Service Connections

A ServiceConnection creates an encrypted, authenticated tunnel between a source and a destination service. It allows applications running in NKE clusters or Deploio to reach On-Demand Services over a private network instead of the public internet.

Sources

The following sources are supported:

NKE Kubernetes Clusters (kubernetescluster)
Deploio applications (application)

Destinations

The following destinations are supported:

Key-Value Store (keyvaluestore)
MySQL (mysql, mysqldatabase)
PostgreSQL (postgres, postgresdatabase)

The destination must be in the same project as the service connection.

Create a Service Connection

Cockpit
nctl

Service Connections are not yet available in Cockpit. Please use nctl for now.

Use nctl create serviceconnection with --source and --destination in the format kind/name:

nctl create serviceconnection my-connection \
  --source=kubernetescluster/my-cluster \
  --destination=keyvaluestore/my-kvs

Connect to a Service over a Service Connection

After configuring a service connection, you can connect to the destination using the private FQDN of the service:

Cockpit
nctl

Service Connections are not yet available in Cockpit. Please use nctl for now.

nctl get keyvaluestore my-kvs \
  -o yaml

Make note of the privateNetworkingFQDN field in the output. You can use this FQDN to connect to the service.

Restrict Access

When using a NKE Kubernetes Cluster (kubernetescluster) as a source, you can restrict access to specific pods or namespaces:

Restrict Access by Pod

By default, all pods in the source cluster can use the connection. To restrict access to specific pods, provide a label selector:

Cockpit
nctl

Service Connections are not yet available in Cockpit. Please use nctl for now.

Use --source-pod-selector:

nctl create serviceconnection \
  --source=kubernetescluster/my-cluster \
  --destination=keyvaluestore/my-kvs \
  --source-pod-selector='app=my-app,env=production'

Restrict Access by Namespace

To limit which namespaces the connection is available in, provide a namespace label selector:

Cockpit
nctl

In the Create Service Connection form, enter a label selector in the Namespace Selector field, for example: kubernetes.io/metadata.name=production

Use --source-namespace-selector:

nctl create serviceconnection \
  --source=kubernetescluster/my-cluster \
  --destination=keyvaluestore/my-kvs \
  --source-namespace-selector='kubernetes.io/metadata.name=production'

When both selectors are set, only pods matching the pod selector within namespaces matching the namespace selector can use the connection.