Skip to main content
Version: User Guides (Cloud)

Set up a Private Link (Azure)

This guide demonstrates the procedure for setting up a private link from a Zilliz Cloud cluster to your service hosted in different Microsoft Azure VPCs.

This feature is exclusively available to Dedicated (Enterprise) clusters.

A private link is set up at the project level and is effective for all clusters deployed within the same cloud provider and region under this project.

📘Notes

Zilliz Cloud does not charge you for private links. However, your cloud provider may charge you for each endpoint that you create to access Zilliz Cloud.

Before you start​

Make sure the following condition is met:

  • A Dedicated (Enterprise) cluster has been created. For information on how to create a cluster, see Create Cluster.

Create private endpoint​

Zilliz Cloud offers you an intuitive web console to add a private endpoint. Navigate to your target project and click Network > Private Endpoint in the left navigation. Click + Private Endpoint.

setup_private_link_aws_01

Select a cloud provider and region​

To create a private endpoint for a cluster deployed in an Azure region, select Azure from the Cloud Provider drop-down list. In Region, select the region that accommodates the cluster you want to access privately. Click Next.

For more information on available cloud providers and regions, see Cloud Providers & Regions.

setup_private_link_window_azure

Establish and endpoint service​

establish_endpoint_service_azure

Enter the subcription ID copied from the Microsoft Azure Subscription page. Below is an example

Create an endpoint​

You need to complete this step on your cloud provider console.

  1. Go to Private Link Center, and click + Create.

    TQB9bT5KKojscoxcOZbcZ4Q6nNf

  2. Fill in the basic information for the private endpoint to create.

    ECcPbN4Kaog5bdxyed3cyP3HnHe

  3. Click Next: Resource > and choose Connect to an Azure resource by resource ID or alias. Then paste the one copied from the Zilliz Cloud console into Resource ID or alias.

    TDJVb0pkWoxVPIxCThvct9Hpnae

  4. Select proper values in Virtual network and Subnet, and keep the default for other settings on this tab.

    SNdZbzo0EoP7PYxg1z4clUijnQg

  5. Click Next until you reach the Review + create tab. If the validation passes, click Create to create the private endpoint.

    FJ95b4S4voMavqxFWEac3JdinAc

  6. Once the deployment succeeds, you will see the following.

    QNHubedZWoJFe7xkX5ac5TOInzg

  7. Click Go to resource and see the overview page of the created Private Endpoint.

  8. Click JSON View in the upper right corner on the Overview page. Note that the Connection Status is displayed as Pending.

    YYrobZKr4oFJJ8xNRYicL2PZnde

    In the Resource JSON panel, copy the values of name and properties.resourceGuid. Your endpoint ID should be these two values joined by a period (.).

    Vm7pbEGggo2tx6xirE3c9ZyRnSg

    For example, the value of the key name is zilliz, and the value of the key properties.resourceGuid is d73e9b55-7b9c-4f8d-8f0a-40e737f1ccbf. Your Private Endpoint ID should be zilliz.d73e9b55-7b9c-4f8d-8f0a-40e737f1ccbf.

Authorize your endpoint​

Paste the endpoint ID you obtained from the Azure console into the Endpoint ID box on Zilliz Cloud. Click Create.

After verifying and accepting the preceding attributes you have submitted, Zilliz Cloud allocates a private link for this endpoint. This process takes about 5 minutes.

When the private link is ready, you can view it on the Private Link page on Zilliz Cloud.

Set up DNS​

Before you can access your cluster via the private link allocated by Zilliz Cloud, it is necessary to set up DNS.

Create a Private DNS Zone on the Azure portal​

  1. On the Overview page of the created Private Endpoint, choose Settings > DNS configuration, and copy the IP address of the network interface created along with the Private Endpoint.

    GC9jbsUp2oXgCZxkojbcrmJanJb

    The example value in the screen shot above is 10.0.0.4.

  2. Go to Create a Private DNS zone, and click + Create to start the process.

  3. In the Basics tab, select the subscription and resource group used above, and paste the Private Link URI copied from the Zilliz Cloud console in Instance details > Name. Then click Review create.

    QweWbLRSioY9Cix8nMUc0Q75n1e

  4. Once the validation passes, click Create to start the process.

    LsmabNzrwoz9lvxJpKac2gEdnGG

  5. If the deployment succeeds, you will see the following.

    LGB3bC80FoQnXIxx527cVkTMnAe

  6. Click Go to resource to see the Overview page of the created Private DNS zone.

    M401b0RiNoauaHxbBH6crLXlnXc

  1. On the Overview page of the created Private DNS Zone, choose Settings > Virtual network links in the left navigation pane.

  2. Click + Add. In the Add virtual network link dialog box, enter a Link name, and select Subscription and Virtual network you have used above. In the Configuration section, select Enable auto registration also.

    KQZ2bvbbUodBlAxV98ccbrwxnWg

    Once everything is set up as expected, click OK to continue. The link status of the created virtual network link will change to Completed after the deployment succeeds.

    R84pbAxcKo24pDxQvlKcyxV7n4b

  3. Click Overview in the left navigation pane to go back to the Overview page of the Private DNS zone.

    S4bTb3ICwoWnlgxqSFrcYwEInvh

  4. Click + Record set. In the Add record set dialog box, enter your cluster ID suffixed with -privatelink in Name, select A - Address record in Type, and set TTL to 10 Minutes. Check whether the listed IP address is the one you have noted down.

    DtFQb18jloG9JDxYg0AcSlRsn75

    Click OK to save the record set.

    YWSZbd4qEoAW64xf9gHcamC8nyd

  5. Go back to the Overview page of the created Private Endpoint on the Azure portal, and you will see that the Connection Status of the Private Endpoint turns from Pending to Approved.

    CqAEbOjDUogQGdxl3gjclaPAn1e

    Now the resources in your Azure virtual network can access the Zilliz Cloud cluster privately.

Manage internet access to your clusters​

After configuring your private endpoint, you can choose to disable the cluster public endpoints to restrict internet access to your project. Once you have disabled the public endpoint, users can only connect to the cluster using the private link.

To disable public endpoints:

  1. Go to the Cluster Details page of your target cluster.

  2. Navigate to the Connection section.

  3. Click on the configurations icon next to the cluster public endpoint.

  4. Read the information and click Disable in the Disable Public Endpoint dialog box.

📘Notes

  • Private endpoints only impact data plane access. Control plane can still be accessed over the public internet.

  • After you re-enable the public endpoint, you may need to wait until the local DNS cache to expire before you can access the public endpoint.

disable_public_endpoint