Azure PrivateLink Setup With Couchbase Capella

¿Qué son los PrivateLinks?

PrivateLinks es un servicio de red que permite la conexión privada entre un servicio en la nube y su red virtual. Esta conexión se realiza sin exponer sus datos a la internet pública, lo que mejora la seguridad al mantener el tráfico de red dentro de la red del proveedor de la nube. Al utilizar PrivateLinks, puede garantizar un acceso más seguro y confiable a los recursos en la nube, minimizando el riesgo de amenazas externas y reduciendo la latencia al mantener el tráfico interno dentro de la red del proveedor de la nube.

Los PrivateLinks facilitan la comunicación unidireccional, lo que mejora la seguridad de las conexiones de red al garantizar que el tráfico solo pueda fluir en una sola dirección. Este diseño ayuda a prevenir el acceso no autorizado y la exfiltración de datos, consolidando aún más los beneficios de seguridad de utilizar PrivateLinks para redes en la nube.

Note: XDCR is not compatible with PrivateLinks at the moment.

Part 1 – Installing Azure CLI

1. Open a terminal and install the Azure CLI using the commands in this link for Mac and Windows:
   • brew update && brew install azure-cli # command for MacOS

Part 2 – Creating a Resource Group, Virtual Network and Subnet in Azure Cloud

1.  Go to your Azure home page
2.  Login to your Azure account using the code below via the terminal:
   • az login
     

3. Create a new resource group in Azure. Replace the name privatelinkazure and location eastus as desired.
   Note: This could be done via the Azure UI, however, it is much cleaner to create one with the Azure CLI:
   • • az group create --name privatelinkazure --location eastus
       

4. Check if the group has been created:
   • • az group list --output table
       

5. Next step is to create a virtual network and subnet in the resource group we just created.
   Replace PLVIRTUALNETWORK, Default with the name as desired. You can keep the address to 10.0.0.0/16 y 10.0.0.0/24:
   • • az network vnet create --name PLVIRTUALNETWORK --resource-group privatelinkazure --location eastus --address-prefixes 10.0.0.0/16 --subnet-name default --subnet-prefix 10.0.0.0/24
       

Part 3: Capella Configuration

1. Login into Capella with your corporate email and credentials.
2. Within your project, create a database with the following configuration:
   • Nube: Azure
   • Región: same as the region where you created your Resource Group & Virtual Network
   • Nombre of your choice, e.g. here we use Privatelinkdev
     
3. Una vez que la base de datos Healthy, despliega el travel-sample cubeta
   • Abre la base de datos.
   • Navegue a Herramientas de datos pestaña.
   • En el Importar página, clic Importar bajo el / debajo de travel-sample azulejo.

Part 4: Enable Private Endpoint

1. In your Capella database, open the Settings page, navigate to Private Endpoint and click Enable Private Endpoint.
2. This action will usually take around 10 minutes to enable Private Endpoint.
3. When ready, you should see that the Private Endpoint DNS is now available in the Capella UI. Also notice that Private Endpoints are billed hourly for Azure Private Endpoints for this database until you disable this option.
4. Hacer clic Add Private Endpoint. Add the Resource Group Name and subnet name that we created earlier. In this case resource group will be privatelinkazure, virtual network will be PLVIRTUALNETWORK and subnet name will be default. Refer to Part 2 above.
   
5. Download the script and open in Notepad++ or Sublime Text.
   
6. Open the Azure Terminal again where we created the resource group, virtual network and subnet.
7. From shell script we downloaded, run the first three commands starting from:
   • Create private endpoint:
     • az network private-endpoint create -g privatelinkazure -n pl-7330b162-12a1-4695-9317-2ecae322690b --vnet-name PLVIRTUALNETWORK --subnet default --private-connection-resource-id 'pl-4e207316-42c5-4561-920e-d044dd57f771.e520e4d0-fd92-440e-9a82-eabd3562761c.eastus.azure.privatelinkservice' --connection-name pl-7330b162-12a1-4695-9317-2ecae322690b -l eastus --manual-request true

• Create DNS zone:
  • az network private-dns zone create -g privatelinkazure -n private-endpoint.wqdxhcxm9lcue9g.cloud.couchbase.com

• Link DNS zone:
  • az network private-dns link vnet create -g privatelinkazure -n dnslink-4e207316-42c5-4561-920e-d044dd57f771 -z private-endpoint.wqdxhcxm9lcue9g.cloud.couchbase.com -v PLVIRTUALNETWORK -e False

Part 4: Accept Pending Connection and verify endpoint

1. Head over to the Capella UI again and accept the pending connection. Once the connection has been established, you will see a Linked status.
2. Copy paste the interface endpoint from Capella UI in a notepad. In this case:
   pl-7330b162-12a1-4695-9317-2ecae322690b.ef04ba0b-7b81-4404-8db2-01b3f116dfa3
3. In the below code, replace the interface endpoint with your endpoint until the period “.” In this case:
   pl-7330b162-12a1-4695-9317-2ecae322690b
   • az network private-endpoint show --name pl-7330b162-12a1-4695-9317-2ecae322690b --resource-group privatelinkazure

You have now established a private connection between your Azure VPC and Couchbase Capella using a Private Link!

Conclusión

Azure Private Link offers a secure and efficient method for connecting to Couchbase Capella, ensuring that your data remains protected from external threats by keeping traffic within Microsoft’s private network. This setup eliminates exposure to the public internet, thereby significantly reducing the attack surface. Azure Private Link provides only uni-directional communication, ensuring that data flows securely from your resources to Couchbase Capella without any reverse path. Additionally, Azure Private Link provides consistent network performance, leveraging Microsoft’s global backbone network to deliver low-latency and reliable connectivity. This makes Azure Private Link an essential component for secure and performant database operations in the cloud.

Documentación

• Add an Azure Private Link Connection
• What is Azure Private Link?