Compute Nest supports private connectivity between virtual private clouds (VPCs) and your hosted services, so customers can reach your service without traversing the public internet. This topic explains how to enable and configure VPC access when you publish a service as a service provider.
How VPC access works
When VPC access is disabled, customers access a fully managed service through its public domain name over the internet. When VPC access is enabled, the service instance also gets an internal domain name. Compute Nest shares the service provider's VPC with the customer's VPC, letting the customer resolve and reach the internal domain name directly from their own VPC—no internet egress required.
The full workflow is:
Configure: As the service provider, enable VPC access in the Network Settings section when creating the service.
Customer creates a service instance: The customer selects the VPC they want to connect from.
Connection is established: Compute Nest links the provider's VPC to the customer's VPC using the selected connection mode.
Manage: Both you and the customer can view and manage the VPC connection on the Network Settings tab of the service instance details page.
Prerequisites
Before configuring VPC access, prepare the access resource that matches the connection mode you plan to use:
PrivateLink mode with an SLB instance: Define a Server Load Balancer (SLB) instance in the
Resourcessection of your service template.PrivateLink mode with an endpoint service: Define the endpoint service in the
Outputssection of your service template. You can configure one endpoint service per region. For multi-region deployments, define one endpoint service in each region. For details, see Create and manage endpoint services.VPC Peering mode: Define the parameters for creating a new VPC in the service template. VPC Peering is only available when the service instance creates a new VPC.
Connection modes
Compute Nest supports two connection modes. Select the one that fits your deployment.
| Mode | Scope | Access resource |
|---|---|---|
| PrivateLink | Same zone | SLB instance or endpoint service defined in the service template |
| VPC Peering | New VPC only | New VPC defined in the service template |
In PrivateLink mode, Compute Nest creates an endpoint service in the provider's VPC. Customers connect through an interface endpoint in their VPC. For background on PrivateLink, see What is PrivateLink?
In VPC Peering mode, Compute Nest establishes a VPC peering connection between the provider's new VPC and the customer's selected VPC.
Enable VPC access for a service
When creating a service in the Compute Nest console, configure the following parameters in the Network Settings section.
| Parameter | Description |
|---|---|
| VPC Access | Enable or disable VPC access for the service. |
| Connection mode | Select PrivateLink or VPC Peering. |
| Select payer | Available only when you select an SLB instance as the access resource in PrivateLink mode. Specifies who pays for the SLB instance. By default, designating the service provider as payer is not available. To request this capability, log on to the Quota Center console, go to Products > Privileges, click PrivateLink in the Networking section, search for privatelink_whitelist/epsvc_payer_mode, and click Apply. |
| Custom domain name | (Optional) A recommended domain name that customers see when creating a service instance. If left blank, no custom domain name is suggested. |
Manage VPC connections
After a customer creates a service instance, both you (the service provider) and the customer can view connection details. On the service instance details page, click the Network Settings tab.
Basic information
Shows the endpoint service ID and related metadata. As the service provider, click the endpoint service ID to open the PrivateLink console, where you can:
Create or delete service resources
Manage endpoint connections
Manage account IDs in the service whitelist
View monitoring data
For whitelist management, see Manage account IDs in the whitelist of an endpoint service.
Zone and elastic IP address (EIP)
Shows the customer-side vSwitch that the customer specified when creating the VPC connection.
Security group
Shows the customer-side security group that the customer specified when creating the VPC connection. To strengthen access control, add inbound rules to the elastic network interfaces (ENIs) used for service access.
