Networking in Managed Service for OpenSearch
When creating a cluster, you can:
- Specify a network for the entire cluster.
- Specify subnets for each host in the cluster.
- Request public access to connect to the cluster host groups from outside Yandex Cloud.
You can create a cluster without specifying any subnets for the hosts if the availability zone selected for each host contains exactly one subnet of the cluster network.
Host name and FQDN
Managed Service for OpenSearch generates the name of each cluster host when creating it. This name will be the host's fully qualified domain name (FQDN). The host name and, consequently, FQDN cannot be changed.
To learn how to get a host FQDN, see this guide.
You can use the FQDN to access the host within a single cloud network. For more information, see the Yandex Virtual Private Cloud documentation.
Public access to a host
Any cluster host can be accessible from outside Yandex Cloud if you requested public access when creating its host group. To connect to such a host, use its FQDN.
You cannot request public access after creating a host group.
When deleting a host group with public FQDNs, the assigned IP addresses are revoked.
Security groups
Security groups follow the All traffic that is not allowed is prohibited principle. To connect to a cluster, security groups must include rules allowing traffic from certain ports, IP addresses, or other security groups.
For example, let's assume public access is enabled for a Dashboards
host group. If there is no security group rule that allows connecting to it from the internet on port 443
, you will not be able to connect to the web interface. You will not be able to access an OpenSearch
host group either, unless it has a security group rule that explicitly allows incoming traffic on port 9200
.
Tip
If you connect to a cluster from within its cloud network, configure security groups both for the cluster and the connecting host.
Specifics of working with security groups:
-
Even if the cluster and host are in the same security group, rules allowing traffic between them must be in place to establish a connection to the cluster from that host. By default, such rules are included in the security group created together with the cloud network. They are the
Self
rules that allow unlimited traffic within a security group. -
Security group settings only affect whether it will be possible to connect to the cluster. They do not affect cluster features, such as replication, sharding, and backups.
For more information, see the Virtual Private Cloud documentation.