Skip to main content
Version: Next

Secure your Database Connection

In the guide Provision and Binding Cloud Resources and Provision a Database and Import a SQL File for initialization, a database's public host DB_PUBLIC_HOS is used to connect by business component. It's necessary when you want to have a try, create a PoC, or use the database outside a cloud provider. But it's not secure for production use of database.

This tutorial will talk about how to secure your database connection.

Provision a database

In the reference doc for Alibaba Cloud RDS, these two properties are essential.

NameDescriptionTypeRequiredDefault
vswitch_idThe vswitch id of the RDS instance. If set, the RDS instance will be created in VPC, or it will be created in classic network.stringfalse
allocate_public_connectionWhether to allocate public connection for a RDS instance.boolfalse

Set vswitch_id to the same as one of VSwitch of your ACK cluster, or a new VSwitch which belongs to the VPC of the cluster. Set allocation_public_connection to false to disable internet connection.

Then using DB_HOST in business component to securely connect the database by intranet connection

apiVersion: core.oam.dev/v1beta1
kind: Application

spec:
components:
- name: web
...
traits:
- type: service-binding
properties:
envMappings:
DATABASE_HOST:
secret: db-conn
- key: DB_PUBLIC_HOST
+ key: DB_HOST


- name: db
type: alibaba-rds
properties:
...
+ vswitch_id: xxx
+ allocate_public_connection: false
writeConnectionSecretToRef:
name: db-conn