Serverless App Engine:Bind an NLB instance for a fixed endpoint

Background

By default, SAE applications cannot be accessed from the public network. Although you can access an application within a Virtual Private Cloud (VPC) using an instance's private IP address, this method is unreliable because the IP address may change during application updates or restarts. To address these issues, you can bind a public or private NLB instance to your application. By binding an NLB instance, you can not only use a fixed domain name to access the application but also efficiently load-balance traffic across different zones and SAE instances.

• Before you bind an NLB instance to an application, learn about how Network Load Balancer (NLB) works and its performance and usage limits.

• When you use the NLB service in SAE, the NLB instance incurs additional fees.

  Important

  If you delete an NLB instance in the SAE console without also deleting it from the Server Load Balancer (SLB) console, it will continue to incur fees. For instructions on how to delete the NLB instance from the SLB console, see Delete an NLB instance.

Overview

SAE applications support binding to public or private NLB instances. You can associate NLB instances of different network types with your SAE application based on your business needs.

• Bind a private NLB instance: The main purpose is to provide a fixed access address (DNS name) for the SAE application and distribute traffic to the instances of the SAE application using a load balancing algorithm, such as round-robin. Common use cases include internal microservices communication, database access, and enterprise intranet access.

• Bind a public NLB instance: By default, SAE does not support direct access from the public network. By binding a public NLB instance to your application, you can provide a fixed public endpoint to handle traffic from the public network. The public access workflow is shown in the following figure.

Step 1: Add an NLB instance

1. On the Applications page, select a region and namespace in the top navigation bar, and then click the Application ID of the target application to open the application details page.

2. On the Basic Information page, find the application access settings section. On the NLB-based Access tab, click Add NLB Access.

3. In the Add NLB Access panel, configure the parameters as follows, and then click OK.

   Note

   SAE allows you to create an NLB instance or bind an existing one. Choose an option based on your needs.

   • Create a new NLB instance: SAE automatically purchases an NLB instance for you. You can view the details of the NLB instance in the Server Load Balancer (SLB) console.

   • Bind an existing NLB instance: You must create an NLB instance in advance on the Instances page of the SLB console. If you want to create a private NLB instance, we recommend that you use the same Virtual Private Cloud (VPC) for both the NLB instance and the SAE application. If they are in different VPCs, you must configure the network to enable communication between them. For example, you can use Alibaba Cloud's Cloud Enterprise Network (CEN) or other network connection products to enable cross-VPC communication.

   Create a new NLB instance

   1. For instance source, select Create Instance.

   2. For Network Type, select Public or Private based on your needs.

      • If you select Public, the system creates a public NLB instance and allocates an Elastic IP Address and a VIP to each zone.

      • If you select Private, the system creates a private NLB instance and allocates a VIP to each zone.

   3. Select the zones where your vSwitches are located based on your business requirements. For high availability, select at least two zones.

      You cannot select a Virtual Private Cloud (VPC). The VPC of the target application is used by default.

   4. The supported protocol types are TCP, UDP, and TCPSSL.

      Protocol type	Parameter	Example
      TCP	Listener port: The port that receives requests and forwards them to backend servers. Container port: The port on which the application's process listens.	Listener port: 80 Container port: 8080 (default port for web services)
      UDP
      TCPSSL	Listener port: The port that receives requests and forwards them to backend servers. Container port: The port on which the application's process listens. Select SSL certificate: An SSL protocol certificate. Select an uploaded SSL certificate from the drop-down list. Note To access a custom domain name over HTTPS, the domain name must have an ICP filing with Alibaba Cloud. For more information, see ICP filing process.	Listener port: 80 Container port: 8080 (default port for web services) Select SSL certificate: Select a purchased SSL certificate from the drop-down list. If you have not purchased an SSL certificate, see Purchase a certificate.

   Bind an existing NLB instance

   1. For instance source, select Use Existing.

   2. From the NLB Instance drop-down list, select the NLB instance that you created.

      If you have not created an NLB instance, click Create NLB Instance. Then, create an NLB instance on the Instances page of the SLB console.

   3. The supported protocol types are TCP, UDP, and TCPSSL.

      Protocol type	Parameter	Example
      TCP	Listener port: The port that receives requests and forwards them to backend servers. Container port: The port on which the application's process listens.	Listener port: 80 Container port: 8080 (default port for web services)
      UDP
      TCPSSL	Listener port: The port that receives requests and forwards them to backend servers. Container port: The port on which the application's process listens. Select SSL certificate: An SSL protocol certificate. Select an uploaded SSL certificate from the drop-down list. Note To access a custom domain name over HTTPS, the domain name must have an ICP filing with Alibaba Cloud. For more information, see ICP filing process.	Listener port: 80 Container port: 8080 (default port for web services) Select SSL certificate: Select a purchased SSL certificate from the drop-down list. If you have not purchased an SSL certificate, see Purchase a certificate.

4. After the NLB instance is created, you can view its status on the NLB-based Access tab in the application access settings section.

   If you want to add multiple NLB instances, click Add NLB Access and follow the steps above to add more instances.

   Important

   Configuring listener rules for the same NLB instance in both the SAE and Server Load Balancer (SLB) consoles can cause conflicts, as settings in one console may overwrite those in the other. To avoid configuration conflicts, we recommend that you configure listener rules for NLB instances only in the SAE console.

   You can perform the following operations on the NLB instance:

   • Add listener: Click Add Listener. In the Add Listener dialog box, select a protocol type and configure the parameters.

   • Modify container port: In the Actions column of the NLB instance, click Edit. In the Edit NLB Access panel, you can modify the container port.

   • Delete a listener or NLB instance: In the Actions column of the NLB instance, click Delete. In the Confirm Deletion dialog box, click OK to delete the corresponding listener rule or NLB instance.

     If you add multiple listener rules for the same NLB instance, the delete operation removes only the corresponding listener rule. If you delete the last listener rule, the NLB instance is automatically deleted because it has no remaining listener rules.

   • View the NLB instance: Click the NLB instance name to go to the Instance Details page of the NLB instance in the SLB console. You can view the details of the NLB instance, such as the Elastic IP Address and VIP allocated to each zone, and the DNS name automatically generated for the NLB instance.

     You can use the DNS name provided by the NLB instance or the Elastic IP Address provided for the zone to test access.

Step 2: Configure domain resolution

The DNS name provided by the NLB instance can be used for access testing. However, in production environments, we recommend using a custom domain name and adding a CNAME record to map it to the DNS name of the NLB instance.

1. In the application access settings section, click the name of the created NLB instance to open its details page in the SLB console.

2. On the Instance Details page of the NLB instance in the SLB console, copy the DNS name.

   The DNS name provided by the NLB instance is used as the record value when you configure domain name resolution.

3. Log on to the Alibaba Cloud DNS console and add a CNAME record.

   Note

   If your domain name is not registered with Alibaba Cloud, you must add it to the Alibaba Cloud DNS console before you can configure domain name resolution. If your domain name is registered with Alibaba Cloud, proceed with the following steps.

   1. On the Authoritative Domains page, find the target domain and click Configure in the Actions column.

   2. On the Configure page, click Add Record.

   3. In the Add Record panel, configure the following parameters to complete the CNAME configuration, and then click OK.

      Parameter	Example	Description
      Type	CNAME	Select CNAME from the drop-down list. A CNAME record maps your custom domain name to the DNS name provided by the NLB instance.
      Host	www	Enter the prefix of the subdomain you are creating. Refer to the console description for a detailed explanation of the host record.
      Resolution Request Source	Default	Select Default. Alibaba Cloud DNS can identify the region and carrier of the source IP address of a DNS request (usually the IP address of a carrier's Local DNS). When adding a record, you can return different record values for requests from different regions or carrier networks.
      Value	nlb-****.com	Enter the DNS name provided by the NLB instance. The record value is the domain name that the CNAME record points to.
      TTL	10 minutes	Use the default value provided by the console. TTL (Time to Live) is the duration for which a DNS record is cached on a DNS server.

Step 3: Test access

Enter your custom domain name in a browser to test access. For example, http://your_domain_name.

Hello, World!

Clean up resources (optional)