Configure inbound and outbound internet access for an SAE instance using an EIP - Serverless App Engine

Associating an elastic IP address (EIP) with each instance of an SAE application enables both inbound and outbound internet access for the instances. This topic describes how to associate or disassociate EIPs in the SAE console and how to view application events.

Prerequisites

You understand the usage limits of EIPs.
You have requested EIPs.
You have confirmed that the number of available EIPs in the region exceeds the number of SAE application instances.

Background information

Internet access solutions

The following two solutions allow internet access to SAE applications in a VPC.

Solution 1: NAT gateway + EIP

This solution uses the Source Network Address Translation (SNAT) feature to provide internet access for all instances within a VPC that do not have public IP addresses. You only need to configure one EIP to allow multiple applications in the VPC to access the internet. For more information, see Configure a public NAT gateway to enable SAE applications to access the internet. This solution is suitable for the following scenarios:
- Your application requires an auto scaling policy.
- You need a fixed public IP address for outbound traffic, for example, to add the IP address to the allowlist of a service like WeChat Mini Program.
Solution 2: Associate an EIP with each application instance

If multiple applications in a VPC need to access the internet, each application must have at least one instance associated with an EIP. This solution is more cost-effective than a NAT gateway if you have 20 or fewer instances in your VPC. When you create or deploy an application, an EIP is automatically associated with each of its instances. This solution is suitable for the following scenarios:
- Application accessing the internet (outbound traffic): Suitable for when an SAE service needs to access external services. This is applicable if EIPs are allowed to change and an auto scaling policy is not required.
- Accepting connections from the internet (inbound traffic): Suitable for scenarios where clients access your application by connecting to the EIP of each instance. However, because SAE assigns new EIPs during deployment updates, this solution is not suitable if external services need to access the SAE service using a fixed IP address.

Note

After you purchase EIPs and use Solution 2 to create or deploy an application, SAE automatically associates an EIP with each instance that requires one. However, after an EIP is associated, you can create but cannot use an auto scaling policy. If your application requires both Auto Scaling and internet access, we recommend using Solution 1.

Billing

SAE does not charge additional fees for EIP association. You are charged only for the EIPs that you purchase. For more information, see EIP billing overview and SAE billing overview.

Usage notes

When you deploy an application and associate EIPs, SAE creates new instances before releasing the original ones. Because the original EIPs are not released during this process, you must have a sufficient number of available EIPs.
After an EIP is successfully associated, ensure the required port allowlist rules are configured in the security group. For more information, see Add a security group rule.

Configure EIPs when creating an application

In the SAE Application List, select the target region and namespace at the top, and then click Create Application.
In the Application Basic Information step of the wizard, set the application parameters and click Next: Advanced Settings.
Expand the Application Outbound/Inbound Public Network Access Settings section and turn on the Solution 2. Bind Elastic IP Address switch.

If you do not enable this feature when you create the application, EIPs are not associated by default with instances added later through manual scaling. In this case, you must configure EIPs when you deploy the application. After you turn on this switch, an EIP is automatically associated with each instance when you create or deploy the application. EIP association is not supported during Auto Scaling.
Click Create Application.
Verify the result.

On the Basic Information page of the application, click the Instance List tab to view the elastic IP address associated with the target instance.

The Instance List page displays information such as the ID, vSwitch, IP address, status, image, and runtime of each instance. A banner at the top of the page indicates that private IP addresses and elastic IP addresses are not fixed and may change during application deployment or underlying host migration. We recommend using a NAT gateway and an EIP to obtain a fixed public IP address for outbound traffic.

Configure EIPs when deploying an application

Warning

Redeploying an application restarts it. To prevent business interruptions and other unexpected issues, perform deployments during off-peak hours.

In the SAE Application List, select the target region and namespace at the top, and then click the target Application ID to go to the application details page.
On the Basic Information page of the application, click Deploy Application.
On the Deploy Application page, expand the Application Outbound/Inbound Public Network Access Settings section and configure the parameters.

The deployment method is determined by the method used for the initial deployment.

The following scenarios apply when you configure an EIP.
- Scenario 1: An auto scaling policy is not configured or enabled.
  - To associate an EIP:
    
    Turn on the Solution 2. Bind Elastic IP Address switch.
  - To disassociate an EIP:
    1. Turn off the Solution 2. Bind Elastic IP Address switch.
    2. In the Disassociate Elastic IP Address dialog box that appears, click OK.
- Scenario 2: An auto scaling policy is enabled.
  1. In the Resume Auto Scaling After Deployment section, select Manual Resume.
    
    Note
    If you select Automatic Resumption when you deploy the application, you cannot associate an EIP with the application.
  2. Associate or disassociate the EIP.
    - To associate an EIP:
      
      Turn on the Solution 2. Bind Elastic IP Address switch.
    - To disassociate an EIP:
      1. Turn off the Solution 2. Bind Elastic IP Address switch.
      2. In the Disassociate Elastic IP Address dialog box that appears, click OK.
    Note
    After an EIP is associated with an application, SAE disables any active auto scaling policies, and you cannot enable the Auto Scaling feature. If your application requires both Auto Scaling and internet access, we recommend using the NAT gateway and EIP solution. For more information, see Configure a public NAT gateway to enable SAE applications to access the internet.
After you complete the configuration, click Confirm.
Verify the result.

On the Basic Information page of the application, click the Instance List tab to view the elastic IP address associated with the target instance.

Configure EIPs when rolling back an application

Follow these steps if you are rolling back to a historical version that has an EIP, and an auto scaling policy was active before the rollback.

In the SAE Application List, select the target region and namespace at the top, and then click the target Application ID to go to the application details page.
In the upper-right corner of the Basic Information page, click Roll Back to Historical Version.
In the Roll Back to Historical Version panel, configure the parameters, and then click OK.
1. In the Rollback Version section, select the target version.
  
  Note
  The historical version of the application selected in this step has an associated EIP.
2. Optional: Click Select Batch/Grayscale Policy to configure a release policy.
Verify the result.

On the Basic Information page of the application, click the Instance List tab to view the elastic IP address associated with the target instance.

A yellow banner at the top of the page indicates that instance IP addresses are not fixed. The table shows information such as the ID, vSwitch, IP address, and status of each instance.

Configure EIPs during manual scaling

In the SAE Application List, select the target region and namespace at the top, and then click the target Application ID to go to the application details page.
In the upper-right corner of the Basic Information page, click Manual Scaling.
In the Application Scaling dialog box, configure the parameters and click OK.

The following scenarios apply when you scale an application. For more information, see Manual scaling.
- Scenario 1: An auto scaling policy is not deployed or enabled before scaling.
  
  Use the slider to set the Target Number of Application Instances.
  
  The current number of instances is displayed below the slider for your reference. You can also enter the target number in the input field on the right and then click OK.
- Scenario 2: An auto scaling policy is deployed and enabled before scaling.
  1. Use the slider to set the Target Number of Application Instances.
  2. Select Manual Resume.
  Note
  If you select Automatic Resumption when you deploy the application, you cannot associate an EIP with the application.
Associate or disassociate an EIP.

For detailed instructions, see Configure EIPs when deploying an application.
Verify the result.

On the Basic Information page of the application, click the Instance List tab to view the elastic IP address associated with the target instance.

View application events

View error information for application instances on the Application Events page.

In the SAE Application List, select the target region and namespace at the top, and then click the target Application ID to go to the application details page.
In the left-side navigation pane, click Application Events. Select Application Instance (Pod) from the Source Type drop-down list and Warning from the Event Level drop-down list. The detailed error information for the application instance is displayed at the bottom of the page.
Troubleshoot the failure based on the Event Cause.
- EipNotEnough: The number of available EIPs is insufficient. You need to apply for more EIPs or scale in the application. For more information, see Apply for EIPs and Manual Scaling.
- EipNotReady: Indicates that the EIP binding or unbinding failed. Please join the DingTalk group (Group number: 32874633) and contact product and technical experts for assistance.