ApsaraDB RDS:Use the hybrid access mode to retain both classic network and VPC endpoints

Before you begin

Verify the following before starting the migration:

• The RDS instance resides in the classic network

• A VPC and a vSwitch are created in the zone where the RDS instance resides — see Create and manage a VPC

If your RDS instance has read-only instances, complete the hybrid access migration on the primary instance first, then migrate the read-only instances. VPC residency requirements differ by storage type:

Restrictions

While hybrid access mode is enabled:

• Cannot change the network type back to classic network

• Cannot change the zone of the RDS instance

• Cannot switch between RDS High-availability Edition and RDS Enterprise Edition

How it works

When you switch from classic network to VPC without hybrid access, the internal endpoint IP address changes. This causes an instance switchover, and classic network-type Elastic Compute Service (ECS) instances immediately lose internal network access to the RDS instance.

Hybrid access avoids this disruption. The system retains the original classic network internal endpoint and generates a new VPC internal endpoint. Both endpoints remain active for as long as you need:

• Classic network-type ECS instances connect using the classic network internal endpoint.

• VPC-type ECS instances connect using the VPC internal endpoint.

• The public endpoint is not affected.

When all your applications are using the VPC endpoint, release the classic network endpoint to complete the migration.

Direct change vs. hybrid access

Use the following comparison to decide whether hybrid access mode is right for your situation.

Switch the network type to VPC

1. Log on to the ApsaraDB RDS console and go to the Instances page. Select the region where your RDS instance resides, then click the instance ID.

2. In the left-side navigation pane, click Database Connection.

3. Click Switch to VPC.

   Note

   If Switch to VPC is not displayed, verify that the instance meets the requirements listed in Before you begin.

4. In the dialog box, configure the following settings:

   • VPC: Select the VPC where your ECS instances reside. If the ECS and RDS instances are in different VPCs, internal network communication requires Cloud Enterprise Network (CEN) or VPN Gateway. For more information, see Overview of Alibaba Cloud CEN or Establish IPsec-VPN connections between two VPCs (single-tunnel mode).

   • vSwitch: Select a vSwitch in the zone where the RDS instance resides. If no vSwitches are available, create one first — see Create and manage vSwitches.

   • Reserve original classic endpoint: Select this option to enable hybrid access mode.

   Note

   • Switching the network type does not cause an instance switchover. Classic network-type ECS connections remain active until the classic endpoint expires.

   • Before the classic endpoint expires, add the VPC endpoint to applications running on VPC-type ECS instances to complete the migration with no downtime.

   • If your instance runs MySQL 5.6 or MySQL 5.7 on RDS High-availability Edition with Premium Local SSDs, you must change the IP address whitelist mode to enhanced whitelist mode when you enable the hybrid access mode. Existing IP addresses are automatically copied to a new enhanced whitelist for the classic network. See Change to the enhanced whitelist mode.

   

5. Add the private IP address of each VPC-type ECS instance to an IP address whitelist of the VPC type on the RDS instance. If no VPC-type whitelist exists, create one.

6. Before the classic endpoint expires, add the VPC endpoint of the RDS instance to each VPC-type ECS instance.

   Note

   • For VPC-type ECS instances to connect over an internal network, the ECS and RDS instances must reside in the same region and the same VPC. Verify this using the VPC ID.

   • To connect a classic network-type ECS instance to a VPC-type RDS instance, use ClassicLink or migrate the ECS instance to the same VPC. For more information, see Overview and Migrate ECS instances from the classic network to a VPC.

Change the expiration date of the classic network endpoint

During the hybrid access window, you can change the classic endpoint's validity period based on your business requirements. The new expiration date is calculated from the day you make the change.

Example: The classic endpoint is set to expire on August 18, 2017. On August 15, 2017, you extend the validity by 14 days. The new expiration date becomes August 29, 2017.

To change the expiration date:

1. Log on to the ApsaraDB RDS console and go to the Instances page. Select the region where your RDS instance resides, then click the instance ID.

2. In the left-side navigation pane, click Database Connection.

3. On the Instance Connection tab, click Change Expiration Time.

   

4. In the Change Expiration Time dialog box, select the new expiration date and click OK.

FAQ

Does switching from classic network to VPC affect the public endpoint or internet access?

No. The change only converts the internal (classic network) endpoint to a VPC endpoint. The public endpoint and internet access are not affected.