kafka® Connect to only be connected via VNet peering.

After toggling the values, your Private Link resource will be rebuilt with load balancer rules added for the service component’s ports.

Note

For Aiven for Apache Kafka® services, the security group for the VPC endpoint must allow ingress in the port range 10000-31000. This is to accommodate the pool of Kafka broker ports used in the Private Link implementation.

Acquire connection information#

One Azure Private Link connection#

If you have one private endpoint connected to your Aiven service, you can preview the connection information (URI, hostname, or port required to access the service through the private endpoint) in Aiven Console > the service’s Overview page > the Connection information section, where you’ll also find the switch for the privatelink access route. privatelink-access-route values for host and port differ from those for the dynamic access route used by default to connect to the service.

Multiple Azure Private Link connections#

Use CLI to acquire connection information for more than one AWS PrivateLink connection.

Each endpoint (connection) has PRIVATELINK_CONNECTION_ID, which you can check using the avn service privatelink azure connection list SERVICE_NAME command.

To acquire connection information for your service component using Azure Private Link, run the avn service connection-info command.

For SSL connection information for your service component using Azure Private Link, run the following command:
```
avn service connection-info UTILITY_NAME SERVICE_NAME -p PRIVATELINK_CONNECTION_ID
```

Where

UTILITY_NAME is kcat, for example
SERVICE_NAME is kafka-12a3b4c5, for example
PRIVATELINK_CONNECTION_ID is plc39413abcdef, for example

For SASL connection information for Aiven for Apache Kafka® service components using Azure Private Link, run the following command:
```
avn service connection-info UTILITY_NAME SERVICE_NAME -p PRIVATELINK_CONNECTION_ID -a sasl
```

Where

UTILITY_NAME is kcat, for example
SERVICE_NAME is kafka-12a3b4c5, for example
PRIVATELINK_CONNECTION_ID is plc39413abcdef, for example

Note

SSL certificates and SASL credentials are the same for all the connections.

Update subscription list#

In the Aiven CLI, you can update the list of Azure subscriptions that have access to Aiven service endpoints:

avn service privatelink azure update AIVEN_SERVICE SUBSCRIPTION_ID

Delete a Private Link service#

Use the Aiven CLI to delete the Azure Load Balancer and Private Link service:

avn service privatelink azure delete AIVEN_SERVICE