Networking in Managed Service for PostgreSQL

When creating a PostgreSQL cluster, you can:

• Specify a network for the entire cluster.

• Specify subnets for each host in the cluster.

• Request public access to connect to the cluster from outside Yandex Cloud.

You can create a cluster without specifying any subnets for the hosts if the availability zone selected for each host contains exactly one subnet of the cluster network.

Host name and FQDNHost name and FQDN

Managed Service for PostgreSQL generates a name for each cluster host when it is created. This name will be the host's fully qualified domain name (FQDN). The host name and, consequently, FQDN cannot be changed.

For instructions on retrieving a host’s FQDN, see this guide.

To access a host within a single cloud network, use its FQDN. For more information, see the Yandex Virtual Private Cloud documentation.

Public access to a hostPublic access to a host

Any cluster host can be accessible from outside Yandex Cloud if you requested public access when creating or editing a host.

When deleting a publicly accessible host, the assigned IP address is revoked.

Security groupsSecurity groups

Security groups follow the rule that all traffic is denied unless you explicitly allow it. To connect to a cluster, configure security group rules. These rules allow traffic from certain ports, IP addresses, or other security groups. For example, a VM will not be able to connect to a cluster in the following cases:

• The VM is in the 10.128.0.0/16 subnet, whereas the inbound rules only allow 10.133.0.0/24.
• The VM is in the 10.133.0.0/24 subnet but attempts to access a port not exposed in the security group rules.

For information on how to configure security groups, see Configuring security groups.

Features of using security groups:

• Even if the cluster and host share the same security group, you still need rules allowing traffic between them to be able to connect to the cluster from the host. By default, such rules are included in the security group created along with the cloud network. These are the Self rules that allow unlimited traffic within the security group.

• Security group settings only determine whether connecting to the cluster is possible. They do not affect cluster features, such as replication, sharding, and backups.

For more information, see this Virtual Private Cloud article.

Use casesUse cases

• Delivering data to Yandex Managed Service for Apache Kafka® using Yandex Data Transfer
• Delivering data to Yandex Managed Service for Apache Kafka® using Debezium
• Migrating databases from Managed Service for PostgreSQL