All Products
Search
Document Center

Auto Scaling:Automatically add or remove the private IP addresses of ECS instances to or from the IP address whitelist of a PolarDB cluster

Last Updated:Jun 11, 2024

This topic describes how to combine the lifecycle hook feature of Auto Scaling and a CloudOps Orchestration Service (OOS) template to first put Elastic Compute Service (ECS) instances into a Pending state and then automate the task for adding or removing the instance IP addresses to or from the IP address whitelists of PolarDB clusters.

Prerequisites

  • A scaling group is created and is in the Enabled state.

  • A PolarDB cluster is created.

  • A RAM role is created for CloudOps Orchestration Service (OOS). The trusted entity of the RAM role must be Alibaba Cloud Service, the trusted service must be CloudOps Orchestration Service, and the RAM role must have the permissions to perform operations on the OOS template. For more information, see Use RAM to grant permissions to OOS.

    Note

    In this topic, the OOSServiceRole RAM role is used as an example. You can also use other roles.

Background

Auto Scaling currently supports only the integration with Server Load Balancer (SLB) and ApsaraDB RDS. If you store your application data in a PolarDB cluster, manually updating the cluster IP address whitelist with the private IP addresses of your ECS instances leads to inefficient operation processes. To enhance operational efficiency, you can consider automating updates of the IP address whitelist for your PolarDB cluster by combing the lifecycle hook feature of Auto Scaling and an OOS template.

Procedure

In this example, a public OOS template named ACS-ESS-LifeCycleModifyPolarDBIPWhitelist is used to show how to automate the addition of instance IP addresses to the IP address whitelist of a PolarDB cluster during a scale-out event. Perform the following steps:

Note

If you want to automate the removal of instance IP addresses from the IP address whitelist of your PolarDB cluster, you can create a lifecycle hook for scale-in purposes and apply the lifecycle hook during a scale-in event.

Step 1: Grant a RAM role the permissions on OOS

You must have the permissions to execute OOS templates. The ACS-ESS-LifeCycleModifyPolarDBIPWhitelist template includes ECS, Auto Scaling, and PolarDB resources that are required to perform O&M tasks.

  1. Log on to the RAM console.

  2. Create a policy.

    1. In the left-side navigation pane, choose Permissions > Policies.

    2. Click Create Policy.

    3. On the Create Policy page, click the JSON tab, configure parameters based on your business requirements, and then click OK.

      The following table describes the settings that are used in this example. Any parameters not covered in the following table default to their predefined settings.

      Parameter

      Description

      Name

      Enter ESSHookPolicyForPolarDBWhitelist.

      Policy document

      Enter the following content:

      {
          "Version": "1",
          "Statement": [
              {
                  "Action": [
                      "ecs:DescribeInstances"
                  ],
                  "Resource": "*",
                  "Effect": "Allow"
              },
              {
                  "Action": [
                      "polardb:DescribeDBClusterAccessWhitelist",
                      "polardb:ModifyDBClusterAccessWhitelist"
                  ],
                  "Resource": "*",
                  "Effect": "Allow"
              },
              {
                  "Action": [
                      "ess:CompleteLifecycleAction"
                  ],
                  "Resource": "*",
                  "Effect": "Allow"
              }
          ]
      }
  3. Attach the policy to the OOSServiceRole RAM role.

    1. In the left-side navigation pane, choose Identities > Roles.

    2. Find OOSServiceRole and click Grant Permission in the Actions column.

      Add the required permissions for the OOSServiceRole RAM role that is assumed by OOS to complete the authorization.

    3. In the Grant Permission panel, configure Resource Scope and Policy. After you complete the configuration, click Grant permissions.

      The following table describes the settings that are used in this example. Any parameters not covered in the following table default to their predefined settings.

      Parameter

      Description

      Resource Scope

      Set the value to Account.

      Policy

      Select the following custom policy: ESSHookPolicyForPolarDBWhitelist.

Step 2: Create a lifecycle hook for scale-out purposes and trigger a scale-out event

  1. Log on to the Auto Scaling console.

  2. In the left-side navigation pane, click Scaling Groups.

  3. In the top navigation bar, select the region where Auto Scaling is activated.

  4. Find a scaling group and use one of the following methods to go to the scaling group details page:

    • Click the ID of the scaling group in the Scaling Group Name/ID column.

    • Click Details in the Actions column.

  5. Create a lifecycle hook.

    1. In the upper part of the scaling group details page, click the Lifecycle Hook tab.

    2. Click Create Lifecycle Hook.

    3. Configure parameters based on your business requirements and click OK.

      The following table describes the settings that are used in this example. Any parameters not covered in the following table default to their predefined settings.

      Parameter

      Description

      Name

      Enter ESSHookForAddPolarDBWhitelist.

      Scaling Activity

      Select Scale-out Event.

      Timeout Period

      Configure Timeout Period based on your business requirements. In this example, set the value to 300. Unit: seconds.

      Note

      The timeout period is the period of time during which you can perform custom operations on instances. If the timeout period is shorter than the period of time that is required to perform custom operations, the operations may fail. We recommend that you estimate the period of time that is required to perform custom operations on instances and configure Timeout Period based on your estimations.

      Default Execution Policy

      Select Continue.

      Send Notification When Lifecycle Hook Takes Effect

      Configure the following parameters for the template:

      • Select OOS Template.

      • Select Public Templates.

      • Select ACS-ESS-LifeCycleModifyPolarDBIPWhitelist.

      In the ACS-ESS-LifeCycleModifyPolarDBIPWhitelist public template, you must also configure the following parameters:

      • dbClusterId: Enter the ID of the PolarDB cluster.

      • modifyMode: Select Append. This value applies to the scale-out event during which Auto Scaling adds the private IP addresses of your ECS instances to the IP address whitelist of the PolarDB cluster.

      • OOSAssumeRole: Select OOSServiceRole. In Step 1, OOSServiceRole is granted the permissions on the ECS, Auto Scaling, and PolarDB resources. OOS obtains the preceding permissions after it assumes the RAM role.

  6. Trigger a scale-out event.

    In this example, a scale-out event is manually triggered by executing a scaling rule. You can also trigger scale-out events by using scheduled or event-triggered tasks.

    Note

    If scaling events are triggered when you manually execute scaling rules, lifecycle hooks take effect. However, lifecycle hooks do not take effect when you manually add or remove ECS instances to or from a scaling group.

    1. In the upper part of the page that appears, click the Scaling Rules and Event-triggered Tasks tab.

    2. On the Scaling Rules tab, click Create Scaling Rule.

    3. In the Create Scaling Rule dialog box, configure parameters based on your business requirements and click OK.

      The following table describes the settings that are used in this example. Any parameters not covered in the following table default to their predefined settings.

      Parameter

      Description

      Rule Name

      Enter Add1.

      Rule Type

      Select Simple Scaling Rule.

      Operation

      Set the value to Add 1 Instances.

    4. On the Scaling Rules page, find the Add1 scaling rule and click Execute in the Actions column.

    5. In the Execute Scaling Rule message, click OK.

    After the scaling rule is executed, Auto Scaling adds one ECS instance to the scaling group. However, the ECS instance enters the Pending Add state because of the ESSHookForAddPolarDBWhitelist lifecycle hook that is in effect. During the timeout period of the lifecycle hook, Auto Scaling notifies OOS to execute the O&M tasks that are defined in the ACS-ESS-LifeCycleModifyPolarDBIPWhitelist public template.

Step 3: Check the IP address whitelist of the PolarDB cluster

  1. Log on to the PolarDB console.

  2. In the left-side navigation pane, click Clusters.

  3. Search for the desired PolarDB cluster and click the ID in the Cluster ID/Name column.

  4. In the left-side navigation pane, choose Settings and Management > Cluster Whitelists.

    • If the private IP address of the ECS instance is added to the IP address whitelist of the PolarDB cluster, the ACS-ESS-LifeCycleModifyPolarDBIPWhitelist public template takes effect.

    • If the ECS instance is created but its private IP address is not added to the IP address whitelist of the PolarDB cluster, go to the OOS console to view the execution of the O&M tasks. For more information, see Step 4: (Optional) View the OOS execution.

Step 4: (Optional) View the OOS execution

  1. Log on to the OOS console.

  2. In the left-side navigation pane, choose Automated Tasks > Task Execution Management.

  3. Find the execution task by time and click Details in the Actions column.

  4. On the execution details page that appears, view the related information.

    For example, in the Basic Information section, you can view the execution ID and status. In the Execution Steps and Results section, you can click a task node to view the execution details. For more information, see View the details of an execution.

    Note

    If the execution fails, an error message is displayed on the execution details page.

Common errors and troubleshooting

If you fail to execute an O&M task, troubleshoot the issue based on the error message in the execution result. The following section describes the common error messages and solutions:

  • Error message: Forbidden.Unauthorized message: A required authorization for the specified action is not supplied.

    Solution: Check whether the required permissions, such as the sample permissions in Step 1, are granted to the OOSServiceRole RAM role. Before OOS can manage the resources that are declared in the OOS template, you must grant the required permissions to the RAM role.

  • Error message: Forbidden.RAM message: User not authorized to operate on the specified resource, or this API doesn't support RAM.

    Solution: Check whether the required permissions, such as the sample permissions in Step 1, are granted to the OOSServiceRole RAM role. Before OOS can manage the resources that are declared in the OOS template, you must grant the required permissions to the RAM role.

  • Error message: LifecycleHookIdAndLifecycleActionToken.Invalid message: The specified lifecycleActionToken and lifecycleActionId you provided does not match any in process lifecycle action.

    Solution: Check whether the timeout period of the lifecycle hook is sufficient for the O&M task specified in the OOS template to complete.