Connecting to a Modernisation Platform database
If you have an RDS instance on Modernisation Platform and a namespace on a Container Platform cluster, you can use a port-forward pod on the Container Platform to reach that database and prove connectivity.
There are two parts to it:
- Allow your cluster’s address range through the database’s security group. This is a Terraform change in your Modernisation Platform namespace.
- Connect to the database. You can connect your application, or use a port-forward pod to connect from your own machine.
Before you start
You need:
- a namespace on a Container Platform nonlive cluster. See Deploying an application to the Container Platform
- an RDS instance on the Modernisation Platform. See Creating resources in the Modernisation Platform
- the ability to raise a pull request against modernisation-platform-environments
Step 1: Allow your cluster to reach the database
Find the security group config in your Modernisation Platform RDS code (or add it if not already present). For example:
resource "aws_security_group" "rds-example" {
description = "RDS Security Group"
vpc_id = data.aws_vpc.shared.id
}
Add in the security group rule for the cluster you are connecting from. For example:
resource "aws_security_group_rule" "rds_example_ingress_cp3_octo_nonlive" {
description = "container-platform-octo-nonlive nodes"
type = "ingress"
from_port = 3306
to_port = 3306
protocol = "tcp"
security_group_id = aws_security_group.rds-example.id
cidr_blocks = ["10.195.48.0/20"]
}
You must change cidr_blocks to your Container Platform cluster:
| Cluster | Address range |
|---|---|
container-platform-octo-nonlive |
10.195.48.0/20 |
container-platform-hmpps-nonlive |
10.195.64.0/20 |
container-platform-laa-nonlive |
10.195.80.0/20 |
container-platform-cd-nonlive |
10.195.96.0/20 |
These are the node ranges. Your pods have their own addresses, but traffic leaving the cluster appears to come from the node it is running on, so the node range is what the security group needs to allow.
More clusters will be added over time. The ranges for every cluster are defined in the
vpc_cidr map in
network/locals.tf,
where primary is the node range you need and secondary is the pod range.
If your cluster is not listed above, use the primary value for it from that file. Ask in
#container-platform-alpha-users
if you are not sure which applies to you.
Raise a pull request with the changes. Once it is merged, the pipeline applies it.
The example above uses 3306 for MySQL. Use the port for your engine:
| Engine | Port |
|---|---|
| PostgreSQL (RDS and Aurora) | 5432 |
| MySQL and MariaDB | 3306 |
| Microsoft SQL Server | 1433 |
| Redis (ElastiCache) | 6379 |
If you use an engine that is not listed, ask in #container-platform-alpha-users before you start. Traffic between the platforms passes through an inspection firewall that allows these ports only, and anything else is dropped without an error.
Step 2: Get Your Target RDS Details
You will need the following details from your Modernisation Platform RDS to connect:
- hostname
- username
- password
Step 3: Connect
Follow the instructions below depending on how you wish to connect:
- Connecting to a Remote Database From an Application
- Connecting to a Remote Database With A Port Forwarding Pod