Serverless App Engine:Bind a CLB instance for public or private access

Procedure

1. On the SAE applications page, select a region and namespace, then click the target application's Application ID to open its details page.

2. On the Basic Information page, on the Application Information tab, find the Application Access Settings section and configure a Public Endpoint or a Private Endpoint as needed:

   • Public Endpoint: Bind a public CLB instance to allow clients to access the application by using a public IP address.

   • Private Endpoint: Bind a private CLB instance to allow other applications or clients within the VPC to access the application by using a private IP address.

   Note

   To enable application access using both public and private IP addresses, use one of the following methods:

   • Option 1: Follow the instructions in this topic to configure both a Public Endpoint and a Private Endpoint.

   • Option 2: Follow the instructions in this topic to configure a Private Endpoint, and then bind an Elastic IP Address (EIP) to the private CLB instance.

   A banner at the top of the page provides the following information: Before you use the SAE CLB feature, review the CLB configuration constraints. Starting from April 1, 2020, if you create or edit a CLB instance in SAE and then modify restricted resources such as listener ports, protocols, or SSL certificates in the CLB console, SAE will forcibly overwrite the modified configurations with the configurations saved in SAE. The page also includes a small traffic ramp-up option, which is available only after you configure CLB access.

   This section uses configuring a Public Endpoint as an example. Click Add Internet-facing CLB.

3. Bind a CLB instance to the application: You can create a CLB instance or select an existing CLB instance.

   Create a CLB instance

   In the Add Internet-facing CLB dialog box, select Create CLB Instance from the CLB Instance drop-down list.

   After you complete the configuration, SAE purchases a new CLB instance and binds it to the application.

   In the Protocol Configuration section, select a protocol tab (HTTP, HTTPS, TCP, or UDP), and set the HTTP Port and Container Port. To add more port mappings, click + Add Listener.

   Select an existing CLB

   In the Add Internet-facing CLB dialog box, select an existing CLB instance from the CLB Instance drop-down list.

   The CLB instance cannot be a performance-shared instance, an instance dedicated to Container Service, or an instance purchased by or dedicated to other products. This prevents listener configuration conflicts.

   For a public CLB instance, ensure it is in the same region as the SAE application. For a private CLB instance, ensure it is in the same VPC. Otherwise, the CLB instance will not appear in the selection list.

   After you select a CLB instance, select a network protocol on the HTTP, HTTPS, TCP, or UDP tab, and configure the corresponding listener and container ports. Click + Add Listener to add multiple listener rules.

4. Configure at least one listener as described in the table below. To add multiple listeners, click Add Listener. For more information about the four types of listeners and their use cases, see CLB listeners. When you are finished, click OK.

   Parameter	Description	Example
   HTTP	Http port: The public-facing port on the CLB instance used for application access. Valid values: 1 to 65535. Container port: The port on which your application process listens.	Http port: 80 Container port: 8080 (the default port for web services)
   HTTPS	Https port: The public-facing port on the CLB instance used for application access. Valid values: 1 to 65535. SSL certificate: The certificate used for SSL encryption. Select an uploaded certificate from the drop-down list. Container port: The port on which your application process listens. Note If you use a custom domain name over HTTPS, it must be filed with Alibaba Cloud. For more information, see ICP filing process.	Https port: 443 SSL certificate: Select an SSL certificate. If you do not have one, see Create a certificate before you configure an HTTPS listener. Container port: 8080 (the default port for web services)
   TCP	Clb port: The public-facing port on the CLB instance used for application access. Valid values: 1 to 65535. Container port: The port on which your application process listens.	Clb port: 21 Container port: 8080 (the default port for web services)
   UDP	Clb port: The public-facing port on the CLB instance used for application access. Valid values: 1 to 65535. Container port: The port on which your application process listens.	Clb port: 49152 Container port: 8080 (the default port for web services)

   If the No available instances for the application. Please scale out and retry message appears, it means the application has scaled to zero instances. You must perform manual scaling before you can bind a CLB instance.

   Listeners created in SAE are automatically synchronized to CLB. You can view them in the Server Load Balancer console. We recommend managing these listener configurations exclusively in SAE and not in the CLB console. For more information, see Avoid configuration conflicts between SAE and CLB.

   Avoid configuration conflicts

   Listeners created in SAE are automatically synchronized to CLB. SAE also maintains the correct configuration during application restarts and scaling events. Therefore, you should manage these listeners exclusively in SAE. If you must modify SAE-created configurations, such as listeners and vServer groups, in the CLB console, first consult the table below to see if the operation is permitted. This helps prevent configuration failures or unexpected errors.

   You can add extra configurations in the CLB console, for example, create new listeners for other resources. However, for CLB instances purchased by SAE, SAE automatically releases the CLB instance when you delete the public or private CLB access or delete the application. Any custom configurations added in the CLB console will also be lost.

   Type	Item	Allowed in CLB console
   Instance	Instance name	Yes
   	Instance tags	Do not perform the following operations: Change tags created by SAE. Delete tags created by SAE.
   	EIP binding	Yes
   	Upgrade or downgrade	Yes
   	Bandwidth	Yes
   Listener	Listener name	No
   	Bandwidth	Yes
   	Scheduling algorithm	Yes
   	vServer group ID	No
   	Access control	Yes
   	Add X-Forwarded-For header	Yes
   	Gzip compression	Yes
   	Session persistence	Yes
   	Health check	Yes
   	Timeout period	Yes
   	Certificate configuration	No
   	Forwarding rule	No
   vServer group	Name	No
   	Backend servers (weight, instance, port, etc.)	No

5. Wait for the CLB instance to be bound. In the Public Endpoint section, you can view the IP address and port of the application.

   If the SAE application has multiple instances to process client requests, CLB uses the default round-robin scheduling algorithm to distribute traffic across instances. To change the scheduling algorithm, see Scheduling algorithm in Add a TCP listener.

   Copy the generated IP address and port into your browser's address bar and press Enter to verify that the application is accessible.

   When you access the application, you may also need to add information such as an access path to the URL. This depends on the business logic in the application. The complete URL format is <protocol>://<IP address>:<port>/<path>, for example, http://8.154.xx.xx:80/hello.

   If no IP address and port are displayed, the CLB binding has failed. View the change records to diagnose and fix the issue. For more information, see View change records.

6. (Optional) To allow client access using a custom domain name, you need to add a DNS record in the DNS console to point your domain name to the public IP address generated by SAE.

Related operations